This allows LCP ECHOs to be enabled independently of LQR reports.
Note: This introduces a change in the default behaviour (search for lqr and
echo in the man page). I'll update UPDATING to reflect this.
PR: 74821
Add ``disable NAS-IP-Address'' and ``disable NAS-Identifier'' options to
support pre-rfc2865 RADIUS servers.
This pushes our enable/disable items over the 32 bit limit, so reoganise
things to allow a bunch more options.
Go to version 3.4.1 so that any compatability problems can be identified.
units (as specified in _BIF). (noted by Bruno Ducrot)
o In looking in the standard, if the cap numbers are 0xffffffff, then acpi
is reporting unknown for that field. Report unknown numbers properly.
o Update the state to reflect charging, discharging and critical.
my patches for this information. Commit my more complete version.
This version isn't complete yet, since some details aren't handled
right just yet.
Poaching by: phk
hence bump it to 6.
Note that the last commit message was not quite accurate. While the
assumption exists in the code, it's not possible to have an
uninitialized p there because if lflag is set when username is NULL
then execution would be terminated earlier.
- Allow the upload directory to be optional. If the upload directory
field is cleared to the empty string then no directory will be created.
- Don't create a bin/ subdirectory in ftp's home dir containing ls(1) and
date(1) as ftpd(8) no longer requires it.
- Create a pwd.db file in etc/ instead of a passwd file.
- Ignore NIS compat entries in /etc/group and /etc/master.passwd when
building the anonymous files.
PR: bin/60662
Submitted by: Olafur Osvaldsson oli at isnic dot is
If turned on no NIS support and related programs will be built.
Lost parts rediscovered by: Danny Braniss <danny at cs.huji.ac.il>
PR: bin/68303
No objections: des, gshapiro, nectar
Reviewed by: ru
Approved by: rwatson (mentor)
MFC after: 2 weeks
http://www.securityfocus.com/archive/1/379450
This patch is based on dillon's patch on DragonFlyBSD, which is in
turn derived from OpenBSD's src/usr.sbin/pppd/cbcp.c,v 1.6.
Obtained from: OpenBSD via DragonFlyBSD
Encouraged by: nectar
This commit does not affect the code generated, as proven by md5'ing
resulting binaries.
Bump WARNS accordingly.
Compiled on: sparc64, ia64, i386
Reviewed by: alfred (but blame me if anything goes wrong :-)
syslog(3) if we are a priveleged program (sshd, su, etc.).
- Make syslogd open an additional socket /var/run/logpriv, with 0600
permissions.
- In libc, try to use this socket.
- Do not loop forever if we are using this socket (partial backout of 1.31)
Reviewed by: dwmalone, Andrea Campi <andrea webcom it>
Approved by: julian (mentor)
MFC after: 1 month
remove limit for 20 sockets.
- Add possibility to specify file mode for sockets created with '-l'.
- Check that socket name in '-l' is absolute.
Reviewed by: dwmalone, Andrea Campi <andrea webcom it>
Approved by: julian (mentor)
to PRECIOUSLIB from bsd.lib.mk. The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.
Reviewed by: oliver
the implementation of the following feature in revision 1.4:
- Install Makefile.yp as /var/yp/Makefile.dist and link it to
/var/yp/Makefile only if /var/yp/Makefile doesn't already exist.
Suggested by Peter Wemm.
The actual code was only symlinking when no /var/yp/Makefile.dist
existed, i.e., never.
Since we can only override the DSDT, a custom ASL dumped previously that
contained SSDTs would result in lots of multiple definition errors.
A longer-term fix involves adding the ability to override SSDTs to ACPI-CA.
MFC after: 3 days
Disable some code which magics minor numbers into card/port numbers.
I think we will have to parse this from the device name in the future,
but I need to confer with peter@ about this.
Put sicontrol back in the build.
Troublespotter: dwhite
NO_BIND_DNSSEC, NO_BIND_ETC, NO_BIND_NAMED, and NO_BIND_UTILS.
2. Make creation of directories in /usr/include that are only needed
in the WITH_BIND_LIBS case conditional.
Reviewed by: ru, des
with this configuration, but Ruslan tells me that I was probably mistaken,
and on retest the .5 pages are being installed just fine.
Therefore reverse the MAN[58] change in favor of the more modern syntax.
Submitted by: ru
1. Install man files and links for the lwres library.
2. Fix the path in various files to say /etc/namedb/ instead of just /etc.
3. Correctly install the conf file man pages for named and rndc.
but have a knob (WANT_BIND_LIBS) to build and install them in /usr/lib
and /usr/include. Rumors are that this may be useful at a later point,
let's see.
What this really means is that all BIND libraries are now internal to
buildworld (by default, unless WANT_BIND_LIBS is defined), and linked
statically into various BIND executables.
While here, removed redundant -I's from CFLAGS in lib/bind makefiles.
Sponsored by: des
OK'ed by: dougb
loop to avoid an incorrect display of the nologin path twice.
PR: 71786
Submitted by: Andrew Hayden <andrew.hayden@gmail.com>
Reviewed by: mtm
MFC after: 3 days
POSIX threads libraries are not available. Add crypto support if
the crypto libraries are available. Build dnssec-{keygen,signzone}
if crypto is available.
Submitted by: (in part) dougb@
This adds a safebelt that prevents users to mark more than
one "active" partitions, which will lead to a unbootable
machine, especially in multi-boot configurations.
PR: bin/71404
MFC After: 3 days
Approved by: murray (mentor)
$ crontab -e
[Add an entry with an error in the crontab file.]
crontab: errors in crontab file, can't install
Do you want to retry the same edit? yes
[Exit the editor without any changes.]
crontab: no changes made to crontab
[Entry is lost.]
Now crontab will loop until the error is fixed, or the
user answers no.
VT6122 gigabit ethernet chip and integrated 10/100/1000 copper PHY.
The vge driver has been added to GENERIC for i386, pc98 and amd64,
but not to sparc or ia64 since I don't have the ability to test
it there. The vge(4) driver supports VLANs, checksum offload and
jumbo frames.
Also added the lge(4) and nge(4) drivers to GENERIC for i386 and
pc98 since I was in the neighborhood. There's no reason to leave them
out anymore.
remaining consumers to have the count passed as an option. This is
i4b, pc98/wdc, and coda.
Bump configvers.h from 500013 to 600000.
Remove heuristics that tried to parse "device ed5" as 5 units of the ed
device. This broke things like the snd_emu10k1 device, which required
quotes to make it parse right. The no-longer-needed quotes have been
removed from NOTES, GENERIC etc. eg, I've removed the quotes from:
device snd_maestro
device "snd_maestro3"
device snd_mss
I believe everything will still compile and work after this.
concensus seems to be that is best left for doing post-install.
Discussed on: freebsd-current@
Tested with: make release
Approved by: re@
MFC after: 3 days
Previously, it would recognize it as a valid shell only
if the basename (nologin) was specified. Now, it will
recognize both the basename and the full path.
NOTE: The full path as adduser(8) understands it is /usr/sbin/nologin.
There is a symlink, /sbin/nologin, but that's deprecated and
only there for backwards compatibility.
relocation is not sufficient for ELF relocatable object format
modules, since accessing the module metadata involves following
pointers between different ELF sections.
This allows kldxref to correctly build linker.hints on the amd64
platform.
to get used to the fact that Perl is no longer part of the base system.
It is practically impossible to install any useful package and not get
Perl automatically pulled in as a dependency. So the typical user will
get their Perl.
This change greatly reduces the amount of manual labor in building the
miniinst.iso in release building.
Centralize the fdctl_wr() function by adding the offset in
the resource to the softc structure.
Bugfix: Read the drive-change signal from the correct place:
same place as the ctl register.
Remove the cdevsw{} related code and implement a GEOM class.
Ditch the state-engine and park a thread on each controller
to service the queue.
Make the interrupt FAST & MPSAFE since it is just a simple
wakeup(9) call.
Rely on a per controller mutex to protect the bioqueues.
Grab GEOMs topology lock when we have to and Giant when
ISADMA needs it. Since all access to the hardware is
isolated in the per controller thread, the rest of the
driver is lock & Giant free.
Create a per-drive queue where requests are parked while
the motor spins up. When the motor is running the requests
are purged to the per controller queue. This allows
requests to other drives to be serviced during spin-up.
Only setup the motor-off timeout when we finish the last
request on the queue and cancel it when a new request
arrives. This fixes the bug in the old code where the motor
turned off while we were still retrying a request.
Make the "drive-change" work reliably. Probe the drive on
first opens. Probe with a recal and a seek to cyl=1 to
reset the drive change line and check again to see if we
have a media.
When we see the media disappear we destroy the geom provider,
create a new one, and flag that autodetection should happen
next time we see a media (unless a specific format is configured).
Add sysctl tunables for a lot of drive related parameters.
If you spend a lot of time waiting for floppies you can
grab the i82078 pdf from Intels web-page and try tuning
these.
Add sysctl debug.fdc.debugflags which will enable various
kinds of debugging printfs.
Add central definitions of our well known floppy formats.
Simplify datastructures for autoselection of format and
call the code at the right times.
Bugfix: Remove at least one piece of code which would have
made 2.88M floppies not work.
Use implied seeks on enhanced controllers.
Use multisector transfers on all controllers. Increase
ISADMA bounce buffers accordingly.
Fall back to single sector when retrying. Reset retry count
on every successful transaction.
Sort functions in a more sensible order and generally tidy
up a fair bit here and there.
Assorted related fixes and adjustments in userland utilities.
WORKAROUNDS:
Do allow r/w opens of r/o media but refuse actual write
operations. This is necessary until the p4::phk_bufwork
branch gets integrated (This problem relates to remounting
not reopening devices, see sys/*/*/${fs}_vfsops.c for details).
Keep PC98's private copy of the old floppy driver compiling
and presumably working (see below).
TODO (planned)
Move probing of drives until after interrupts/timeouts work
(like for ATA/SCSI drives).
TODO (unplanned)
This driver should be made to work on PC98 as well.
Test on YE-DATA PCMCIA floppy drive.
Fix 2.88M media.
This is a MT5 candidate (depends on the bioq_takefirst() addition).
This gets us the info we need on systems which have proprietary tables that
don't match the standard. For instance, an AMI system has a table of type
"OEMB" with an invalid checksum.
Tested by: Maxim Maximov <mcsi_at_mcsi.pp.ru>
MFC after: 1 day
callers. These ioctls attempted to enable and disable the ACPI
interpreter at runtime. In practice, it is not possible to boot with
ACPI and then disable it on many systems and trying to do so can cause
crashes, interrupt storms, etc. Binary compatibility with userland is
retained.
MFC after: 2 days
and explicitly mention SSDT when we talk about the DSDT so that people
don't have to guess whether it includes the SSDT.
While here, touch date.
Pointed out by: le@
Decrease log severity to debug if a protocol is not supported by the
kernel (rpcbind checks /etc/netconfig if a protocol is available).
This avoids "rpcbind: cannot create socket for tcp6" messages
at startup on IPv4-only kernels.
use it, only those with FCode. Add references to dc(4), gem(4) and hme(4)
for obtaining further information about such devices presently supported
by FreeBSD.
- Correct the HISTORY section. There was an eeprom(8) utility in 4.4BSD and
early versions of FreeBSD 2.x.
- Add an AUTHORS section.
now include the contents if any SSDT table as well. This makes use
of the property that one can concatenate the body of SSDT tables to
the DSDT, updating the DSDT header (length and checksum) and end up
with a larger and valid DSDT table. Hence, this also works with -f.
Reviewed by: njl@
contents of /usr/src/rescue. Until now, the files were shipped with
releases but sysinstall would ignore them (resulting in a non-buildable
source tree).
Sanity checked by: jhb
Specifically, change the second level menu title from 'Country' to
'Country or Region', since e.g. Hong Kong is not a country.
Submitted by: Xin LI <delphij@frontfree.net>
another process already has /dev/snp0 open, the snp(4) will return
EBUSY, in which case watch will try to open /dev/snp1..9. Currently
watch does not check errno to see if the failure was a result of EBUSY.
This results in watch making futile attempts to open snp0..snp9 even
though devices may not exist or the caller does not have permissions
to access the device.
In addition to this, it attempts to setup the screen for snooping even
though it may not ever get an snp device.
So this patch does two things
1) Checks errno for EBUSY, if open(2) fails for another reason
print that reason and exit.
2) setup the terminal for snooping after the snp descriptor has
been obtained.
Approved by: bmilekic (mentor)
install of Postfix fails since Postfix 1 is picked from INDEX instead
of Postfix 2.
The problem is that the package_add function matches multiple Postfix
packages and then installs a "random" version (the last one found in
INDEX). This does not occur with a CD-ROM install since there is only
one Postfix package on the CD-ROM.
The correct solution to this would be to check the origin field from
INDEX instead of the package name, but due to the way sysinstall is
made that is not trivial, so instead work around the problem by
hard-coding the Postfix major and minor revision (for the current
stable version) to install directly into the package_add call.
PR: misc/65426
Reported by: Harold Kachelmyer <bugs@princessharold.net>
Approved by: trhodes
or 'env MAKEOBJDIRPREFIX=... make' depending on the setting of
MAKEOBJDIRPREFIX in the environment. In any case this line kills the
original value of ${MAKE}. When during buildworld a new make is built (as
is the case during the upgrade) this causes a wrong make to be picked up
(the first one in the path). Use the same technique as Makefile.inc1:
create a MAKEENV variable and a CRUNCHMAKE that calls ${MAKE} with that
MAKEENV prefixed. Use CRUNCHMAKE instead of MAKE throughout the generated
makefile. This leaves the original ${MAKE} undisturbed.
some confusion as to how large the EFI system partition should be,
but 100MB seems to be either the maximum, the minimum or the default
size, so make the EFI partition 100MB.
global variables. On ia64, save a pointer to the efi chunk as well.
o At the same time, change checkLabels() to define these globals instead
of having the caller of checkLabels() pass addresses to variables for
these. Change the two callers correspondingly.
o Spent a bit more time adjusting try_auto_label() to prepate for having
the EFI partition created on ia64.
o Remove efi_mountpoint(). The EFI chunk is now available without having
to iterate over the disks and chunks to find it every time we need it.
o On ia64, now that the root chunk is globally available, set the
vfs.root.mountfrom tunable in loader.conf. This avoids that one cannot
boot into FreeBSD after an install. The kernel cannot find the root
device without a little help...
of releases. The -DNOCRYPT build option still exists for anyone who
really wants to build non-cryptographic binaries, but the "crypto"
release distribution is now part of "base", and anyone installing from a
release will get cryptographic binaries.
Approved by: re (scottl), markm
Discussed on: freebsd-current, in late April 2004
o Remove the code that creates the boot directory on the EFI file
system after it has been mounted, as well as remove the code
that creates the symlink from /boot -> /efi/boot (*). As a result,
/boot will be extracted onto the root file system.
o Add a function efi_mountpoint() that returns the mount point of
the EFI file system or NULL if no EFI partition is created. This
function is used to both check whether there's an EFI file system
and to return what its mount point is.
o When there's no EFI file system, ask the user if this is what he
or she wants. Since we extract /boot onto the root file system,
we do not actually need an EFI file system for the installation to
work. Whether one wants to install without an EFI partition is
of course an entirely different question. We allow it...
o When we're done installing and need to fix up the various bits
and pieces, check if there's an EFI partition and if yes, move
/boot to /efi/boot and create a symlink /boot -> /efi/boot (*).
This is a much more reliable way to get /boot onto the EFI
partition than creating the symlink up front and hope its being
respected. It so happened that we never had the boot directory
end up on the EFI partition. We make the symlink relative.
(*) /efi is a place holder for the actual EFI mount point of course.
instead of BD_ADDRs
- Convert BD_ADDRs in l2ping(8) output into the human readable names via
bt_gethostbyaddr(3)
- Introduce and document '-n' - numberic output option
Suggested by: Anil Madhavapeddy <anil at recoil dot org>
we'll actually create an EFI partition with a FAT file system instead
of an UFS file system. It also allows us to give a sensible default
mount point for EFI partitions so that people don't have to guess.
This also means that we can now remove new_efi_part(), which did the
same thing as new_part(), except it created a FAT file system. The
function wasn't called when the EFI partition was created from scratch
though, which was the problem. By passing the partition type to the
various functions, we can deal with EFI without having to duplicate
code.
While I'm here, document the existence of the '-l' option, which allows
one to use moused to use psm in some more interesting ways.
Approved by: njl (mentor)
that actually need it. This makes it easier for a platform porter to
find the files that may need tweaking to support whatever MD specific
partitioning is needed. It also helps to prevent that the libdisk API
gets exposed and/or used where it's not needed.
some debug support turned on. It turns out the sections in this driver
binary had relative virtual addresses (RVAs) that were different
from the raw addresses, and it had a .data section where the virtual size
was much larger than the raw size. (Most production binaries produced
with the Microsoft DDK have RVA == PA.)
There's code in the ndiscvt(8) utility that's supposed to handle
the vsize != rsize case, but it turns out it was slightly broken,
and it failed to handle the RVA != RA case at all. Hopefully, this
commit will fix all that.
- Give ndiscvt(8) the ability to process a .SYS file directly into
a .o file so that we don't have to emit big messy char arrays into
the ndis_driver_data.h file. This behavior is currently optional, but
may become the default some day.
- Give ndiscvt(8) the ability to turn arbitrary files into .ko files
so that they can be pre-loaded or kldloaded. (Both this and the
previous change involve using objcopy(1)).
- Give NdisOpenFile() the ability to 'read' files out of kernel memory
that have been kldloaded or pre-loaded, and disallow the use of
the normal vn_open() file opening method during bootstrap (when no
filesystems have been mounted yet). Some people have reported that
kldloading if_ndis.ko works fine when the system is running multiuser
but causes a panic when the modile is pre-loaded by /boot/loader. This
happens with drivers that need to use NdisOpenFile() to access
external files (i.e. firmware images). NdisOpenFile() won't work
during kernel bootstrapping because no filesystems have been mounted.
To get around this, you can now do the following:
o Say you have a firmware file called firmware.img
o Do: ndiscvt -f firmware.img -- this creates firmware.img.ko
o Put the firmware.img.ko in /boot/kernel
o add firmware.img_load="YES" in /boot/loader.conf
o add if_ndis_load="YES" and ndis_load="YES" as well
Now the loader will suck the additional file into memory as a .ko. The
phony .ko has two symbols in it: filename_start and filename_end, which
are generated by objcopy(1). ndis_open_file() will traverse each module
in the module list looking for these symbols and, if it finds them, it'll
use them to generate the file mapping address and length values that
the caller of NdisOpenFile() wants.
As a bonus, this will even work if the file has been statically linked
into the kernel itself, since the "kernel" module is searched too.
(ndiscvt(8) will generate both filename.o and filename.ko for you).
- Modify the mechanism used to provide make-pretend FASTCALL support.
Rather than using inline assembly to yank the first two arguments
out of %ecx and %edx, we now use the __regparm__(3) attribute (and
the __stdcall__ attribute) and use some macro magic to re-order
the arguments and provide dummy arguments as needed so that the
arguments passed in registers end up in the right place. Change
taken from DragonflyBSD version of the NDISulator.
It does survive « make release ».
Uses an upcoming patch from the vendor branch (ntp-stable) of ntp-keygen.
Submitted by: Marius Strobl <marius@alchemy.franken.de>
you've specified a directory. It is intended to be used in building
custom releases over NFS where locking may be unreliable at best and
there is no contention that the locking is designed to arbitrate.
Other uses of this flag are discouraged. Document same in usage and
man page (including the warning about unwise).
Sponsored by: Timing Solutions
(1) use strlcpy instead of strncpy since the use here of the latter
was incorrect.
(2) Move 'N' case into proper sorted order (sorted the same way that
ls sorts its args).
This bring us several things:
- updated drivers
- IPv6 support at last
- ntp-genkeys is replaced by ntp-keygen
- ntptrace is now a script (courtesy of John Hay)
- lots of renamed files from .htm to .html (while I prefer .html, I
find the change a bit gratuitous)
- still no manpages :(
Please test and report.
Commit very much helped by: GNU arch (http://gnuarch.org/)
information being sent to the RADIUS server.
Logging of RADIUS accounting information moves to a ``set log [+-]radius''
level, along with the RADIUS alive info, and the version number is bumped
to 3.2 to reflect this.
Mostly submitted by: alx@sm.ukrtel.net (back in January)
MFC after: 3 weeks
apply the patch of bin/61718 (which should include/elimatate kern/61122 also).
It seems to fix a few annoying bugs.
PR: bin/61718, kern/61122
Submitted by: bg@sics.seohartman@mail.physik.uni-mainz.de
but conveniently, because ncpaddr.ncpaddr_family != AF_INET, the call to
ncpaddr_getip4addr() became a no-op leaving the local address as it was
(defaulting to whatever my hostname resolves to).
PR: 62050
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>
MFC after: 3 days
FFLAG_NEEDSYNC and fsync the file when select() next returns zero. This
dramatically speeds up the process of logging large amounts of data, while
leaving the essential semantics (that data can be expected to be on disk
if we crash) unchanged.
In my tests, this speeds up the rc phase of booting by 18-20%. [1]
YES PLEASE! by: phk [1]
enable the use as a port on older systems
- use absolute paths in all calls to external programs, to account for strange
PATH settings
- use INDEX or INDEX-5 depending on FreeBSD version, to enable the use on
FreeBSD 4.x as a port.
- conditionalize all 4.x/5.x differences on __FreeBSD_version, so that the
pkg_install tools can be kept in sync on 4.x and 5.x
- Bump PKG_INSTALL_VERSION
Reviewed by: portmgr (bento run)
MFC after: 4 weeks
- pkg_info: new flag -j (show the requirements script)
- pkg_info: fix verbose output when used on packages
- better handling of corrupt entries in /var/db/pkg
- differ between corrupt entires and packages not installed
- various small fixes
PR: 56989, 57016, 57029, 26468
- use glob patterns when matching packages by origin
- csh-style {...} choices in glob matching
- pkg_info: new flag -E (list matching package names only)
- pkg_version: new flag -T (test if a given name matches a pattern)
- new flag -X (interpret pattern as an extended regular expression)
PR: 56961
- parse version numbers of ports containing an underscore followed by a number correctly
- handle special strings pl, alpha, beta, pre and rc
PR: 56961
seeing status of mounted file system for jailed processes.
Pass full path of jail's root directory to the kernel. mount(8) utility is
doing the same thing already.
disappearing from the tree. We already were splitting the baby (using
the symbol for the vendor BROADCOM, but not for the device). Use
#defines for both.
the *filename* and not the pid_file(!). Stupid brain-fault on my part.
This could cause a segfault under -neworder if newsyslog had to rotate
multiple files, and later ones had specifed the 'N' flag.
Bug first reported by: le
MFC after: 3 days
-d option was equal to the one already saved and which caused
the pw utility to avoid updating values passed by other options
processed before the -d option in the code path.
Spotted by: Richard Caley <rjc@interactive.co.uk>
processes, and balance that by adding a 10-second delay after all the
processes have been signaled. Also improvement a few messages printed
with `-n' or `-v' processing (mostly signal-related messages).
MFC after: 13 days
files to rotate. The new order will first rotate all files that need
to be rotated, and then send a single signal to each process which
needs to be signaled, and finally it will compress all the files which
were rotated.
This means daemons will be signaled once per run of newsyslog, instead
of once per file rotated. Also, files will be compressed in order of
file-size (smallest to largest). Also, it waits for each file to be
completely compressed before starting the next one (effectively as if
the 'w' flag is specified for all entries in newsyslog.conf). This
avoids the situation of having 10 gzip's going at the same time (each
with a log.0 and a log.0.gz file active), and it also means that file
attributes can be reliably set on files after they are compressed.
NOTE: This commit does define NEWORDER (which you could get rid of if
you really don't trust this), but it does not flip the "-D neworder"
switch. So, at the moment none of these changes happen unless you
request them (perhaps by adding '<debug> neworder' in newsyslog.conf).
PR: bin/25070 inspired some parts of this
Submitted by: parts from bin/25070 done by Helge Oldach
MFC after: 14 days
the newsyslog.conf file. Rename one size-related variable, and move
another one from the stack into conf_entry. Add a routine to change
file-attributes (chown, chmod, chflags), instead of having several
places doing the same sequence of system-calls. A few cosmetic/style
changes.
These should not effect any users. Most of these probably look
pointless, but they are the "insignificant parts" of a much larger
update that I'll be committing soon. Doing these as a separate update
should make that update easier to read.
MFC after: 14 days
that had been written some months ago for other processing. This
should get rid of a few subtle situations where an existing log
file would not exist (for a short time) while it is being rotated.
MFC after: 16 days
about the risks of enabling raw sockets in prisons.
Because raw sockets can be used to configure and interact
with various network subsystems, extra caution should be
used where privileged access to jails is given out to
untrusted parties. As such, by default this option is disabled.
A few others and I are currently auditing the kernel
source code to ensure that the use of raw sockets by
privledged prison users is safe.
Approved by: bmilekic (mentor)
