MAC_NTPD(4)

💅 MAC_NTPD(4) — the manual page, but make it make sense 🦋

okay so bestie, welcome to the mac_ntpd(4) page from the Kernel Interfaces Manual — yes, that's the manual name, and this is the policy that lets ntpd run as a non-root user. no cap, this is the whole vibe check. ✨

🌸 NAME 🌸

mac_ntpd — policy allowing ntpd to run as non-root user.

✨ SYNOPSIS ✨

To compile the ntpd policy into your kernel, place the following lines in your kernel configuration file:

options MAC
options MAC_NTPD

Alternately, to load the ntpd policy module at boot time, place the following line in your kernel configuration file:

options MAC

and in loader.conf(5):

mac_ntpd_load="YES"

💖 DESCRIPTION 💖

The mac_ntpd policy grants any process running as user ntpd (uid 123) the privileges needed to manipulate system time, and to (re-)bind to the privileged NTP port.

When ntpd(8) is started with -u <user>[:group] on the command line, it performs all initializations requiring root privileges, then drops root privileges by switching to the given user id. From that point on, the only privileges it requires are the ability to manipulate system time, and the ability to re-bind a UDP socket to the NTP port (port 123) after a network interface change.

With the mac_ntpd policy active, it may also be possible to start ntpd as a non-root user, because the default ntpd options don't require any additional root privileges beyond those granted by the policy.

👑 Privileges Granted 👑

The exact set of kernel privileges granted to any process running with the configured uid is:

PRIV_ADJTIME
PRIV_CLOCK_SETTIME
PRIV_NTP_ADJTIME
PRIV_NETINET_RESERVEDPORT
PRIV_NETINET_REUSEPORT

🎀 Runtime Configuration 🎀

The following sysctl(8) MIBs are available for fine-tuning this MAC policy. All sysctl(8) variables can also be set as loader(8) tunables in loader.conf(5).

• security.mac.ntpd.enabled — Enable the mac_ntpd policy. (Default: 1).
• security.mac.ntpd.uid — The numeric uid of the ntpd user. (Default: 123).

🌈 SEE ALSO 🌈

mac(4), ntpd(8)

🦋 HISTORY 🦋

MAC first appeared in FreeBSD 5.0 and mac_ntpd first appeared in FreeBSD 12.0.

---

mwah 💋 source/version: Debian, dated July 20, 2018 — catch you in the kernel, bestie 🫶