src/libexec/rc, branch main

nuageinit: Allow the userdata script to run before firstboot* rc services

2026-08-01T13:02:59Z

Allowing nuageinit user scripts to run before these makes it possible to customize official BASIC-CI and BASIC-CLOUDINIT FreeBSD images. This was requested by KDE for their CI. Approved by: cperciva Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/60

rc.d/bthidd: Correct load_kld invocations

2026-07-31T18:05:03Z

Pass a single module name to load_kld for kbdmux and vkbd, allowing bthidd_prestart to load both modules successfully. Fixes: cfe1962a1925 (rc: Fix improper use of load_kld) MFC after: 3 days Sponsored by: The FreeBSD Foundation

rc.subr: Fix premature return from wait_for_pids

2026-07-27T10:15:47Z

Use pwait's new -r option to wait until the target processes have not only terminated, but also been reaped. PR: 293183 MFC after: 1 week Sponsored by: Klara, Inc. Sponsored by: NetApp, Inc. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58391

rc.d/dumpon: minor hardening/tightening up

2026-07-16T16:25:03Z

- Scope local variables properly to each function. - Quote variables that should be treated as single words. - Replace `${cmd}; if [ $? -eq 0 ]` with `if ${cmd}` for simplicity. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57899

pflog: create bpf tapping points without ifnet(9)

2026-06-28T13:59:35Z

Just as was done for ipfw's log device stop creating entire struct ifnet's for pflog devices. Create only a bpf_t. This does mean we lose the create/destroy infrastructure provided by the clone interface. Rather than implement this ourselves we allow users to configure the number of pflog interfaces using the net.pflog.if_count sysctl. We default to 8 devices, but allow up to 256. The /etc/rc.d/pflog script will create extra devices as required. While it was possible to rename pflog devices pfctl expected the pflogX name, so it's safe to assume users never did this. Requested by: glebius Reviewed by: glebius Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D57851

rc.d: fix lockd and statd flags processing after scvj

2026-06-27T13:52:08Z

The documented flags are named differently than the script name, this requires special handling of the flags. The Service Jails feature requires the handling of the variable to be differently than it was initially. The change back then did not work, which resulted in the flags to be ignored. This commit fixes the issue in head. This affects 15.0 and 15.1 too. PR: 296233 Reported by: Robert Blayzor Tested by: Robert Blayzor Fixes: f99f0ee14e3af81c2 - rc.d: add a service jails config to all base system services MFC after: 1 month MFC to: 15-stable

rc.d/tmp: Fix dupe mount check

2026-06-26T14:39:03Z

Before mounting a new mfs on /tmp, we check if there already is one. However, the dupe check only takes /dev/md[0-9]* into account, while the default mfs type these days is tmpfs. Rewrite it to look for tmpfs as well. Note that the dupe check is redundant in the tmpmfs=auto case, but we leave moving it for later. PR: 182035 MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57682

rc.d/ddb: Really silently exit

2026-06-26T14:38:58Z

The comment says “silently exit if ddb is not enabled”, but we'd exit with an error message. Note that I switched the sysctl variable used to test for the presence of ddb from debug.ddb.scripting.scripts to d.d.s.script, which has a smaller value if set. While here, drop a pointless fork-exec, and use ${SYSCTL_N} for consistency. PR: 177217 MFC after: 1 week Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57686

rc.firewall: Support on-disk lists

2026-06-26T14:38:53Z

For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679

rc.firewall: Use checkyesno for boolean variables

2026-06-26T14:38:44Z

Use the checkyesno function from rc.subr instead of hardcoded checks for boolean variables. Also drop an incorrect comment about the default logamount value; the actual default is zero (unlimited). MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57678