- Note that kernel options are required
- Shift parameters around in SYNOPSIS to make it more clear that there are
different modes
- For all literal symbols such as 'process' or 'loginclass' or 'wallclock',
etc, make them into bold symbols with .Sy
- For each subject:subject-id:etc: use .Em to underline to make it more clear
they relate to the rule syntax
- Document how devd(8) support works
- Move RSS warning to BUGS and replace RSS with 'memoryuse' since 'RSS' is not
defined in the manpage
- Add more examples around listing existing rules
- Make rule syntax into a list to improve readability
- Add a list of subjects and their corresponding subject-id same as
RESOURCES/ACTIONS have lists
- Note that rctl(8) takes affect on all current and future processes
- Note that amount can take human numbers
- Add reference to login.conf(5) in few places login class is mentioned
Reviewed by: trasz
Approved by: bapt (mentor)
MFC after: 1 week
patch supplied by Allan Jude <freebsd@allanjude.com>. Add xref to
pam_passwdqc(8), where that testing is now done.
PR: docs/184482
Submitted by: Ryan Gerstenkorn <ryan_gerstenkorn@fastmail.fm>
Reviewed by: jilles, eadler
MFC after: 3 days
insert flow entry. During the route lookup the critical section is
exited. It may happen, that after route lookup we will be executed
on an other CPU that already has such flowentry. Before this change
we simply freed the flowentry and returned to ip_output() with
failure.
Actually there is nothing wrong with using previously allocated
flow entry, updating it properly. Thus, make flowentry_insert()
return the new either old fle, and make use of it.
Count reuses as "collisions" and real inserts as "inserts".
Reviewed by: adrian
Sponsored by: Netflix
Sponsored by: Nginx, Inc.
Some of the collisions that are occuring are due to flowtable lookups
that succeed but have an invalid lle - typically because the L2 adjacency
lookup hasn't completed. This would lead to a follow-up insert which
would then fail (ie, collision) and the code would fall through to doing
a slow-path L2/L3 lookup in the netinet/netinet6 code.
This patch simply aborts storing a new flowtable entry if the lle isn't
yet valid.
Whilst I'm here, add a new pcpu counter for the item so the number of
failures can be tracked separately from generic "collisions."
Reviewed by: glebius
MFC after: 10 days
Sponsored by: Netflix, Inc.
- ip_output() and ip_output6() simply call flowtable_lookup(),
passing mbuf and address family. That's the only code under
#ifdef FLOWTABLE in the protocols code now.
o Revamp statistics gathering and export.
- Remove hand made pcpu stats, and utilize counter(9).
- Snapshot of statistics is available via 'netstat -rs'.
- All sysctls are moved into net.flowtable namespace, since
spreading them over net.inet isn't correct.
o Properly separate at compile time INET and INET6 parts.
o General cleanup.
- Remove chain of multiple flowtables. We simply have one for
IPv4 and one for IPv6.
- Flowtables are allocated in flowtable.c, symbols are static.
- With proper argument to SYSINIT() we no longer need flowtable_ready.
- Hash salt doesn't need to be per-VNET.
- Removed rudimentary debugging, which use quite useless in dtrace era.
The runtime behavior of flowtable shouldn't be changed by this commit.
Sponsored by: Netflix
Sponsored by: Nginx, Inc.
report the actual number of RPCs issued, not the theoretical number
that would be issued if all caching was disabled.
Reviewed by: rmacklem
MFC after: 2 weeks
commit c1acf022c5
Author: Brooks Davis <brooks@one-eyed-alien.net>
Date: Fri Jan 17 21:46:44 2014 +0000
Add an option WITHOUT_NCURSESW to suppress building and linking to
libncursesw. While wide character support it useful we'd like to
only need one ncurses library on embedded systems.
MFC after: 4 weeks
Sponsored by: DARPA, AFRL
propagate the buffer size to libc, which uses a 1 kB buffer by default,
negating any hypothetical benefit of increasing fetch(1)'s buffer size.
MFC after: 3 days
This avoids leaving stale entries in utmpx after the connection is closed on
an open login session. It also allows a clean way (SIGTERM) to forcibly
terminate a user's terminal session.
This does not affect the situation for "hung" processes after the connection
is closed. The foreground process group receives SIGHUP and the tty becomes
inaccessible.
Also replace all use of the obsolete signal() function with sigaction() (not
only the part where it is actually required: SIGHUP and SIGTERM must mask
the other as well when caught).
PR: misc/183495
Reviewed by: ed
killall confusing killall -INT with killall -I (interactive
confirmation) which resulted in the wrong signal (TERM)
being delivered to the process(s).
Discussed with: delphij
MFC after: 2 weeks
Do this by generating misc_helpers explicitly, without using the
ATF_TESTS_SH functionality.
While this script is technically an atf-sh test program, it is not intended
to be run as a test and therefore it mustn't end up in the Kyuafile. Using
ATF_TESTS_SH means that misc_helpers ended up registered in the Kyuafile
and then failed to run as a test.
The alternative would be to supply an explicit Kyuafile from this directory
that lists the known test files, but doing it the way described above will
be easier to maintain.
MFC after: 3 days
These files are required to get packages in ports to build against atf and
also to get a couple of currently-failing tests to pass.
I'm following the approach already used by the libusb pkg-config files
installed by the system regarding the location and the install rules.
MFC after: 5 days
fts(3) detects directories even in FTS_NOSTAT mode (so it can descend into
them).
No functional change is intended, but find commands that use -type d but no
primaries that still require stat/lstat calls make considerably fewer system
calls.
* Do not match symlinks that are followed because of -H or -L. This is
explicitly documented in GNU find's info file and is like -type l.
* Fix matching symlinks in subdirectories when fts changes directories.
Also, avoid some readlink() calls on files that are obviously not symlinks
(because of fts(3) restrictions, not all of them).
MFC after: 1 week
The code did not take into account that readlink() does not add a
terminating '\0', and therefore did not work reliably.
As before, symlinks of length PATH_MAX or more are not handled correctly.
(These can only be created on other operating systems.)
PR: bin/185393
Submitted by: Ben Reser (original version)
MFC after: 1 week
clang-specific or gcc-specific flags, introduce the following new
variables for use in Makefiles:
CFLAGS.clang
CFLAGS.gcc
CXXFLAGS.clang
CXXFLAGS.gcc
In bsd.sys.mk, these get appended to the regular CFLAGS or CXXFLAGS for
the right compiler.
MFC after: 1 week
necessary symbols needed per subsystem. Main kvm(3) init is now delayed
as much as possbile. This finally fixes performance issues reported in
kern/167204.
Some non-working code (ng_socket.ko symbol addresses calculation) removed.
Some global variables eliminated.
PR: kern/167204
MFC after: 4 weeks
to casperd, but we cannot access the service we need we exit with an error.
This should not happen and just indicates some configuration error which
should be fixed, so we force the user to do it by failing.
Discussed with: emaste
