Author: Scott Lampert <[email protected]>

- Add fix for ntp.leapseconds apparmor error
  Fixes [COOK-3023]

README.md

@@ -27,15 +27,15 @@ Attributes
 ### Recommended tunables
 
 * `ntp['servers']` - (applies to NTP Servers and Clients)
-- Array, should be a list of upstream NTP servers that will be considered authoritative by the local NTP daemon. The local NTP daemon will act as a client, adjusting local time to match time data retrieved from the upstream NTP servers.
+  - Array, should be a list of upstream NTP servers that will be considered authoritative by the local NTP daemon. The local NTP daemon will act as a client, adjusting local time to match time data retrieved from the upstream NTP servers.
 
   The NTP protocol works best with at least 4 servers. The ntp daemon will disregard any server after the 10th listed, but will continue monitoring all listed servers. For more information, see [Upstream Server Time Quantity](http://support.ntp.org/bin/view/Support/SelectingOffsiteNTPServers#Section_5.3.3.) at [support.ntp.org](http://support.ntp.org).
 
 * `ntp['peers']` - (applies to NTP Servers ONLY)
-- Array, should be a list of local NTP peers. For more information, see [Designing Your NTP Network](http://support.ntp.org/bin/view/Support/DesigningYourNTPNetwork) at [support.ntp.org](http://support.ntp.org).
+  - Array, should be a list of local NTP peers. For more information, see [Designing Your NTP Network](http://support.ntp.org/bin/view/Support/DesigningYourNTPNetwork) at [support.ntp.org](http://support.ntp.org).
 
 * `ntp['restrictions']` - (applies to NTP Servers only)
-- Array, should be a list of restrict lines to define access to NTP clients on your LAN.
+  - Array, should be a list of restrict lines to define access to NTP clients on your LAN.
 
 * `ntp['sync_clock']` (applies to NTP Servers and Clients)
   - Boolean. Defaults to false. Forces the ntp daemon to be halted, an ntp -q command to be issued, and the ntp daemon to be restarted again on every Chef-client run. Will have no effect if drift is over 1000 seconds.
@@ -53,43 +53,35 @@ Attributes
 ### Platform specific
 
 * `ntp['packages']`
-
   - Array, the packages to install
   - Default, ntp for everything, ntpdate depending on platform. Not applicable for
     Windows nodes
 
 * `ntp['service']`
-
   - String, the service to act on
   - Default, ntp, NTP, or ntpd, depending on platform
 
 * `ntp['varlibdir']`
-
   - String, the path to /var/lib files such as the driftfile.
   - Default, platform-specific location. Not applicable for Windows nodes
 
 * `ntp['driftfile']`
-
   - String, the path to the frequency file.
   - Default, platform-specific location.
 
 * `ntp['conffile']`
-
   - String, the path to the ntp configuration file.
   - Default, platform-specific location.
 
 * `ntp['statsdir']`
-
   - String, the directory path for files created by the statistics facility.
   - Default, platform-specific location. Not applicable for Windows nodes
 
 * `ntp['conf_owner'] and ntp['conf_group']`
-
   - String, the owner and group of the sysconf directory files, such as /etc/ntp.conf.
   - Default, platform-specific root:root or root:wheel.
 
 * `ntp['var_owner'] and ntp['var_group']`
-
   - String, the owner and group of the /var/lib directory files, such as /var/lib/ntp.
   - Default, platform-specific ntp:ntp or root:wheel. Not applicable for Windows nodes
 
@@ -98,20 +90,17 @@ Attributes
   - Default, /etc/ntp.leapseconds.
 
 * `ntp['package_url']`
-
   - String, the URL to the the Meinberg NTPd client installation package.
   - Default, Meinberg site download URL
   - Windows platform only
 
 * `ntp['vs_runtime_url']`
-
   - String, the URL to the the Visual Studio C++ 2008 runtime libraries that are required
     for the Meinberg NTP client.
   - Default, Microsoft site download URL
   - Windows platform only
 
 * `ntp['vs_runtime_productname']`
-
   - String, the installation name of the Visual Studio C++ Runtimes file.
   - Default, "Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"
   - Windows platform only
@@ -121,6 +110,12 @@ Attributes
   - Default, false
   - Not applicable for Windows nodes
 
+* `ntp['apparmor_enabled']`
+  - Boolean, enables configuration of apparmor if set to true
+  - Defaults to false and will make no provisions for apparmor.  If a
+    platform is apparmor enabled by default, (currently Ubuntu)
+    default will be true.
+
 
 Usage
 -----

attributes/default.rb

@@ -42,11 +42,13 @@
 default['ntp']['sync_hw_clock'] = false
 default['ntp']['listen'] = nil
 default['ntp']['listen_network'] = nil
+default['ntp']['apparmor_enabled'] = false
 
 # overrides on a platform-by-platform basis
 case node['platform_family']
 when 'debian'
   default['ntp']['service'] = 'ntp'
+  default['ntp']['apparmor_enabled'] = true if node['platform'] == 'ubuntu' && node['platform_version'].to_f >= 8.04
 when 'rhel'
   default['ntp']['packages'] = %w(ntp) if node['platform_version'].to_i < 6
 when 'windows'

files/default/usr.sbin.ntpd.apparmor

@@ -0,0 +1,83 @@
+# vim:syntax=apparmor
+#
+# Maintained by Chef
+#
+# Updated for Ubuntu by: Jamie Strandboge <[email protected]>
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2009-2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#include <tunables/global>
+#include <tunables/ntpd>
+/usr/sbin/ntpd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+
+  capability ipc_lock,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+  capability sys_time,
+  capability sys_nice,
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+
+  @{PROC}/net/if_inet6 r,
+  @{PROC}/*/net/if_inet6 r,
+  @{NTPD_DEVICE} rw,
+
+  /usr/sbin/ntpd rmix,
+
+  /etc/ntp.conf r,
+  /etc/ntp.conf.dhcp r,
+  /etc/ntpd.conf r,
+  /etc/ntpd.conf.tmp r,
+  /var/lib/ntp/ntp.conf.dhcp r,
+
+  /etc/ntp.leapseconds r,
+
+  /etc/ntp.keys r,
+  /etc/ntp/** r,
+
+  /etc/ntp.drift rwl,
+  /etc/ntp.drift.TEMP rwl,
+  /etc/ntp/drift* rwl,
+  /var/lib/ntp/*drift rw,
+  /var/lib/ntp/*drift.TEMP rw,
+
+  /var/log/ntp w,
+  /var/log/ntp.log w,
+  /var/log/ntpd w,
+  /var/log/ntpstats/clockstats* rwl,
+  /var/log/ntpstats/loopstats*  rwl,
+  /var/log/ntpstats/peerstats*  rwl,
+  /var/log/ntpstats/rawstats*   rwl,
+  /var/log/ntpstats/sysstats*   rwl,
+
+  /{,var/}run/ntpd.pid w,
+
+  # samba4 ntp signing socket
+  /{,var/}run/samba/ntp_signd/socket rw,
+
+  # For use with clocks that report via shared memory (e.g. gpsd),
+  # you may need to give ntpd access to all of shared memory, though
+  # this can be considered dangerous. See https://launchpad.net/bugs/722815
+  # for details. To enable, add this to local/usr.sbin.ntpd:
+  #     capability ipc_owner,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.ntpd>
+}

recipes/apparmor.rb

@@ -0,0 +1,30 @@
+#
+# Cookbook Name:: ntp
+# Recipe:: apparmor
+# Author:: Scott Lampert (<[email protected]>)
+#
+# Copyright 2013, Scott Lampert
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+service 'apparmor' do
+  action :nothing
+end
+
+cookbook_file '/etc/apparmor.d/usr.sbin.ntpd' do
+  source 'usr.sbin.ntpd.apparmor'
+  owner 'root'
+  group 'root'
+  mode '0644'
+  notifies :restart, 'service[apparmor]'
+end

recipes/default.rb

@@ -38,6 +38,8 @@
     group node['ntp']['conf_group']
     mode  '0644'
   end
+
+  include_recipe 'ntp::apparmor' if node['ntp']['apparmor_enabled']
 end
 
 unless node['ntp']['servers'].size > 0

spec/unit/attributes_spec.rb

@@ -77,6 +77,10 @@
     it 'sets the upstream server list in the recipe' do
       expect(ntp['servers']).to include('0.pool.ntp.org')
     end
+
+    it 'sets apparmor_enabled to false' do
+      expect(ntp['apparmor_enabled']).to eq(false)
+    end
   end
 
   describe 'on Debian-family platforms' do
@@ -87,6 +91,14 @@
     end
   end
 
+  describe 'on Ubuntu' do
+    let(:chef_run) { ChefSpec::ChefRunner.new(platform: 'ubuntu', version: '12.04').converge('ntp::default') }
+
+    it 'sets the apparmor_enabled attribute to true' do
+      expect(ntp['apparmor_enabled']).to eq(true)
+    end
+  end
+
   describe 'on the CentOS 5 platform' do
     let(:chef_run) { ChefSpec::ChefRunner.new(platform: 'centos', version: '5.8').converge('ntp::default') }
 

spec/unit/recipes/apparmor_spec.rb

@@ -0,0 +1,16 @@
+require 'spec_helper'
+
+describe 'ntp::apparmor' do
+  let(:chef_run) { ChefSpec::ChefRunner.new.converge('recipe[ntp::apparmor]') }
+
+  it 'creates the apparmor file' do
+    expect(chef_run).to create_cookbook_file '/etc/apparmor.d/usr.sbin.ntpd'
+    file = chef_run.cookbook_file('/etc/apparmor.d/usr.sbin.ntpd')
+    expect(file).to be_owned_by('root', 'root')
+  end
+
+  it 'restarts the apparmor service' do
+    chef_run.cookbook_file('/etc/apparmor.d/usr.sbin.ntpd').should notify('service[apparmor]', :restart)
+  end
+
+end

spec/unit/recipes/default_spec.rb

@@ -246,6 +246,10 @@
     it 'sets ntp to start on boot' do
       expect(chef_run).to set_service_to_start_on_boot('ntp')
     end
+
+    it 'includes the apparmor recipe' do
+      expect(chef_run).to include_recipe('ntp::apparmor')
+    end
   end
 
   context 'freebsd' do