aboutsummaryrefslogtreecommitdiff
path: root/libexec
Commit message (Collapse)AuthorAgeFilesLines
* nuageinit: fix support on OpenStackAdam Mizerski4 days1-8/+6
| | | | | | | | | | | | | | Change added in 90a7728cd8905cd26b90d06f7873df8bad43ae9a contained a lot of bugs: - If all network interfaces correctly respond to DHCP, then pwait was waiting forever. - If there was more than 1 interface, then "cat /tmp/ephemeraldhcp.*.pid" joined pid numbers into one long string. - "for iface in $left; do kill -15 $left; done" is not using $iface. Tested by: adam.mizerski@ovhcloud.com Sponsored by: OVHcloud Pull Request: https://github.com/freebsd/freebsd-src/pull/2436
* rtld: more caution when parsing in digest_notes()Konstantin Belousov7 days1-5/+10
| | | | | | | | | | | | | | | | | | | Incorrect ELF might have PT_NOTE slightly larger than the needed to contain all notes, and the PT_NOTE size could be larger than one page. Then rtld mmaps just the notes bytes to parse. After the last note, we iterate past the mapped region trying to read the Elf_Note header. This was found in wild. Require full elf note to fit into the [start_note, end_note) region to continue the parsing. Check it in stages, first verifying the Elf_Note header structure fits, to be able to read the name and data length. After that, check the whole note against limit. Reported and tested by: makc Reviewed by: emaste Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59635
* rtld.c: fix indentKonstantin Belousov7 days1-1/+1
| | | | | Sponsored by: The FreeBSD Foundation MFC after: 3 days
* amd64 rtld: implement support for TLSDESC relocationKonstantin Belousov2026-09-053-6/+166
| | | | | | | Discussed with: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59269
* i386 rtld: implement support for TLSDESC relocationKonstantin Belousov2026-09-054-4/+183
| | | | | | | Discussed with: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59269
* rtld i386: use macro for the 'GNU ABI' calling convention of TLS resolverKonstantin Belousov2026-09-052-3/+5
| | | | | | | Discussed with: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59269
* rtld: explain the use of rtld_bind_lock in rtld_get_addr_slow()Konstantin Belousov2026-09-051-0/+5
| | | | | | | Discussed with: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59269
* rtld: allow arches to initialize/finalize objectsKonstantin Belousov2026-09-058-0/+23
| | | | | | | Discussed with: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59269
* rc: add a backlight service to save/restore backlight levelsKyle Evans2026-09-023-0/+90
| | | | | | | | | | | | | | | The default on my laptop is annoyingly bright, and this is a useful feature to mitigate that. The backlight script is largely a copy of the mixer service which provides the same value for mixers, but this one is specifically dependant on kld to allow DRM drivers a chance to attach. Note that it's off by default to avoid interference with DEs, and document the capability in backlight(8). Set backlight_enable=YES in rc.conf(5) to enable save/restore. Relnotes: maybe Reviewed by: bapt, ivy, manu, ziaee Differential Revision: https://reviews.freebsd.org/D59296
* nfsclient: Add a new nfs_client_rdma_enable variableRick Macklem2026-08-302-0/+4
| | | | | | | | | | | | | | | | | | | This patch adds a new nfs_client_rdma_enable variable to /etc/rc.d/nfsclient to enable the client side of NFS over RDMA. The client side of NFS over RDMA requires the nfsclrdma.ko module, which is still under test/review. I wanted to get the "glue" into main so that others could test the module more easily. Avaliability of the module will be announced on freebsd-current@ soon. It should not affect non-RDMA operation. I've specified a long MFC, since the module still requires extensive testing and, hopefully, a review. MFC after: 3 months
* rc.subr tests: service jail behaviour of run_rc_commandAlexander Leidinger2026-08-302-1/+1179
| | | | | | | | | | Twenty cases over where each rc option and each method executes for a jailed service, the jail's lifetime, and the svcj option handling. Each case drives the service inside a chroot built in its ATF work directory. MFC after: 1 week MFC to: stable/15 Assisted-by: Claude Code (Opus 5)
* rc.subr: svcj - add a setaudit optionAlexander Leidinger2026-08-301-0/+3
| | | | | | | | | | | setaudit(8) is prefixed to the command inside the jail when ${name}_audit_user is set, and needs allow.setaudit. This is not added automatically when ${name}_audit_user is set, this needs an administrative setting of the options on purpose. MFC after: 1 week MFC to: stable/15
* rc.subr: svcj - run a service's own restart and status methods in its jailAlexander Leidinger2026-08-301-1/+17
| | | | | | | | | | | A script that defines non-default restart_cmd or status_cmd should execute them in the service jail. Where there is no jail to enter, restart starts the service instead of failing. Fixes: 2efbd480f1d3 rc: add service jails framework MFC after: 1 week MFC to: stable/15 Assisted-by: Claude Code (Opus 5)
* rc.subr: svcj - remove the service jail when the service is not runningAlexander Leidinger2026-08-301-0/+4
| | | | | | | | | | | A service whose tracked process had died while another process of its own kept the jail alive, therefore left svcj-${name} behind, and the next start would fail. Fixes: 2efbd480f1d3 rc: add service jails framework MFC after: 1 week MFC to: stable/15 Assisted-by: Claude Code (Opus 5)
* rc.subr: svcj - let svcj_all_enable enable service jailsAlexander Leidinger2026-08-302-1/+4
| | | | | | | | Fix the logic for svcj_all_enable. Fixes: 2efbd480f1d3 rc: add service jails framework MFC after: 1 week MFC to: stable/15
* rc.subr: svcj - send the stop signal from inside the service jailJochen Neumeister2026-08-301-0/+3
| | | | | | | | | | | A service running under ${name}_user was signalled from the host as that user, which the parent of a jail may no longer do: since 8a5ceebece03 an unprivileged process would need allow.unprivileged_parent_tampering. Stop and reload therefore failed and left both the service and its jail running. MFC after: 1 week MFC to: stable/15
* rc+devd: Add growfs_postbootColin Percival2026-08-243-0/+120
| | | | | | | | | | | | | | | | | | | | | | | | In VM and cloud environments it is often possible to enlarge virtual disks; this can be useful, for example, if a system is launched with a small root disk and it later becomes clear that more space is needed. On kernels which support run-time resizing of disks (for NVMe, this was added in November 2025; some other disk types have supported this for longer) a SIZECHANGE notification is sent to userland via devd. Add a "nostart" rc.d script (runnable manually but not automatically at boot time) and a devd script which invokes it when a notification arrives. The rc.d script enlarges the "final partition" on partitioned geoms, or the UFS filesystem or zpool device when triggered on a disk containing either of those. Reviewed by: imp, ziaee MFC after: 2 weeks Relnotes: Disk partitions and filesystems can be enlarged automatically when disks grow by setting growfs_postboot_enable=YES in /etc/rc.conf. Sponsored by: Amazon Differential Revision: https://reviews.freebsd.org/D58582
* nuageinit: root should be allowed to log in when disable_root is falseNavdeep Parhar2026-08-221-0/+2
| | | | | | | | | PermitRootLogin is "no" by default and that stopped root from logging in even though disable_root was set to false during initialization. Reviewed by: bapt Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D59101
* rc.conf: Fix the default NFS-over-RDMA port numberVinicius Ferrao2026-08-151-1/+1
| | | | | | | | | | | The default for nfs_server_rdma_listen transposed two digits: 20490 instead of 20049, the IANA-assigned port for NFS-over-RDMA. Fixes: 471e14267bea ("nfsd: Update the rc.d script for RDMA for the nfsd service") MFC after: 1 month Sponsored by: VersatusHPC Pull Request: #2371 Signed-off-by: Vinícius Ferrão <ferrao@versatushpc.com.br>
* nfsd: Update the rc.d script for RDMA for the nfsd serviceRick Macklem2026-08-142-0/+9
| | | | | | | | | | | | | | | | | | | | | | Commit 7144a1d58c5c added the hooks for the nfsrdma.ko module. Once loaded, this module adds RDMA support to the nfsd. This patch adds a few lines to /etc/rc.d/nfsd, so that nfs_server_rdma_enable="YES" in your /etc/rc.conf will load nfsrdma.ko, so that RDMA service is enabled. It also supports nfs_server_rdma_listen="port#" so that the default of 20490 can be overridden in /etc/rc.conf. At this available as time, the nfsrdma.ko module is an unofficial port, since it was developed by Vinicius Ferrao <ferrao@versatushpc.com.br> using generative AI. As soon as it is available, it will be announced on freebsd-current@freebsd.org. Suggested by: Vinicius Ferrao <versatushpc.com.br> MFC after: 1 month
* etc/rc.subr: svcj - use the filename for servicesAlexander Leidinger2026-08-141-6/+6
| | | | | | | | | | | We have ports and basesystem services, where the internal name and the filename differ. While the documentation recommends to keep them in sync, the reality is different. For service jails use the basename of the service filename. Fixes: 2efbd48 rc: add service jails framework Suggested by: joneum MFC after: 1 week MFC to: stable/15
* rc.d/bgfsck: use the correct variable nameAlexander Leidinger2026-08-141-1/+1
| | | | | | | The name of the script and the name used internally for rc.conf differ, as such the hardcoded disabling of service jails for the didn't work. Fix by using the correct name. Fixes: f99f0ee14e3af rc.d: add a service jails config to all base system services
* rtld: Remove a stale #ifdef PICJohn Baldwin2026-08-131-2/+0
| | | | | | | | | | rtld has always been built PIC since commit 7ca8e6a67068e8357e251bd3ea86253c8a751d59. The stale #ifdef might confuse a reader by thinking rtld can be built as non-PIC. Reviewed by: kib Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D58623
* rc_subr_test: ignore stderr in no_cycles testSiva Mahadevan2026-08-131-1/+1
| | | | | | | | | | | | | nuageinit_user_data_script references 'firstboot_freebsd_update' and 'firstboot_pkg_upgrade', which are from Ports. In a default base system test without sysutils/firstboot-freebsd-update and sysutils/firstboot-pkg-upgrade, rcorder will warn on "unknown provisions" to stderr, but is otherwise harmless. Reviewed by: arrowd Fixes: 16e47f317c4ce2be5fed530bf8a9af9f9bf55364 MFC after: 3 days Sponsored by: The FreeBSD Foundation
* nuageinit: support allow_public_ssh_keysBaptiste Daroussin2026-08-113-2/+55
| | | | Skip importing datasource public keys when set to false.
* nuageinit: accept lock_passwd for usersBaptiste Daroussin2026-08-113-2/+35
| | | | Alias cloud-init lock_passwd key alongside locked.
* nuageinit: fix ssh_pwauth string handlingBaptiste Daroussin2026-08-112-3/+37
| | | | Treat "no"/"unchanged" correctly instead of any non-nil value as yes.
* nuageinit: adopt cloud-init disable_root semanticsBaptiste Daroussin2026-08-114-41/+73
| | | | | | | disable_root now restricts root's authorized_keys instead of setting PermitRootLogin. Reported by: np@
* rtld: fix indentation of multiline conditionalBrooks Davis2026-08-031-2/+2
| | | | | Fixes: 7e2f38311e62 ("rtld-elf/rtld.c: apply clang-format") Sponsored by: Innovate UK
* nuageinit: Allow the userdata script to run before firstboot* rc servicesGleb Popov2026-08-011-0/+1
| | | | | | | | | | Allowing nuageinit user scripts to run before these makes it possible to customize official BASIC-CI and BASIC-CLOUDINIT FreeBSD images. This was requested by KDE for their CI. Approved by: cperciva Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/60
* rc.d/bthidd: Correct load_kld invocationsLi-Wen Hsu2026-07-311-2/+2
| | | | | | | | | Pass a single module name to load_kld for kbdmux and vkbd, allowing bthidd_prestart to load both modules successfully. Fixes: cfe1962a1925 (rc: Fix improper use of load_kld) MFC after: 3 days Sponsored by: The FreeBSD Foundation
* rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memszJohn Baldwin2026-07-312-0/+18
| | | | | | | | | | All sorts of places in the ELF loading code assume that filesz <= memsz, so check that explicitly up front. The kernel already performs this check for the PT_LOAD segments in the main binary and rtld in imgact_elf.c. Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58541
* rtld: Remove write-only text_end local variable from map_objectJohn Baldwin2026-07-291-7/+0
| | | | | | | Reviewed by: kib Fixes: 561991144e42 ("Remove Obj_Entry textsize member.") Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D58522
* rc.subr: Fix premature return from wait_for_pidsDag-Erling Smørgrav2026-07-272-16/+8
| | | | | | | | | | | | Use pwait's new -r option to wait until the target processes have not only terminated, but also been reaped. PR: 293183 MFC after: 1 week Sponsored by: Klara, Inc. Sponsored by: NetApp, Inc. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58391
* rc.d/dumpon: minor hardening/tightening upEnji Cooper2026-07-161-5/+8
| | | | | | | | | - Scope local variables properly to each function. - Quote variables that should be treated as single words. - Replace `${cmd}; if [ $? -eq 0 ]` with `if ${cmd}` for simplicity. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57899
* rtld: unify the return path for map_object()Konstantin Belousov2026-06-291-6/+4
| | | | | | | Reviewed by: kevans Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* rtld: stop using unbound alloca()Konstantin Belousov2026-06-293-25/+63
| | | | | | | | | | | | | | | | | For DoneList allocations, its size depends on the number of loaded DSOs. Small images could be served by alloca(), but large donelists need to go into heap. For map_object(), alloca size is the number of segments in the object. In both cases, over-grown situations would cause a stack overflow. PR: 295991 Noted and reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* rtld: add spinlock around the crt malloc callsKonstantin Belousov2026-06-292-26/+71
| | | | | | | | | | | | | Right now, the rtld malloc is called under the write-locked rtld bind lock. A future change adds places where only read-locked rtld bind lock is held, and then the spinlock protects the malloc structures from the parallel updates. Reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* pflog: create bpf tapping points without ifnet(9)Kristof Provost2026-06-281-17/+5
| | | | | | | | | | | | | | | | | | | | Just as was done for ipfw's log device stop creating entire struct ifnet's for pflog devices. Create only a bpf_t. This does mean we lose the create/destroy infrastructure provided by the clone interface. Rather than implement this ourselves we allow users to configure the number of pflog interfaces using the net.pflog.if_count sysctl. We default to 8 devices, but allow up to 256. The /etc/rc.d/pflog script will create extra devices as required. While it was possible to rename pflog devices pfctl expected the pflogX name, so it's safe to assume users never did this. Requested by: glebius Reviewed by: glebius Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D57851
* rc.d: fix lockd and statd flags processing after scvjAlexander Leidinger2026-06-272-2/+4
| | | | | | | | | | | | | | | | | | The documented flags are named differently than the script name, this requires special handling of the flags. The Service Jails feature requires the handling of the variable to be differently than it was initially. The change back then did not work, which resulted in the flags to be ignored. This commit fixes the issue in head. This affects 15.0 and 15.1 too. PR: 296233 Reported by: Robert Blayzor <rblayzor@inoc.net> Tested by: Robert Blayzor <rblayzor@inoc.net> Fixes: f99f0ee14e3af81c2 - rc.d: add a service jails config to all base system services MFC after: 1 month MFC to: 15-stable
* rc.d/tmp: Fix dupe mount checkDag-Erling Smørgrav2026-06-261-4/+9
| | | | | | | | | | | | | | | Before mounting a new mfs on /tmp, we check if there already is one. However, the dupe check only takes /dev/md[0-9]* into account, while the default mfs type these days is tmpfs. Rewrite it to look for tmpfs as well. Note that the dupe check is redundant in the tmpmfs=auto case, but we leave moving it for later. PR: 182035 MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57682
* rc.d/ddb: Really silently exitDag-Erling Smørgrav2026-06-261-2/+2
| | | | | | | | | | | | | | | | | The comment says “silently exit if ddb is not enabled”, but we'd exit with an error message. Note that I switched the sysctl variable used to test for the presence of ddb from debug.ddb.scripting.scripts to d.d.s.script, which has a smaller value if set. While here, drop a pointless fork-exec, and use ${SYSCTL_N} for consistency. PR: 177217 MFC after: 1 week Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57686
* rc.firewall: Support on-disk listsDag-Erling Smørgrav2026-06-262-15/+39
| | | | | | | | | | | | | | | For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679
* rc.firewall: Use checkyesno for boolean variablesDag-Erling Smørgrav2026-06-261-34/+19
| | | | | | | | | | Use the checkyesno function from rc.subr instead of hardcoded checks for boolean variables. Also drop an incorrect comment about the default logamount value; the actual default is zero (unlimited). MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57678
* rc: Make devmatch use load_kldDag-Erling Smørgrav2026-06-231-2/+4
| | | | | | | | | | | | | The default behavior of load_kld is now robust enough for devmatch. Switching means settings from /etc/sysctl.kld.d are now properly applied when the corresponding modules are loaded by devmatch. While here, reduce the amount of output produced by devmatch from one line per module to a single line. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57707
* rc: Improve load_kldDag-Erling Smørgrav2026-06-233-16/+19
| | | | | | | | | | | | | | | | | * Centralize the usage message. * Document and enforce that -e and -m are mutually exclusive; previously, speficying both would result in only -e being applied. * If -e was not specified, and -m was not specified or did not match, fall back to `kldstat -n file` which will always work for modules that aren't built into the kernel. This means the kld and ntpd scripts can now rely on load_kld to dtrt. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57706
* rc: Fix improper use of load_kldDag-Erling Smørgrav2026-06-234-9/+9
| | | | | | | | | | | Fix scripts that needlessly used -e when the simpler -m would work, or that used -m when the module and file name are the same, or, in one particularly egregious case, used -m with the wrong name when using nothing at all would have worked just fine. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57705
* zfskeys - only prompt if zfskeys and zfskeys_prompt are enabledDoug Ambrisko2026-06-232-7/+10
| | | | | | | | | | | | | | By default don't block booting with a prompt if a zpool needs a keyboard password to unlock it. To enable prompting for keyboard password during boot require: zfskeys_enable="YES" zfskeys_prompt_enable="YES" to both be enabled. This returns to POLA of prior behaviour. PR: 296130 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57750
* rtld: Check for -1 as an-end-of-section markerDaniel Levin2026-06-221-2/+4
| | | | | | | | | | | | | | | | rtld calls functions in the .init_array section one at a time, until it finds a distinguished sentinel value. The C runtime does the same thing (in crtend.c). However, that checks for the sentinel -1 and not 1. If one is using a linker that unifies .ctors and .init_array, then rtld will miss the sentinel value. I believe the author of this code intended to write -1 instead of 1. Indeed, changing the code to also check for -1 prevents rtld from attempting to call a non-existent function. The same is true of .dtors and .fini_array. Signed-off-by: Daniel Levin <daniellevin2607@gmail.com> Reviewed by: kib MFC after: 3 days Pull Request: https://github.com/freebsd/freebsd-src/pull/2270
* rtld-elf: add some tests for parse_integer()Konstantin Belousov2026-06-142-0/+45
| | | | | | | Reviewed by: des, dim Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57549
generated by cgit v1.3 (git 2.53.0) at 2026-09-21 13:39:15 +0000