Apparmor denies net_admin for hwtimestamp

[Joshua Powers]

Summary:
When enabling hwtimestamp capability for chrony apparmor reports a denied operation for net_admin. hwtimestamp is a nice feature for very fast time setting on a local network when devices have the capabilities.

Expected Results:
syslog messges stating that hwtimestamping was enabled

Actual Results:
[ 8093.250474] audit: type=1400 audit(1522880521.783:19): apparmor="DENIED" operation="capable" profile="/usr/sbin/chronyd" pid=4137 comm="chronyd" capability=12 capname="net_admin"
[ 8514.101791] audit: type=1400 audit(1522880942.637:20): apparmor="DENIED" operation="capable" profile="/usr/sbin/chronyd" pid=4248 comm="chronyd" capability=12 capname="net_admin"

Steps to reproduce:
1. sudo apt update; sudo apt install -y chrony
2. echo "hwtimestamp *" | sudo tee -a /etc/chrony/chrony.conf
3. sudo systemctl restart chrony.service

Output from syslog during the service restart:

Apr 4 22:48:30 wind chronyd[1378]: chronyd exiting
Apr 4 22:48:30 wind systemd[1]: Stopping chrony, an NTP client/server...
Apr 4 22:48:30 wind systemd[1]: Stopped chrony, an NTP client/server.
Apr 4 22:48:30 wind systemd[1]: Starting chrony, an NTP client/server...
Apr 4 22:48:30 wind chronyd[1649]: chronyd version 3.2 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SECHASH +SIGND +ASYNCDNS +IPV6 -DEBUG)
Apr 4 22:48:30 wind chronyd[1649]: Frequency 2.390 +/- 11.697 ppm read from /var/lib/chrony/chrony.drift
Apr 4 22:48:30 wind kernel: [ 4036.581454] kauditd_printk_skb: 7 callbacks suppressed
Apr 4 22:48:30 wind kernel: [ 4036.581455] audit: type=1400 audit(1522882110.457:18): apparmor="DENIED" operation="capable" profile="/usr/sbin/chronyd" pid=1649 comm="chronyd" capability=12 capname="net_admin"
Apr 4 22:48:30 wind systemd[1]: Started chrony, an NTP client/server.

Removing the hwtimestamp line from the configuration file removes the apparmor denied message.

Fix:
1. Add the net_admin capability to /etc/apparmor.d/usr.sbin.chronyd
2. sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.chronyd
3. sudo systemctl restart chrony.service

Apparmor message no longer occurs and in the syslog the HW timestamping message appears:

Apr 4 22:52:12 wind chronyd[2066]: Enabled HW timestamping on enp0s25

And eventually `sudo chronyc ntpdata` shows:
TX timestamping : Hardware
RX timestamping : Hardware

instead of:
TX timestamping : Kernel
RX timestamping : Kernel

System Info:
Ubuntu Bionic
chrony 3.2-4ubuntu2

[Christian Ehrhardt  (paelzer)]

Thanks for the repro steps, to add to that is only triggers if the HW REALLY can do HW Timestamping (which likely is the reason it was missed as e.g. virtio devs can't).
You can check with:
  ethtool -T <dev>

From man chrony.conf
This directive is supported on Linux 3.19 and newer. The NIC must support HW timestamping, which can be verified with the ethtool -T command. The list of capabilities should include
SOF_TIMESTAMPING_RAW_HARDWARE, SOF_TIMESTAMPING_TX_HARDWARE, and SOF_TIMESTAMPING_RX_HARDWARE. Receive filter HWTSTAMP_FILTER_ALL, or HWTSTAMP_FILTER_NTP_ALL, is necessary for timestamping of received packets. Timestamping of packets received from bridged and bonded interfaces is supported on Linux 4.13 and newer. When chronyd is running, no other process (e.g. a PTP daemon) should be working with the NIC clock.

In a KVM guest it will run with SW timestamping which works.
From chronc > ntpdata
[...]
TX timestamping : Kernel
RX timestamping : Kernel

[Christian Ehrhardt  (paelzer)]

Would be what is missing:
Apr 05 07:23:44 node-horsea chronyd[19961]: Enabled HW timestamping (TX only) on eno1
Apr 05 07:23:44 node-horsea chronyd[19961]: Enabled HW timestamping (TX only) on eno2
Apr 05 07:23:44 node-horsea chronyd[19961]: Enabled HW timestamping (TX only) on eno3
Apr 05 07:23:44 node-horsea chronyd[19961]: Enabled HW timestamping (TX only) on eno4
Apr 05 07:23:44 node-horsea chronyd[19961]: Enabled HW timestamping (TX only) on eno50

Without those ntpdata reports:
TX timestamping : Kernel

With the following rule added:
  # for hwtimestamp
  capability net_admin,

We get proper TX timestamping:
TX timestamping : Hardware

[Christian Ehrhardt  (paelzer)]

Working fine, can be reviewed without ppa as it is a config change only.
My checks are good on this.

@Josh I added you as reviewer since you have the env ready to confirm.

[Christian Ehrhardt  (paelzer)]

Reported to Debian to get in sync later on, linking debian bug 894879

[Launchpad Janitor (janitor)]

This bug was fixed in the package chrony - 3.2-4ubuntu3

---------------
chrony (3.2-4ubuntu3) bionic; urgency=medium

  * debian/usr.sbin.chronyd: add cap net_admin for hwtimestamp (LP: #1761327)

 -- Christian Ehrhardt <email address hidden> Thu, 05 Apr 2018 09:38:10 +0200