chronyd systemd service Unknown lvalue

SUSE Linux Enterprise Server 12 SP5

SUSE Linux Enterprise Server for SAP Applications 12 SP5

There are "Unknown lvalue" messages seen when looking at the systemd chrony service:

Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:25] Unknown lvalue 'ProtectKernelLogs' in section 'Service'
Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:26] Unknown lvalue 'ProtectControlGroups' in section 'Service'
Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:23] Unknown lvalue 'ProtectHostname' in section 'Service'
Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:24] Unknown lvalue 'ProtectKernelModules' in section 'Service'
Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:25] Unknown lvalue 'ProtectKernelLogs' in section 'Service'
Oct 25 17:31:31 s12s5 systemd[1]: [/usr/lib/systemd/system/chronyd.service:26] Unknown lvalue 'ProtectControlGroups' in section 'Service'

To permanently prevent these messages, edit the chronyd systemd service and comment the lines:

#ProtectHostname=true
#ProtectKernelModules=true
#ProtectKernelLogs=true
#ProtectControlGroups=true
#DeviceAllow=char-rtc
#DeviceAllow=char-ptp

To make the change run this command and comment the above lines as shown:

systemctl edit --full chronyd.service

Then restart the chrondy service and the messages will be no longer seen.

systemctl restart chronyd.service

Systemd sandboxing options added to chronyd.service file to cause warnings on SLE12-SP5 because they are unknown to older systemd.

On systems with systemd < 244 this will generate one or more warnings like this to syslog:

Unknown key name 'XXX' in section 'Service', ignoring.

These are just warnings and completely harmless, Systemd simply warns about keywords it doesn't know and ignores them.

Systemd hardening options were added for future security purposes.

They are documented here:

https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort