Date: Mon, 13 Nov 2017 11:57:26 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-ports-bugs@FreeBSD.org Subject: [Bug 223647] net/chrony: remove dubious security warning Message-ID: <bug-223647-13@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D223647 Bug ID: 223647 Summary: net/chrony: remove dubious security warning Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: Individual Port(s) Assignee: freebsd-ports-bugs@FreeBSD.org Reporter: decke@FreeBSD.org CC: yonas@fizk.net CC: yonas@fizk.net Flags: maintainer-feedback?(yonas@fizk.net) The chrony port has since it's appearance in the ports tree in r350635 (Apr= il 2014) the following security warning after installation: "Unfortunately, this software has shameful history of several vulnerabiliti= es previously discovered. FreeBSD Project cannot guarantee that this spree had come to an end. It is further complicated, as chronyd(8) requires superuser permissions to operate; please type ``make deinstall'' to deinstall the port if tight security is a concern." The "requires superuser" part has become invalid in 2017 with r434012 when = the maintainer decided to use the privilege dropping feature in the port. In the chrony code it seems this code was available for a very long time already. What remains is a dubious security warning for the chrony port without any technical arguments. In the FreeBSD portstree it's not our job to tell our "feelings" about probable future security risks. We should provide CVE and = CPE information (already exists in the port) and warn people about EXISTING and KNOWN vulnerabilities. In addition to that a recent security audit exists which came to a complete= ly different conclusion about the chrony security situation: "The overwhelmingly positive result of this security assignment performed by three Cure53 testers can be clearly inferred from a marginal number and low-risk nature of the findings amassed in this report. Withstanding eleven full days of on-remote testing in August of 2017 means that Chrony is robus= t, strong, and developed with security in mind. The software boasts sound desi= gn and is secure across all tested areas. It is quite safe to assume that unte= sted software in the Chrony family is of a similarly exceptional quality. In general, the software proved to be well-structured and marked by the right abstractions at the appropriate locations. While the functional scope of the software is quite wide, the actual implementation is surprisingly elegant a= nd of a minimal and just necessary complexity. In sum, the Chrony NTP software stands solid and can be seen as trustworthy." https://www.linuxfoundation.org/blog/cii-audit-identifies-secure-ntp-implem= entation/ https://wiki.mozilla.org/images/e/e4/Chrony-report.pdf The longterm CVE history also seems quite reasonable in comparison to other= NTP implementations: https://www.cvedetails.com/vulnerability-list/vendor_id-10533/product_id-18= 821/Tuxfamily-Chrony.html I will add a few parties to the loop to make sure all opinions are heard and will keep this bug open for at least a month to make sure people have a cha= nce to respond. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-223647-13>