Merge ~paelzer/ubuntu/+source/chrony:merge-eoan-3.4-4 into ubuntu/+source/chrony:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~paelzer/+archive/ubuntu/merge-chrony-eoan-3.4-4

Replacing ours delta for networkd-dispatcher:
8f52063b d/control: Suggest networkd-dispatcher
=> We had used Recommends, but I think we can also work with a suggests as it is a rare case to even be a problem.
18fde15f Update sources in response to systemd-networkd events (LP: #1718227).
=> Taken from us as-is

We can drop those this time.

Minor typo in SYNC_IN_CONTAINER comment fixed.

[Christian Ehrhardt  (paelzer)]

Usual tags for review:
 * [new tag] lp1828992/logical/3.4-1ubuntu1 -> lp1828992/logical/3.4-1ubuntu1
 * [new tag] lp1828992/new/debian -> lp1828992/new/debian
 * [new tag] lp1828992/old/debian -> lp1828992/old/debian
 * [new tag] lp1828992/old/ubuntu -> lp1828992/old/ubuntu
 * [new tag] lp1828992/reconstruct/3.4-1ubuntu1 -> lp1828992/reconstruct/3.4-1ubuntu1
 * [new tag] lp1828992/split/3.4-1ubuntu1 -> lp1828992/split/3.4-1ubuntu1

[Christian Ehrhardt  (paelzer)]

Fixed the install/remove/install issue in the MP

[Christian Ehrhardt  (paelzer)]

FYI: Debian compatible delta submitted in https://salsa.debian.org/debian/chrony/merge_requests/1

[Andreas Hasenack (ahasenack)]

Do we expect trouble with the "Enable the system call filter by default" change? The NEWS file mentions the daemon won't be able to email anymore.

review: Needs Information

[Andreas Hasenack (ahasenack)]

Delta changes accounted for
d/changelog correct
closing merge bug
other debian changes don't seem to interact badly with our delta

Just the earlier question about the emailing, if we want to keep that, or maybe detect that it is being used in the chrony config and warn the user perhaps, or even switch the syscall filter off.

[Christian Ehrhardt  (paelzer)]

I thought it is a nice change for security, the potential issue with mail-on-change is known.

The suggestion of an auto-catch is interesting.
We'd only do so on the version switch this is at not anymore later.
So it is not relevant for Debian as they already have this in the archive.
We OTOH could drop it post 20.04 so it would be no very long standing delta.

And isn't the lesson learned that modifying conffiles (chrony.conf and default/chrony are conffiles - from the postinst is always error prone.

And if we only want to detect+warn since changing is often worse than doing nothing then we are right at the same place as we are with the NEWS file already (which is shown to the user if he cares).

After the following:
 61 # We change a TMP file to leave non conffiles unmodified, but also UCF working
 62 tmp=$(mktemp)
 63 cp /usr/share/chrony/chrony.conf "$tmp"
 64 if [ -n "$2" ] && dpkg --compare-versions "$2" lt "3.4-4ubuntu1"; then
 65 if grep -q '^ *mailonchange' /etc/chrony/chrony.conf
 66 # TODO also need md5 check like mailman-2.1.16/debian/postinst
 67 echo "Warning: mailonchange configured, not enabling seccomp filter'" >&2
 68 if ! sed -e 's/^DAEMON_OPTS="-F -1"/DAEMON_OPTS="-F -0"/' debian/chrony.default
 69 echo "Warning: Failed disabling seccomp filter, please see NEWS file'" >&2
 70 fi
 71 fi
 72 fi

I gave up and decided it might be too much complexity for too rare of a case and potentially more harm than gain.

TL;DR: no lets keep the seccomp/mailonchange as it comes from Debian

[Andreas Hasenack (ahasenack)]

ok, +1

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks you - tag pushed and uploaded to Eoan

[Christian Ehrhardt  (paelzer)]

This migrated -> merged

diff --git a/debian/README.container b/debian/README.container
new file mode 100644
index 0000000..16f2618
--- /dev/null
+++ b/debian/README.container
@@ -0,0 +1,60 @@
+Chrony in Containers
+--------------------
+
+Currently in in 99.9+% of the cases syncing the local clock in a container
+is wrong. Most of the time it will be unable to do so, because it is lacking
+CAP_SYS_TIME. Or worse, if the CAP_SYS_TIME privilege is granted, multiple
+containers could fight over the system's time, because the Linux kernel does
+not provide time namespaces (yet).
+
+There are two things a user installing chrony usually wants:
+1. synchronize my time (NTP client)
+2. serve NTP (NTP server)
+
+In a container the first makes (usually) no sense, so by default we enable -x
+there (as it would only crash otherwise).
+This will disable the control of the system clock.
+See `man chronyd` for more details on the -x option.
+
+Formerly, the check for Condition=CAP_SYS_TIME in the systemd service avoided
+the crash of the NTP client portion, but that means the server use case will
+not work by default in containers. It is still not recommended to use a
+container as an NTP server, but if the host clock is synchronised via NTP,
+adding the -x option to chronyd instances running in containers will allow
+them to function as NTP servers which do not adjust the system clock.
+The Condition=CAP_SYS_TIME check was a silent, no-log-entry stealing away
+leaving users often unclear what happened - especially if they were more after
+the NTP server than the NTP client.
+
+One could argue that someone who installs chrony expects the system time to be
+synchronised, so it should fail if it is not able to do so.  On the other hand
+it could be argued that someone who installs chrony expects time to be served
+over the network via NTP.
+We can't know which expectation is applicable, so we assume that time should
+be synchronised unless chronyd is running in a container (or is without
+CAP_SYS_TIME in any other environment).
+
+To make things worse recent container implementations will offer CAP_SYS_TIME
+to the container. Since from the container's point of view, this capability is
+available for the container's user namespace. Just later on adjtimex and similar
+are actually evaluated against the host kernel where they will fail. Due to
+that without further precaution running chrony in Ubuntu in the future will
+likely have the service start (as Condition=CAP_SYS_TIME will be true) but
+then immediately fail.
+This will depend on the environment e.g. versions and types of containers and
+thereby feel just 'unreliable' from users point of view.
+Furthermore it will affect upgrades as the service has to be restarted for a
+package upgrade to be considered complete.
+
+Due to all of that Ubuntu decided (LP: #1589780) to default to -x (do not
+set the system clock) in containers.
+
+If one really wants to (try to) sync time in a container or CAP_SYS_TIME-less
+environment set SYNC_IN_CONTAINER="yes" in /etc/default/chrony to disable
+this special handling.
+
+It is important to mention that as soon as upstream provides a way to provide
+a default config working in those cases Ubuntu intends to use that and drop
+the current workaround.
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Mar 2018 12:25:44 +0100
diff --git a/debian/changelog b/debian/changelog
index 8f8c9a4..f3070be 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,45 @@
+chrony (3.4-4ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable (LP: #1828992). Remaining changes:
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664 1754358)
+    - Set -x as default if unable to set time (e.g. in containers) (LP 1589780)
+      Chrony is a single service which acts as both NTP client (i.e. syncing the
+      local clock) and NTP server (i.e. providing NTP services to the network),
+      and that is both desired and expected in the vast majority of cases.
+      But in containers syncing the local clock is usually impossible, but this
+      shall not break the providing of NTP services to the network.
+      To some extent this makes chrony's default config more similar to 'ntpd',
+      which complained in syslog but still provided NTP server service in those
+      cases.
+      + debian/chrony.service: allow the service to run without CAP_SYS_TIME
+      + debian/control: add new dependency libcap2-bin for capsh (usually
+        installed anyway, but make them explicit to be sure).
+      + debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+        (Default off) [fixed a minor typo in the comment in this update]
+      + debian/chronyd-starter.sh: wrapper to handle special cases in containers
+        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+        containers on a default installation and avoid failing to sync time (or
+        if allowed to sync, avoid multiple containers to fight over it by
+        accident).
+      + debian/install: make chrony-starter.sh available on install.
+      + debian/docs, debian/README.container: provide documentation about the
+        handling of this case.
+    - d/postrm: re-establish systemd-timesyncd on removal (LP 1764357)
+    - d/postrm: respect policy-rc.d when restoring systemd-timesyncd
+      (LP 1771994)
+  * Added Changes:
+    - removed d/init to avoid weird interactions between sysV and systemd
+  * Dropped Changes:
+    - Notify chrony to update sources in response to systemd-networkd
+      events (LP: 1718227)
+      + d/links: link dispatcher script to networkd-dispatcher events routable
+        and off
+      + d/control: set Recommends to networkd-dispatcher
+      [Those are in Debian, except that we agreed to have networkd-dispatcher
+       to only be a Suggests]
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 14 May 2019 12:49:30 +0200
+
 chrony (3.4-4) unstable; urgency=medium
 
   * debian/patches/*:
@@ -74,6 +116,48 @@ chrony (3.4-2) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Wed, 13 Feb 2019 17:08:17 +0100
 
+chrony (3.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1802886). Remaining changes:
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+    - Set -x as default if unable to set time (e.g. in containers) (LP: 1589780)
+      Chrony is a single service which acts as both NTP client (i.e. syncing the
+      local clock) and NTP server (i.e. providing NTP services to the network),
+      and that is both desired and expected in the vast majority of cases.
+      But in containers syncing the local clock is usually impossible, but this
+      shall not break the providing of NTP services to the network.
+      To some extent this makes chrony's default config more similar to 'ntpd',
+      which complained in syslog but still provided NTP server service in those
+      cases.
+      + debian/chrony.service: allow the service to run without CAP_SYS_TIME
+      + debian/control: add new dependency libcap2-bin for capsh (usually
+        installed anyway, but make them explicit to be sure).
+      + debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+        (Default off).
+      + debian/chronyd-starter.sh: wrapper to handle special cases in containers
+        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+        containers on a default installation and avoid failing to sync time (or
+        if allowed to sync, avoid multiple containers to fight over it by
+        accident).
+      + debian/install: make chronyd-starter.sh available on install.
+      + debian/docs, debian/README.container: provide documentation about the
+        handling of this case.
+    - d/postrm: re-establish systemd-timesyncd on removal (LP: 1764357)
+    - Notify chrony to update sources in response to systemd-networkd
+      events (LP: 1718227)
+      + d/links: link dispatcher script to networkd-dispatcher events routable
+        and off
+      + d/control: set Recommends to networkd-dispatcher
+  * Dropped Changes (upstream):
+    - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+    - d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+      the service on newer kernels by falling back to urandom. (LP: 1787366)
+  * Added Changes:
+    - d/postrm: respect policy-rc.d when restoring systemd-timesyncd
+      (LP: #1771994)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 12 Nov 2018 11:39:08 +0100
+
 chrony (3.4-1) unstable; urgency=medium
 
   * Import upstream version 3.4:
@@ -150,6 +234,66 @@ chrony (3.3-3) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Sat, 18 Aug 2018 16:23:19 +0200
 
+chrony (3.3-2ubuntu2) cosmic; urgency=medium
+
+  * - d/p/lp-1787366-fall-back-to-urandom.patch: avoid hangs when starting
+      the service on newer kernels by falling back to urandom.
+      (LP: #1787366, Closes: #906276)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 16 Aug 2018 11:48:38 +0200
+
+chrony (3.3-2ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1771061). Remaining changes:
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+    - Set -x as default if unable to set time (e.g. in containers) (LP: 1589780)
+      Chrony is a single service which acts as both NTP client (i.e. syncing the
+      local clock) and NTP server (i.e. providing NTP services to the network),
+      and that is both desired and expected in the vast majority of cases.
+      But in containers syncing the local clock is usually impossible, but this
+      shall not break the providing of NTP services to the network.
+      To some extent this makes chrony's default config more similar to 'ntpd',
+      which complained in syslog but still provided NTP server service in those
+      cases.
+      - debian/chrony.service: allow the service to run without CAP_SYS_TIME
+      - debian/control: add new dependency libcap2-bin for capsh (usually
+        installed anyway, but make them explicit to be sure).
+      - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+        (Default off).
+      - debian/chronyd-starter.sh: wrapper to handle special cases in containers
+        and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+        containers on a default installation and avoid failing to sync time (or
+        if allowed to sync, avoid multiple containers to fight over it by
+        accident).
+      - debian/install: make chronyd-starter.sh available on install.
+      - debian/docs, debian/README.container: provide documentation about the
+        handling of this case.
+    - d/postrm: re-establish systemd-timesyncd on removal (LP: 1764357)
+    - Notify chrony to update sources in response to systemd-networkd
+      events (LP: 1718227)
+      - d/links: link dispatcher script to networkd-dispatcher events routable
+        and off
+      - d/control: set Recommends to networkd-dispatcher
+      - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+  * Dropped changes
+    - debian/usr.sbin.chronyd: ensure RTC/GPS usage isn't blocked by apparmor
+      (LP: 1751241) (in Debian now)
+    - debian/usr.sbin.chronyd: add cap net_admin for hwtimestamp (LP: 1761327)
+      (in Debian now)
+    - d/p/lp1589780-sys_linux-don-t-keep-CAP_SYS_TIME-with-x-option.patch:
+      When dropping the root privileges, don't try to keep the CAP_SYS_TIME
+      capability if the -x option was enabled. This allows chronyd to be
+      started without the capability (e.g. in containers) and also drop the
+      root privileges (This is upstream now).
+    - d/p/lp-1718227-ignore-non-up-down-events-in-nm-dispatcher.patch (This is
+      upstream now).
+    - d/control: switch to nss instead of tomcrypt (Debian switched to nettle
+      which is in main, so we can drop this)
+  * Added changes
+    - debian/README.container: fix typos
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 14 May 2018 09:06:01 +0200
+
 chrony (3.3-2) unstable; urgency=medium
 
   * debian/chrony.service:
@@ -205,6 +349,76 @@ chrony (3.2-5) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Wed, 28 Feb 2018 17:31:08 +0100
 
+chrony (3.2-4ubuntu4) bionic; urgency=medium
+
+  * d/postrm: re-establish systemd-timesyncd on removal (LP: #1764357)
+  * Notify chrony to update sources in response to systemd-networkd
+    events (LP: #1718227)
+    - d/links: link dispatcher script to networkd-dispatcher events routable
+      and off
+    - d/control: set Recommends to networkd-dispatcher
+    - d/p/lp-1718227-ignore-non-up-down-events-in-nm-dispatcher.patch
+    - d/p/lp-1718227-nm-dispatcher-for-networkd.patch
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 16 Apr 2018 17:04:06 +0200
+
+chrony (3.2-4ubuntu3) bionic; urgency=medium
+
+  * debian/usr.sbin.chronyd: add cap net_admin for hwtimestamp (LP: #1761327)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 05 Apr 2018 09:38:10 +0200
+
+chrony (3.2-4ubuntu2) bionic; urgency=medium
+
+  * Set -x as default if unable to set time (e.g. in containers) (LP: #1589780)
+    Chrony is a single service which acts as both NTP client (i.e. syncing the
+    local clock) and NTP server (i.e. providing NTP services to the network),
+    and that is both desired and expected in the vast majority of cases.
+    But in containers syncing the local clock is usually impossible, but this
+    shall not break the providing of NTP services to the network.
+    To some extent this makes chrony's default config more similar to 'ntpd',
+    which complained in syslog but still provided NTP server service in those
+    cases.
+    - d/p/lp1589780-sys_linux-don-t-keep-CAP_SYS_TIME-with-x-option.patch:
+      When dropping the root privileges, don't try to keep the CAP_SYS_TIME
+      capability if the -x option was enabled. This allows chronyd to be
+      started without the capability (e.g. in containers) and also drop the
+      root privileges.
+    - debian/chrony.service: allow the service to run without CAP_SYS_TIME
+    - debian/control: add new dependency libcap2-bin for capsh (usually
+      installed anyway, but make them explicit to be sure).
+    - debian/chrony.default: new option SYNC_IN_CONTAINER to not fall back
+      (Default off).
+    - debian/chronyd-starter.sh: wrapper to handle special cases in containers
+      and if CAP_SYS_TIME is missing. Effectively allows to run NTP server in
+      containers on a default installation and avoid failing to sync time (or
+      if allowed to sync, avoid multiple containers to fight over it by
+      accident).
+    - debian/install: make chronyd-starter.sh available on install.
+    - debian/docs, debian/README.container: provide documentation about the
+      handling of this case.
+  * debian/chrony.conf: update default chrony.conf to not violate the policy
+    of pool.ntp.org (to use no more than four of their servers) and to provide
+    more ipv6 capable sources by default (LP: #1754358)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Mar 2018 12:25:44 +0100
+
+chrony (3.2-4ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control: switch to nss instead of tomcrypt (nss is in main)
+    - d/chrony.conf: use ubuntu ntp pool and server (LP 1744664)
+  * Dropped changes (in Debian)
+    - d/chrony.default, d/chrony.service: support /etc/default/chrony
+      DAEMON_OPTS in systemd environment (LP: 1746081)
+    - d/chrony.service: properly start after networking (LP: 1746458)
+    - d/usr.sbin.chronyd: allow to create /run/chrony on demand (LP: 1746444)
+  * Added Changes:
+    - debian/usr.sbin.chronyd: ensure RTC/GPS usage isn't blocked by apparmor
+      (LP: #1751241, Closes: #891201)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 26 Feb 2018 14:44:54 +0100
+
 chrony (3.2-4) unstable; urgency=medium
 
   * debian/changelog:
@@ -271,6 +485,27 @@ chrony (3.2-3) unstable; urgency=medium
 
  -- Vincent Blut <[e-mail]>  Wed, 07 Feb 2018 21:27:09 +0100
 
+chrony (3.2-2ubuntu3) bionic; urgency=medium
+
+  * Revert the changes of (LP 1746458) as in the follow on discussion
+    it became clear that we want it to start early (for example for an
+    early offset from drift file). iIf needed chrony will later on pick
+    up that servers are online via retries (augmented by hooks on network
+    events).
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 08 Feb 2018 10:52:30 +0100
+
+chrony (3.2-2ubuntu2) bionic; urgency=medium
+
+  * d/control: use to nss instead of tomcrypt (in main) (LP: #1744072)
+  * d/chrony.conf: use ubuntu ntp pool and server (LP: #1744664)
+  * d/chrony.default, d/chrony.service: support /etc/default/chrony
+    DAEMON_OPTS in systemd environment (LP: #1746081)
+  * d/chrony.service: properly start after networking (LP: #1746458)
+  * d/usr.sbin.chronyd: allow to create /run/chrony on demand (LP: #1746444)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 19 Jan 2018 09:45:38 +0100
+
 chrony (3.2-2) unstable; urgency=medium
 
   * Initial AppArmor profile for chronyd. Thanks to Jamie
diff --git a/debian/chrony.conf b/debian/chrony.conf
index 6c19767..d5a0b37 100644
--- a/debian/chrony.conf
+++ b/debian/chrony.conf
@@ -1,6 +1,23 @@
 # Welcome to the chrony configuration file. See chrony.conf(5) for more
 # information about usuable directives.
-pool 2.debian.pool.ntp.org iburst
+
+# This will use (up to):
+# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
+# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
+# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
+# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
+# sources will be used.
+# At the same time it retains some protection against one of the entries being
+# down (compare to just using one of the lines). See (LP: #1754358) for the
+# discussion.
+#
+# About using servers from the NTP Pool Project in general see (LP: #104525).
+# Approved by Ubuntu Technical Board on 2011-02-08.
+# See http://www.pool.ntp.org/join.html for more information.
+pool ntp.ubuntu.com        iburst maxsources 4
+pool 0.ubuntu.pool.ntp.org iburst maxsources 1
+pool 1.ubuntu.pool.ntp.org iburst maxsources 1
+pool 2.ubuntu.pool.ntp.org iburst maxsources 2
 
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
diff --git a/debian/chrony.default b/debian/chrony.default
index eead3e6..5391fc4 100644
--- a/debian/chrony.default
+++ b/debian/chrony.default
@@ -4,3 +4,7 @@
 
 # Options to pass to chrony.
 DAEMON_OPTS="-F -1"
+
+# Sync system clock in containers or without CAP_SYS_TIME (likely to fail)
+# See /usr/share/doc/chrony/README.container for details.
+SYNC_IN_CONTAINER="no"
diff --git a/debian/chrony.service b/debian/chrony.service
index 3e4451a..bb01a79 100644
--- a/debian/chrony.service
+++ b/debian/chrony.service
@@ -3,13 +3,13 @@ Description=chrony, an NTP client/server
 Documentation=man:chronyd(8) man:chronyc(1) man:chrony.conf(5)
 Conflicts=systemd-timesyncd.service openntpd.service ntp.service ntpsec.service
 After=network.target
-ConditionCapability=CAP_SYS_TIME
 
 [Service]
 Type=forking
 PIDFile=/run/chronyd.pid
 EnvironmentFile=-/etc/default/chrony
-ExecStart=/usr/sbin/chronyd $DAEMON_OPTS
+# Starter takes care of special cases mostly for containers
+ExecStart=/usr/lib/systemd/scripts/chronyd-starter.sh $DAEMON_OPTS
 ExecStartPost=-/usr/lib/chrony/chrony-helper update-daemon
 PrivateTmp=yes
 ProtectHome=yes
diff --git a/debian/chronyd-starter.sh b/debian/chronyd-starter.sh
new file mode 100755
index 0000000..c175db5
--- /dev/null
+++ b/debian/chronyd-starter.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+set -ue
+
+CONF="/etc/default/chrony"
+DOC="/usr/share/doc/chrony/README.container"
+CAP="cap_sys_time"
+CMD="/usr/sbin/chronyd"
+# Take any args passed, use none if nothing was specified
+EFFECTIVE_DAEMON_OPTS=${@:-""}
+
+if [ -f "${CONF}" ]; then
+    . "${CONF}"
+else
+    echo "<4>Warning: ${CONF} is missing"
+fi
+# take from conffile if available, default to no otherwise
+EFFECTIVE_SYNC_IN_CONTAINER=${SYNC_IN_CONTAINER:-"no"}
+
+if [ ! -x "${CMD}" ]; then
+    echo "<3>Error: ${CMD} not executable"
+    # ugly, but works around https://github.com/systemd/systemd/issues/2913
+    sleep 0.1
+    exit 1
+fi
+
+# Check if -x is already set manually, don't process further if that is the case
+X_SET=0
+while getopts ":x" opt; do
+    case $opt in
+        x)
+            X_SET=1
+            ;;
+    esac
+done
+
+if [ ${X_SET} -ne 1 ]; then
+  # Assume it is not in a container
+  IS_CONTAINER=0
+  if [ -x /usr/bin/systemd-detect-virt ]; then
+      if /usr/bin/systemd-detect-virt --quiet --container; then
+          IS_CONTAINER=1
+      fi
+  fi
+
+
+  # Assume it has the cap
+  HAS_CAP=1
+  CAPSH="/sbin/capsh"
+  if [ -x "${CAPSH}" ]; then
+      ${CAPSH} --print | grep -q "^Current.*${CAP}" || HAS_CAP=0
+  fi
+
+  if [ ${HAS_CAP} -eq 0 ]; then
+      echo "<4>Warning: Missing ${CAP}, syncing the system clock will fail"
+  fi
+  if [ ${IS_CONTAINER} -eq 1 ]; then
+      echo "<4>Warning: Running in a container, likely impossible and unintended to sync system clock"
+  fi
+
+  if [ ${HAS_CAP} -eq 0 -o ${IS_CONTAINER} -eq 1 ]; then
+      if [ "${EFFECTIVE_SYNC_IN_CONTAINER}" != "yes" ]; then
+          echo "<5>Adding -x as fallback disabling control of the system clock, see ${DOC} to override this behavior"
+          EFFECTIVE_DAEMON_OPTS="${EFFECTIVE_DAEMON_OPTS} -x"
+      else
+          echo "<5>Not falling back to disable control of the system clock, see ${DOC} to change this behavior"
+      fi
+  fi
+fi
+
+${CMD} ${EFFECTIVE_DAEMON_OPTS}
diff --git a/debian/control b/debian/control
index 54c4ccc..c552ce7 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: chrony
 Section: net
 Priority: optional
-Maintainer: Vincent Blut <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Vincent Blut <[e-mail]>
 Uploaders: Joachim Wiedorn <[e-mail]>
 Standards-Version: 4.3.0
 Build-Depends: asciidoctor (>= 1.5.3-1~),
@@ -25,6 +26,7 @@ Pre-Depends: ${misc:Pre-Depends}
 Depends: adduser,
          iproute2 [linux-any],
          lsb-base,
+         libcap2-bin,
          ucf,
          ${misc:Depends},
          ${shlibs:Depends}
diff --git a/debian/docs b/debian/docs
index e12f653..3bfc9dc 100644
--- a/debian/docs
+++ b/debian/docs
@@ -1,3 +1,4 @@
 FAQ
 NEWS
 README
+debian/README.container
diff --git a/debian/init b/debian/init
deleted file mode 100644
index bc376b5..0000000
--- a/debian/init
+++ /dev/null
@@ -1,73 +0,0 @@
-#! /bin/sh
-#
-# Written by Miquel van Smoorenburg <[e-mail]>.
-# Modified for Debian GNU/Linux by Ian Murdock <[e-mail]>.
-# Modified for Debian by Christoph Lameter <[e-mail]>
-# Modified for chrony by John Hasler <[e-mail]> 1998-2012
-# Modified for Debian by Vincent Blut <[e-mail]>
-
-### BEGIN INIT INFO
-# Provides:          chrony
-# Required-Start:    $remote_fs
-# Required-Stop:     $remote_fs
-# Should-Start:      $syslog $network $named $time
-# Should-Stop:       $syslog $network $named $time
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Controls chronyd NTP time daemon
-# Description:       Chronyd is the NTP time daemon in the Chrony package
-### END INIT INFO
-
-PATH=/bin:/usr/bin:/sbin:/usr/sbin
-DAEMON=/usr/sbin/chronyd
-NAME="chronyd"
-DESC="time daemon"
-PIDFILE=/run/chronyd.pid
-CHRONY_HELPER=/usr/lib/chrony/chrony-helper
-
-[ -x "$DAEMON" ] || exit 0
-
-. /lib/lsb/init-functions
-
-# Override this variable by editing /etc/default/chrony.
-DAEMON_OPTS=""
-if [ -f /etc/default/chrony ]; then
-    . /etc/default/chrony
-fi
-
-case "$1" in
-    start)
-        if $0 status > /dev/null ; then
-            log_success_msg "$NAME is already running"
-        else
-            log_daemon_msg "Starting $DESC" "$NAME"
-            start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS
-            if [ -x $CHRONY_HELPER ]; then
-                $CHRONY_HELPER update-daemon
-            fi
-            log_end_msg $?
-        fi
-        ;;
-
-    stop)
-        log_daemon_msg "Stopping $DESC" "$NAME"
-        start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --remove-pidfile --exec $DAEMON
-        log_end_msg $?
-        ;;
-
-    restart|force-reload)
-        $0 stop
-        $0 start
-        ;;
-
-    status)
-        status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $?
-        ;;
-
-    *)
-        log_action_msg "Usage: /etc/init.d/chrony {start|stop|restart|force-reload|status}"
-        exit 1
-        ;;
-esac
-
-exit 0
diff --git a/debian/install b/debian/install
index db2e305..abaa2f3 100644
--- a/debian/install
+++ b/debian/install
@@ -2,3 +2,4 @@ debian/chrony-dnssrv@.* lib/systemd/system
 debian/chrony-helper usr/lib/chrony
 debian/chrony.conf usr/share/chrony
 debian/usr.sbin.chronyd etc/apparmor.d
+debian/chronyd-starter.sh usr/lib/systemd/scripts/
diff --git a/debian/postrm b/debian/postrm
index ed3bac1..a5fd9ba 100644
--- a/debian/postrm
+++ b/debian/postrm
@@ -7,6 +7,15 @@ set -e
 
 # targets: purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear
 
+restore_timesyncd() {
+    # on next reboot it would start, but that would leave time
+    # unsynchronized until then. So as the Conflicts in the service file kill
+    # systemd-timesyncd re-establish it if it is enabled
+    if [ "$(systemctl is-enabled systemd-timesyncd 2>/dev/null)" = "enabled" ] ; then
+        deb-systemd-invoke start systemd-timesyncd
+    fi
+}
+
 case "$1" in
     purge)
         rm -f /var/lib/chrony/*
@@ -30,9 +39,15 @@ case "$1" in
         then
             deluser --quiet --system _chrony > /dev/null 2>&1 || true
         fi
+
+        restore_timesyncd
+    ;;
+
+    remove)
+        restore_timesyncd
     ;;
 
-    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
 
     ;;