freeipa

#8316 [Azure] Whitelist clock_adjtime syscall
Closed: fixed by cheimes. Opened by slev.

Closed: fixed
Reopen Issue

It was figured out that since glibc2.31 glibc changed its internal implementation of adjtimex from adjtimex to clock_adjtime. This results in chronyd fails to start in Docker container with:

Fatal error : adjtimex(0x8001) failed : Operation not permitted

Though time namespace support has been merged into the Linux kernel 5.6, Azure's Ubuntu VM has an older kernel.

Whether Docker upstream fixes that or not, we should apply our own seccomp profile to allow sync time (this is required by NTP tests). it is acceptable for testing 1 IPA environment on 1 Azure VM.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1778133
Docker issue: https://github.com/moby/moby/issues/40919

master:

  • 958e2458133c13219d8cd0d7618eba2b70b4be89 Azure: Add custom seccomp profile
  • 8882fc49d07dad75368a6f0e39d77ede3cc06b83 Azure: Allow chronyd to sync time

ipa-4-8:

  • fd58bac1c3feeb7f64c97278e841c553f026e917 Azure: Add custom seccomp profile
  • 9d01875d12c20855d4be1351717ee4105e34e5ac Azure: Allow chronyd to sync time

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.