Commit Graph

220 Commits

Author SHA1 Message Date
Sebastien Bini
f3dba162bd init: allow to start script executions with sh -o verify
On systems where mac_veriexec is enforced, init should run its scripts in verified mode.
This relies on the verify shell option introduced by D30464. init will detect if the shell
is /bin/sh, and in which case, add the verify option to the argument vector.
The verify option propagates to all files sourced by the shell, ensuring a better
protection than if the script was tested against an open(O_VERIFY) before running it.
This security can be bypassed with the kenv which overloads the shell to use.
However we feel confident that on systems running with mac_veriexec, this kenv will be blocked somehow.
Also, the verify option has no effect on systems where mac_veriexec is not loaded nor enforced.

Differential revision:  https://reviews.freebsd.org/D34622
Reviewed by:		sjg, wma
2022-10-11 09:48:04 +02:00
Corvin Köhne
203f2c14c4 init: fix shutdown race
When calling shutdown, shutdown sends a signal to init and exits. This
causes a race condition for the waitpid function. If the signal wins the
race, wpid will be set to -1 and init calls death_single. If shutdown
wins the race, wpid will be set to the pid of the shutdown process and
the requested_transition will be ignored.

Reviewed by:		imp
Differential Revision:	https://reviews.freebsd.org/D36356
MFC after:		1 week
Sponsored by:		Beckhoff Automation GmbH & Co. KG
2022-09-06 09:06:51 +02:00
Mitchell Horne
de08b5167b init(8): use proper boolean type for globals
Now that stdbool.h is included, prefer this. No functional change
intended.
2022-02-21 20:16:13 -04:00
Mitchell Horne
7b0a665d72 boottrace: annotate init and shutdown utilities
Add boottrace annotations to record events in init(8), shutdown(8), and
reboot(8).

Sponsored by:	NetApp, Inc.
Sponsored by:	Klara, Inc.
X-NetApp-PR:	#23
Differential Revision:	https://reviews.freebsd.org/D31928
2022-02-21 20:16:07 -04:00
Kyle Evans
4d15976919 init: execute /etc/rc.final after all user processes have terminated
This can be useful for, e.g., unmounting filesystems that were needed
for shutdown.

Reviewed by:	kib
Sponsored by:	NetApp, Inc.
Sponsored by:	Klara, Inc.
X-NetApp-PR:	#63
Differential Revision:	https://reviews.freebsd.org/D31230
2021-07-22 23:26:11 -05:00
Julien Grall
2b2c460d7b etc/ttys: add xen console
Xen VMs get a simulated serial device meant for use as a console.  Often
an xterm or other advanced terminal is used, so use xterm as the type.

Depending on configuration, FreeBSD on Xen for amd64 may instead use an
emulated serial port, but the virtual console may also be available.

Submitted by:	Elliott Mitchell <ehem+freebsd@m5p.com>
Reviewed by:	imp (slightly earlier version)
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D29873
2021-07-06 11:53:10 -03:00
Elliott Mitchell
c76616f496 etc/ttys: merge ttys file down to single file
The tty lists were already pretty similar and there hadn't been any real
need for them to remain distinct for some time. As such, merge to a
single file.

The RISC-V console is preserved. For systems where it doesn't exist, its
presence in /etc/ttys is harmless. The uncommented version of the
ttyv8/XDM line from ttys.amd64 was the one chosen.

Reviewed by:	imp
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D30256
2021-07-06 11:53:10 -03:00
Warner Losh
36be84b966 ttys: diff reduction
Back in the day, we used to have a number of entries that were either
'on' or 'off' directly, rather than conditionally on 'onifexists'
etc. Back then, we tried to line up the 'secure' columns by using the
construct 'on secure' or 'off secure' (one space or two). Now that these
have all moved to a conditional construct, remove the second space on
the ttys that still have it. This reduces diffs between the different
ttys and is no functional change. i386 and amd64 did this a long time
ago, and those are the only ones that affected external users (who used
to sed 's/on /off /' the entires as part of the automation).

MFC After:		3 days
Sponsored by:		Netflix
2021-05-04 14:06:31 -06:00
Kyle Evans
852f70b240 init: use explicit_bzero() for clearing passwords
This is a nop in practice, because it cannot be proven that this
particular bzero() is not significant.  Make it explicit anyways, rather
than relying on an implementation detail of how the password is
collected.

Discussed with:	Andrew Gierth <andrew tao146 riddles org uk>
2021-03-02 21:55:41 -06:00
Xin LI
804b4afb9c sbin/init: Reduce code duplication by using %m for error message
instead of passing %s with return value from strerror().

MFC after:	2 weeks
2020-12-25 17:49:33 -08:00
Brooks Davis
a449e81e00 Remove risky compatability with old kernels
The badsys() handler for SIGSYS was added as a transtion aid for kernels
lacking sysctl() in 1993.  It is unsafe and unsound so remove it rather
than running the risk of a privilege-dropping system call being silently
omitted.

This partially reverts SCCSID 6.12 (Berkeley) 03/03/93 "add code to
change the system security level".

Reviewed by:	mckusick, imp, kevans
Obtained from:	CheriBSD
MFC after:	1 week
Sponsored by:	DARPA
Differential Revision:	https://reviews.freebsd.org/D26289
2020-09-02 21:14:36 +00:00
Yoshihiro Takahashi
8f11c99715 - Cleanups related to sparc64 removal.
- Remove remains of sparc64 files.

Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D25831
2020-07-28 10:58:37 +00:00
Kyle Evans
21c1a93c04 init(8): set environment variables from the "daemon" class as well
Specifically, when running /etc/rc. This allows one to specify via
login.conf(5) an environment that should be used when running services to
ease, e.g., setting up env vars for an HTTP proxy consistently across cron
and services alike.

Future changes will extend cron(8)/service(8) to use environment vars
pecified in login.conf(5) as well to promote a more cohesive experience.

This is a part of D21481.

Submitted by:	Andrew Gierth <andrew_tao173.riddles.org.uk>
2020-02-05 04:27:44 +00:00
Warner Losh
73c6e0c358 Small tweak to the default behavior of shutdown -c
'shutdown -c' is supposed to power cycle the system rather than doing a normal
reboot. However, when that fails, it halts the system. This is not quite right
since the intent isn't to halt the system but to restart. Make the default init
behavior be to restart the system. The halt(8) interface can be used if you'd
like to powercycle or halt.

MFC After: 1 week
Differential Revision: https://reviews.freebsd.org/D23129
2020-01-17 01:20:48 +00:00
Andriy Gapon
5fda0d60c1 add ability to set watchdog timeout for a shutdown
This change allows to specify a watchdog(9) timeout for a system
shutdown.  The timeout is activated when the watchdogd daemon is
stopped.  The idea is to a prevent any indefinite hang during late
stages of the shutdown.  The feature is implemented in rc.d/watchdogd,
it builds upon watchdogd -x option.

Note that the shutdown timeout is not actiavted when the watchdogd
service is individually stopped by an operator.  It is also not
activated for the 'shutdown' to the single-user mode.  In those cases it
is assumed that the operator knows what they are doing and they have
means to recover the system should it hang.

Significant subchanges and implementation details:
- the argument to rc.shutdown, completely unused before, is assigned to
  rc_shutdown variable that can be inspected by rc scripts
- init(8) passes "single" or "reboot" as the argument, this is not
  changed
- the argument is not mandatory and if it is not set then rc_shutdown is
  set to "unspecified"
- however, the default jail management scripts and jail configuration
  examples have been updated to pass "jail" to rc.shutdown, just in case
- the new timeout can be set via watchdogd_shutdown_timeout rc option
- for consistency, the regular timeout can now be set via
  watchdogd_timeout rc option
- watchdogd_shutdown_timeout and watchdogd_timeout override timeout
  specifications in watchdogd_flags
- existing configurations, where the new rc options are not set, should
  keep working as before

I am not particularly wed to any of the implementation specifics.
I am open to changing or removing any of them as long as the provided
functionality is the same (or very close) to the proposed one.
For example, I think it can be implemented without using watchdogd -x,
by means of watchdog(1) alone.  In that case there would be a small
window between stopping watchdogd and running watchdog, but I think that
that is acceptable.

Reviewed by:	bcr (man page changes)
MFC after:	5 weeks
Relnotes:	yes
Differential Revision: https://reviews.freebsd.org/D21221
2019-10-03 11:23:10 +00:00
Ed Maste
98b1cf29cf init: pedantic correction to "can't exec" script warning
Direct /etc/rc exec was introduced in r337321, with a fallback to
passing it to sh if direct exec fails.  "Can't exec" is slightly
misleading in this case (the script is still executed, just not
directly).
2019-03-26 19:38:25 +00:00
Bjoern A. Zeeb
0696600c41 Move the rc framework out of sbin/init into libexec/rc.
The reasons for this are forward looking to pkgbase:
 * /sbin/init is a special binary; try not to replace it with
   every package update because an rc script was touched.
   (a follow-up commit will make init its own package)
 * having rc in its own place will allow more easy replacement
   of the rc framework with alternatives, such as openrc.

Discussed with:		brd (during BSDCam), kmoore
Requested by:		cem, bz
PR:			231522
Approved by:		re (gjb)
2018-10-17 16:49:11 +00:00
Danilo G. Baio
877a050958 Fix information about $firewall_myservices
After r273201 it is supported "/{udp,tcp,proto}" suffix into
$firewall_myservices, and in the rc.conf the information is outdated.

Reviewed by:	bcr, rgrimes
Approved by:	re (gjb), doc (bcr), src (rgrimes)
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D17338
2018-10-05 20:35:43 +00:00
John Baldwin
fe35316fed Run 32-bit compat ldconfig on mips64.
mips64 supports COMPAT_FREEBSD32 (for o32 binaries), so run the 32-bit
compat ldconfig on it as well.

Reported by:	brooks
Reviewed by:	brooks, kib
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D17342
2018-09-28 17:01:43 +00:00
Konstantin Belousov
dcf55de22a Remove -m (update) from ldconfig -32 & -soft invocation on startup.
Since r154114 which introduced ldconfig_local32_dirs, ldconfig -32 was
called with -m. This means that ld-elf32.so.hints paths set is not
cleared for compat32 on boot, unlike ld,so,hints.  Same -m was used in
r294295 for ld-elf-soft.so.hints on arm.  The patch fixes the
asymmetry.

Noted by:	Andreas Longwitz <longwitz@incore.de>
Reviewed by:	brooks, emaste, imp
Discussed with:	bdrewery
Sponsored by:	The FreeBSD Foundation
Approved by:	re (gjb)
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D17331
2018-09-27 14:31:41 +00:00
Brad Davis
966f2a6f27 Move etc/ttys to sbin/init/.
And simplify this a little by flattening the directory structure.

Approved by:	re (gjb), will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16955
2018-09-04 15:48:13 +00:00
Warner Losh
8a317ce4b3 Implement blacklisting for devmatch
devmatch_blacklist is a space separated list of modules (w/o the .ko
or full path) to exclude from devmatch's processing.

Differential Revision: https://reviews.freebsd.org/D16735
2018-08-23 05:06:27 +00:00
Warner Losh
8769858311 Improve devmatch driver loading
Use devctl freeze / thaw to allow us to laod multiple modules before
doing the probe/attach so they all get a bite at the apple.

Differential Revision: https://reviews.freebsd.org/D16735
2018-08-23 05:06:07 +00:00
Edward Tomasz Napierala
be03cfdd75 Consistently use NULL to terminate the argv; no functional changes.
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
2018-08-17 14:57:13 +00:00
Edward Tomasz Napierala
5469cc0ee9 Add SECURITY section to loader(8).
Reviewed by:	bcr, jilles, imp (earlier version)
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D16700
2018-08-15 08:45:05 +00:00
Edward Tomasz Napierala
335fe94f90 Add init_exec kenv(1) variable, to make init(8) execute a file
after opening the console, replacing init as PID 1.

From the user point of view, it makes it possible to run eg the
shell as PID 1, using 'set init_exec=/bin/sh' at the loader(8)
prompt.

Reviewed by:	kib
MFC after:	2 weeks
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D16625
2018-08-14 11:01:52 +00:00
Edward Tomasz Napierala
d1b1fe3a25 Use NULLs instead of casted zeroes, for consistency.
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
2018-08-09 12:17:03 +00:00
Edward Tomasz Napierala
f3c4a698df Refactor common code into execute_script().
Reviewed by:	kib
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D16627
2018-08-09 12:13:08 +00:00
Edward Tomasz Napierala
fdfbf12784 Move description of init_shell, init_script, and init_chroot kenv
tunables from loader(8) to init(8), since it's init that actually
uses them.  Add .Xrs at their old place.

MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
2018-08-07 19:23:03 +00:00
Mark Johnston
976e100378 dhclient: Don't chroot if we are in capability mode.
The main dhclient process is Capsicumized but also chroots to
restrict filesystem access.  With r322369, pidfile(3) maintains a
directory descriptor for the pidfile, which can cause the chroot
to fail in certain cases.  To minimize the problem, only chroot
if we fail to enter capability mode, and store dhclient pidfiles
in a subdirectory of /var/run, thus restricting access via
pidfile(3)'s directory descriptor.

PR:		223327
Reviewed by:	cem, oshogbo
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D16584
2018-08-06 16:22:01 +00:00
Edward Tomasz Napierala
37ac37f90c Make it possible for init to execute any executable, not just sh(1)
scripts. This means one should be able to eg rewrite their /etc/rc
in Python.

Reviewed by:	kib
MFC after:	2 weeks
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D16565
2018-08-04 14:52:32 +00:00
Don Lewis
c13b53f6fb Fix a variable name typo in r336845 that prevented the rc.d scripts
from being installed in the correct directory.

Resurrect a few rc.d scripts that were prematurely deleted from the
Makefile by r336845.

Reviewed by:	brd
2018-07-29 05:42:07 +00:00
Brad Davis
d2b68ebeaf Fix a typo that prevented some rc scripts from being installed.
Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16495
2018-07-29 03:20:05 +00:00
Brad Davis
76ec4952ff Switch these to CONFS as well so they work with etcupdate/mergemaster.
Approved by:	will (mentor)
2018-07-28 23:02:10 +00:00
Brad Davis
df89e31712 Opps, I missed moving a couple of files in r336845.
Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16466
2018-07-28 20:41:33 +00:00
Brad Davis
1135e97b7c Move rc startup scripts from etc/ to sbin/init/
This keeps most startup scripts as CONFS per discussion on src-committers from
back during BSDCan.

Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16466
2018-07-28 20:36:23 +00:00
Edward Tomasz Napierala
1cde387c83 Improve missing tty handling in init(8). This removes a check that did
nothing - it was checking for ENXIO, which, with devfs, is no longer
returned - and was badly placed anyway, and replaces it with similar
one that works, and is done just before starting getty, instead of being
done when rereading ttys(5).

From the practical point of view, this makes init(8) handle disappearing
terminals (eg /dev/ttyU*) gracefully, without unneccessary getty restarts
and resulting error messages.

Reviewed by:	imp@
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D14307
2018-02-27 10:54:15 +00:00
Pedro F. Giffuni
8a16b7a18f General further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.
2017-11-20 19:49:47 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Warner Losh
35c1d16e3e Implement power cycle in init.
If SIGWINCH is received, then halt with power cycle.

Sponsored by: Netflix
2017-10-25 15:30:40 +00:00
Conrad Meyer
2c9a33f557 Correct sense of crypt(3) NULL checks in init(8) and lock(1)
In r231994, an attempt was made to fix crypt(3) failure returns (NULL).
However, instead of treating crypt(3) failure as authentication failure,
some of the changes treated crypt(3) failure as authentication success.
This is wrong.

r324225 fixed this for ppp, which also inspired this review.  The other
changes in the 231994 revision were audited for correctness and look ok.

Reviewed by:	jhb
Security:	yes
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D12571
2017-10-03 00:53:11 +00:00
Xin LI
95595f99b9 - Use strlcat() instead of strncat().
- Use asprintf() and handle allocation errors.

Reviewed by:	kevlo
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D11486
2017-07-07 02:48:55 +00:00
Enji Cooper
22289a8c3d sbin: normalize paths using SRCTOP-relative paths or :H when possible
This simplifies make logic/output

MFC after:	1 month
Sponsored by:	Dell EMC Isilon
2017-03-04 11:33:01 +00:00
Warner Losh
fbbd9655e5 Renumber copyright clause 4
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96
2017-02-28 23:42:47 +00:00
Konstantin Belousov
e10037df2c Add verbosity around failed reboot(2) call.
Sponsored by:	The FreeBSD Foundation
MFC after:	3 weeks
2016-10-07 13:43:38 +00:00
Konstantin Belousov
8402d33aa3 When making a pause after detecting hard kill of the single-user
shell, ensure that we do sleep for at least the specified time, in
presence of signals.

Interrupted sleep(3) is followed by _exit(), which might cause 'Going
nowhere without my init' panic if init(8) exits before the reboot(2)
really started, or before SIGTSTP stopped init(8) (both events are
initiated by the parallel reboot(8) operation).

I do not see other calls to sleep(STALL_TIMEOUT) as having the same
disasterous consequences and kept them as is until the similar change
is proven required.

Reported and tested by:	Andy Farkas <chuzzwassa@gmail.com>
Sponsored by:	The FreeBSD Foundation
MFC after:	3 weeks
2016-10-07 13:41:28 +00:00
Sevan Janiyan
2580acbe95 init was there in UNIX from V1
http://minnie.tuhs.org/cgi-bin/utree.pl?file=V1/init.s

PR:		212503
Approved by:	bcr (mentor)
MFC after:	4 days
Differential Revision:	https://reviews.freebsd.org/D8105
2016-10-02 23:51:13 +00:00
Marcelo Araujo
2ef6931a15 For pointers use NULL instead of 0.
MFC after:	2 weeks.
2016-05-16 00:34:48 +00:00
Edward Tomasz Napierala
377b6d1e7c When rerooting, take the init(8) path from argv[0] instead of fetching
it via kern.proc.pathname sysctl(2).  In some cases - booting from NFS
or rerooting after replacing the init binary with a new one - the sysctl
would fail.  In other cases - after upgrading, which moves the old init
to /sbin/init.bak - it would return /sbin/init.bak, which is the actual
path of the running init, instead of /sbin/init.

Reported by:	Melissa Jenkins <melissa-freebsd at littlebluecar.co.uk>, jilles@
MFC after:	1 month
Sponsored by:	The FreeBSD Foundation
2016-05-11 10:03:13 +00:00
Edward Tomasz Napierala
126ba2193b When rerooting, ignore ESRCH returned from kill(2). I couldn't reproduce
this by myself, but apparently it sometimes happens when rerooting from
single user mode.

Reported by:	jilles@
MFC after:	1 month
Sponsored by:	The FreeBSD Foundation
2016-05-11 09:30:18 +00:00