Merge ~paelzer/ubuntu/+source/chrony:merge-disco-3.4 into ubuntu/+source/chrony:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Related PPA and ticket at
- https://bileto.ubuntu.com/#/ticket/3512
- https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3512

[Christian Ehrhardt  (paelzer)]

Pushed merge tags for review
 * [new tag] lp1802886/deconstruct/3.3-2ubuntu2 -> lp1802886/deconstruct/3.3-2ubuntu2
 * [new tag] lp1802886/logical/3.3-2ubuntu2 -> lp1802886/logical/3.3-2ubuntu2
 * [new tag] lp1802886/new/debian -> lp1802886/new/debian
 * [new tag] lp1802886/old/debian -> lp1802886/old/debian
 * [new tag] lp1802886/old/ubuntu -> lp1802886/old/ubuntu
 * [new tag] lp1802886/reconstruct/3.3-2ubuntu2 -> lp1802886/reconstruct/3.3-2ubuntu2

[Christian Ehrhardt  (paelzer)]

Tests on the Bileto ticket fail for Disco not being fully available yet :-/
I'd appreciate a review still as it looks rather normal this time (no huge changes).

[Christian Ehrhardt  (paelzer)]

The pidfile is actually configured - I missed that.
I need to rework it a bit.

[Christian Ehrhardt  (paelzer)]

Ok, fortunately I just needed to drop two commits to clean that up

[Andreas Hasenack (ahasenack)]

Bileto should work with disco shortly:
<ahasenack> looks like all we need is one package in that ppa built for disco
<xnox> ahasenack, that is fixable.
<xnox> ahasenack, not built =) _copied_
* xnox does that

You might want to upload a ~ppa2 or something to trigger a new run.

[Andreas Hasenack (ahasenack)]

Some changelog entries under "remaining changes" have incorrect indentation, namely:
      - debian/chrony.service: allow the service to run without CAP_SYS_TIME
      - debian/control: add new dependency libcap2-bin for capsh (usually
        installed anyway, but make them explicit to be sure).
      - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
        (Default off).
      - debian/chronyd-starter.sh: wrapper to handle special cases in containers
        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
        containers on a default installation and avoid failing to sync time (or
        if allowed to sync, avoid multiple containers to fight over it by
        accident).
      - debian/install: make chronyd-starter.sh available on install.
      - debian/docs, debian/README.container: provide documentation about the
        handling of this case.

and

      - d/links: link dispatcher script to networkd-dispatcher events routable
        and off
      - d/control: set Recommends to networkd-dispatcher
      - d/p/lp-1718227-nm-dispatcher-for-networkd.patch

[Andreas Hasenack (ahasenack)]

commit 9a45945013355c5fad351a36cfc0ee17a8ac5882
Author: Christian Ehrhardt <email address hidden>
Date: Thu Mar 15 09:31:48 2018 +0100

    - debian/chronyd-starter.sh: wrapper to handle special cases in containers

That also touched debian/chrony.service.

[Andreas Hasenack (ahasenack)]

In my comment about the indentation of d/changelog, the second "hunk" that starts with "- d/links:...", is correct as it is, indented below "Notify chrony ...". My mistake.

[Andreas Hasenack (ahasenack)]

And I just realized that everything in the first "hunk" of that comment is also related to the parent line, so indentation is also correct. Sorry.

[Andreas Hasenack (ahasenack)]

Sorry about the confusing review.

I guess my only comment is about that d/chronyd-starter.sh wrapper commit which forgot to mention chrony.service. I see that in under paelzer/lp1802886/logical/3.3-2ubuntu2 too:

commit bb17fdf9967601d436a73bf93f9b3e72fa67696a
Author: Christian Ehrhardt <email address hidden>
Date: Thu Mar 15 09:31:48 2018 +0100

    - debian/chronyd-starter.sh: wrapper to handle special cases in containers

    Signed-off-by: Christian Ehrhardt <email address hidden>

No big deal, though.

Logical, drops, and added change are good. delta carried forward as expected. Would be cool to see a new dep8 run after bileto was fixed today to work with disco (hopefully).

review: Approve

[Christian Ehrhardt  (paelzer)]

The indents are meant that way.
It is not meant to me misread as you did only to then realize it is right.
That means my CL is bad, so I replaced the - with a + to make clear that it is intentionally an extra level.
Thanks for the catch

Updated the commit message on 9a4594 (changelog was ok)

I'll use the fixed thing for a new bileto upload.
If it works fine, otherwise I might go on still.

[Christian Ehrhardt  (paelzer)]

Tests are good now: https://bileto.ubuntu.com/excuses/3512/disco.html

So we are complete, I'll upload

diff --git a/debian/README.container b/debian/README.container
 new file mode 100644
index 0000000..16f2618
--- /dev/null
+++ b/debian/README.container
@@ -0,0 +1,60 @@
+Chrony in Containers
+--------------------
+
+Currently in in 99.9+% of the cases syncing the local clock in a container
+is wrong. Most of the time it will be unable to do so, because it is lacking
+CAP_SYS_TIME. Or worse, if the CAP_SYS_TIME privilege is granted, multiple
+containers could fight over the system's time, because the Linux kernel does
+not provide time namespaces (yet).
+
+There are two things a user installing chrony usually wants:
+1. synchronize my time (NTP client)
+2. serve NTP (NTP server)
+
+In a container the first makes (usually) no sense, so by default we enable -x
+there (as it would only crash otherwise).
+This will disable the control of the system clock.
+See `man chronyd` for more details on the -x option.
+
+Formerly, the check for Condition=CAP_SYS_TIME in the systemd service avoided
+the crash of the NTP client portion, but that means the server use case will
+not work by default in containers. It is still not recommended to use a
+container as an NTP server, but if the host clock is synchronised via NTP,
+adding the -x option to chronyd instances running in containers will allow
+them to function as NTP servers which do not adjust the system clock.
+The Condition=CAP_SYS_TIME check was a silent, no-log-entry stealing away
+leaving users often unclear what happened - especially if they were more after
+the NTP server than the NTP client.
+
+One could argue that someone who installs chrony expects the system time to be
+synchronised, so it should fail if it is not able to do so.  On the other hand
+it could be argued that someone who installs chrony expects time to be served
+over the network via NTP.
+We can't know which expectation is applicable, so we assume that time should
+be synchronised unless chronyd is running in a container (or is without
+CAP_SYS_TIME in any other environment).
+
+To make things worse recent container implementations will offer CAP_SYS_TIME
+to the container. Since from the container's point of view, this capability is
+available for the container's user namespace. Just later on adjtimex and similar
+are actually evaluated against the host kernel where they will fail. Due to
+that without further precaution running chrony in Ubuntu in the future will
+likely have the service start (as Condition=CAP_SYS_TIME will be true) but
+then immediately fail.
+This will depend on the environment e.g. versions and types of containers and
+thereby feel just 'unreliable' from users point of view.
+Furthermore it will affect upgrades as the service has to be restarted for a
+package upgrade to be considered complete.
+
+Due to all of that Ubuntu decided (LP: #1589780) to default to -x (do not
+set the system clock) in containers.
+
+If one really wants to (try to) sync time in a container or CAP_SYS_TIME-less
+environment set SYNC_IN_CONTAINER="yes" in /etc/default/chrony to disable
+this special handling.
+
+It is important to mention that as soon as upstream provides a way to provide
+a default config working in those cases Ubuntu intends to use that and drop
+the current workaround.
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Mar 2018 12:25:44 +0100
diff --git a/debian/changelog b/debian/changelog
index 513307a..2ea28a0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,45 @@
+chrony (3.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1802886). Remaining changes:
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+    - Set -x as default if unable to set time (e.g. in containers) (LP: 1589780)
+      Chrony is a single service which acts as both NTP client (i.e. syncing the
+      local clock) and NTP server (i.e. providing NTP services to the network),
+      and that is both desired and expected in the vast majority of cases.
+      But in containers syncing the local clock is usually impossible, but this
+      shall not break the providing of NTP services to the network.
+      To some extent this makes chrony's default config more similar to 'ntpd',
+      which complained in syslog but still provided NTP server service in those
+      cases.
+      - debian/chrony.service: allow the service to run without CAP_SYS_TIME
+      - debian/control: add new dependency libcap2-bin for capsh (usually
+        installed anyway, but make them explicit to be sure).
+      - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+        (Default off).
+      - debian/chronyd-starter.sh: wrapper to handle special cases in containers
+        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+        containers on a default installation and avoid failing to sync time (or
+        if allowed to sync, avoid multiple containers to fight over it by
+        accident).
+      - debian/install: make chronyd-starter.sh available on install.
+      - debian/docs, debian/README.container: provide documentation about the
+        handling of this case.
+    - d/postrm: re-establish systemd-timesyncd on removal (LP: 1764357)
+    - Notify chrony to update sources in response to systemd-networkd
+      events (LP: 1718227)
+      - d/links: link dispatcher script to networkd-dispatcher events routable
+        and off
+      - d/control: set Recommends to networkd-dispatcher
+  * Dropped Changes (upstream):
+    - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+    - d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+      the service on newer kernels by falling back to urandom. (LP: 1787366)
+  * Added Changes:
+    - d/postrm: respect policy-rc.d when restoring systemd-timesyncd
+      (LP: #1771994)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 12 Nov 2018 11:39:08 +0100
+
 chrony (3.4-1) unstable; urgency=medium
 
   * Import upstream version 3.4:
@@ -74,6 +116,66 @@ chrony (3.3-3) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Sat, 18 Aug 2018 16:23:19 +0200
 
+chrony (3.3-2ubuntu2) cosmic; urgency=medium
+
+  * - d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+      the service on newer kernels by falling back to urandom.
+      (LP: #1787366, Closes: #906276)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 16 Aug 2018 11:48:38 +0200
+
+chrony (3.3-2ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1771061). Remaining changes:
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+    - Set -x as default if unable to set time (e.g. in containers) (LP: 1589780)
+      Chrony is a single service which acts as both NTP client (i.e. syncing the
+      local clock) and NTP server (i.e. providing NTP services to the network),
+      and that is both desired and expected in the vast majority of cases.
+      But in containers syncing the local clock is usually impossible, but this
+      shall not break the providing of NTP services to the network.
+      To some extent this makes chrony's default config more similar to 'ntpd',
+      which complained in syslog but still provided NTP server service in those
+      cases.
+      - debian/chrony.service: allow the service to run without CAP_SYS_TIME
+      - debian/control: add new dependency libcap2-bin for capsh (usually
+        installed anyway, but make them explicit to be sure).
+      - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+        (Default off).
+      - debian/chronyd-starter.sh: wrapper to handle special cases in containers
+        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+        containers on a default installation and avoid failing to sync time (or
+        if allowed to sync, avoid multiple containers to fight over it by
+        accident).
+      - debian/install: make chronyd-starter.sh available on install.
+      - debian/docs, debian/README.container: provide documentation about the
+        handling of this case.
+    - d/postrm: re-establish systemd-timesyncd on removal (LP: 1764357)
+    - Notify chrony to update sources in response to systemd-networkd
+      events (LP: 1718227)
+      - d/links: link dispatcher script to networkd-dispatcher events routable
+        and off
+      - d/control: set Recommends to networkd-dispatcher
+      - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+  * Dropped changes
+    - debian/usr.sbin.chronyd: ensure RTC/GPS usage isn't blocked by apparmor
+      (LP: 1751241) (in Debian now)
+    - debian/usr.sbin.chronyd: add cap net_admin for hwtimestamp (LP: 1761327)
+      (in Debian now)
+    - d/p/lp1589780-sys_linux-don-t-keep-CAP_SYS_TIME-with-x-option.patch:
+      When dropping the root privileges, don't try to keep the CAP_SYS_TIME
+      capability if the -x option was enabled. This allows chronyd to be
+      started without the capability (e.g. in containers) and also drop the
+      root privileges (This is upstream now).
+    - d/p/lp-1718227-ignore-non-up-down-events-in-nm-dispatcher.patch (This is
+      upstream now).
+    - d/control: switch to nss instead of tomcrypt (Debian switched to nettle
+      which is in main, so we can drop this)
+  * Added changes
+    - debian/README.container: fix typos
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 14 May 2018 09:06:01 +0200
+
 chrony (3.3-2) unstable; urgency=medium
 
   * debian/chrony.service:
@@ -129,6 +231,76 @@ chrony (3.2-5) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Wed, 28 Feb 2018 17:31:08 +0100
 
+chrony (3.2-4ubuntu4) bionic; urgency=medium
+
+  * d/postrm: re-establish systemd-timesyncd on removal (LP: #1764357)
+  * Notify chrony to update sources in response to systemd-networkd
+    events (LP: #1718227)
+    - d/links: link dispatcher script to networkd-dispatcher events routable
+      and off
+    - d/control: set Recommends to networkd-dispatcher
+    - d/p/lp-1718227-ignore-non-up-down-events-in-nm-dispatcher.patch
+    - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 16 Apr 2018 17:04:06 +0200
+
+chrony (3.2-4ubuntu3) bionic; urgency=medium
+
+  * debian/usr.sbin.chronyd: add cap net_admin for hwtimestamp (LP: #1761327)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 05 Apr 2018 09:38:10 +0200
+
+chrony (3.2-4ubuntu2) bionic; urgency=medium
+
+  * Set -x as default if unable to set time (e.g. in containers) (LP: #1589780)
+    Chrony is a single service which acts as both NTP client (i.e. syncing the
+    local clock) and NTP server (i.e. providing NTP services to the network),
+    and that is both desired and expected in the vast majority of cases.
+    But in containers syncing the local clock is usually impossible, but this
+    shall not break the providing of NTP services to the network.
+    To some extent this makes chrony's default config more similar to 'ntpd',
+    which complained in syslog but still provided NTP server service in those
+    cases.
+    - d/p/lp1589780-sys_linux-don-t-keep-CAP_SYS_TIME-with-x-option.patch:
+      When dropping the root privileges, don't try to keep the CAP_SYS_TIME
+      capability if the -x option was enabled. This allows chronyd to be
+      started without the capability (e.g. in containers) and also drop the
+      root privileges.
+    - debian/chrony.service: allow the service to run without CAP_SYS_TIME
+    - debian/control: add new dependency libcap2-bin for capsh (usually
+      installed anyway, but make them explicit to be sure).
+    - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+      (Default off).
+    - debian/chronyd-starter.sh: wrapper to handle special cases in containers
+      and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+      containers on a default installation and avoid failing to sync time (or
+      if allowed to sync, avoid multiple containers to fight over it by
+      accident).
+    - debian/install: make chronyd-starter.sh available on install.
+    - debian/docs, debian/README.container: provide documentation about the
+      handling of this case.
+  * debian/chrony.conf: update default chrony.conf to not violate the policy
+    of pool.ntp.org (to use no more than four of their servers) and to provide
+    more ipv6 capable sources by default (LP: #1754358)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Mar 2018 12:25:44 +0100
+
+chrony (3.2-4ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control: switch to nss instead of tomcrypt (nss is in main)
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+  * Dropped changes (in Debian)
+    - d/chrony.default, d/chrony.service: support /etc/default/chrony
+      DAEMON_OPTS in systemd environment (LP: 1746081)
+    - d/chrony.service: properly start after networking (LP: 1746458)
+    - d/usr.sbin.chronyd: allow to create /run/chrony on demand (LP: 1746444)
+  * Added Changes:
+    - debian/usr.sbin.chronyd: ensure RTC/GPS usage isn't blocked by apparmor
+      (LP: #1751241, Closes: #891201)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 26 Feb 2018 14:44:54 +0100
+
 chrony (3.2-4) unstable; urgency=medium
 
   * debian/changelog:
@@ -195,6 +367,27 @@ chrony (3.2-3) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Wed, 07 Feb 2018 21:27:09 +0100
 
+chrony (3.2-2ubuntu3) bionic; urgency=medium
+
+  * Revert the changes of (LP 1746458) as in the follow on discussion
+    it became clear that we want it to start early (for example for an
+    early offset from drift file). iIf needed chrony will later on pick
+    up that servers are online via retries (augmented by hooks on network
+    events).
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 08 Feb 2018 10:52:30 +0100
+
+chrony (3.2-2ubuntu2) bionic; urgency=medium
+
+  * d/control: use to nss instead of tomcrypt (in main) (LP: #1744072)
+  * d/chrony.conf: use ubuntu ntp pool and server (LP: #1744664)
+  * d/chrony.default, d/chrony.service: support /etc/default/chrony
+    DAEMON_OPTS in systemd environment (LP: #1746081)
+  * d/chrony.service: properly start after networking (LP: #1746458)
+  * d/usr.sbin.chronyd: allow to create /run/chrony on demand (LP: #1746444)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 19 Jan 2018 09:45:38 +0100
+
 chrony (3.2-2) unstable; urgency=medium
 
   * Initial AppArmor profile for chronyd. Thanks to Jamie
diff --git a/debian/chrony.conf b/debian/chrony.conf
index 6c19767..d5a0b37 100644
--- a/debian/chrony.conf
+++ b/debian/chrony.conf
@@ -1,6 +1,23 @@
 # Welcome to the chrony configuration file. See chrony.conf(5) for more
 # information about usuable directives.
-pool 2.debian.pool.ntp.org iburst
+
+# This will use (up to):
+# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
+# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
+# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
+# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
+# sources will be used.
+# At the same time it retains some protection against one of the entries being
+# down (compare to just using one of the lines). See (LP: #1754358) for the
+# discussion.
+#
+# About using servers from the NTP Pool Project in general see (LP: #104525).
+# Approved by Ubuntu Technical Board on 2011-02-08.
+# See http://www.pool.ntp.org/join.html for more information.
+pool ntp.ubuntu.com        iburst maxsources 4
+pool 0.ubuntu.pool.ntp.org iburst maxsources 1
+pool 1.ubuntu.pool.ntp.org iburst maxsources 1
+pool 2.ubuntu.pool.ntp.org iburst maxsources 2
 
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
diff --git a/debian/chrony.default b/debian/chrony.default
index ae79e8a..b523f60 100644
--- a/debian/chrony.default
+++ b/debian/chrony.default
@@ -4,3 +4,7 @@
 
 # Options to pass to chrony.
 DAEMON_OPTS=""
+
+# Sync systecm clock in containers or without CAP_SYS_TIME (likely to fail)
+# See /usr/share/doc/chrony/README.container for details.
+SYNC_IN_CONTAINER="no"
diff --git a/debian/chrony.service b/debian/chrony.service
index 3e4451a..bb01a79 100644
--- a/debian/chrony.service
+++ b/debian/chrony.service
@@ -3,13 +3,13 @@ Description=chrony, an NTP client/server
 Documentation=man:chronyd(8) man:chronyc(1) man:chrony.conf(5)
 Conflicts=systemd-timesyncd.service openntpd.service ntp.service ntpsec.service
 After=network.target
-ConditionCapability=CAP_SYS_TIME
 
 [Service]
 Type=forking
 PIDFile=/run/chronyd.pid
 EnvironmentFile=-/etc/default/chrony
-ExecStart=/usr/sbin/chronyd $DAEMON_OPTS
+# Starter takes care of special cases mostly for containers
+ExecStart=/usr/lib/systemd/scripts/chronyd-starter.sh $DAEMON_OPTS
 ExecStartPost=-/usr/lib/chrony/chrony-helper update-daemon
 PrivateTmp=yes
 ProtectHome=yes
diff --git a/debian/chronyd-starter.sh b/debian/chronyd-starter.sh
 new file mode 100755
index 0000000..c175db5
--- /dev/null
+++ b/debian/chronyd-starter.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+set -ue
+
+CONF="/etc/default/chrony"
+DOC="/usr/share/doc/chrony/README.container"
+CAP="cap_sys_time"
+CMD="/usr/sbin/chronyd"
+# Take any args passed, use none if nothing was specified
+EFFECTIVE_DAEMON_OPTS=${@:-""}
+
+if [ -f "${CONF}" ]; then
+    . "${CONF}"
+else
+    echo "<4>Warning: ${CONF} is missing"
+fi
+# take from conffile if available, default to no otherwise
+EFFECTIVE_SYNC_IN_CONTAINER=${SYNC_IN_CONTAINER:-"no"}
+
+if [ ! -x "${CMD}" ]; then
+    echo "<3>Error: ${CMD} not executable"
+    # ugly, but works around https://github.com/systemd/systemd/issues/2913
+    sleep 0.1
+    exit 1
+fi
+
+# Check if -x is already set manually, don't process further if that is the case
+X_SET=0
+while getopts ":x" opt; do
+    case $opt in
+        x)
+            X_SET=1
+            ;;
+    esac
+done
+
+if [ ${X_SET} -ne 1 ]; then
+  # Assume it is not in a container
+  IS_CONTAINER=0
+  if [ -x /usr/bin/systemd-detect-virt ]; then
+      if /usr/bin/systemd-detect-virt --quiet --container; then
+          IS_CONTAINER=1
+      fi
+  fi
+
+
+  # Assume it has the cap
+  HAS_CAP=1
+  CAPSH="/sbin/capsh"
+  if [ -x "${CAPSH}" ]; then
+      ${CAPSH} --print | grep -q "^Current.*${CAP}" || HAS_CAP=0
+  fi
+
+  if [ ${HAS_CAP} -eq 0 ]; then
+      echo "<4>Warning: Missing ${CAP}, syncing the system clock will fail"
+  fi
+  if [ ${IS_CONTAINER} -eq 1 ]; then
+      echo "<4>Warning: Running in a container, likely impossible and unintended to sync system clock"
+  fi
+
+  if [ ${HAS_CAP} -eq 0 -o ${IS_CONTAINER} -eq 1 ]; then
+      if [ "${EFFECTIVE_SYNC_IN_CONTAINER}" != "yes" ]; then
+          echo "<5>Adding -x as fallback disabling control of the system clock, see ${DOC} to override this behavior"
+          EFFECTIVE_DAEMON_OPTS="${EFFECTIVE_DAEMON_OPTS} -x"
+      else
+          echo "<5>Not falling back to disable control of the system clock, see ${DOC} to change this behavior"
+      fi
+  fi
+fi
+
+${CMD} ${EFFECTIVE_DAEMON_OPTS}
diff --git a/debian/control b/debian/control
index a35df2d..c740cc9 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: chrony
 Section: net
 Priority: optional
-Maintainer: Vincent Blut <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Vincent Blut <[e-mail]>
 Uploaders: Joachim Wiedorn <[e-mail]>
 Standards-Version: 4.2.1
 Build-Depends: asciidoctor (>= 1.5.3-1~),
@@ -24,9 +25,11 @@ Architecture: linux-any
 Depends: adduser,
          iproute2 [linux-any],
          lsb-base,
+         libcap2-bin,
          ucf,
          ${misc:Depends},
          ${shlibs:Depends}
+Recommends: networkd-dispatcher (>= 1.7-0ubuntu3)
 Suggests: dnsutils
 Conflicts: ntp,
            time-daemon
diff --git a/debian/docs b/debian/docs
index e12f653..3bfc9dc 100644
--- a/debian/docs
+++ b/debian/docs
@@ -1,3 +1,4 @@
 FAQ
 NEWS
 README
+debian/README.container
diff --git a/debian/install b/debian/install
index db2e305..abaa2f3 100644
--- a/debian/install
+++ b/debian/install
@@ -2,3 +2,4 @@ debian/chrony-dnssrv@.* lib/systemd/system
 debian/chrony-helper usr/lib/chrony
 debian/chrony.conf usr/share/chrony
 debian/usr.sbin.chronyd etc/apparmor.d
+debian/chronyd-starter.sh usr/lib/systemd/scripts/
diff --git a/debian/links b/debian/links
 new file mode 100644
index 0000000..71e2c52
--- /dev/null
+++ b/debian/links
@@ -0,0 +1,5 @@
+# Update sources in response to systemd-networkd events (LP: #1718227).
+# This is reusing the NetworkManager dispatch script which has no hard
+# dependency to NetworkManager (not using any of its arguments)
+etc/NetworkManager/dispatcher.d/20-chrony usr/lib/networkd-dispatcher/routable.d/chrony
+etc/NetworkManager/dispatcher.d/20-chrony usr/lib/networkd-dispatcher/off.d/chrony
diff --git a/debian/postrm b/debian/postrm
index ed3bac1..a5fd9ba 100644
--- a/debian/postrm
+++ b/debian/postrm
@@ -7,6 +7,15 @@ set -e
 
 # targets: purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear
 
+restore_timesyncd() {
+    # on next reboot it would start, but that would leave time
+    # unsynchronized until then. So as the Conflicts in the service file kill
+    # systemd-timesyncd re-establish it if it is enabled
+    if [ "$(systemctl is-enabled systemd-timesyncd 2>/dev/null)" = "enabled" ] ; then
+        deb-systemd-invoke start systemd-timesyncd
+    fi
+}
+
 case "$1" in
     purge)
         rm -f /var/lib/chrony/*
@@ -30,9 +39,15 @@ case "$1" in
         then
             deluser --quiet --system _chrony > /dev/null 2>&1 || true
         fi
+
+        restore_timesyncd
+    ;;
+
+    remove)
+        restore_timesyncd
     ;;
 
-    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
 
     ;;