way interfaces are configured. Some key points:
- At startup, all interfaces are configured through /etc/rc.d/netif.
- ifconfig_<if> variables my now mix real ifconfig commands the with
DHCP and WPA directives. For example, this allows media
configuration prior to running dhclient.
- /etc/rc.d/dhclient is not run at startup except by netif to start
dhclient on specific interfaces.
- /etc/pccard_ether calls "/etc/rc.d/netif start <if>" to do most of
it's work.
- /etc/pccard_ether no longer takes additional arguments to pass to
ifconfig. Instead, ifconfig_<if> variables are now honored in favor
of pccard_ifconfig when available.
- /etc/pccard_ether will only run on interfaces specified in
removable_interfaces, even if pccard_ifconfig is set.
installed. This is the same directory as found on Solaris.
NB: In FreeBSD 4.x and earlier, a script (file) named /etc/security
exists. Does mergemaster need to be taught how to replace a file with
a directory?
Submitted by: wsalamon
Obtained from: TrustedBSD Project
because new devfs entries can show up later and one can access such entires
from inside named chroot.
In rc.d scripts we can use devfs_domount() function with devfsrules_hide_all
policy and unhide 'null' and 'random' manually.
to see if a prior devfs has been mounted. If no devfs is mounted on
${jail_devdir}/dev then proceed. This will prevent the stack up of
multiple devfs mounts on the same mount point.
Discussed with: pjd
MFC after: 1 week
to run initdiskless before we run rcorder on /etc/rc.d. To allow this,
move /etc/rc.d/initdiskless to /etc/rc.initdiskless and run it directly
from /etc/rc.
Remove /etc/rc.d/preseedrandom as it is no longer necessicary (we start
with entropy unblocked) and was only used by initdiskless when it
was needed.
Discussed on: freebsd-rc
Repocopy by: peter
Without this flag, if the symlink existed already a new symlink would
be created in the source directory. While harmless if the two symlinks
were the same, it nonetheless caused pointless confusion.
The pathological case is that when there is an existing /etc/namedb
symlink, but named_chrootdir in rc.conf pointed to a different
directory, it was the symlink in /var/named that was getting
updated, not the one in /etc. This led to some difficult to diagnose
problems for users.
sockets placed into prisons from the host environment get clobbered
by the prison's instance of cleanvar. (assuming /etc/rc is run in
the prison).
Discussed with: pjd, green, cperciva
MFC after: 1 week
save file was /var/db/entropy, which also happens to
be the directory where the individual entropy files
created by /usr/libexec/save-entropy are stored.
Change the suggestion to be /var/db/entropy-file
instead.
In an error condition where the shutdown file is not
created, the error message accessed a variable that
doesn't exist.
PR: conf/75722
Submitted by: Nicolas Rachinsky <list@rachinsky.de>
systems that boot with this value at the lowest setting. Change the
default boot config back to "leave frequency as BIOS set it". Also, fix
buglet where acpi_throttle wouldn't be used if p4tcc was present but
disabled by the user.
MFC after: 1 week
on boot, force it to HIGH. This is needed for some systems which appear
to boot with a low acpi_throttle setting by default. Thanks to Christian
Brueffer for tracking this down on his system.
MFC after: 1 day
default for now. Default flags create missing directories.
Remove comment about doing this in etc/rc.d/var.
Unlike in the PR, I chose to do this in the lpd script where we reliably
have /usr available.
PR: conf/71488
Submitted by: RZ-FreeBSD0904 at fh-karlsruhe dot de
to hit this case when /usr is remote and thus hasn't been mounted (since
you're supposed to have /var before mounting remote file systems).
Normal machines that don't have a /var for some reason will have /usr
already available because it's local.
automaticly created at boot. There's no need to maintain a list of
files and permissions in multiple places. This also means binary
updates won't stomp on log files.
For the record, utmp is created in etc/rc.d/cleanvar, wtmp and lastlog
in etc/rc.d/var, and the reset via etc/rc.d/newsyslog.
- Enable it by default, running newsyslog with -CN which creates files
that have the C flag specified in /etc/newsyslog.conf.
- Remove the "newsyslog -CC" call from etc/rc.d/var and the check for
newsyslog.
- Add the C flag to entries in /etc/newsyslog.conf that are currently
installed as part of the base system.
There are two effects from this change:
- Users who delete default syslog files to stop logging to them
will need to set newsyslog_enable=NO in rc.conf or remove the C
flag from those file in /etc/newsyslog.conf or they will come back
on the next boot.
- Diskless systems now create the same set of files that ordinary
systems have by default instead of every file in newsyslog.conf.
to create /var/log/lastlog.
- Also create /var/log/wtmp if missing.
- Attempt to create these files unless populate_var is NO rather then
only when /var is empty or populate_var=YES.
hosts to share an IP address, providing high availability and load
balancing.
Original work on CARP done by Michael Shalayeff, with many
additions by Marco Pfatschbacher and Ryan McBride.
FreeBSD port done solely by Max Laier.
Patch by: mlaier
Obtained from: OpenBSD (mickey, mcbride)
this can cause a really heavy load on system. Several kernel debugging
messages can be triggered even remotely (e.g. bad ARP replies).
Use kern.warning instead, so that really significant messages still
will be printed on console.
Reviewed by: current@
MFC after: 1 week
Security: this change fixes a DoS condition, when default system
console is serial, and box is flooded with bogus ARP
packets
frequencies are specified with performance_cpu_freq and economy_cpu_freq.
Of course, special values LOW and HIGH are also supported. Also, remove
old throttling support.
rc.d/mountcritlocal and sed(1) is placed in /usr/bin/. Other useful tools
for this task are also placed in /usr/ (tr(1), awk(1)), so I implemented
local_tr() function which works simlar to tr(1).
Reported by: Amir Shalem <amir@boom.org.il>
MFC after: 1 week
with the rest of the examples, so after discussion with him and gshapiro,
re-sort the examples, and add more comments to make things very obvious.
Also, divide the examples between example.{com|net|org} to make things
even more obvious, and use the same RFC 1918 block for all examples.
Pointed out by: Scot W. Hetzel <hetzels@westbend.net>
and so the fix committed in r1.42 was not quite correct for the case
where there are two or more DHCP consuming removable interfaces - dhclient
must be restarted so that the other interfaces continue to function
correctly.
Approved by: murray
MFC After: 7 days
user owns these directories or the sticky bit is unset may open security holes,
so simply create them at startup with the correct owner/mode.
MFC after: 1 day
reject. For example:
Checking for rejected mail hosts:
48 getherbalnow.info (451... resolve)
46 absorb.com (451... resolve)
4 tgmart01.codns.com (553... exist)
3 kali.com.cn (451... resolve)
2 genie.com (451... resolve)
1 zv.qy (553... exist)
1 zd.hinet.hr (553... exist)
....
The bit in parenthesis is the reject code and the last word on the line -
enough to give the admin a better chance of seeing real problems (hopefully!).
While I'm here, remove the "<" at the start of rejects coming from "from"
addresses without a name@ part.
I had to rewrite the patch given by the submitter as this script has been
sed'ified (used to be perl) and I think the reject code is useful....
PR: 17377
Idea from: root at ns dot internet dot dk
MFC after: 7 days
- add udav(4)
In the scsi-controller-regex:
- correct an entry
- move another one to the right place
- add a bunch of missing drivers
Glanced at by: trhodes (scsi-controller-regex part)
MFC after: 3 days
1. Feature: for flexibility reasons and as a prerequisite to clean
shutdowns, allow the configuration of a stop/shutdown command
via rc.conf variable "jail_<name>_exec_stop" in addition to the
start/boot command (rc.conf variable "jail_<name>_exec_start"). For
backward compatibility reasons, rc.conf variable "jail_<name>_exec"
is still supported, too.
2. Debug: Add the used boot/shutdown commands to the debug output of
the /etc/rc.d/jail script, too.
3. Security: Run the Jail start/boot command in a cleaned environment
to not leak information from the host to the Jail during startup.
4. Feature: Run the Jail stop/shutdown command "jail_<name>_exec_stop" on
"/etc/rc.d/jail stop <name>" to allow a graceful shutdown of the Jail
before its processes are just killed.
5. Bugfix: When killing the remaining Jail processes give the processes
time to actually perform their termination sequence. Without this the
subsequent umount(8) operations usually fail because the resources
are still in use. Additionally, if after trying to TERM-inate the
processes there are still processes hanging around, finally just KILL
them.
6. Bugfix: In rc.shutdown, if running inside a Jail, skip the /etc/rc.d/*
scripts which are flagged with the KEYWORD "nojail" to allow the
correct operation of rc.shutdown under jail_<name>_exec_stop="/bin/sh
/etc/rc.shutdown". This is analogous to what /etc/rc does inside a Jail.
Now the following typical host-configuration for two Jails works as
expected and correctly boots and shutdowns the Jails:
-----------------------------------------------------------
# /etc/rc.conf:
jail_enable="YES"
jail_list="foo bar"
jail_foo_rootdir="/j/foo"
jail_foo_hostname="foo.example.com"
jail_foo_ip="192.168.0.1"
jail_foo_devfs_enable="YES"
jail_foo_mount_enable="YES"
jail_foo_exec_start="/bin/sh /etc/rc"
jail_foo_exec_stop="/bin/sh /etc/rc.shutdown"
jail_bar_rootdir="/j/bar"
jail_bar_hostname="bar.example.com"
jail_bar_ip="192.168.0.2"
jail_bar_devfs_enable="YES"
jail_bar_mount_enable="YES"
jail_bar_exec_start="/path/to/kjailer -v"
jail_bar_exec_stop="/bin/sh -c 'killall kjailer && sleep 60'"
-----------------------------------------------------------
# /etc/fstab.foo
/v/foo /j/foo/v/foo nullfs rw 0 0
-----------------------------------------------------------
# /etc/fstab.bar
/v/bar /j/bar/v/bar nullfs rw 0 0
-----------------------------------------------------------
Reviewed by: freebsd-hackers
MFC after: 2 weeks
rebadged Xircom REM56 RealPort card. Short MFC timeout to beat the 4.11
code freeze.
PR: 53027
Submitted by: John Merryweather Cooper <coop9211 at uidaho dot edu>
Approved by: imp (mentor)
MFC after: 2 days
ifnet_rename() to support situations where rc.conf's $network_interfaces
variable is set to an explicit list of network interfaces (instead of
the default "auto").
Using "list_network_interfaces all" resulted in using
$network_interfaces for both interface _renaming_ and interface
_configuration_ which obviously cannot work either before (if the
new name is in $network_interfaces) or after (if the old name is in
$network_interfaces) renaming the interface.
can't be removed as ofw_console(4) and zs(4) use them so one has to
live with some complaints about non-existent devices at boot time and
remove the respective entries locally for now.
adapters from usbd.conf to devd.conf. USB ethernet devices were
already handled in devd.conf so this just removes their usbd.conf
entry.
PR: conf/73799
packet counts by pf(4).
This adds a ``daily_status_security_pfdenied_enable'' variable to
periodic.conf, which defaults to ``YES'' as the matching IPF(W) versions.
The output will look like this (line wrapped):
pf denied packets:
> block drop log on rl0 proto tcp all [ Evaluations: 504986 Packets: 0
Bytes: 0 States: 0 ]
> block drop log on rl0 all [ Evaluations: 18559 Packets: 427 Bytes: 140578
States: 0 ]
Submitted by: clive (thanks a lot!)
MFC after: 2 weeks
this feature for a jail named foo :
jail_foo_mount_enable="YES"
jail_foo_fstab="/etc/fstab.foo"
The second line is actually useless, since the code defaults to
using "/etc/fstab.$jailname" as the fstab file if none is specified.
MFC after: 3 days
Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
These can be used to pass extra options to the mdmfs(8) utility,
to customize the finer details of the md file system creation
(i.e. to turn on/off softupdates, to specify a default owner for md
filesystem, etc).
Use these two new flags to mount tmpmfs and varmfs without
softupdates, since it doesn't make much sense to use SU on
malloc-backed file systems.
Reviewed by: mtm
Inspired by: J. D. Bronson, jbronson at wixb dot com
user (for creation of the zone journal file). This is separate from the
master/ directory for security. Give an example dynamic zone in the
sample named.conf.
Approved by: dougb
Noticed by: Eivind Olsen <eivind at aminor.no>
MFC after: 1 week
on the system.
To start/stop/check on a specific device give the device name as
the second argument to the script:
# /etc/rc.d/moused start ums0
To use different rc.conf(5) knobs with different mice use the device
name as part of the knob. For example, if the mouse device is ums0, then:
moused_ums0_enable=yes
moused_ums0_flags="-z 4"
moused_ums0_port="/dev/ums0"
Starting rc.d/moused without the device argument will use the standard
moused_* flags. So, this commit should not disrupt or change current usage.
To preserve current behaviour with respect to usb mice, which appear
automatically when inserted, there is a new knob, moused_nondefault_enable,
which will treat any devices without rc.conf knobs as enabled.
To minimize knobs in /etc/rc.conf, the device file and pid file are
auto-computed, so that in the typical case for a usb mouse you don't
need to add anything extra in /etc/rc.conf to get it working.
Additionally, this updates /etc/usbd.conf to use the rc.d/moused script so
people don't have to modify it to configure their usb mouse anymore.
MFC after: 1 month
unbreak /etc/rc.d/root for diskless systems that get their root
filesystem from a read-only NFS mount.
PR: conf/72927
Submitted by: Ralf Wenk <RZ-FreeBSD1004@fh-karlsruhe.de>
Reviewed by: brooks
do not have these device special files. Where this previously failed
quietly, it now emits annoying but complete messages at best and
incomprehensible prefixes on average. During all of October, this is
a string of 16 O's, as in:
:
Starting inetd.
Sun Oct 17 15:09:09 PDT 2004
OOOOOOOOOOOOOOOO
FreeBSD/ia64 (itanium.pn.xcllnt.net) (ttyu2)
login:
pointed out that /usr/local/etc/rc.d/000.pkgtools.sh installed
with the portupgrade does an equivalent thing, so I personally
would like to see the change reverted, but let David handle it.
/etc/namedb symlink is created.
2. Incorporate Brian's suggestion to make the link relative. This
is necessary to handle situations (such as mergemaster) where the
user is building a tree in a seperate environment. This will also
fix the problem with the way DESTDIR is set in 'make release'.
3. Add a new knob, NO_BIND_MTREE, as suggested by the folks who
already have stuff in /var/named that they don't want me to mess with.
4. Update make.conf(5) with the new stuff, and correct a few paths
that have changed since I last updated it.
device
device.bde
/dev/device
/dev/device.bde
- Fix stop routine:
+ There don't have to be file system mounted on gbde device,
so ignore errors from umount(8).
+ Only detach existing gbde devices.
I used ugly "/dev/${parent}" instead of "${parentdev}", because "/dev/"
prefix for devices listed in gbde_devices variable is optional.
Reported by: Sean McNeil <sean@mcneil.com>
install now complains about ttyu0/ttyu1 not existing at boot time.
Since users wanting the uart based devices as terminals will need
to do something special to get them anyway set it up so a default
config doesn't complain.
MFC after: 3 days
authoritative servers.
2. Add an IPv4 listen-on option for 127.0.0.1, which is appropriate
for the default use as a local resolver.
3. Add a commented out listen-on-v6 option.
so we'll use the more secure default till I have a chance to prove
myself wrong. :)
Add a /var/stats directory to be enabled in named.conf.
Submitted by: gshapiro
to NO of course). Provide a basic ruleset file, rc.bsdextended, but allow
the filename to be overridden through rc.conf.
Discussed with: rwatson (awhile ago)
1. Update text about later BINDs using a pseudo-random, unpriviliged
query port for UDP by default.
2. We are now running in a sandbox by default, with a dedicated dump
directory, so remove the stale comment.
3. The topology configuration is not for the faint of heart, so
remove the commented example.
4. Tighten up some language a bit.
5. s/secondary/slave/
6. No need for the example about a bind-owned directory for slave zones.
7. Change domain.com to example.com in the example, per RFC 2606.
8. Update the path for slave zones in the example.
- Thanks to Scot Hetzel <swhetzel@gmail.com>
There is more work to do here, but this is an improvement.
by default when named is enabled. Also, improve our default directory
layout by creating /var/named/etc/namedb/{master|slave} directories,
and use the former for the generated localhost* files.
Rather than using pax to copy device entries, mount devfs in the
chroot directory.
There may be some corner cases where things need to be adjusted,
but overall this structure has been well tested on a production
network, and should serve the needs of the vast majority of users.
UPDATING has instructions on how to do the conversion for those
with existing configurations.
NO_BIND_DNSSEC, NO_BIND_ETC, NO_BIND_NAMED, and NO_BIND_UTILS.
2. Make creation of directories in /usr/include that are only needed
in the WITH_BIND_LIBS case conditional.
Reviewed by: ru, des
chrooted the pid symlink code should not fire. Also, remove the quotes
around the chroot variable in the rndc-confgen invocation so that if
not chrooted the command will still succeed.
Pointed out by: Sean McNeil <sean@mcneil.com>
1. Making the pid symlink now has to happen after named starts, otherwise
it can generate a fatal error.
2. named-xfer is not part of the BIND 9 world.
3. BIND 9 needs a /dev/random in the chroot directory if chrooted.
4. Only the pid file is symlinked now, the ndc socket is BIND 8 only.
5. Create an rndc.key file for the user if one does not exist.
This (generally) allows a BIND 8 config file to be used in a BIND 9
world with little or no modification.
Without this change, if one had a swap-on-mirror configuration, gmirror
will rebuild mirror component(s) on boot, because they are dirty (they
were open on shutdown).
complete backout as the ntpd_sync_on_start etc/rc.conf tunable is still
present, though the default is now NO (was YES). Since we're no longer
syncing time at startup by default when ntpd is enabled (as was the case
24hrs ago), remove UPDATING entry pointing out that ntpd(1) -g is slower
than ntpdate(1).
Hopefully ntpd_sync_on_start="YES" can be made the default for -CURRENT
after 5.3 is cut. At the very least, this should be set to YES when a
user requests to have ntpd enabled via sysinstall(1).
Requested by: many
calls to ntpd -g. ntpd is noticeably slower than ntpdate, but is also more
accurate. This removes the nasty hackery in rc.d/ntpdate that would parse
out ntp servers from /etc/ntp.conf (ntpd knows how to read its own config
file). By default, ntpd *will* sync with its listed time servers. To
turn this off so that ntpd does not sync, ntpd_sync_on_start="NO" can be
added to /etc/rc.conf. If ntpd is not enabled (the default), then time is
not synced on startup. ntpdate has been depreciated by the ntpd authors
for quite some time so this change shouldn't be unexpected.
Suggested by: des
Approved by: roberto (resident ntp guru)
calls to ntpd -g. ntpd is noticably slower than ntpdate, but is also more
accurate. This removes the nasty hackery in rc.d/ntpdate that would parse
out ntp servers from /etc/ntp.conf (ntpd knows how to read its own config
file). By default, ntpd *will* sync with its listed time servers. To
turn this off so that ntpd does not sync, ntpd_sync_on_start="NO" can be
added to /etc/rc.conf. If ntpd is not enabled (the default), then time is
not synced on startup. ntpdate's use has been depreciated by the ntpd
authors for quite some time so this change shouldn't be unexpected.
Suggested by: des
Approved by: roberto (resident ntp guru)
- Add OpenBSD example rulesets as advertised in etc/pf.conf and pf.conf(5)
- Tweak the pointer to fit the FreeBSD default location share/examples/pf
- Account for the new directory in BSD.usr.dist (no hier(7) change required
as share/examples is an opaque item there).
Obtained from: OpenBSD
Reminded by: Thomas T. Veldhouse
PR: docs/71691
MFC after: 2 days
VT6122 gigabit ethernet chip and integrated 10/100/1000 copper PHY.
The vge driver has been added to GENERIC for i386, pc98 and amd64,
but not to sparc or ia64 since I don't have the ability to test
it there. The vge(4) driver supports VLANs, checksum offload and
jumbo frames.
Also added the lge(4) and nge(4) drivers to GENERIC for i386 and
pc98 since I was in the neighborhood. There's no reason to leave them
out anymore.
part of the pf module.
While here fix a comment that was c'n'ped from rc.d/pf
PR: bin/71096 (partly)
Submitted by: Ville-Pertti Keinonen
MFC after: 2 days
from list_net_interfaces() when network_interfaces=auto.
Rationale: Since the auto case is special, the lesser evil
had to be chosen among not adding cloned interfaces to
_tmplist or removing duplicates from _tmplist after adding
cloned interfaces. Since list_net_interfaces() must not use
/usr/bin tools, the former "evil" appeared clearer and much
more efficient. (See the PR audit trail for discussion.)
PR: conf/63700
Reviewed by: brooks
MFC after: 5 days
the submit and outbound daemon, else if sendmail_submit_enable=yes, don't
start the outbound daemon. Only one daemon should be started.
Also, do not rebuild database maps at boot time. The code didn't pay
attention to SENDMAIL_MAP_TYPE and assumed 'hash'. Also, admins may
not want maps automatically rebuilt just because the back end database
has changed. Finally, some maps are built with mode tools than just
makemap (e.g., using cidrexpand on the access text file before sending
it to makemap).
Noticed by: ache
Reviewed by: ache
so reflect this in the default. The uucp uid is a bit funny, and
is used by mtree in /var/spool for locks, so we can't remove it
without thinking about it a bit harder.
than one interface from the command line:
# /etc/rc.d/netif start bfe0 xl0
It's also possible to restart an interface(s):
# /etc/rc.d/netif restart bfe0
This required some changes to rc.subr(8) so that if the start/stop commands
are overidden the rest of the command line (after the start/stop/etc... cmd)
is passed through to the subroutines.
o Separate out local (ports) scripts that use rc.d, and the old style
startup/shutdown scripts and execute them separately. On startup the
rc.d style scripts are executed first and then the old-style scripts.
On shutdown, exactly the reverse happens.
o The rc.d ports scripts should now behave more like base system scripts.
Scripts ending in .sh will be sourced into the current shell, while the
rest will be executed in a subshell. Previously, all ports scripts,
regardless of the .sh suffix, were executed in a subshell.
o The parent script, /etc/rc.d/localpkg, passes its command line arguments
straight to the rc.d ports scripts. This means they should now honor
faststop and faststart commands as well. Old style scripts, should not see
any differences. They will still get either a start or stop command.
o The initial phrase shown during shutdown has been changed to use
"local packages" instead of "daemon processes" to be more inline with the
phrase used during local package startup. The phrases are also used only for
old-style ports script startup/shutdown, whereas previously they were being
used for both rc.d and old-style scripts. This should make startup/shutdown
output a bit less ugly.
Discussed with: portmgr
Has Reservations: eik
- Ask the user up to X times (3 by default) for the pass-phrase, if
it is incorrect the first time.
- Add support for storing the lockfiles in another other directory
than /etc.
- Document that it is possible to override the location of each single
lockfile.
Approved by: pjd
if [ -z "${_rc_subr_loaded}" ]; then
_rc_subr_loaded="YES"
...
fi
in order to avoid re-interpreting rc.subr every time an rc.d
script is run. In my tests, this speeds up rc time by about
8-10%.
This class is used for detecting volume labels on file systems:
UFS, MSDOSFS (FAT12, FAT16, FAT32) and ISO9660.
It also provide native labelization (there is no need for file system).
g_label_ufs.c is based on geom_vol_ffs from Gordon Tetlow.
g_label_msdos.c and g_label_iso9660.c are probably hacks, I just found
where volume labels are stored and I use those offsets here,
but with this class it should be easy to do it as it should be done by
someone who know how.
Implementing volume labels detection for other file systems also should
be trivial.
New providers are created in those directories:
/dev/ufs/ (UFS1, UFS2)
/dev/msdosfs/ (FAT12, FAT16, FAT32)
/dev/iso9660/ (ISO9660)
/dev/label/ (native labels, configured with glabel(8))
Manual page cleanups and some comments inside were submitted by
Simon L. Nielsen, who was, as always, very helpful. Thanks!
Most notably, this cleans up messages when shutting down from
single user. In such a case there are usually no daemons running,
but their pid files are still in /var/run. This causes rc.d to
output diagnostics about daemons with pidfiles, but that are
not running.
again. This user/group is not required for install* targets, hence do not
add them to CHECK_UIDS/CHECK_GIDS in Makefile.inc1 (no need to annoy
people).
Discussed-on: -current
your (network) modules as well as any userland that might make sense of
sizeof(struct ifnet).
This does not change the queueing yet. These changes will follow in a
seperate commit. Same with the driver changes, which need case by case
evaluation.
__FreeBSD_version bump will follow.
Tested-by: (i386)LINT
ip6addrctl_enable is set to YES, address selection policy is installed
into kernel.
If there is /etc/ip6addrctl.conf, it is used for address selection
policy. Even if there is no /etc/ip6addrctl.conf, we install default
policy. In this case, if ipv6_enable is set to YES, we use address
selection policy described in RFC 3484 as default. Otherwise, we
install priority policy for IPv4 address.
The default of ip6addrctl_enable is NO for now. However, it may
better to enable it by default.
/usr/local/www
[1] Semi-arbitrary cutoff, but I didn't want to add every locale directory
used by ports, because a lot are only used by one or two, and it's less
intrusive for these ports to just clean up after themselves.
MFC after: 2 days
The reason for doing this is that (at least some) 4.x binaries are very
unhappy if host.conf does not exist, and if we create host.conf but not
nsswitch.conf, nsswitch.conf will be created at the next reboot, so it
is better to create a correct nsswitch.conf right away.
use the conf/* stuff for their firewall configuration.
Running ipfw before could seem to make sense in that it would allow
one to setup access to the NFS server on a "default-deny" kernel,
but it is pretty obvious to the casual observer that such a configuration
never makes it far enough to mount the NFS-root in the first place.
debug.watchdog since it is not created by hardware watchdog(4) devices.
The watchdog(4) device is always compiled in the kernel, so removing the
check should not cause any problems.
Approved by: phk
initdiskless. The output of several commands and if available the
contents of /entropy are feed into /dev/random to kickstart the PRNG.
/etc/rc.d/initrandom is left alone to maintain the previous behavior as
much as possiable.
Further work in this area is probably needed.
Discussed with: markm
and permissions specified per rc.conf(5) now apply both to the md
device and to the mountpoint directory, after the mount has completed.
This has to be done in two steps, because chown is not available
until after /usr has been mounted, but the mdconfig and newfs steps
have to complete before fstab processing.
(when new natd is started before old natd died) and allows to manage natd
without touching ipfw.
natd should probably be killed with SIGKILL when stopping natd.
- Use sendmail_foo variables after load_rc_config so that they actually work.
- Utilize sendmail_procname.
- Check sendmail_submit_enable instead of sendmail_enable when dealing
with mail submission MTA.
comments and empty lines have been touched.
All of this should go in the diskless(8) manpage, now if we had
some kind of 'literate programming' tool to extract the comments
from the script and put them in a reasonable nroff format, it
would be a lot easier to keep code and docs in sync
+ SUBDIR.cpio.gz prevents files from SUBDIR/ to be copied when
priming the memory filesystems. This restores the old behaviour
and makes the copy process a lot more efficient
+ look for templates also in the list of directories supplied by
bootp/dhcp via the T134 option aka kern.bootp_cookie
+ keep track of directories temporarily mounted with "remount"
or "diskless_remount" commands and unmount them once we are done
with them (at the end of this script).
1. Add the shutdown keyword so that the script is run at shutdown time,
and the mixer* files are saved.
2. Twiddle whitespace.
3. Remove an unecessary function, and therefore collapse one variable.
hostname, resolve, tmp, and var scripts. The latter three are new and
were repo copied. These scripts no longer depend on being booted with
and NFS root instead attempt to automaticly create mfs /tmp and /var
volumes if the they are not writable. This behavior can be overridden
in /etc/rc.conf.
Reviewed by: luigi, pjd
Yes, this means for stuff OTHER than jails, too. Example usage:
#devfs_system_ruleset="root"
devfs_set_rulesets="/dev=root /etc/namedb/dev=named_devfs"
in the system on shutdown and restores the settings on boot. The settings
can also be reset to the saved values via 'mixer reload'.
Reviewed by: current@
thing, but we're ready to move on.
2. Remove the -g default argument in named_flags. It doesn't actually do
what most users think it does, and what most users want it to do is already
accomplished with a proper default group for the bind user, which we have.
Also, the -g knob does something entirely different in BIND 9, which leads
to a lot of needless confusion/aggravation.
3. In the rc.d script, don't bogusly override $command, or $rc_flags. Both
are adequately handled in rc.conf[.local].
4. DO properly override $rc_flags if user has named_chrootdir set.
This may need to be revisited, but should be ok for now.
5. Protect all chrootdir-related bits under that variable, instead of
named_rcng.
There is more work to be done here, especially in the area of BIND 9
compatibility, but this is a start at least.
Prompted in part by (legitmate) grousing from: kuriyama, Randy Bush
identical) on GENERIC.hints, hence the following change:
Moved the creation of /boot/device.hints where it belongs. This
should aid in merging GENERIC.hints changes to /boot/device.hints,
using mergemaster(8) or a similar approach.
In particular, this allows a "virgin" system installed from
source (installworld, installkernel, cd etc && make distribution)
to boot correctly and modestly simplifies the creation
of single-partition network/cdrom/CF bootable images.
Trigger not only on diskless booting sysctls being set, but also
on the existence of the file "/etc/diskless". But do not try to
extract IP# related keywords in that case.
Add a general "remount" facility to allow non-NFS remounting.
This adds the former ports registered groups: proxy and authpf as well as
the proxy user. Make sure to run mergemaster -p in oder to complete make
installworld without errors.
This also provides the passive OS fingerprints from OpenBSD (pf.os) and an
example pf.conf.
For those who want to go without pf; it provides a NO_PF knob to make.conf.
__FreeBSD_version will be bumped soon to reflect this and to be able to
change ports accordingly.
Approved by: bms(mentor)
included a start_precmd check for gated. The precommand was not
executed in the FreeBSD branch. When I did a mass removal of
NetBSD specific logic a while back this file apparently got only
a partial treatement. This bug did not have any functional consequences,
however, since the precommand was not declared to the rc.subr routines.
Noticed by: pjd
they exit. Sometimes they simply can't (core-dump, for example).
So, when searching for a running program send standard error
output from ps(1) to never-never land.
# This should quite those
# ps: kvm_getprocs: No such user
# errors. Since ports use a duplicate rc.subr(8) you might
# still see this error from ports startup scripts.
Certain MTA configurations mean that the notifications from
virecover keep bouncing; so here's a patch to allow administrators
to turn them off.
PR: conf/54910
Submitted by: bms (with a minor cleanup)
cannot or does not want to be executed in a jail the
KEYWORDS line should contain the nojail keyword.
o Update Copyright
# I suggest people who use jails more extensively than I do
# make commits to the appropriate files.
Implement ``one'' prefix to allow a "one shot" operation as if
${rcvar}=yes yet all the other prerequisite tests are still performed.
The existing ``force'' prefix is a sledgehammer that ignores all the
prerequisite checks and always returns a zero exit status; this is a
more gentle approach to the problem of "manipulate this disabled
service without editing rc.conf(5)".
Obtained From: NetBSD
# We have a work-around in our version of rc.subr that
# makes force* return a non-zero exit status if the
# command/service could not be acted upon. The work-around
# is no longer necessary and should be removed.
run_rc_command(): when checking if ${command} exists before executing it,
be sure to check under ${name_chroot} (if set).
Fix from Ed Ravin in [bin/18523]
Obtained From: NetBSD
Change how internal boolean variables are used to:
if ! ${_somevar:-false}; then
_somevar=true
fi
(Consisent, slightly quicker, and slightly cleaner)
Obtained from: NetBSD
I committed it. Apologies to Juergen Unger <j.unger@addict.de>.
o When stopping jails output the hostname of the jails that
were stopped.
o Refactor
o Remove extraneous empty line
o Correct spelling error
that the keys are currently generated by computing the MD5 checksum of 512
bytes read from /dev/random, and are passed to gbde on the command line.
Sponsored by: Teleplan AS
it is still above the critical temperature on the next poll cycle. This
is a 10 second advance notice by default. Document the private
(non-standard) notify we will be using with devd(8).
This commit also removes the support for the sysutils/jailer port. This
is inline with the general policy to keep ports related knobs out
of the base system's configuration mechanism.
Submitted by: Juergen Unger <j.unger@addict.de>
- If there was an exiting dhclient running on the same interface as the
new iface that left and returned then dhclient would be told to use the
same interface twice. Dhclient would fail and exit after getting
confused. Use "sort -u" on them to ensure no duplicates.
This is a mostly a race condition on suspend and resume and how things
happen to occur.
- Check for netmask being set on an interface rather then up. An interface
can be up but not configured.
Reviewed by: mbr
targets, have "distribution" always install original (as from the release
media) files, whether SENDMAIL_MC is set or not. Do error handling the
make(1) way.
Reviewed by: gshapiro
Approved by: gshapiro
in keeping the scripts under rc.d in sync with us. So, remove
NetBSD specific stuff (which made our scripts more complicated
than necessary).
The NetBSD ident string will be left intact, both for history and
also incase we wish to pull in future versions.
in keeping the scripts under rc.d in sync with us. So, remove
NetBSD specific stuff (which made our scripts more complicated
than necessary).
The NetBSD ident string will be left intact, both for history and
also incase we wish to pull in future versions.
in keeping the scripts under rc.d in sync with us. So, begin removal
of NetBSD specific stuff (which made our scripts more complicated
than necessary), starting with the NetBSD KEYWORD.
case so that if devices need different initialization, we can key off
this in the rc scripts (currently unused). Also update the man page
which is a 100% duplicate of the rc scripts.
the throttling state in response to line transitions. Future plans
include adding support for CPU frequency changes.
Add a devd.conf entry for calling this script.
The default values for this are:
performance_cx_lowest="HIGH" # Use HLT (C0) online
performance_throttle_state="HIGH" # 100% (no throttling)
economy_cx_lowest="LOW" # Use the lowest Cx state possible
economy_throttle_state="HIGH" # 100% (no throttling)
systems are mounted. An example set of entries for /etc/rc.conf:
ataraid_enable="YES"
ataraid_devices="ar0"
ataraid_ar0_set="ad2 ad3"
ataraid_ar0_type="RAID1"
Because there is no "correct" way of doing ATA raid (ie, geom vs.
atacontrol vs. vinum) that is bikeshed proof, this rcng script stays within
the bounds of atacontrol and assumes that other RAID solutions for GEOM or
vinum will end up in a different rcNG script.
Reviewed by: green
then immediately terminate the shell (during boot this
also terminates the parent rc(8) shell). This was the pre-rcNG behaviour.
Also, remove an extraneous mount /.
PR: conf/57659
Submitted by: yar (with modifications)
as these ioctl's aren't MD. This also means they are installed in
/usr/include/dev/bktr now. Also provide compatability wrappers for
where these headers lived in 4.x.
time during the boot process. This is needed in the case where NFS mounts
from servers reachable only via IPSEC are in /etc/fstab.
PR: conf/42497
Submitted by: Volker Stolz
Approved by: re (rwatson)
default attempt to list Biba, LOMAC, and MLS label information
for the socket if they are present.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
dcons(4): very simple console and gdb port driver
dcons_crom(4): FireWire attachment
dconschat(8): User interface to dcons
Tested with: i386, i386-PAE, and sparc64.
we are configured to use an MTA or MSP queue runner. Otherwise the
script used to complain about the missing PID file.
PR: conf/57075
Submitted by: Jonathan Chen <jonc@chen.org.nz>
MFC after: 2 weeks
the number of broken DNS servers out there in the world. Since we are
diverging from the sendmail.org submit.mc, it's time to make our own
freebsd.submit.mc.
PR: conf/57733
Reviewed by: nork
MFC after: 2 weeks
porting this stuff back.
* Test /etc/motd for writability before trying to update it. This is
especially useful when /etc/ is mounted ro, like on a diskless boot.
(Thanks to phk for the idea on this one.)
* Make the "updating" message reflect what actually happens.
A "driftfile" caches the oscillator offset estimate from boot to boot,
having this means faster and less bumpy time synchronization. Will
be overridden by any value in the config file.
thin blue air if the kenv doesn't have any info.
This improves the truth value of the comment above significantly and
reduces the bogous output on the console considerably.
- Use a more robust check to determine if we need to load ipl.ko.
- Don't try to run ipf -E if ipfilter is already enabled. Look at
the net.inet.ipf.fr_running sysctl to figure this out. This fixes
a warning message about ipfilter being already initialized.
- Only one ipf -E command is needed. We don't need an extra one for
the -6 case which would only print a warning message about ipfilter
being already initialized.
- Fix one occurence where we were running /sbin/ipf directly without
using the ${ipfilter_program} variable if set.
- In ipfilter_stop(), don't try to save the firewall state tables if
ipfilter is disabled. Similarly, don't try to disable it if it's
already disabled. This fixes some more error messages.
and use it in src/etc/sendmail/Makefile in case the user wants to use
a different path to the sendmail m4 sources (e.g., sendmail port users).
Submitted by: dinoex
MFC after: 21 days
X-MFC after: RELENG_4 code freeze ends
dhclient couldn't get killed.
If we execute 'dhclient -r', dhclient gets already
killed, so there is no need to do it twice. Only do
this if we really have to release some leases.
Reviewed by: silence on freebsd-rc@yahoogroups.com
written by Stuart Walsh and Duncan Barclay (with some kibbitzing by
me). I'm checking it in on Stuart's behalf.
The BCM4401 is built into several x86 laptop and desktop systems. For the
moment, I have only enabled it in the x86 kernel config because although
it's a PCI device, I haven't heard of any standalone NICs that use it. If
somebody knows of one, we can easily add it to the other arches.
This driver uses register/structure data gleaned from the Linux
driver released by Broadcom, but does not contain any of the code
from the Linux driver itself. It uses busdma.
device special files created by sio(4). The latter are the device
special files created by uart(4). As of this moment sio(4) is not
supported on ia64... by me, that is :-)
with the vendor sendmail distribution. By doing so, we avoid mergemaster
warnings after every 'make' in /etc/mail/.
Reported by: Jeremy Chadwick <koitsu@parodius.com>
MFC after: 3 days
X-MFC after: and re approval
o The following additional configuration attributes of a jail can be
controlled from rc.conf:
- mounting devfs(5)
- mounting fdescfs(5)
- mounting procfs(5)
- custom devfs(8) ruleset
If no ruleset is specified, the default jail ruleset is used.
o The output of executing /etc/rc in the jail is now redirected
to /dev/null. Instead, the hostname of the jail is echoed if
the jail(8) command exited successfully. If the output is wanted
it can probably be redirected to a file (/var/run/$jail maybe)
instead of /dev/null.
Submitted by: Scot W. Hetzel <hetzels@westbend.net>
with modifications by Jens Rehsack <rehsack@liwing.de>
and me.
the src/etc makefile. This list was used to manually
install the files from src/etc. Instead, simply change
directory and 'make install'.
o There is no reason for the files in src/etc/defaults to
be installed as writeable.
Reviewed by: ru
off by default.
o Apparently the routine displaying the informational messages wasn't
checking its knob in rc.conf, so fix that as well.
Requested by: obrien
devfs(8) rules in rc(8). It is most useful for applying
rules to devfs(5) mount points in /dev or inside jails.
The following line of script is sufficient to
mount a relatively useful+secure devfs(5) in a jail:
devfs_mount_jail /some/jail/dev
Some new shell routines available to scripts that source
rc.subr(5):
o devfs_link - Makes it a little easier to create symlinks
o devfs_init_rulesets - Create devfs(8) rulesets from devfs.rules
o devfs_set_ruleset - Set a ruleset to a devfs(5) mount
o devfs_apply_ruleset - Apply a ruleset to a devfs(5) mount
o devfs_domount - Mount devfs(5) and apply some ruleset
o devfs_mount_jail - Mount devfs(5) and apply a ruleset
appropriate to jails.
Additional rulesets can be specified in /etc/devfs.rules.
If the devfs_system_ruleset variable is defined in rc.conf
and it contains the name of a ruleset defined in /etc/defaults/devfs.rules
or user supplied rulesets in /etc/devfs.rules then that ruleset will
be applied to /dev at startup by the /etc/rc.d/devfs script. It can
also be applied post-startup:
/etc/rc.d/devfs start
This is a more flexible mechanism than the previous method of using
/etc/devfs.conf. However, that method is still available.
Note: since devfs(8) doesn't provide any way for creating symlinks
as part of a ruleset, anyone wishing to create symlinks in a devfs(5)
as part of the bootup sequence will still have to rely on /etc/devfs.conf.
use the atmconfig(8) utility instead of route(8) to install those routes.
For this we need a new rc.conf variable natm_static_routes that works
just like static_routes except that the referenced routes use the syntax
of atmconfig(8).
Okay'ed by: mtm
one internal device. Don't call the startup procedure again if
we already use start.
Support a manually started dhclient and keep its configured
interfaces after pccard removal.
Make pccard_ether working in single-user mode without /usr mounted.
There are now many configurations which have a NIC on board, and
pccard slots. If a dhclient is running on the internal nic, the
Improve the handling dhcp handling of pccard_ether.
Improve the dhcp handling of pccard_ether.
There are now many configurations which have a NIC on board and
Improve the dhcp handling of pccard_ether.
There are now many configurations which have a NIC on board and
cardbus slots too. If a dhclient was already running on the internal
NIC, the user was forced to kill a running dhclient manually.
If now a pccard is included at startup time, /etc/rc.d/dhclient
start does include it into the startup list for dhcp devices.
That means you can now do dhcp on the internal and the pccard devices
at the same time. If the card is plugged in later, a running dhclient
(working for the internal interface only) is killed, and restarted,
but the interface name of the new pccard is added to the internal
name. After removal, /etc/rc.d/dhclient is started again. This
script does nothing if there are no devices in /etc/rc.conf
This is only a workaround for a well known problem. After we have
a dhcp client which handles device adding and removal, it will go
away.
The original name was really a mistake since
/usr/local/etc/rc.d scripts can (and usually do) start
more than just daemons. Even the output in the script
uses 'local packages.' Also, the term 'local daemons' is
used by rc.d/local, which was etc/rc.local of rcOG fame.
No repo-copy because there isn't much history to save.
I will remove localdaemons shortly with all the other
files that don't belong in rc.d anymore.
Discussed with: dougb, freebsd-rc@yahoogroups.com
for the harp(4) pseudo driver and for loadable native HARP drivers
(like hfa_pci).
To use harp(4) the rc variable natm_interfaces must be set to the
list of NATM interfaces to be used for HARP. These interfaces
will be brought up with ifconfig and the harp(4) will be loaded.
To use loadable native HARP drivers atm_load must be set to
the list of drivers to load.
Reviewed by: mtm, gordon (partly)
and PAM configuration. Remove the line concerning "auth_list"
from the template, since it's referenced only in the tinyware
password command, and only #ifdef KERBEROS, which isn't defined
in tinyware. Add a comment about auth.conf being on the way
out the door. The one remaining consumer of auth.conf is
crypt(3).
the address, also kill the dhclient process. Instead of doing the
release in the stop command, move it to the precmd stage and allow
rc.subr(8) to automatically kill the dhclient process by leaving the
stop command undefined.
Noticed by: mbr
evaluating the $_precmd command as a string. We're not actually
trying to evaluate the contents of the command.
Reported by: Glenn Johnson <gjohnson@srrc.ars.usda.gov>
variable in rc.conf to have sshd from ports (or somewhere else) installed.
So, don't make the sshd_config for the base system a required file
to start the service.
PR: conf/45766
instead of SENDMAIL_MC but don't remove on it 'make clean' as the
user may not have the original .mc file and removing it could be
dangerous (e.g., make SENDMAIL_CF=/etc/mail/sendmail.cf clean).
Noticed by: peter
MFC after: 3 days
defined. The only two files installed in this case are aliases (which
I believe other MTAs may use) and mailer.conf (which isn't sendmail,
it belongs to mailwrapper).
PR: 50477
MFC after: 5 days
`hostname`.submit.mc which is templated from freebsd.submit.mc if the
default file does not exist. This makes the building of the submit.cf
behavior identical to that of the the sendmail.cf.
PR: 44256
Submitted by: Matt Emmerton <matt@gsicomp.on.ca>
MFC after: 5 days
- Stop 'make clean' from removing SENDMAIL_CF
- install and distribute targets should not attempt to build anything
- SENDMAIL_ADDITIONAL_CF were not installed in the distribution case
- If SENDMAIL_SET_USER_ID was defined, submit.cf was needlessly installed
in the distribution case
- Collapse install and distribution target into one to remove code
duplication
Submitted by: ru
MFC after: 5 days
network interfaces could only be turned on and off as a group (all
static interfaces or all dhcp interfaces).
When used to start the interface a 'long form' ifconfig output is
used to show the status of the interface, but when stopping an interface
the script will simply output the name of the interface. This is simply my
personal preference. Hopefully as this functionality matures we can
stabilize on a prefered form of output for these scripts.
A stop command to the dhclient script now explicitly releases the dhcp lease.
Behaviour at system shutdown; however, is unchanged since dhclient is not,
by default, run at that time. The client will not release its lease
at shutdown.
o Ensure rc.d/network2 and rc.d/network3 are not automatically run
during boot
o Modify script headers so rcorder(8) can put the two scripts in the
correct sequence.
o Change the provider names.
o Separate routing into two parts: static routing and routing options. The
start command will run both parts, but they can be run separately using
the static and options command, respectively:
(/etc/rc.d/routing static; /etc/rc.d/routing options)
This commit has two pieces. One half is the watchdog kernel code which lives
primarily in hardclock() in sys/kern/kern_clock.c. The other half is a userland
daemon which, when run, will keep the watchdog from firing while the userland
is intact and functioning.
Approved by: jeff (mentor)
than duplicate it. This requires OpenPAM Dianthus, which was committed two
weeks ago; installing these files on a system running a world older than
June 1st, 2003 will cause login(1) and su(1) to fail.
It currently supports the PMC Sierra Lite, Ultra and 622 chips and
the IDT 77105. The driver handles media options and state in a consistent
manner for ATM drivers. The next commit to the midway driver will make
it use utopia.
exception of the default 'status' command) regardless of whether the
executed command was actually successfull or not. Forced scripts should
always correctly reflect the outcome of the command.
NOTE: exit values are treated as booleans. We don't care what
the actual exit value was, only whether it was successfull or not.
interfaces, interface aliases, user supplied ifconfig scripts, and
ipx interfaces. The ipx routine fails unconditionaly at the moment.
Someone who has a need for it can fill it in with the appropriate incantations.
take advantage of the rc.subr(8) glue. They are renamed dhclient_program
and dhclient_flags.
o Rename them in rc.conf(5)
o Rename them in /etc/defaults/rc.conf
o Add the deprecated variables to /etc/rc.subr
o Isolate the use of the 'command' variable to the
NetBSD specific parts in /etc/rc.d/dhclient.
o Now that dhcp_flags has also been renamed it will
be applied properly by rc.subr(8) glue code.
Reported by: John Nielsen <john@jnielsen.net>
really make much difference since this script is not used during startup
and is due to be removed before RELENG_5.
Submitted by: "Simon L. Nielsen" <simon@nitro.dk>
down to the section of optional mail/news services. Change the nntpd
location to /usr/local/libexec since it's an optional software.
Henceforth, nntpd will be advised to run as "news", which is a
standard user in the system, instead of "usenet", which has never
existed in the default master.passwd(5).
Note: It's not "news:news" since inetd(8) runs a service at the
specified user's login group by default.
Add a blank comment line above the uucpd line so the section looks uniform.
Partly pointed out by: Alexey Neyman <alex.neyman at auriga.ru>
MFC after: 1 week
with the rest of the options following it. This caused problems for
people using ldconfig_insecure=yes because the '-i' switch was being
positioned before the format argument.
Approved by: markm/mentor (implicit), re/rwatson
PR: 47430
script to read /etc/devfs.conf, and take appropriate actions based on
what it finds there.
The (commented out) examples in the new devfs.conf file are taken in
part from the old rc.devfs script.
sessions if the mailer is dynamically linked. This happens because
on some systems the ldconfig script is run after the vi recovery
script.
I thought I had already fixed this with revision 1.5 of rc.d/ldconfig,
but apparently not. So, in addition I'm making ldconfig a requirement
of this script.
Approved by: markm (mentor)(implicit)
PR: bin/51767
We can't remove the sourcing of /etc/rc.devfs yet in case the user
might have custom entries in it. We will have to come up with an
/etc/devfs.rules or something to make this kind of thing easier.
Approved by: markm (mentor)(implicit)
All functionality from the previous system has been preserved, and
users should still customize their system boot with the familiar
methods, rc.conf, rc.conf.local, rc.firewall, sysctl.conf, etc.
Users who have customized versions of scripts that have been removed
should take great care when upgrading, since the compatibility code
that used those old scripts has also been removed.
script at which a filesystem will be mounted in FreeBSD. Without this
the script was being inserted later in the boot than necessary.
Approved by: markm (mentor) (implicit)
Reviewed by: dougb
Noticed by: Andrzej ToboÅa <san@wilk.2a.pl>
it doesn't work because the start_cmd doesn't enable ipfilter if
it is currently disabled.
Approved by: markm (mentor) (implicit)
Submitted by: Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
PR: conf/46103
o group them together so they run one right after another
o use the NetBSD supplied ipfs script instead of tacking
it on to the end of ipnat
o Load the ipl module in ipnat and ipfilter, if it's not already
loaded
o In ipmon and ipnat show a warning if neither ipfilter nor
ipnat is enabled or the ipl module is not loaded, and exit
Approved by: markm (mentor) (implicit)
Tested by: leafy <leafy@leafy.idv.tw>
This is how it has always been done (before and after rc.d) but
I somehow failed to include it when I broke up network1.
Submitted by: bmah
Approved by: markm (mentor)(implicit)
no longer plan on shipping a TE MAC module independent from SEBSD.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
o /etc/network.subr contains common subroutines used for seting
up network interfaces
o rc.d/hostname sets the hostname if not already set
o rc.d/nisdomain sets the nis domain *after* rpcbind but
before the yp* daemons. This fixes issues with temporary
hangs when looking up informaion in nis before it's ready.
o rc.d/netif brings network interfaces (minus dhcp) up.
o rc.d/network1 has been disabled and will be retired before
RELENG_5. It will be replaced by rc.d/netif
Approved by: markm (mentor)
stop ipfw, but not enable it again.
Aesthetic changes
o Use positve logic (instead of negative)
o create a 'stop' function, rather than putting the
commands in the stop_cmd variable.
Submitted by: des
Approved by: markm (mentor) (implicit)
but it's no longer a part of the base-system and buildworld works fine
here after deleting them both on disk and from the mtree spec files.
Not objected to by: kris, silence on -audit
devd later in the boot process. This should fix all the problems
people have had with those commits. Diskless should be working again,
and those that mount /usr with nfs should be able to do that again too.
critical remote systems. This lets us run commands from devd that
aren't on the / partition. This also means we can remove some kludges
from the networking startup that I added a while ago that caused other
problems.
There's still a race in starting devd that needs to be fixed in devd
so that things present at boot will be configured by the time devd
does daemon(). That race will be fixed later.
device node exists directly to see if OLDCARD is compiled into the
kernel. This eliminates the scary warning that people using NEWCARD
are seeing when they have pccard_enable=YES in their /etc/rc.conf
files.
be). Using that string leads rc.network to execute:
# sysctl -w vfs.nfs.bufpackets=DEFAULT
vfs.nfs.bufpackets: 4 -> 0
Which isn't what was intended.
PR: conf/31280
MFC after: 3 days
name of the device that it creates. Update /etc/ttys accordingly.
An alias is created for the old name so that old /etc/ttys will continue to
work, but due to aliases being implemented as symlinks in devfs you cannot
login as root when using the alias device.
Discussed with: grehan
withough the $natd_interface having to be explicitly specified on the
command line.
Approved by: markm (mentor)
Submitted by: Aaron D. Gifford <agifford@infowest.com>
PR: conf/47024
MFC: upon re approval
named(8) daemon by providing a new rc.conf knob: named_pidfile
that defaults to the path specified in the system-installed named.conf(5).
Approved by: markm (mentor)
Reviewed by: dougb
Noticed by : Galen Sampson <galen_sampson@yahoo.com>
Dan Pelleg <daniel+bsd@pelleg.org>
PR: conf/46402
MFC: 2 weeks (with re@ approval)
to /dev/raidctl, don't set the group to operator. (This isn't a
storage device, it's a control device).
Also, since umask here is already restrictive, we don't need to
explicitly set the mode.
Submitted by: bde
Instead, load them as part of the rc.d system. This allows us to prioritize
the initidiskless script so it runs before the configuration files are loaded
and allows us to get rid of the exit 2 hack in /etc/rc. The exit 2 never
worked anyway since it did not unset the prior configuration, causing the
diskless code to not operate properly.
Do a major cleanup and revamping of the diskless code for RCNG. This will
be backported to the non-RCNG scripts as well as -stable.
With suggestions from: Mike Makonnen <mtm@identd.net>
MFC after: 7 days
the whole thing generic. That is, /conf/base, /conf/default,
/conf/${ipba}, and /conf/${ip} are all handled the same way.
Introduce an NFS remounting feature via the /conf/base/<dir>/diskless_remount
so you can avoid dup'ing system directories in /conf (described in rc file).
Introduce a memory filesystem sizing feature via the /conf/base/<dir>/md_size
file that allows you to override the default memory filesystem size.
Introduce a file containing relative paths to remove for each memory filesystem
directory as /conf/base/<dirname>.remove.
Make the cpio feature more generic (applies to any filesystem) (aka
/conf/base/<dirname>.cpio.gz).
Allow any root directories to be created as a memory filesystem via the
/conf/*/* mechanism.
Replace the copyright notice with a reference to the COPYRIGHT file and
do other cleanups.
(documentation and man page updates to follow).
MFC after: 3 days
background fsck. The delay defaults to sixty seconds to allow
large applications such as the X server to start before disk I/O
bandwidth is monopolized by fsck.
Submitted by: Brooks Davis <brooks@one-eyed-alien.net>
Sponsored by: DARPA & NAI Labs.
from "unix" back to "local". Add some compat stuff so both
ways work for some time.
Reviewed by: phk
Approved by: imp (UPDATING)
Requested by: iedowse, lukem@netbsd.org
that's being replaced here. This is what /etc/rc does now.
There is no NetBSD devfs, so there is no compatibility issue.
Not objected to by: FreeBSD-rc@yahoogroups.com
Approved by: re (murray)
where people want to have the cards configured. Lack of -z is a speed
optimization.
Submitted by: many voices on mobile@
Approved by: re@ (rwatson)
MFC after: 3 days
Fix a minor grammer nit.
Get rid of _echo that uses logger and just call logger in the 3 routines
that need it.
Add a comment referencing rc.conf(5) in the case of an incorrectly set
variable.
This pulls rc.subr up to 1.51 of rc.subr. I skipped 1.49 (systrace support)
since I don't have systrace.
Obtained from: NetBSD
to specify rules definition file for ipfilter. The default is
/etc/ipf6.rules. If there is a file which is specified by
'ipv6_ipfilter_rules', IPv6 rule is installed.
Reviewed by: Ronald van der Pol <Ronald.vanderPol@rvdp.org>
MFC after: 1 week
an entry in /etc/sysctl.conf didn't exist. Fixing this exposed a minor
typo "exits" vs. "exist".
However, there doesn't appear to be any provision to run this with
the "lastload" argument, meaning that the error will never appear.
whatever random value was already in $unit. It happened to work
because the variable is often unset, but this is not always the
case e.g. when you call "MAKEDEV sio2 usb ..."
This affects -stable as well.
Reviewed by: n_hibma
Silence from: re
MFC after: 3 days
# or any login.conf resource limits or features; use it only if this is
# appropriate for your environment. If you require these features, use
# the regular FreeBSD ftpd below.
Discourage users from using lukemftpd if they rely any of these standard
FreeBSD features that are fully supported by our native ftpd. There
may be other features that are not yet supported that I have not yet
discovered.
tells applications to print labels for all of the TrustedBSD-
generated policies, if they are present.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
the wheel group has no explicit members listed in /etc/group. This adds
the "exempt_if_empty" flag to pam_wheel in the default configuration;
in some environments, it may be appropriate to remove this flag, however,
this default is the same as pre-pam_wheel.
Reviewed by: markm
Sponsored by: DARPA, Network Associates Laboratories
configuration. Root privileges override DAC on local file systems and
therefore root does not generally need to be a member of a group to
access files owned by that group. In the NFS case, require explicit
authorization for root to have these privileges.
Leave root in operator for dump/restore broadcast reasons; leave root
in wheel until discrepencies in the "no users in wheel means any user
can su" policy are resolved (possibly indefinitely).
* Space -> tabs conversion.
* Removed blanks before semicolon in "if ... ; then".
* Proper indentation of misindented lines.
* Put a full stop after some comments.
* Removed whitespace at end of line.
Approved by: silence from gordon
script did. Stuff in rc.local frequently has lines like
"echo -n ' service_name'" which look ugly without a prefix and a
trailing period. Likewise for rc.shutdown.local for consistency.
and atime only, but also the ctime. Otherwise, files extracted from
tar or zip archives will immediately be declared stale since they've
got their mtime reset to the original mtime.
Reviewed by: brian
MFC after: 1 week
