base-files: sysfixtime exclude dnsmasq.time
authorKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Thu, 5 May 2016 11:34:49 +0000 (12:34 +0100)
committerJo-Philipp Wich <jo@mein.io>
Wed, 18 May 2016 20:17:33 +0000 (22:17 +0200)
commit382779e009af7c1c688fbd98adf71fb19ce66254
treeb4db3035f3b9a6d1cf6ac48ad53d5c23e37b9149
parentc19b7aaac5f861a20be9a7ddcce3832f6ba4a899
base-files: sysfixtime exclude dnsmasq.time

dnsmasq maintains dnsmasq.time across reboots and uses it as a means of
determining if current time is good enough to validate dnssec time
stamps.  By including /etc/dnsmasq.time as a time source for sysfixtime,
the mechanism was effectively defeated because time was set to the
last time that dnsmasq considered current even though that time is in
the past.  Since that time is out of date, dns(sec) resolution would
fail thus defeating any ntp based mechanisms for setting the clock
correctly.

In theory the process is defeated by any files in /etc that are newer
than /etc/dnsmasq.time however dnsmasq now updates the file's timestamp
on process TERM so hopefully /etc/dnsmasq.time is the latest file
timestamp in /etc as part of LEDE shutdown/reboot.

Either way, including /etc/dnsmasq.time as a time source for
sysfixtime is not helpful.
package/base-files/files/etc/init.d/sysfixtime