Merge ~paelzer/ubuntu/+source/chrony:fix-slow-init-bionic into ubuntu/+source/chrony:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Trivial single patch backport from upstream in preparation of newer kernels.
4.17 should have been the one bringing the random changes, if not they will hit sooner or later.
Please follow the liks from the Bug Description for some background on this.

Note: added a ~ubuntu-security review slot for the potential drawback of the lower quality bits which might in theory make it easier to spoof replies.

Bug: https://bugs.launchpad.net/ubuntu/+source/chrony/+bug/1787366
PPA for Testing: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3361

This was acked from a security POV in https://code.launchpad.net/~paelzer/ubuntu/+source/chrony/+git/chrony/+merge/353232 and now just needs packaging review to make sure we didn't miss something on making this available for Bionic.

[Christian Ehrhardt  (paelzer)]

Tests on Bionic passed as well: https://bileto.ubuntu.com/excuses/3361/bionic.html

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/chrony
 * [new tag] upload/3.2-4ubuntu4.2 -> upload/3.2-4ubuntu4.2

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading chrony_3.2-4ubuntu4.2.dsc: done.
  Uploading chrony_3.2-4ubuntu4.2.debian.tar.xz: done.
  Uploading chrony_3.2-4ubuntu4.2_source.buildinfo: done.
  Uploading chrony_3.2-4ubuntu4.2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index cfa85ad..7e2efd8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+chrony (3.2-4ubuntu4.2) bionic; urgency=medium
+
+  * d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+    the service on newer kernels by falling back to urandom.
+    (LP: #1787366, Closes: #906276)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 20 Aug 2018 11:36:18 +0200
+
 chrony (3.2-4ubuntu4.1) bionic; urgency=medium
 
   * debian/usr.sbin.chronyd:
diff --git a/debian/patches/lp-1787366-fall-back-to-urandom.patch b/debian/patches/lp-1787366-fall-back-to-urandom.patch
new file mode 100644
index 0000000..48585f8
--- /dev/null
+++ b/debian/patches/lp-1787366-fall-back-to-urandom.patch
@@ -0,0 +1,42 @@
+From 7c5bd948bb7e21fa0ee22f29e97748b2d0360319 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <[e-mail]>
+Date: Thu, 17 May 2018 14:16:58 +0200
+Subject: [PATCH] util: fall back to reading /dev/urandom when getrandom()
+ blocks
+
+With recent changes in the Linux kernel, the getrandom() system call may
+block for a long time after boot on machines that don't have enough
+entropy. It blocks the chronyd's initialization before it can detach
+from the terminal and may cause a chronyd service to fail to start due
+to a timeout.
+
+At least for now, enable the GRND_NONBLOCK flag to make the system call
+non-blocking and let the code fall back to reading /dev/urandom (which
+never blocks) if the system call failed with EAGAIN or any other error.
+
+This makes the start of chronyd non-deterministic with respect to files
+that it needs to open and possibly also makes it slightly easier to
+guess the transmit/receive timestamp in client requests until the
+urandom source is fully initialized.
+
+Author: Christian Ehrhardt <[e-mail]>
+Original-Author: Miroslav Lichvar <[e-mail]>
+Origin: backport, https://git.tuxfamily.org/chrony/chrony.git/commit/?id=7c5bd948bb7e21fa0ee22f29e97748b2d0360319
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1787366
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906276
+Last-Update: 2018-08-16
+---
+ util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/util.c
++++ b/util.c
+@@ -1224,7 +1224,7 @@ get_random_bytes_getrandom(char *buf, un
+       if (disabled)
+         break;
+ 
+-      if (getrandom(rand_buf, sizeof (rand_buf), 0) != sizeof (rand_buf)) {
++      if (getrandom(rand_buf, sizeof (rand_buf), GRND_NONBLOCK) != sizeof (rand_buf)) {
+         disabled = 1;
+         break;
+       }
diff --git a/debian/patches/series b/debian/patches/series
index 947a7d5..872c0b2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 lp1589780-sys_linux-don-t-keep-CAP_SYS_TIME-with-x-option.patch
 lp-1718227-ignore-non-up-down-events-in-nm-dispatcher.patch
 lp-1718227-nm-dispatcher-for-networkd.patch
+lp-1787366-fall-back-to-urandom.patch