Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
MAC_NTPD(4)		 BSD Kernel Interfaces Manual		   MAC_NTPD(4)

NAME
     mac_ntpd -- policy	allowing ntpd to run as	non-root user

SYNOPSIS
     To	compile	the ntpd policy	into your kernel, place	the following lines in
     your kernel configuration file:

	   options MAC
	   options MAC_NTPD

     Alternately, to load the ntpd policy module at boot time, place the fol-
     lowing line in your kernel	configuration file:

	   options MAC

     and in loader.conf(5):

	   mac_ntpd_load="YES"

DESCRIPTION
     The mac_ntpd policy grants	any process running as user `ntpd' (uid	123)
     the privileges needed to manipulate system	time, and to (re-)bind to the
     privileged	NTP port.

     When ntpd(8) is started with `-u _user_[:group]' on the command line, it
     performs all initializations requiring root privileges, then drops	root
     privileges	by switching to	the given user id.  From that point on,	the
     only privileges it	requires are the ability to manipulate system time,
     and the ability to	re-bind	a UDP socket to	the NTP	port (port 123)	after
     a network interface change.

     With the mac_ntpd policy active, it may also be possible to start ntpd as
     a non-root	user, because the default ntpd options don't require any addi-
     tional root privileges beyond those granted by the	policy.

   Privileges Granted
     The exact set of kernel privileges	granted	to any process running with
     the configured uid	is:
	   PRIV_ADJTIME
	   PRIV_CLOCK_SETTIME
	   PRIV_NTP_ADJTIME
	   PRIV_NETINET_RESERVEDPORT
	   PRIV_NETINET_REUSEPORT

   Runtime Configuration
     The following sysctl(8) MIBs are available	for fine-tuning	this MAC pol-
     icy.  All sysctl(8) variables can also be set as loader(8)	tunables in
     loader.conf(5).

     security.mac.ntpd.enabled
	     Enable the	mac_ntpd policy.  (Default: 1).

     security.mac.ntpd.uid
	     The numeric uid of	the ntpd user.	(Default: 123).

SEE ALSO
     mac(4), ntpd(8)

HISTORY
     MAC first appeared	in FreeBSD 5.0 and mac_ntpd first appeared in
     FreeBSD 12.0.

BSD				 July 20, 2018				   BSD

NAME | SYNOPSIS | DESCRIPTION | SEE ALSO | HISTORY

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=mac_ntpd&sektion=4&manpath=FreeBSD+12.1-RELEASE+and+Ports>

home | help