Re: Chrony and NTP hardening

On 2/4/26 17:25, Holger Hoffstätte wrote:
> It's not clear to me whether you want to do this only at startup or
> continously at runtime. For the former you will have to write your own
> pre-start script where you can check for "the current offset" without
> setting the clock with:
> 
>    chronyd -x -Q 2>&1 | grep "System clock" | cut -d ' ' -f 6
> 
> which will give you something like:
> 
>    -0.000211
> 
> You can then compare this with the checkpoint time and do whatever is
> necessary. Does that help?

It's only supposed to happen at startup. I have already thought about 
this approach, but the problem is that it imposes a TOCTOU 
(time-of-check-time-of-use) problem. Even if the result of the pre-check 
is OK, it does not guarantee that after the following start chronyd will 
still get a valid time. (Even though this seems a bit far-fetched also 
to me, but I haven't written the requirements.)

Thanks and best regards,
Bernd

-- 
To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "unsubscribe" in the subject.
For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "help" in the subject.
Trouble?  Email [email protected]