From 297f21e357b63ca45814467824e61c48e1d610fa Mon Sep 17 00:00:00 2001 From: Pyrox Date: Sat, 19 Oct 2024 03:24:01 -0400 Subject: [PATCH 1/4] nixos/ntpd: format with nixfmt-rfc-style --- .../modules/services/networking/ntp/ntpd.nix | 79 ++++++++++++------- 1 file changed, 51 insertions(+), 28 deletions(-) diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix index e7ea8866d79b..4cc33fb007ed 100644 --- a/nixos/modules/services/networking/ntp/ntpd.nix +++ b/nixos/modules/services/networking/ntp/ntpd.nix @@ -1,4 +1,9 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: with lib; @@ -25,7 +30,12 @@ let ${cfg.extraConfig} ''; - ntpFlags = [ "-c" "${configFile}" "-u" "ntp:ntp" ] ++ cfg.extraFlags; + ntpFlags = [ + "-c" + "${configFile}" + "-u" + "ntp:ntp" + ] ++ cfg.extraFlags; in @@ -58,7 +68,14 @@ in recommended in section 6.5.1.1.3, answer "No" of https://support.ntp.org/Support/AccessRestrictions ''; - default = [ "limited" "kod" "nomodify" "notrap" "noquery" "nopeer" ]; + default = [ + "limited" + "kod" + "nomodify" + "notrap" + "noquery" + "nopeer" + ]; }; restrictSource = mkOption { @@ -69,7 +86,13 @@ in The default flags allow peers to be added by ntpd from configured pool(s), but not by other means. ''; - default = [ "limited" "kod" "nomodify" "notrap" "noquery" ]; + default = [ + "limited" + "kod" + "nomodify" + "notrap" + "noquery" + ]; }; servers = mkOption { @@ -96,14 +119,13 @@ in type = types.listOf types.str; description = "Extra flags passed to the ntpd command."; example = literalExpression ''[ "--interface=eth0" ]''; - default = []; + default = [ ]; }; }; }; - ###### implementation config = mkIf config.services.ntp.enable { @@ -113,34 +135,35 @@ in environment.systemPackages = [ pkgs.ntp ]; services.timesyncd.enable = mkForce false; - systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "ntpd.service"; }; + systemd.services.systemd-timedated.environment = { + SYSTEMD_TIMEDATED_NTP_SERVICES = "ntpd.service"; + }; - users.users.ntp = - { isSystemUser = true; - group = "ntp"; - description = "NTP daemon user"; - home = stateDir; - }; - users.groups.ntp = {}; + users.users.ntp = { + isSystemUser = true; + group = "ntp"; + description = "NTP daemon user"; + home = stateDir; + }; + users.groups.ntp = { }; - systemd.services.ntpd = - { description = "NTP Daemon"; + systemd.services.ntpd = { + description = "NTP Daemon"; - wantedBy = [ "multi-user.target" ]; - wants = [ "time-sync.target" ]; - before = [ "time-sync.target" ]; + wantedBy = [ "multi-user.target" ]; + wants = [ "time-sync.target" ]; + before = [ "time-sync.target" ]; - preStart = - '' - mkdir -m 0755 -p ${stateDir} - chown ntp ${stateDir} - ''; + preStart = '' + mkdir -m 0755 -p ${stateDir} + chown ntp ${stateDir} + ''; - serviceConfig = { - ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}"; - Type = "forking"; - }; + serviceConfig = { + ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}"; + Type = "forking"; }; + }; }; From 53bc9450bceb1252177997e1f88e1b4087271a7e Mon Sep 17 00:00:00 2001 From: Pyrox Date: Sat, 19 Oct 2024 03:25:15 -0400 Subject: [PATCH 2/4] nixos/ntpd: Use StateDirectory instead of a preStart script --- nixos/modules/services/networking/ntp/ntpd.nix | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix index 4cc33fb007ed..ed7b5214f83e 100644 --- a/nixos/modules/services/networking/ntp/ntpd.nix +++ b/nixos/modules/services/networking/ntp/ntpd.nix @@ -13,10 +13,8 @@ let cfg = config.services.ntp; - stateDir = "/var/lib/ntp"; - configFile = pkgs.writeText "ntp.conf" '' - driftfile ${stateDir}/ntp.drift + driftfile /var/lib/ntp/ntp.drift restrict default ${toString cfg.restrictDefault} restrict -6 default ${toString cfg.restrictDefault} @@ -143,7 +141,7 @@ in isSystemUser = true; group = "ntp"; description = "NTP daemon user"; - home = stateDir; + home = "/var/lib/ntp"; }; users.groups.ntp = { }; @@ -154,14 +152,10 @@ in wants = [ "time-sync.target" ]; before = [ "time-sync.target" ]; - preStart = '' - mkdir -m 0755 -p ${stateDir} - chown ntp ${stateDir} - ''; - serviceConfig = { ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}"; Type = "forking"; + StateDirectory = "ntp"; }; }; From 4e632e9c3fe0b3a09eb9e8506df911583ab845df Mon Sep 17 00:00:00 2001 From: Pyrox Date: Sat, 19 Oct 2024 14:26:17 -0400 Subject: [PATCH 3/4] nixos/ntpd: Add hardening --- .../modules/services/networking/ntp/ntpd.nix | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix index ed7b5214f83e..bdc5adb394c2 100644 --- a/nixos/modules/services/networking/ntp/ntpd.nix +++ b/nixos/modules/services/networking/ntp/ntpd.nix @@ -156,6 +156,32 @@ in ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}"; Type = "forking"; StateDirectory = "ntp"; + + # Hardening options + PrivateDevices = true; + PrivateIPC = true; + PrivateTmp = true; + ProtectClock = false; + ProtectHome = true; + + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = true; + + RestrictNamespaces = true; + RestrictRealtime = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + AmbientCapabilities = [ + "CAP_SYS_TIME" + ]; + + ProtectControlGroups = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + RestrictSUIDSGID = true; }; }; From 19c40f0e11f39b8a5abb0eeb53415932474e00ae Mon Sep 17 00:00:00 2001 From: Pyrox Date: Sat, 19 Oct 2024 14:26:27 -0400 Subject: [PATCH 4/4] nixos/tests/ntpd: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/ntpd.nix | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 nixos/tests/ntpd.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 8ddcc779ea90..f153f9f8e0f0 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -714,6 +714,7 @@ in { nsd = handleTest ./nsd.nix {}; ntfy-sh = handleTest ./ntfy-sh.nix {}; ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix {}; + ntpd = handleTest ./ntpd.nix {}; ntpd-rs = handleTest ./ntpd-rs.nix {}; nvidia-container-toolkit = runTest ./nvidia-container-toolkit.nix; nvmetcfg = handleTest ./nvmetcfg.nix {}; diff --git a/nixos/tests/ntpd.nix b/nixos/tests/ntpd.nix new file mode 100644 index 000000000000..1864044b64d4 --- /dev/null +++ b/nixos/tests/ntpd.nix @@ -0,0 +1,25 @@ +import ./make-test-python.nix ( + { lib, ... }: + { + name = "ntpd"; + + meta = { + maintainers = with lib.maintainers; [ pyrox0 ]; + }; + + nodes.machine = { + services.ntp = { + enable = true; + }; + }; + + testScript = '' + start_all() + + machine.wait_for_unit('ntpd.service') + machine.wait_for_console_text('Listen normally on 10 eth*') + machine.succeed('systemctl is-active ntpd.service') + machine.succeed('ntpq -p') + ''; + } +)