MAC_NTPD(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MAC_NTPD(4) 💖

okay so this is the mac_ntpd page from the Kernel Interfaces Manual — yes bestie, we're in the kernel section, put your big-girl hat on 🎀

✨ NAME ✨

mac_ntpd — the policy that lets ntpd run as a non-root user, like the icon it is 👑

🌸 SYNOPSIS 🌸

So you wanna compile the ntpd policy right into your kernel? Slay. Drop these lines in your kernel configuration file:

options MAC
options MAC_NTPD

OR, if you'd rather load the ntpd policy module at boot time (main character energy, honestly), put this one line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_ntpd_load="YES"

periodt 💅

🦋 DESCRIPTION 🦋

The mac_ntpd policy grants any process running as user 'ntpd' (uid 123) all the privileges it needs to manipulate system time, plus the ability to (re-)bind to the privileged NTP port. it's giving "trusted friend privileges" 🫶

So here's the situation. When ntpd(8) is started with -u <user>[:group] on the command line, it does all its root-requiring initializations first, then drops root privileges by switching to the given user id. From that moment on, the only things it still needs are:

  • the ability to manipulate system time, and
  • the ability to re-bind a UDP socket to the NTP port (port 123) after a network interface change.

With the mac_ntpd policy active, it may also be possible to start ntpd as a non-root user, because the default ntpd options don't require any additional root privileges beyond those granted by the policy. lowkey iconic ✨

🔐 Privileges Granted

The exact set of kernel privileges granted to any process running with the configured uid is:

PRIV_ADJTIME
PRIV_CLOCK_SETTIME
PRIV_NTP_ADJTIME
PRIV_NETINET_RESERVEDPORT
PRIV_NETINET_REUSEPORT

no more, no less, we keep it exact 💯

⚙️ Runtime Configuration

The following sysctl(8) MIBs are available for fine-tuning this MAC policy. And psst — all sysctl(8) variables can also be set as loader(8) tunables in loader.conf(5). flexible AND cute 🌈

  • security.mac.ntpd.enabled — Enable the mac_ntpd policy. (Default: 1).
  • security.mac.ntpd.uid — The numeric uid of the ntpd user. (Default: 123).

👀 SEE ALSO 👀

mac(4), ntpd(8)

go read those too, bestie, i'm not kidding, they're the whole context 💜

📜 HISTORY 📜

MAC first appeared in FreeBSD 5.0 and mac_ntpd first appeared in FreeBSD 12.0. glow-up timeline fr fr 🧚

and that's the whole page!! you understood all of it, i'm so proud of you 😭💖

okay bye, this was the Debian build of the manpage, dated July 20, 2018 — love u, go run your NTP daemon as a normal little user now 🍓👑

📦 where this page comes from