[Bug 223647] net/chrony: remove dubious security warning

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=223647

            Bug ID: 223647
           Summary: net/chrony: remove dubious security warning
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs at FreeBSD.org
          Reporter: decke at FreeBSD.org
                CC: yonas at fizk.net
                CC: yonas at fizk.net
             Flags: maintainer-feedback?(yonas at fizk.net)

The chrony port has since it's appearance in the ports tree in r350635 (April
2014) the following security warning after installation:

"Unfortunately, this software has shameful history of several vulnerabilities
previously discovered.  FreeBSD Project cannot guarantee that this spree had
come to an end.  It is further complicated, as chronyd(8) requires superuser
permissions to operate; please type ``make deinstall'' to deinstall the port
if tight security is a concern."

The "requires superuser" part has become invalid in 2017 with r434012 when the
maintainer decided to use the privilege dropping feature in the port. In the
chrony code it seems this code was available for a very long time already.

What remains is a dubious security warning for the chrony port without any
technical arguments. In the FreeBSD portstree it's not our job to tell our
"feelings" about probable future security risks. We should provide CVE and CPE
information (already exists in the port) and warn people about EXISTING and
KNOWN vulnerabilities.

In addition to that a recent security audit exists which came to a completely
different conclusion about the chrony security situation:

"The overwhelmingly positive result of this security assignment performed by
three Cure53 testers can be clearly inferred from a marginal number and
low-risk nature of the findings amassed in this report. Withstanding eleven
full days of on-remote testing in August of 2017 means that Chrony is robust,
strong, and developed with security in mind. The software boasts sound design
and is secure across all tested areas. It is quite safe to assume that untested
software in the Chrony family is of a similarly exceptional quality. In
general, the software proved to be well-structured and marked by the right
abstractions at the appropriate locations. While the functional scope of the
software is quite wide, the actual implementation is surprisingly elegant and
of a minimal and just necessary complexity. In sum, the Chrony NTP software
stands solid and can be seen as trustworthy."

https://www.linuxfoundation.org/blog/cii-audit-identifies-secure-ntp-implementation/

https://wiki.mozilla.org/images/e/e4/Chrony-report.pdf


The longterm CVE history also seems quite reasonable in comparison to other NTP
implementations:

https://www.cvedetails.com/vulnerability-list/vendor_id-10533/product_id-18821/Tuxfamily-Chrony.html


I will add a few parties to the loop to make sure all opinions are heard and
will keep this bug open for at least a month to make sure people have a chance
to respond.

-- 
You are receiving this mail because:
You are the assignee for the bug.