SUSE-SU-2025:20846-1

This update for chrony fixes the following issues:

• Update to version 4.8:

  • Add maxunreach option to limit selection of unreachable sources
  • Add -u option to chronyc to drop root privileges (default chronyc user is set by configure script)
  • Fix refclock extpps option to work on Linux >= 6.15
  • Validate refclock samples for reachability updates

• Fix racy socket creation allowing privilege escalation to root (bsc#1246544)

• Update to version 4.7:

  • Add opencommands directive to select remote monitoring commands
  • Add interval option to driftfile directive
  • Add waitsynced and waitunsynced options to local directive
  • Add sanity checks for integer values in configuration
  • Add support for systemd Type=notify service
  • Add RTC refclock driver
  • Allow PHC refclock to be specified with network interface name
  • Don’t require multiple refclock samples per poll to simplify filter configuration
  • Keep refclock reachable when dropping samples with large delay
  • Improve quantile-based filtering to adapt faster to larger delay
  • Improve logging of selection failures
  • Detect clock interference from other processes
  • Try to reopen message log (-l option) on cyclelogs command
  • Fix sourcedir reloading to not multiply sources
  • Fix tracking offset after failed clock step
  • Drop support for NTS with Nettle < 3.6 and GnuTLS < 3.6.14
  • Drop support for building without POSIX threads

• Update to version 4.6.1:

  • Add ntsaeads directive to enable only selected AEAD algorithms for NTS.
  • Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD algorithm.
  • Switch to compliant NTS keys if first response from server is NTS NAK.

• Drop rcFOO symlinks for CODE16 (PED-266).

• Update to version 4.6:

  • Add activate option to local directive to set activation threshold
  • Add ipv4 and ipv6 options to server/pool/peer directive
  • Add kod option to ratelimit directive for server KoD RATE support
  • Add leapseclist directive to read NIST/IERS leap-seconds.list file
  • Add ptpdomain directive to set PTP domain for NTP over PTP
  • Allow disabling pidfile
  • Improve copy server option to accept unsynchronised status instantly
  • Log one selection failure on start
  • Add offset command to modify source offset correction
  • Add timestamp sources to ntpdata report
  • Fix crash on sources reload during initstepslew or RTC initialisation
  • Fix source refreshment to not repeat failed name resolving attempts

• Update to version 4.5:

  • Add support for AES-GCM-SIV in GnuTLS
  • Add support for corrections from PTP transparent clocks
  • Add support for systemd socket activation
  • Fix presend in interleaved mode
  • Fix reloading of modified sources from sourcedir