Commit Graph

1139 Commits

Author SHA1 Message Date
gavin
3289affe76 After writing a kernel core dump into /var/crash, call sync(8).
If we panic again shortly after boot (say, within 30 seconds), any core
dump we wrote out may be lost on reboot.  In this situation, we really
want to keep that core file, as it may be the only way to have the issue
resolved.  Call sync(8) after writing out the core file and running
crashinfo(8), in the hope that these will not be lost if we panic
again.  sync(8) is only called in the case where there is a core dump
to be written out, so won't be called during normal boots.

Discovered by:	Trying to debug an IPSEC panic
MFC after:	1 week
2013-08-28 15:12:15 +00:00
peter
088808bf23 Pass pidfile to bsnmpd if it's been changed (parts cut/pasted from
rc.d/rarpd and rc.d/wpa_supplicant)
2013-08-19 05:37:49 +00:00
peter
d7ac7dd6dc Revert r254508. 2013-08-19 05:12:38 +00:00
peter
d80ee1955b Add the optional ability to run as a different user.
Obtained from:	Antique freebsd.org cluster archive images
2013-08-19 04:56:03 +00:00
hrs
cbd7fe2b24 - Reimplement $gif_interfaces as a variant of $cloned_interfaces.
Newly-configured systems should use $cloned_interfaces.

- Call clone_{up,down}() and ifnet_rename() in rc.d/netif {start,stop}.
  ifnet_rename() now accepts an interface name list as its argument.

- Add rc.d/netif clear.  The "clear" subcommand is basically equivalent to
  "stop" but it does not call clone_down().

- Add "ifname:sticky" keyword into $cloned_interfaces.  If :sticky is
  specified, the interface will not be destroyed in rc.d/netif stop.

- Add cloned_interfaces_sticky={YES,NO}.  This variable globally sets
  :sticky keyword above for all interfaces.  The default value is NO.
  When cloned_interfaces_sticky=YES, :nosticky keyword can be used to
  override it on per interface basis.
2013-08-04 06:36:17 +00:00
des
60f83c2b99 When stopping pfsync, remove the pfsync interface's syncpeer setting.
MFC after:	3 days
2013-07-15 08:48:45 +00:00
avg
22e327d005 rc.d/zfs: pass -v option to zfs mount
this should make boot process more informative (and entertaining)
on systems with lots of zfs filesystems.

MFC after:	7 days
2013-07-09 08:59:39 +00:00
hrs
8a3748f531 - Add vnode-backed swap space specification support. This is enabled when
device names "md" or "md[0-9]*" and a "file" option are specified in
  /etc/fstab like this:

  md    none    swap    sw,file=/swap.bin       0       0

- Add GBDE/GELI encrypted swap space specification support, which
  rc.d/encswap supported.  The /etc/fstab lines are like the following:

  /dev/ada1p1.bde       none    swap    sw      0       0
  /dev/ada1p2.eli       none    swap    sw      0       0

  .eli devices accepts aalgo, ealgo, keylen, and sectorsize as options.

  swapctl(8) can understand an encrypted device in the command line
  like this:

  # swapctl -a /dev/ada2p1.bde

- "-L" flag is added to support "late" option to defer swapon until
  rc.d/mountlate runs.

- rc.d script change:

    rc.d/encswap -> removed
    rc.d/addswap -> just display a warning message if $swapfile is defined
    rc.d/swap1 -> renamed to rc.d/swap
    rc.d/swaplate -> newly added to support "late" option

These changes alleviate a race condition between device creation/removal
and swapon/swapoff.

MFC after:	1 week
Reviewed by:	wblock (manual page)
2013-06-27 18:28:45 +00:00
rpaulo
5d588b2eef Implement ifconfig_wlanX="HOSTAP".
Not only this is a bit cleaner, it allows multiple instances of hostapd to be
running on the system host, useful for simultaneous dual-band WiFi.
This is similar to ifconfig_wlanX="WPA" but it uses /etc/hostapd-wlanX.conf.
Compatibility with hostapd_enable=YES/NO was kept.

Reviewed by:	adrian
2013-06-26 04:00:52 +00:00
delphij
8d3f5f270f Call sshd_precmd instead of sshd_configtest when the operator
requests reload or restart, which, in addition of testing the
configuration, will also generate host keys when they are not
present (previous behavior).

Obtained from:	FreeNAS
Ok'ed by:	bdrewery, des
MFC after:	1 week
2013-06-21 17:23:19 +00:00
dteske
59d4cd3965 Allow $ntpdate_config to be NULL. Due to a lack of surrounding quotes, when
ntpdate_config was set to NULL the conditional would (counter to prevailing
logic) succeed -- leading to awk attempting to redirect from a NULL pathname
standard-in. While we're here, make the script consistant with itself by
removing the {curlies} around ntpdate_config (they are unnecessary).
2013-06-18 02:37:15 +00:00
crees
5219f99e6a Clean up swapfile memory disk on shutdown
Make the md unit number configurable so that it can be predicted

PR:		bin/168544
Submitted by:	wblock (based on)
Approved by:	kevlo
2013-06-12 16:44:17 +00:00
hrs
2ec3ccab05 Add :ifname modifier to specify interface-specific routes into
{,ipv6_}static_routes and rc.d/routing.  For example:

 static_routes="foo bar:em0"
 route_foo="-net 10.0.0.0/24 -gateway 192.168.2.1"
 route_bar="-net 192.168.1.0/24 -gateway 192.168.0.2"

At boot time, all of the static routes are installed as before.
The differences are:

- "/etc/rc.d/netif start/stop <if>" now configures static routes
  with :<if> if any.
- "/etc/rc.d/routing start/stop <af> <if>" works as well.  <af> cannot be
  omitted when <if> is specified, but a keyword "any" or "all" can be used
  for <af> and <if>.
2013-06-09 18:11:36 +00:00
jamie
7941fefd80 Refine the "nojail" rc keyword, adding "nojailvnet" for files that don't
apply to most jails but do apply to vnet jails.  This includes adding
a new sysctl "security.jail.vnet" to identify vnet jails.

PR:		conf/149050
Submitted by:	mdodd
MFC after:	3 days
2013-05-19 04:10:34 +00:00
asomers
641feb7a9e etc/rc.d/syslogd
Add netif as a requirement of syslogd to get lo0 up.  Currently, this
	doesn't affect the rc order, because mountcritremote already depends on
	netif.

Reviewed by:	eadler
Approved by:	kenm (mentor)
MFC after:	2 weeks
2013-05-13 20:28:24 +00:00
hrs
4bf79fd947 - Fix exit status when ip6addrctl_verbose=yes [*]
- Use the absolute pathname for ip6addrctl.
- Use "install" instead of "add" to reduce the number of invocations.

Reported by:	Tatsuki Makino [*]
PR:		conf/175006 [*]
MFC after:	1 week
2013-05-04 15:42:55 +00:00
crees
6473a2540f Introduce and use new flag -L to mount for mounting only late filesystems.
Previously, rc.d/mountlate mounted *all* filesystems, causing problems with
background NFS mounts being mounted twice.

PR:		conf/137629
Submitted by:	eadler (original concept)
Reviewed by:	mjg
Approved by:	hrs
2013-05-04 14:00:16 +00:00
bdrewery
b5bdbccc2d Also call configtest before reload to ensure working config.
Approved by:	jhb
MFC after:	1 week
X-MFC-With:	r249489
2013-04-16 17:30:13 +00:00
bdrewery
f1d57c3c1d Run configtest before restarting so that the system is not
left without a running sshd.

Approved by:	des
MFC after:	1 week
2013-04-14 21:11:19 +00:00
jilles
b69a01f7fa rc.d/sysctl: Fix error messages about unknown OIDs.
There are three situations where the sysctl script is called:
1. "start", very early
2. "lastload", near the end of rc
3. "reload", at admin request while the system is booted

Ignore unknown OIDs in situation 1 because kernel modules may not be loaded
yet and complain about them in situations 2 and 3.

PR:		conf/174595
Submitted by:	Olivier Smedts
2013-03-22 20:12:25 +00:00
cperciva
f07d0be8f8 Fix typo in previous commit: Exit if */dev/dumpdev* does not exist, not if
*/bin/realpath* does not exist...

Submitted by:	markj
Pointy hat to:	cperciva
2013-03-19 05:08:25 +00:00
cperciva
262a11c529 If dumpdev is AUTO but no dump device has been set -- i.e., there is no swap
space configured for rc.d/dumpon to designate for dumping -- then exit
silently rather than with a
> realpath: /dev/dumpdev: No such file or directory
error message.

An argument could be made that we should print a (more informative) warning
message; but given that under the same conditions the rc.d/dumpon script will
already print a
> No suitable dump device was found
warning, it seems that printing an additional
> Dump device does not exist.  Savecore not run.
warning would be superfluous.
2013-03-19 04:42:04 +00:00
des
11d336c804 If rtadvd_interfaces is set to "none", start rtadvd without listing
any interfaces on the command line.

MFC after:	1 week
2013-02-25 17:07:42 +00:00
des
2ab43ec83e Load the pfsync module if necessary.
Reviewed by:	glebius@
MFC after:	1 week
2013-02-05 12:18:39 +00:00
ume
d10987d402 Use the default policy table of RFC 6724.
MFC after:	1 weeks
2013-02-02 18:08:09 +00:00
bz
c68369b543 Add a conditional sleep 1 in case we add any IPv6 addresses to interfaces.
Do this per jail started, not per address.  This will allow DAD to complete
and services to properly start.   Before we have seen problems with services
trying to start before the IPv6 address was available to use and thus
erroring and failing to start.

MFC after:	3 days
2013-01-17 01:27:39 +00:00
pjd
1d3ec906ca - When checking if a dump exists on the given device there is no need to
provide dump directory. Eliminate this redundant argument. This changes
  the usage, but the only risk here is that a warning will be printed
  about directory given as device.

- Update usage of -C option.

- When clearing dump header from the given device there is also no need to
  provide dump directory, although additional arguments for -c were not
  documented.

- Document that -v can be used with -c and that list of devices can be given.

Obtained from:	WHEEL Systems
2012-12-14 15:12:08 +00:00
delphij
976943f3a9 Teach sysctl(8) about parsing a file (while I'm there also give it
capability of parsing both = and : formats).

Submitted by:	hrs (initial version, bugs are mine)
MFC after:	3 months
2012-12-13 23:32:47 +00:00
pjd
3b54c5ffbe Fix the location of auditdistd configuration file.
Reported by:	Johan Hendriks <joh.hendriks@gmail.com>
2012-12-13 09:41:32 +00:00
rwatson
991e942bf2 Merge a number of changes required to hook up OpenBSM 1.2-alpha2's
auditdistd (distributed audit daemon) to the build:

- Manual cross references
- Makefile for auditdistd
- rc.d script, rc.conf entrie
- New group and user for auditdistd; associated aliases, etc.

The audit trail distribution daemon provides reliable,
cryptographically protected (and sandboxed) delivery of audit tails
from live clients to audit server hosts in order to both allow
centralised analysis, and improve resilience in the event of client
compromises: clients are not permitted to change trail contents
after submission.

Submitted by:	pjd
Sponsored by:	The FreeBSD Foundation (auditdistd)
2012-12-01 15:11:46 +00:00
hrs
a65c6ba8dc Fix condition to check if the maximum number of FIBs is greater than 0 or not.
Spotted by:	zont
2012-11-18 11:22:15 +00:00
hrs
0f95bf629a Use -fib N modifier to add/delete a route to/from multiple FIBs. 2012-11-17 21:44:02 +00:00
eadler
413379c5a8 Only pass ip[46].addr when _addrl contains a value
Submitted by:	crees
Reviewed by:	Mike Jakubik <mike.jakubik@intertainservices.com>
Approved by:	cperciva
MFC after:	2 weeks
2012-11-15 15:06:15 +00:00
hrs
b2713d8866 Load ipdivert.ko when natd_enable=YES.
PR:	conf/167566
2012-10-29 06:31:51 +00:00
hrs
94b3ca6d00 Fix an issue when ipv6_enable=YES && ipv6_gateway_enable=YES which could
prevent rtadvd(8) from working as intended.

Spotted by:	brian
Discussed with:	brian
2012-10-27 17:06:26 +00:00
brian
4bbccef318 Enable "accept_rtadvd" on interfaces running rtadvd.
Without this, rtadvd runs but never advertises a default (IPv6) route.

MFC after:	1 week
2012-10-25 08:37:08 +00:00
avg
291fc901e4 rc.d/power_profile: use recently added Cmax for cx_lowest
Trying to determine current lowest C-state after an AC event is racy
with C-states actually being changed by ACPI platform and kernel driver.

MFC after:	3 weeks
2012-09-11 06:25:10 +00:00
obrien
232b6c98b4 Simply things so that "#REQUIRE: FILESYSTEMS" means the file
systems are fully "ready to go".

'FILESYSTEMS' states: "This is a dummy dependency, for services which
require file systems to be mounted before starting."  However, we have
'var' which is was run after 'FILESYSTEMS' and can mount /var if it
already isn't mounted.  Furthermore, several scripts cannot use /var
until 'cleanvar' has done its thing.  Thus "FILESYSTEMS" hasn't really
meant all critical file systems are fully usable.
2012-09-11 05:04:59 +00:00
obrien
5690c36115 Add postrandom. 2012-09-11 04:53:32 +00:00
des
82e7e4bb59 Add a configtest command.
Submitted by:	gjb@
MFC after:	1 week
2012-09-04 21:56:16 +00:00
obrien
30fc7390d1 * Rather than run the same 'ps' command twice, add 'kenv' which often
gives machine unique values from the firmware.
* The kernel is more likely to be unique than /bin/ls (but no need to
  stuff many megabytes into /dev/random, so hash it).
* Change ordering to give larger variance across reboots to reduce
  predictability.
2012-09-04 21:47:09 +00:00
obrien
7d5d8d9c68 Correct style. 2012-08-22 23:44:12 +00:00
obrien
6068eb26e1 * Reinstate r128059's consumption of our best entropy first.
r128060 for "hardware-supplied entropy" reversed this without reason,
  seems a typo.
* Isolate "better than nothing" implementation to a function.

Submitted by:	obrien & Arthur Mesh <arthurmesh@gmail.com>
Sponsored by:	Juniper Networks
2012-08-22 23:37:24 +00:00
obrien
936202737a The entire comment block is now spell checked this time -- I promise. 2012-08-22 22:34:55 +00:00
delphij
57e31b3d63 Allow - be used in the name of a provider. Without this change it's not
possible to specify a gptid in geli_devices.
2012-08-22 22:17:35 +00:00
obrien
779be1a1c0 Fix comment misspelling.
Submitted by:	kargl
2012-08-22 20:56:53 +00:00
obrien
73aa45316e Depend on the new 'postrandom' instead of random.
We need to limit the amount of time between consuming the entropy seeds
and removing it in case of a kernel panic.
2012-08-22 18:49:02 +00:00
obrien
1103474a1b Remove old entropy seeding after consumption initializing /dev/random PRNG.
Not doing so opens us up to replay attacks.

Submitted by:	Arthur Mesh <arthurmesh@gmail.com>
Sponsored by:	Juniper Networks
2012-08-22 18:43:21 +00:00
obrien
fb4ec97724 Add dependencies based on security(7). 2012-08-22 18:35:17 +00:00
kuriyama
9f3e00996f - Allow to pass extra parameters for each jails.
- To achieve above, convert jail(8) invocation to use new style
  command line "-c" flag.

Reviewed at:	freebsd-jail@
2012-08-19 08:15:32 +00:00