Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
MAC_NTPD(4)		    Kernel Interfaces Manual		   MAC_NTPD(4)

NAME
       mac_ntpd	-- policy allowing ntpd	to run as non-root user

SYNOPSIS
       To  compile the ntpd policy into	your kernel, place the following lines
       in your kernel configuration file:

	     options MAC
	     options MAC_NTPD

       Alternately, to load the	ntpd policy module at  boot  time,  place  the
       following line in your kernel configuration file:

	     options MAC

       and in loader.conf(5):

	     mac_ntpd_load="YES"

DESCRIPTION
       The mac_ntpd policy grants any process running as user `ntpd' (uid 123)
       the  privileges	needed	to manipulate system time, and to (re-)bind to
       the privileged NTP port.

       When ntpd(8) is started with `-u	<user>[:group]'	on the	command	 line,
       it  performs  all initializations requiring root	privileges, then drops
       root privileges by switching to the given user id.  From	that point on,
       the only	privileges it requires are the ability	to  manipulate	system
       time,  and  the	ability	 to re-bind a UDP socket to the	NTP port (port
       123) after a network interface change.

       With the	mac_ntpd policy	active,	it may also be possible	to start  ntpd
       as  a non-root user, because the	default	ntpd options don't require any
       additional root privileges beyond those granted by the policy.

   Privileges Granted
       The exact set of	kernel privileges granted to any process running  with
       the configured uid is:
	     PRIV_ADJTIME
	     PRIV_CLOCK_SETTIME
	     PRIV_NTP_ADJTIME
	     PRIV_NETINET_RESERVEDPORT
	     PRIV_NETINET_REUSEPORT

   Runtime Configuration
       The  following  sysctl(8)  MIBs	are available for fine-tuning this MAC
       policy.	All sysctl(8) variables	can also be set	as loader(8)  tunables
       in loader.conf(5).

       security.mac.ntpd.enabled
	       Enable the mac_ntpd policy.  (Default: 1).

       security.mac.ntpd.uid
	       The numeric uid of the ntpd user.  (Default: 123).

SEE ALSO
       mac(4), ntpd(8)

HISTORY
       MAC  first  appeared  in	 FreeBSD  5.0  and  mac_ntpd first appeared in
       FreeBSD 12.0.

FreeBSD	13.2			 July 20, 2018			   MAC_NTPD(4)
NAME | SYNOPSIS | DESCRIPTION | SEE ALSO | HISTORY

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=mac_ntpd&sektion=4&manpath=FreeBSD+14.0-RELEASE+and+Ports>

home | help