Re: PROBLEM: Linux updates RTC secretly when clock synchronizes

[Riley Williams <rhw@MemAlpha.cx>]

Hi Pavel.

>> Take the position of a sysadmin who can't understand why the system
>> clock on his computer keeps getting randomly changed under Linux,
>> and has verified using another operating system that it isn't a
>> hardware problem, then ask yourself what said sysadmin would expect
>> from the kernel to help him/her track the problem down. Would said
>> sysadmin prefer to be told...
>> 
>>  1. "Look in the system log - you'll get a message every time any
>>      program writes to the RTC."
>> 
>>  2. "Sorry, you'll have to go through every piece of software on
>>      your system and find the one that's updating the system clock
>>      that shouldn't be."
>> 
>> According to your comments, you prefer (2).
>>
>> I most definitely prefer (1).

> Hmm, and if some malicious software insmods kernel module to work
> around your printk()?

...it gets "Port busy" when it tries to access the RTC ports that the
RTC driver built into the kernel already has opened exclusively. At
least, that's my understanding of the situation at present.

> We are talking root only here.

Are we?

Unless I've misunderstood the arguments so far, the aim is to take the
RTC driver out of the kernel altogether and replace it with a usermode
driver to do the same thing. As I see it, that opens up far too many
problems to be seriously considered, not least the fact that setting
the RTC is not necessarily a root-only operation.

> If sofware with uid 0 is malicious, you have big problems.

True, but that's not what people appear to be talking about.

Best wishes from Riley.