Re: Question regarding ntpd
On Monday, October 10, 2016 2:48:23 PM EDT L. A. Walsh wrote:
Steve Grubb wrote:
> But ntpd overwhelms logs but chronyd might be marginally better. See bz
> https://bugzilla.redhat.com/show_bug.cgi?id=918127
---
I took a gander at said bugzilla num, and found a minor surprise in that
there
Miroslav Lichvar said:
"You can use ntpd from the ntp package instead of chrony, it
shouldn't call adjtimex as often as chronyd does."
---
I.e. the exact opposite of your (Steve)'s statement. Wondered if that was
a misread or newer information...<*idle curiosity*>.
Either way sounds like it would be "nice" to differentiate a "read"
from
a "write" in this syscall if it is to be useful.
I agree. But the problem with this syscall is that the operation is part of a
data structure that is passed by address to the kernel. There currently is no
good way to filter its uses because the audit subsystem can only look at the
actual argument passed. I think there may be an issue opened for this on
github.
-Steve