#1072475 ntpsec: allow access to /dev/refclock[0-9]* and /dev/ttyUSB[0-9]* in apparmor

Package:
ntpsec
Source:
ntpsec
Description:
Network Time Protocol daemon and utility programs
Submitter:
Carsten Leonhardt
Date:
2025-03-01 06:33:02 UTC
Severity:
normal
Tags:
#1072475#5
Date:
2024-06-02 14:54:31 UTC
From:
To:
Dear Maintainer,

to be able to use my USB-attached reference clock ("GUDE Expert
mouseCLOCK USB v2.0"), I had to edit /etc/apparmor.d/usb.sbin.ntpd (see
attached patch).

Additionally, I added an udev rule in
/etc/udev/rules.d/persistent-refclock.rules with these contents:

KERNEL=="ttyUSB*", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="e88a", SYMLINK+="refclock-%m" MODE="644"

But the udev rule is probably outside the scope of the ntpsec package.

After these changes, I can use the device with the following
configuration in ntp.conf:

refclock generic subtype 19

Regards

Carsten
#1072475#12
Date:
2025-03-01 06:29:38 UTC
From:
To:
I'm sorry for the very delayed response...

If I'm understanding this correctly, you are using a udev rule to create
a symlink from /dev/refclock-0 to /dev/ttyUSB0 (or whatever number).

I'm not sure how AppArmor deals with symlinks in this context. Does it
work if you just allow the /dev/refclock pattern and not the /dev/ttyUSB
pattern?

You can customize for your local device with
/etc/apparmor.d/tunables/ntpd. If you only need one device pattern, then
you can just fill that in and it's simple. If you need more than one,
I'm less sure. The comment in there mentions devices plural, though the
variable name is NTPD_DEVICE singular.

This seems to indicate that they can be lists, but I'm not sure if using
a list would make sense given where the variable is used:
https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha-apparmor-profiles.html#sec-apparmor-profiles-glob-variables

Another option might be to use a singular pattern that matches both,
e.g. @{NTPD_DEVICE}="/dev/{refclock,USB}[0-9]*"