DWS/chrony
1
0
Fork 0
mirror of https://gitlab.com/chrony/chrony.git synced 2025-12-04 04:25:06 -05:00
Code Issues Packages Projects Releases Wiki Activity

doc: update FAQ

Browse Source
This commit is contained in:
Miroslav Lichvar
2025-08-06 09:29:38 +02:00
parent 4886c776d5
commit 487cf3840f
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
doc/faq.adoc
View File

@@ -165,6 +165,13 @@ versions or implementations of the libraries might make different system calls.
If the filter is missing some system call, `chronyd` could be killed even in If the filter is missing some system call, `chronyd` could be killed even in
normal operation. normal operation.
The impact of potential security issues in `chronyc` can be reduced by running
`chronyc` under the _chrony_ user instead of root, or another unprivileged user
if access to the Unix domain socket is not needed. Since version 4.8, `chronyc`
drops root privileges automatically if it is started with the `-u` option
specifying the _chrony_ user, or the name was specified to be the compiled-in
default by the `--with-chronyc-user` option of the configure script.
=== How can I make the system clock more secure? === How can I make the system clock more secure?
An NTP client synchronising the system clock to an NTP server is susceptible to An NTP client synchronising the system clock to an NTP server is susceptible to
@@ -897,7 +904,9 @@ measurements from both sources.
If the first source was significantly better than the second source, it can If the first source was significantly better than the second source, it can
take many hours before the second source is selected, depending on its polling take many hours before the second source is selected, depending on its polling
interval. You can force a faster reselection by increasing the clock error rate interval. You can force a faster reselection by reducing the maximum number of
polls the source can still be selected when unreachable (`maxunreach` option
supported since `chrony` version 4.8), increasing the clock error rate
(`maxclockerror` directive), shortening the polling interval (`maxpoll` (`maxclockerror` directive), shortening the polling interval (`maxpoll`
option), or reducing the number of samples (`maxsamples` option). option), or reducing the number of samples (`maxsamples` option).