1

I change the ntp.conf file to read time from a device:

server 127.127.8.0 mode 2 # standard time from device
server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 12 

The device file is /dev/refclock-0 that is a link for the file /dev/mbgclock. The problem is when I run the ntp daemon and the it's status I observe the line:

PARSE receiver #0: parse_start: open of /dev/refclock-0 failed: Permission denied

I changed the permission of refclock-0 to 777 (I know it's dirty, just for test) and add the line User=root to the ntp start script but the error still remains! How can I fix that? Here is the file /usr/lib/systemd/system/ntpd.service

[Unit]
Description=Network Time Service
After=syslog.target ntpdate.service sntp.service

[Service]
User=root
Type=forking
EnvironmentFile=-/etc/sysconfig/ntpd
ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS
PrivateTmp=true

[Install]
WantedBy=multi-user.target

And here is the status of the ntpd service:

● ntpd.service - Network Time Service
   Loaded: loaded (/usr/lib/systemd/system/ntpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-09-04 17:09:08 +0430; 16h ago
  Process: 5741 ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 5742 (ntpd)
   CGroup: /system.slice/ntpd.service
           └─5742 /usr/sbin/ntpd -u ntp:ntp -g

Sep 04 17:09:08 hardware ntpd[5742]: Listen normally on 2 lo 127.0.0.1 UDP 123
Sep 04 17:09:08 hardware ntpd[5742]: Listen normally on 3 enp3s0 192.168.1.60 UDP 123
Sep 04 17:09:08 hardware ntpd[5742]: Listen normally on 4 lo ::1 UDP 123
Sep 04 17:09:08 hardware ntpd[5742]: Listen normally on 5 enp3s0 fe80::7895:667b:cec:9b2 UDP 123
Sep 04 17:09:08 hardware ntpd[5742]: Listening on routing socket on fd #22 for interface updates
Sep 04 17:09:08 hardware ntpd[5742]: PARSE receiver #0: parse_start: open of /dev/refclock-0 failed: Permission denied
Sep 04 17:09:08 hardware ntpd[5742]: 127.127.8.0 interface 127.0.0.1 -> (none)
Sep 04 17:09:08 hardware ntpd[5742]: 0.0.0.0 c016 06 restart
Sep 04 17:09:08 hardware ntpd[5742]: 0.0.0.0 c012 02 freq_set kernel -9.533 PPM
Sep 04 17:09:10 hardware ntpd[5742]: 0.0.0.0 c515 05 clock_sync

1 Answer 1

1

ntp by default runs under apparmor isolation. So for 99% your case you will be blocked by an apparmor Deny - check dmesg output.

Since there are so many potential names for refclocks the profile can't just allow /dev/* especially since the majority of users do not use refclocks.

Therefore the profile already has a tunable file: /etc/apparmor.d/tunables/ntpd:

#Add your ntpd devices here eg. if you have a DCF clock
# @{NTPD_DEVICE}="/dev/ttyS1"
@{NTPD_DEVICE}="/dev/null"

And for your case the following should make it pass this stage:

@{NTPD_DEVICE}="refclock-0"
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .