Merge ~paelzer/ubuntu/+source/chrony:ubuntu/cosmic-devel into ubuntu/+source/chrony:ubuntu/cosmic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Trivial single patch backport from upstream in preparation of newer kernels.
4.17 should have been the one bringing the random changes, if not they will hit sooner or later.
Please follow the liks from the Bug Description for some background on this.

Note: added a ~ubuntu-security review slot for the potential drawback of the lower quality bits which might in theory make it easier to spoof replies.

Bug: https://bugs.launchpad.net/ubuntu/+source/chrony/+bug/1787366
PPA for Testing: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3359

[Seth Arnold (seth-arnold)]

I don't love it but I understand it. Thanks!

review: Approve

[Andreas Hasenack (ahasenack)]

+1

Please also mention that this closes debian bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906276

(dep3 header, d/changelog with Closes: #)

review: Approve

[Christian Ehrhardt  (paelzer)]

Hey the bug was reported AFTER I created this (well minutes) - so I had to forget about it.
Thanks for both of your acks.

The Debian changes are identical to ours, plus a few packaging buffs.
This means we can surely drop this Delta on the next merge.

But since we already tested the here proposed version I'd go on with the fix as proposed here and NOT merge the latest Debian right now for the packaging cleanups (while the changes should be a no-op Murphy is everywhere and FF close - this will be fine later on).

[Christian Ehrhardt  (paelzer)]

Tag pushed and uploaded to Cosmic

diff --git a/debian/changelog b/debian/changelog
index 46a8195..21fcea8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+chrony (3.3-2ubuntu2) cosmic; urgency=medium
+
+  * - d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+      the service on newer kernels by falling back to urandom (LP: #1787366)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 16 Aug 2018 11:48:38 +0200
+
 chrony (3.3-2ubuntu1) cosmic; urgency=medium
 
   * Merge with Debian unstable (LP: #1771061). Remaining changes:
diff --git a/debian/patches/lp-1787366-fall-back-to-urandom.patch b/debian/patches/lp-1787366-fall-back-to-urandom.patch
new file mode 100644
index 0000000..d7e687a
--- /dev/null
+++ b/debian/patches/lp-1787366-fall-back-to-urandom.patch
@@ -0,0 +1,41 @@
+From 7c5bd948bb7e21fa0ee22f29e97748b2d0360319 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <[e-mail]>
+Date: Thu, 17 May 2018 14:16:58 +0200
+Subject: [PATCH] util: fall back to reading /dev/urandom when getrandom()
+ blocks
+
+With recent changes in the Linux kernel, the getrandom() system call may
+block for a long time after boot on machines that don't have enough
+entropy. It blocks the chronyd's initialization before it can detach
+from the terminal and may cause a chronyd service to fail to start due
+to a timeout.
+
+At least for now, enable the GRND_NONBLOCK flag to make the system call
+non-blocking and let the code fall back to reading /dev/urandom (which
+never blocks) if the system call failed with EAGAIN or any other error.
+
+This makes the start of chronyd non-deterministic with respect to files
+that it needs to open and possibly also makes it slightly easier to
+guess the transmit/receive timestamp in client requests until the
+urandom source is fully initialized.
+
+Author: Christian Ehrhardt <[e-mail]>
+Original-Author: Miroslav Lichvar <[e-mail]>
+Origin: backport, https://git.tuxfamily.org/chrony/chrony.git/commit/?id=7c5bd948bb7e21fa0ee22f29e97748b2d0360319
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1787366
+Last-Update: 2018-08-16
+---
+ util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/util.c
++++ b/util.c
+@@ -1224,7 +1224,7 @@ get_random_bytes_getrandom(char *buf, un
+       if (disabled)
+         break;
+ 
+-      if (getrandom(rand_buf, sizeof (rand_buf), 0) != sizeof (rand_buf)) {
++      if (getrandom(rand_buf, sizeof (rand_buf), GRND_NONBLOCK) != sizeof (rand_buf)) {
+         disabled = 1;
+         break;
+       }
diff --git a/debian/patches/series b/debian/patches/series
index 21d48ce..425fb09 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 lp-1718227-nm-dispatcher-for-networkd.patch
+lp-1787366-fall-back-to-urandom.patch