Feature request for dropping privileges

[faulesocke]

Currently, as far as I can see, ntp-daemon does not have the ability to drop privileges after startup, that is, it can't change it's UID. In the example systemd service files, ntp-daemon is started as an unprivileged user, which is fine for operation as a NTP client. However, when creating a NTP server, the software needs to start as root in order to open the server socket. Afterwards, it would be desirable, if it could setresuid() to an unprivileged user that is specified in the configuration file.

Is that a planned feature for the near future?

[rnijveld]

The server actually doesn't need root, even for binding to a port < 1024. In fact, our default systemd unit file already contains the AmbientCapabilities key to enable us to bind to such a port (CAP_NET_BIND_SERVICE). So you should already be able to setup a full NTP server with our default systemd configuration.

Completely dropping to an unprivileged user is not the easy solution it might seem, as the NTP client still needs to adjust the clock, and needs the CAP_SYS_TIME capability to do that, which an unprivileged user would not have by default. Our previous consideration for going this route was that something like systemd (or other daemon management utilities) are much better at privilege dropping than we would probably be.