Bug 50292 – ntpd dying on permission change

• Status: RESOLVED WORKSFORME
• Product: Gentoo Linux

[Description Mike Moran 2004-05-06 15:24:50 UTC]

cap_set_proc() failed to drop root privileges: Operation not permitted

Reproducible: Always
Steps to Reproduce:
1./etc/init.d/ntpd start
2.
3.

Actual Results:  
cap_set_proc() failed to drop root privileges: Operation not permitted

and ntpd dies


development-sources/development-sources-2.6.4.ebuild
net-misc/ntp-4.2.0-r2
glibc-2.3.3_pre20040207

[Comment 1 SpanKY 2004-05-07 00:19:36 UTC]

post your .config from your kernel

[Comment 2 Mike Moran 2004-05-07 09:50:06 UTC]

Created attachment 30947 [details]
.config for current kernel

As requested the kernel .config  under which ntpd fails

[Comment 3 SpanKY 2004-05-16 01:01:22 UTC]

do you have the ntp user/group on your system ?

[Comment 4 G. Angely 2004-05-18 13:29:29 UTC]

Created attachment 31678 [details]
log with ntpd errors since Apr 14

I have the same problem on a machine with 2.6.6 kernel.
There is a ntp user and group (123:123)

[Comment 5 Mike Moran 2004-05-18 15:57:27 UTC]

yes,  I have id and group ntp  id # 123

[Comment 6 Martijn Koster 2004-07-13 07:17:22 UTC]

Same here, 2.6.7-gentoo-r9, ntp 4.2.0-r2

This works: /usr/bin/ntpd -p /var/run/ntpd.pid -f /tmp/s
This does not: /usr/bin/ntpd -p /var/run/ntpd.pid -u ntp:ntp -f /tmp/s

From strace:

 setgid32(123)                           = 0
 setresgid32(-1, 123, -1)                = 0
 setuid32(123)                           = 0
 setresuid32(-1, 123, -1)                = 0
 capset(0x19980330, 0, {CAP_SYS_TIME, CAP_SYS_TIME, CAP_SYS_TIME}) = -1 EPERM (Operation not permitted)

I rebuilt the kernel with CONFIG_SECURITY_CAPABILITIES, and that fixed it.

[Comment 7 SpanKY 2004-07-23 23:09:47 UTC]

make sure your kernel supports CAPABILITIES or rebuild ntp with USE=nodroproot