This is a small thing : chrony seemed to have lost track of time, the fix was simple - and had to do with SELINUX.

Losing Track of Time

The clock on my machine seemed unusually ‘off’. My first comparison was to my mobile phone

  • an easy check, since mobiles are typically synced against the mobile-provider / cell towers.

Checking as to the state of play on the machine itself :

systemctl status chronyd
## reports a normal-looking status (running, and enabled)
chronyc sourcestats
## reports Zero sources... Something is up

Where are the sources?

The default Fedora /etc/chrony.conf contains a valid ‘pool’ configuration :

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool 2.fedora.pool.ntp.org iburst

#....

so why are no sources picked up? Checking /var/log/messages shows :

Jan 17 02:09:07 square kernel: audit: type=1400 audit(1452967747.816:791): \
avc: denied { read } for pid=12887 comm="chronyd" name="resolv.conf" dev="sdb1" \
ino=3425971 scontext=system_u:system_r:chronyd_t:s0 \
tcontext=unconfined_u:object_r:user_home_t:s0 \
tclass=file permissive=0

This tells us that chronyd is being denied something by SELINUX (something that I felt sure I had turned to permissive mode, since it’s often a source of hard-to-fathom errors).

Bug in chronyd?

At first blush, this seemed like an error with chronyd, since the rest of the system was working fine.

However, SELINUX is doing a typical mis-direct here : The problem actually lay with the /etc/resolv.conf file itself - it had somehow become mislabled.

Simple Fix

## Relabel (SELINUX-wise) the file in question
restorecon -v /etc/resolv.conf

## Restart chronyd to force it to retry accessing the file
systemctl restart chronyd

## Check that chronyd now has a non-zero 'Number of sources'
chronyc sourcestats

210 Number of sources = 4
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
186.211.189.118.static.m1 17 13 43m +1.256 0.300 +6034us 210us
ntp01.cosmicflu.com 17 9 31m +0.152 0.216 +7966us 129us
time1.maxonline.com.sg 0 0 0 +0.000 2000.000 +0ns 4000ms
unknown.maxonline.com.sg 15 6 35m +1.158 6.231 -6320us 3137us

Solved.



Martin Andrews

{Finance, Software, AI} entrepreneur, living in Singapore with my family.



blog comments powered by Disqus