aboutsummaryrefslogtreecommitdiff
path: root/libexec
Commit message (Collapse)AuthorAgeFilesLines
* rc.d/ipfilter: ipfilter must be enabled for options to takeCy Schubert41 hours1-6/+3
| | | | | | | | | | | | ipfilter options are erased and reset to default when ipfilter is disabled. This results in nullifying options from rc.conf that were previously set. 8d6feaaaa26f, which added this code, was incorrect as it was for a bug in ipfilter 4.2.28 and no longer applies to ipfilter 5.1.2. Fixes: 8d6feaaaa26f MFC after: 1 day
* rc.d/{ipfilter,ippool}: Fix typo in variable nameCy Schubert44 hours2-2/+2
| | | | MFC after: 1 day
* noshutdown: Fix startup orderDag-Erling Smørgrav3 days1-1/+1
| | | | | | | | | | | This rc script exists solely to create a file, so have it explicitly require FILESYSTEMS. In its current form, it was as likely as not to end up running before cleanvar, which would undo its work. MFC after: 3 days Fixes: 384d976725a5 ("rc.d: Add precious_machine rc.conf knob to create /var/run/noshutdown") Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D54119
* cleanvar: Fix startup orderDag-Erling Smørgrav3 days2-1/+2
| | | | | | | | | Instead of having FILESYSTEMS require cleanvar, which doesn't really make semantic sense, say that cleanvar needs to run before FILESYSTEMS. MFC after: 3 days Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D54118
* rtld-elf: Mark LD_SHOW_AUXV insecureDag-Erling Smørgrav8 days1-1/+1
| | | | | | | | This prevents dumping the memory layout of setugid processes. MFC after: 3 days Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D54033
* ipfilter: Load optionlist prior to ippool invocationCy Schubert2025-11-261-0/+3
| | | | | | | | | | | | | As a safety precaution df381bec2d2b limits ippool hash table size to 1K. This causes any legitimely large hash table to fail to load. The htable_size_max ipf tuneable adjusts this but the adjustment is made in the ipfilter rc script, invoked after the ippool script (because it depends on ippool). Let's load the ipfilter_optionlist in ippool as well. ipfilter_optionlist load will also occur in the ipfilter rc script in case the user uses ipfilter without ippool. Fixes: df381bec2d2b MFC after: 3 days
* Add description of the LD_DEBUG environment variable.George V. Neville-Neil2025-11-251-1/+6
|
* rtld: fix powerpc buildKonstantin Belousov2025-11-242-6/+2
| | | | | | | | | | | In arch_fix_auxv(), remove local variable shadowing the argument, remove write-only variable, and declare the loop variable. The wrong patch was committed after series of local reverts and re-apply. Fixes: b2b3d2a962eb00005641546fbe672b95e5d0672a Sponsored by: The FreeBSD Foundation MFC after: 1 week
* nuageinit: Add guards against empty user dataJose Luis Duran2025-11-221-0/+8
| | | | | | | | | | Add guards against attempting to process a user data file with an empty first line or contents. PR: 290395 Reviewed by: bapt (earlier), dtxdf, markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D53239
* nuageinit: Silence luacheck warnings and fix typosJose Luis Duran2025-11-224-19/+15
| | | | | | | | No functional change intended. Reviewed by: bapt, dtxdf, kevans MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D53238
* rtld-elf: move powerpc-specific auxv compat code into arch hookKonstantin Belousov2025-11-2110-24/+67
| | | | | | | Tested by: Timothy Pearson (tpearson_raptorengineering.com) Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53801
* nuageinit: Fix a typo in an error messageGordon Bergling2025-11-191-1/+1
| | | | | | - s/outout/output/ MFC after: 3 days
* libexec/lua: Fix two typos in the manual pagesGordon Bergling2025-11-192-2/+2
| | | | | | | - s/environnement/environment/ - s/interger/integer/ MFC after: 3 days
* rc.subr: Support setting the audit user when starting servicesMark Johnston2025-11-181-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | When an unprivileged user restarts a service using, e.g., sudo, the service runs with the audit user ID set to that of the unprivileged user. This can have surprising effects: for instance, a user that restarts a jail that is running sshd will end up with their UID attached to all audit logs associated with users who log in via that sshd instance. (sshd will set the audit user, but this is disallowed in jails by default.) Add support for rc.conf directives which cause rc to override the audit user. Specifically, make <name>_audit_user=foo cause the audit user to be set to "foo" for service <name>. A plain audit_user=foo directive causes all services to be started as foo. Note, like other similar rc features, this feature is limited to rc services which are run by executing a command. Shell functions can't be wrapped this way. Reviewed by: 0mp MFC after: 2 weeks Sponsored by: Modirum MDPay Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D53747
* rc.subr: Remove misguided cpuset usageMark Johnston2025-11-181-4/+4
| | | | | | | | | | | | | | | | | | | | | When running an rc command, if the target rc script defines <command>_cmd, e.g., start_cmd=..., then the run_rc_command() executes that instead of $command. In general it's a shell function, and "cpuset -l <n> <shell function>" doesn't work. Moreover, it doesn't really make sense to run cpuset for anything other than start_cmd. Other optional isolation mechanisms (e.g., <name>_fib, <name>_chroot) are only used when invoking $command directly as part of the "start" command. Make <name>_cpuset consistent with everything else by removing these extraneous cpuset invocations. Reviewed by: 0mp MFC after: 2 weeks Sponsored by: Modirum MDPay Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D53746
* rc.subr: Try to make svjc option handling a bit easier to readMark Johnston2025-11-181-41/+47
| | | | | | | | | | | | | | Specifically, make this code fit in fewer columns: - deindent cases to conform to the usual style, - use a local variable to minimize duplication in each case. No functional change intended. Reviewed by: 0mp, netchild MFC after: 2 weeks Sponsored by: Klara, Inc. Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D53754
* nuageinit.7: fix cloud-config header lineJonathan Matthews2025-11-121-2/+2
| | | | | | | | | | | This updates the nuageinit man page by aligning mentions of the cloud-config header line with the cloud-init documentation[0], removing an unwanted "!" character. [0] https://docs.cloud-init.io/en/latest/explanation/about-cloud-config.html#how-do-i-create-a-cloud-config-file Signed-off-by: Jonathan Matthews <freebsd@hello.jonathanmatthews.com> Differential Revision: https://reviews.freebsd.org/D53706
* rc: virtual_oss: Use required_modules instead of load_kldChristos Margiolis2025-11-111-1/+2
| | | | | | | Sponsored by: The FreeBSD Foundation MFC after: 1 week Reviewed by: imp, markj, emaste Differential Revision: https://reviews.freebsd.org/D53616
* periodic: Move 320.whatis to the mandoc packageLexi Winter2025-11-061-0/+1
| | | | | | | | | | | | | | | | | | This periodic script only makes sense if mandoc is installed, so move it to the mandoc package like other periodic scripts. /usr/libexec/makewhatis.local only exists for the enjoyment of this script, and doesn't work without mandoc installed, so move that as well. This change moves files between packages so, until we have a proper policy on how to handle this in release/stable branches, it should not be MFC'd. MFC after: never Reviewed by: ziaee, manu Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53609
* atf: Move the tests back to the tests packageLexi Winter2025-11-053-1/+6
| | | | | | | | | | | Commit 9065390ddc7b moved atf to its own package, but mistakenly moved the tests as well. Put the tests back into the test package. Fixes: 9065390ddc7b ("packages: Remove the tests-dev package") MFC after: 1 day Reviewed by: emaste Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53594
* rc.subr set dot_dir and dot_file in dotSimon J. Gerraty2025-10-301-2/+12
| | | | | | | | | Files read by '.' cannot workout for themselves where they are or what they are called, so set dot_dir and dot_file to pass this information to them. Reviewed by: obrien, stevek Differential Revision: https://reviews.freebsd.org/D53476
* rc.subr: Fix slow shutdown issueDag-Erling Smørgrav2025-10-281-21/+8
| | | | | | | | | | | Instead of sleeping after pwait returns, use its new -p option to obtain the list of processes that still have not terminated. MFC after: 3 days PR: 290357 Fixes: 5953e7c98427 ("rc.subr: Move the sleep in wait_for_pids") Reviewed by: 0mp, markj Differential Revision: https://reviews.freebsd.org/D53294
* Revert "blocklist-helper: Silence a bogus pf warning"Jose Luis Duran2025-10-281-1/+1
| | | | | | | | | | | This reverts commit 2347ca21d657121670e6e7246c6ac32efc996cac. A fix has been implemented in 99560fe98c76 ("pfctl: Do not warn if there is no Ethernet anchor"). Revert this commit to avoid having differences with upstream. MFC after: 2 days
* Revert "blocklistd-helper: Silence another bogus pf warning"Jose Luis Duran2025-10-281-1/+1
| | | | | | | | | This reverts commit 67ade69eb6079887215db1fde86eba2fb8e2acf7. A fix has been implemented in a943a96a50ba ("libpfctl: Fix displaying deeply nested anchors"). Revert this commit to avoid having differences with upstream.
* blocklist: Fix rcorder(8)Jose Luis Duran2025-10-272-2/+2
| | | | | | | | | | | | | | | The blocklist daemon depends on a packet filter in order to block. Add all supported packet filters to the REQUIRE line, not just pf, to indicate rcorder(8) that it should start after the packet filter service has started. While here, change the mode of the rc file to include the executable bit, just like the rest of the files in the rc.d source directory. Reviewed by: 0mp MFC after: 2 days Differential Revision: https://reviews.freebsd.org/D53364
* flua: Move to a new flua packageLexi Winter2025-10-262-0/+4
| | | | | | | | | | | | | | | flua is a standalone third-party component that deserves its own package. In particular, this means things can use flua without having to depend on FreeBSD-utilities, which will be useful as more base utilities use flua. This saves ~500kB in FreeBSD-utilities for systems which don't need flua. MFC after: 3 days Reviewed by: kevans Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53161
* blocklistd-helper: Silence another bogus pf warningJose Luis Duran2025-10-251-1/+1
| | | | | | | | | | | | It has been reported as PR 290478. In the meantime, just sweep under the carpet. It is worth noting that neither commit: 2347ca21d657 ("blocklist-helper: Silence a bogus pf warning") nor this one will be upstreamed, as this is a FreeBSD-specific issue. PR: 290478 MFC after: 2 days
* rc: Chase 052211e08c0e and bfb202c4554a, remove ifconfig down/upCy Schubert2025-10-211-9/+0
| | | | | | | | | | | | bfb202c4554a addresses the CTRL-EVENT-SCAN-FAILED. Upstream d807e289d caused FreeBSD regression in driver_bsd.c, which this rc.d patch worked around. As of bfb202c4554a this workaround is no longer needed. 052211e08c0e implemented this change for wpa_supplicant but not for hostapd. Reported by: avg MFC after: 3 days
* rc: dmesg: Allow umask to be configurableJose Luis Duran2025-10-182-1/+2
| | | | | | | | | | | | | | | | | | | | Allow umask to be configurable. Being able to set the umask via an rc variable is useful when setting: security.bsd.unprivileged_read_msgbuf=0 As it allows a user to configure: dmesg_umask="066" Without modifying the rc script, and preventing the contents of the $dmesg_file (/var/run/dmesg.boot) from being publicly readable. PR: 272552 Reviewed by: netchild MFC after: 2 days Differential Revision: https://reviews.freebsd.org/D53169
* rc.conf: Fix typo interferring -> interferingJose Luis Duran2025-10-181-1/+1
| | | | | | Reviewed by: emaste MFC after: 2 days Differential Revision: https://reviews.freebsd.org/D53168
* packages: Rename unbound to local-unboundLexi Winter2025-10-151-1/+1
| | | | | | | | | | | | | This more accurately reflects its purpose, and its contents, since everything in the package is prefixed with "local-". While here, add a message on upgrade about regenerating the config. MFC after: 3 seconds Requested by: des Reviewed by: des Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53056
* blocklist-helper: Silence a bogus pf warningJose Luis Duran2025-10-121-1/+1
| | | | | | | | | | Silence a bogus warning about (an ethernet) anchor not being found. It has been reported as PR 280516. In the meantime, just sweep under the carpet. Approved by: emaste (mentor) MFC after: 2 days
* blocklist: Rename blacklist to blocklistJose Luis Duran2025-10-1212-28/+381
| | | | | | | | | | | | | | | | | | Follow up upstream rename from blacklist to blocklist. - Old names and rc scripts are still valid, but emitting an ugly warning - Old firewall rules and anchor names should work, but emitting an ugly warning - Old MK_BLACKLIST* knobs are wired to the new ones Although care has been taken not to break current configurations, this is a large patch containing mostly duplicated code. If issues arise, it will be swiftly reverted. Reviewed by: ivy (pkgbase) Approved by: emaste (mentor) MFC after: 2 days Relnotes: yes
* virtual_oss: Clean up rcorderChristos Margiolis2025-10-101-2/+2
| | | | | | | | | | | | | sndiod is part of audio/sndio, so we should avoid referencing a port utility from base. We should also require NETWORKING for the service to start, since virtual_oss can be configured to send audio through the network. Sponsored by: The FreeBSD Foundation MFC after: 1 day Reviewed by: des, markj, emaste Differential Revision: https://reviews.freebsd.org/D53019
* rc tests: Add a test to check for warnings from rcorderMark Johnston2025-10-081-0/+12
| | | | | | Reviewed by: des MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D52954
* rc: Update dependencies for zpool scriptsMark Johnston2025-10-082-2/+2
| | | | | | | | | | | | | After commit 900bc0206348, zpool depends on mountcritlocal. zpoolreguid and zpoolupgrade depend on zpool and want to run before mountcritcycle, so we have a pair of cycles. Update zpoolreguid and zpoolupgrade to avoid this. Reviewed by: des MFC after: 3 days Fixes: 900bc0206348 ("rc.d/zpool: change mountcritlocal dep from BEFORE to REQUIRE") Differential Revision: https://reviews.freebsd.org/D52953
* libexec/rc/rc.d/Makefile: Use CONFGROUPS.yesLexi Winter2025-10-081-261/+204
| | | | | | | | | | | | | Replace .if statements with CONFGROUPS.${MK_FOO} where possible, and also sort and re-indent the file for readability. A couple of more complicated sections don't work with CONFGROUPS.yes yet, so leave those as they are for now. MFC after: 1 week Reviewed by: imp Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D52974
* rc: Improve netwait DAD logicDag-Erling Smørgrav2025-10-052-5/+8
| | | | | | | | | Disable if IPv6 is not supported, and instead of 10 seconds, default to one more than the value of net.inet6.ip6.dad_count. Fixes: 5ead817c3b7a ("rc: Teach netwait to wait for DAD") Reviewed by: bz Differential Revision: https://reviews.freebsd.org/D52905
* flua: unbreak the buildKyle Evans2025-10-044-12/+0
| | | | | | | | | Local tree pollution let this escape. *sigh*. Pointy hat: kevans Pointy hat: kevans Pointy hat: kevans Fixes: 9c7db0931d486ce ("flua: move lposix back into flua for now")
* nuageinit: require lfs where it's neededKyle Evans2025-10-041-0/+1
| | | | | | | nuageinit largely already did this, but one spot was missed -- add the necessary require() in to get the module loaded. Fixes: b11a5709ec2b6 ("flua: kick out the remaining builtin modules")
* flua: move lposix back into flua for nowKyle Evans2025-10-042-1/+4
| | | | | | | | | | | | The real luaposix is structured differently, and our builtin version tends to model that in its own special way. Build it back in until we get the shlib model just right to unbreak nuageinit, among other things. This is a partial revert of the below-referenced commit; the other two modules are simple, though, and were accurately split out. Reported by: markj Fixes: b11a5709ec2b6 ("flua: kick out the remaining builtin modules")
* flua: kick out the remaining builtin modulesKyle Evans2025-10-0415-9/+41
| | | | | | | | | | | | | Bootstrap flua has some magic now to handle modules by building them in and discovering them via linker sets. This is slightly cleaner than always building them in and baking them into loadedlibs for both bootstrap and system flua. Adjust the stand build now that these three libs have their own new homes. Reviewed by: bapt, emaste Differential Revision: https://reviews.freebsd.org/D51891
* flua: support our flua modules in the bootstrap fluaKyle Evans2025-10-0420-49/+166
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This version builds every module into the flua binary itself, since all of the bootstrap tools are built -DNO_SHARED. As a result, we also cannot dlsym(), so we can't really discover the names of our newly builtin modules. Instead, just build out a linker set with all of our luaopen_*() functions to register everything up-front. Building in all of the modules isn't strictly necessary, but it means that we have an example of how to add a bootstrap module everywhere you go and one doesn't need to consider whether bootstrap flua can use a module when writing scripts. On my build machine, the consequence on our binary size is an increase from around 1.6M -> 1.9M, which isn't really that bad. .lua modules can install into their usual path below $WORLDTMP/legacy and we'll pick them up automagically by way of the ctor that sets up LUA_PATH early on. This re-lands bootstrap module support with a more sensible subset, and after having verified that it cross-builds fine on macOS and Linux -- we cannot do libfreebsd on !FreeBSD because it's more system header dependant. We also need to bootstrap libmd to bring in libhash, and libucl + libyaml. Reviewed by: bapt, emaste (both previous version) Differential Revision: https://reviews.freebsd.org/D51890
* Revert "flua: support our flua modules in the bootstrap flua"Kyle Evans2025-10-0420-159/+49
| | | | | | | This reverts commit 1953a12ee2cde1afacb3e3f7612d89695c96e04f, because it cannot work at all on macOS without more work, at a minimum. We use linker sets for module discovery, but we don't have a version of this that works for mach-o at the moment.
* Revert "flua: kick out the remaining builtin modules"Kyle Evans2025-10-0415-41/+9
| | | | | This reverts commit 80ada959004c4386880e47b11618f8abfc2d80e1, because bootstrap flua is about to get backed out.
* Revert "flua: don't build libjail into the bootstrap flua"Kyle Evans2025-10-041-4/+0
| | | | | This reverts commit 31320402472394af57eb3a36bee7f944117ca0ed, because bootstrap flua is about to get backed out.
* flua: don't build libjail into the bootstrap fluaKyle Evans2025-10-031-0/+4
| | | | Other systems don't have jail support, and we won't be using it anyways.
* flua: kick out the remaining builtin modulesKyle Evans2025-10-0315-9/+41
| | | | | | | | | | | | | Bootstrap flua has some magic now to handle modules by building them in and discovering them via linker sets. This is slightly cleaner than always building them in and baking them into loadedlibs for both bootstrap and system flua. Adjust the stand build now that these three libs have their own new homes. Reviewed by: bapt, emaste Differential Revision: https://reviews.freebsd.org/D51891
* flua: support our flua modules in the bootstrap fluaKyle Evans2025-10-0320-49/+159
| | | | | | | | | | | | | | | | | | | | | | This version builds every module into the flua binary itself, since all of the bootstrap tools are built -DNO_SHARED. As a result, we also cannot dlsym(), so we can't really discover the names of our newly builtin modules. Instead, just build out a linker set with all of our luaopen_*() functions to register everything up-front. Building in all of the modules isn't strictly necessary, but it means that we have an example of how to add a bootstrap module everywhere you go and one doesn't need to consider whether bootstrap flua can use a module when writing scripts. On my build machine, the consequence on our binary size is an increase from around 1.6M -> 1.9M, which isn't really that bad. .lua modules can install into their usual path below $WORLDTMP/legacy and we'll pick them up automagically by way of the ctor that sets up LUA_PATH early on. Reviewed by: bapt, emaste Differential Revision: https://reviews.freebsd.org/D51890
* libexec/kgdb: Add new modules and install them together with debug infoMark Johnston2025-10-033-69/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change simplifies integration of gdb python scripts with our kernel debugging infrastructure. Rather than putting debugging scripts in /usr/libexec/kgdb, move them to <path-to-kernel-debug-symbols>/gdb, and add a kernel-gdb.py which automatically loads modules from that directory. kernel-gdb.py will be automatically executed by kgdb when loading kernel debug symbols (assuming a default configuration), so one no longer needs to do anything to use these modules. The change also adds a couple of new modules, vnet.py and pcpu.py, for conveniently accessing VNET symbols and PCPU/DPCPU fields, respectively. Note that these require a change to the kernel linker when accessing symbols from a loadable kernel module. sys/tools/gdb/README.txt describes the scheme in more detail and provides some rudiementary documentation for the commands and functions added by these modules. It should be updated when adding new features. sys/tools/gdb/selftest.py can be used to do some primitive testing of the modules. All it does is execute a number of gdb commands making use of commands and functions added by these modules. The developer is expected to verify that the commands complete without errors and that the output looks sane. Discussed with: kp, avg, jhb, glebius MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D50825
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-11 16:43:13 +0000