---
name: "mac_ntpd"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/mac_ntpd"
---

# mac\_ntpd(4)

policy allowing ntpd to run as non-root user

## NAME

**mac\_ntpd** – policy allowing ntpd to run as non-root user

## SYNOPSIS

To compile the ntpd policy into your kernel, place the following lines in your kernel configuration file:

**options MAC** **options MAC\_NTPD**

Alternately, to load the ntpd policy module at boot time, place the following line in your kernel configuration file:

**options MAC**

and in [loader.conf(5)](/loader.conf/5.md):

```
mac_ntpd_load="YES"
```

## DESCRIPTION

The **mac\_ntpd** policy grants any process running as user ‘ntpd’ (uid 123) the privileges needed to manipulate system time, and to (re-)bind to the privileged NTP port.

When [ntpd(8)](/ntpd/8.md) is started with ‘**-u** *\<user\>\[:group\]*’ on the command line, it performs all initializations requiring root privileges, then drops root privileges by switching to the given user id. From that point on, the only privileges it requires are the ability to manipulate system time, and the ability to re-bind a UDP socket to the NTP port (port 123) after a network interface change.

With the **mac\_ntpd** policy active, it may also be possible to start ntpd as a non-root user, because the default ntpd options don't require any additional root privileges beyond those granted by the policy.

### Privileges Granted

The exact set of kernel privileges granted to any process running with the configured uid is:

- PRIV\_ADJTIME

  - PRIV\_CLOCK\_SETTIME

  - PRIV\_NTP\_ADJTIME

  - PRIV\_NETINET\_RESERVEDPORT

  - PRIV\_NETINET\_REUSEPORT

  ### Runtime Configuration

The following [sysctl(8)](/sysctl/8.md) MIBs are available for fine-tuning this MAC policy. All [sysctl(8)](/sysctl/8.md) variables can also be set as [loader(8)](/loader/8.md) tunables in [loader.conf(5)](/loader.conf/5.md).

- *security.mac.ntpd.enabled*

  Enable the **mac\_ntpd** policy. (Default: 1).

- *security.mac.ntpd.uid*

  The numeric uid of the ntpd user. (Default: 123).

## SEE ALSO

[mac(4)](/mac/4.md), [ntpd(8)](/ntpd/8.md)

## HISTORY

MAC first appeared in FreeBSD 5.0 and **mac\_ntpd** first appeared in FreeBSD 12.0.