src/usr.sbin/bsdinstall/scripts/config, branch main

bsdinstall: Stop loading cryptodev for ZFS installations

2024-05-08T16:01:52Z

- zfs depends on the crypto module, not cryptodev, and most arm64 kernel configs include std.dev, which includes "device crypto" anyway. - This config works around a problem with kldxref lacking cross-target support, but that has since been fixed. - Loading cryptodev creates /dev/crypto, which gives unprivileged users access to the kernel's opencrypto framework. Very few applications need it, so we're needlessly increasing the kernel's surface area. Thus, stop auto-loading cryptodev. Reviewed by: kevans, allanjude, des Differential Revision: https://reviews.freebsd.org/D45127

Remove $FreeBSD$: one-line sh pattern

2023-08-16T17:55:03Z

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Revert r361257: bsdinstall: do a `certctl rehash` upon installation [...]

2020-09-17T20:35:45Z

As of r365829, any given base distribution set will now include the /etc/ssl symlinks that this rehash would've otherwise installed. This extra step is no longer required. MFC after: 1 week X-MFC-With: r365837

bsdinstall: Update loader.conf for new OpenZFS deps

2020-08-25T21:07:27Z

zfs.ko now includes the SPL but relies on cryptodev instead. Reported by: D Scott Phillips Sponsored by: iXsystems, Inc.

bsdinstall: do a `certctl rehash` upon installation of configuration

2020-05-19T15:19:39Z

If certctl is installed on the system we're configuring, do a certctl rehash. Note that certctl may not be present if the world we've installed was built either WITHOUT_OPENSSL or WITHOUT_CAROOT. In this scenario, we don't currently see if the host has a certctl as this may be an indication that the system *shouldn't* have certs installed into /etc/ssl. Reviewed by: allanjude, dteske MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D24640

Add a comment explaining why the opensolaris_load line in loader.conf

2019-10-02T16:09:28Z

is explicitly added. Requested by: rgrimes MFC after: 3 days MFC with: r353004 Sponsored by: Rubicon Communications, LLC (Netgate)

Explicitly add opensolaris_load="YES" to loader.conf through the

2019-10-02T13:30:17Z

installer when installing the system on a ZFS root filesystem. For arm64, zfs_load="YES" does not add opensolaris.ko as a kld dependency, so add it explicitly to prevent boot-time failures out-of-box. PR: 240478 MFC after: 3 days Sponsored by: Rubicon Communications, LLC (Netgate)

Fix variable name typo in the bsdinstall ttys hardening code.

2018-09-20T16:37:50Z

Submitted by: Jörg Pernfuß Reviewed by: allanjude, dab, emaste Approved by: re (gjb) Differential Revision: https://reviews.freebsd.org/D12476

Ignore error return from newaliases(1)

2017-09-11T17:39:21Z

This was originally added as "exit $SUCCESS" but with nothing to set the SUCCESS variable. Thus it became an exit with no argument, which just exits with the status of the preceding command. MFC after: 3 days Sponsored by: The FreeBSD Foundation

Add option to bsdinstall to disable insecure console, update stack guard option

2017-07-05T13:37:27Z

This patch adds new bsdinstall option to hardening section that allows users to change this behaviour to secure one and updates stack guard option so it would set the value of relevant sysctl to 512 (2MB) Submitted by: Bartek Rutkowski Reviewed by: adrian, bapt, emaste Approved by: bapt, emaste MFC after: 1 day Sponsored by: Pixeware LTD Differential Revision: https://reviews.freebsd.org/D9700