Commit Graph

4608 Commits

Author SHA1 Message Date
simon
84c85600b9 Fix jail rc.d script privilege escalation via symlink attack against
/var/log/console.log and mount points.

Security:	FreeBSD-SA-07:01.jail
2007-01-11 18:18:57 +00:00
njl
198bd4c0fc Re-work Cx handling to be per-cpu and asymmetrical, fixing support on
modern dual-core systems as well.

- Parse the _CST packages for each cpu and track all the states individually,
on a per-cpu basis.

- Revert to generic FADT/P_BLK based Cx control if the _CST package
is not present on all cpus. In that case, the new driver will
still support per-cpu Cx state handling. The driver will determine the
highest Cx level that can be supported by all the cpus and configure the
available Cx state based on that.

- Fixed the case where multiple cpus in the system share the same
registers for Cx state handling. To do that, added a new flag
parameter to the acpi_PkgGas and acpi_bus_alloc_gas functions that
enable the caller to add the RF_SHAREABLE flag.  This flag could also be
useful to other callers (acpi_throttle?) in the tree but this change is
not yet made.

- For Core Duo cpus, both cores seems to be taken out of C3 state when
any one of the cores need to transition out. This broke the short sleep
detection logic.  It is disabled now if there is more than one cpu in
the system for now as it fixed it in my case.  This quirk may need to
be re-enabled later differently.

- Added support to control cx_lowest on a per-cpu basis. There is still
a generic cx_lowest to enable changing cx_lowest for all cpus with a single
sysctl and for ease of use.  Sample output for the new sysctl:

dev.cpu.0.cx_supported: C1/1 C2/1 C3/57
dev.cpu.0.cx_lowest: C3
dev.cpu.0.cx_usage: 0.00% 43.16% 56.83%
dev.cpu.1.cx_supported: C1/1 C2/1 C3/57
dev.cpu.1.cx_lowest: C3
dev.cpu.1.cx_usage: 0.00% 45.65% 54.34%
hw.acpi.cpu.cx_lowest: C3

This work was done by Stephane E. Potvin with some simple reworking by
myself.  Thank you.

Submitted by:	Stephane E. Potvin <sepotvin / videotron.ca>
MFC after:	2 weeks
2007-01-07 21:53:42 +00:00
flz
d7f57382df Jail_ip and jail_interface local variables were renamed to _ip and _interface
in a previous commit to avoid namespace collisions, unfortunately I missed two
of them. This leads to the ip alias being incorrectly removed in some cases
when using the stop command.

Reported by:	Philipp Wuensche <cryx-freebsd@h3q.com>
2007-01-02 11:07:13 +00:00
maxim
015f110c97 o Fix a comment: refer to the write community name by the OID not by
the line number which is incorrect now and probably will shift in future.
2006-12-31 11:19:48 +00:00
yar
0a888a1e57 Allow for /usr/bin/env when parsing the shebang line from an
interpreted $command.  Some "portable" sofware packages use such a
line to skip the task of figuring out the absolute pathname of the
interpreter at install time, e.g.:

	#!/usr/bin/env python

It is insecure, but a popular book on Python seems to have advised
it to a wide audience.  Hence a number of such scripts in the ports,
mostly written in Python.

PR:		bin/100287
MFC after:	1 week
2006-12-31 11:07:29 +00:00
yar
dc9f8423c3 Use $required_modules wherever suitable. Use load_kld() in special
cases.  So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
yar
58a4c67f05 Fix a typo in a warning message. 2006-12-31 10:12:53 +00:00
yar
c91e4c56f6 Eliminate global symbols starting with an underscore from rc.d
scripts, except for mdconfig* and jail.  Such symbols are reserved
for the rc.subr internals.  Most scripts can be fixed by just
declaring _foo symbols as local: few scripts actually need them to
be global.

Discussed with:	dougb in freebsd-rc
2006-12-30 22:53:20 +00:00
piso
0db606a3b1 Summer of Code 2005: improve libalias - part 2 of 2
With the second (and last) part of my previous Summer of Code work, we get:

-ipfw's in kernel nat

-redirect_* and LSNAT support

General information about nat syntax and some examples are available
in the ipfw (8) man page. The redirect and LSNAT syntax are identical
to natd, so please refer to natd (8) man page.

To enable in kernel nat in rc.conf, two options were added:

o firewall_nat_enable: equivalent to natd_enable

o firewall_nat_interface: equivalent to natd_interface

Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet
to continue being checked by the firewall ruleset after being
(de)aliased.

NOTA BENE: due to some problems with libalias architecture, in kernel
nat won't work with TSO enabled nic, thus you have to disable TSO via
ifconfig (ifconfig foo0 -tso).

Approved by: glebius (mentor)
2006-12-29 21:59:17 +00:00
hrs
86de427e3a Add "nojail" keyword to prevent spurious error messages.
Spotted by:	Keve Nagy
PR:		conf/107083
2006-12-29 15:56:21 +00:00
yar
c6dfd2ef7a MFp4:
Implement the checks for required_* objects as two functions, one
to be run before precmd and the other after it.  They get the current
rc command as an argument so they can choose what requirement tests
to perform.  As of now, only "start" needs such tests.

Implement a new requirement variable, required_modules.  It can
list kernel modules that need to be loaded after start_precmd
indicated success.  Each name in the list can be just "file", or
"file:module", or "file~regex".  This will allow us to remove a lot
of duplicated code from rc.d scripts.

Perform the checks not only for the default start method, but for
any method.  This allows for more flexibility and fixes a few rc.d
scripts (namely newsyslog, pf, sendmail) that rely on a required_*
variable while providing a non-default start method.

To be able to call the new check_required* functions naturally,
remove lots of crufty duplicated code pieces from run_rc_command
and replace each of them by a call to the helper function providing
a single corrected instance of the respective code snippet.  Now
run_rc_command isn't as scary as it used to be, and it even appears
to have quite a nice logic that was obscured by the old crufty code.

In the default handler for restart, run start from a subshell to
protect global varibles, e.g., _postcmd, from modification by the
start handler.  This enables using restart_postcmd. [x]

PR:		conf/98734 [x]
Submitted by:	Rick van der Zwet <rick@wzoeterwoude.net> [x]
Reviewed by:	freebsd-rc (silence for an older version)
MFC after:	1 month
2006-12-27 13:15:33 +00:00
syrinx
172079c1c6 Add a (disabled) configuration line to enable snmp_bridge(3) module.
Approved by:	bz (mentor)
2006-12-20 22:10:34 +00:00
yar
f022e5fd4f Syscons cannot be stopped, so provide a no-op stop method.
The default stop method from rc.subr isn't suited for this
case and produces a bogus warning: "syscons not running".

Suggested by:	matteo
2006-12-20 12:59:50 +00:00
yar
7474222271 Improve rc.d conformance:
- don't play a needless trick with prestart, just use start method;
- provide no-op stop method so that we don't get bogus "abi not running" error.
2006-12-20 11:37:15 +00:00
hrs
13f5cb2be8 Disable IPv6 configuration for interfaces in pccard_ether_start().
After a change of devd.conf, devd(8) handles NIC attach/detach event
by using /etc/pccard_ether with the interface name as the argument.
This model does not work properly with IPv6 configuration because the
implementation of IPv6 stateless auto-configuration in the FreeBSD
rc.d scripts depends on whether there are any explicit configurations
for interfaces or not.  It works this way: if no manual configuration,
it will perform auto-configuration, but otherwise no
auto-configuration will be performed.  So, this behavior can only be
determined by all of the interfaces on a system, not a single one.
For this reason, the network6_interface_setup() function called from
the pccard_ether_start() does not work with a single interface name.
And what is worse, this combination of devd.conf and
pccard_ether_start() caused a bad side-effect that when
ipv6_enable=YES, all of interfaces marked as DOWN would be UP
unconditionally (and router solicitation was sent) just after devd(8)
was invoked.  This should be fixed in a more sophisticated way.
2006-12-08 15:48:42 +00:00
hrs
5ed0fdbeea Add a link-local address to the lo0 even when ipv6_enable="NO".
A kernel with INET6 always has ::1 on lo0, so in the case of
ipv6_enable="NO" the lo0 can have ::1 with no link-local address.
This is a violation of the IPv6 specification.  As a workaround for
this situation, fe80::1 is added in rc.d/auto_linklocal when lo0 has
no link-local address.  This should not be harmful for IPv4-only users.
2006-12-08 06:34:06 +00:00
ru
ca2bb82f44 Move npe.4 to a machine specific manpage subdirectory. 2006-12-05 16:57:10 +00:00
luigi
517e9da299 - put some common code in a function handle_remount();
- add better checks on non-existing directories to prevent error
  messages at run time;
- introduce a function log() to help debugging diskless booting
  when things don't work;
- modify the parsing of diskless_remount so you can add mount_nfs
  options after the pathname. You could use 'remount' to do something
  similar, but this way is more convenient because you don't have to
  hardwire the server name in the command.
- document the above.

I have been running the above in a diskless lab since february on RELENG_6.

MFC after: 1 week
2006-12-03 23:50:29 +00:00
flz
e1d91fee6d Teach find_processes() to use ${name}_chroot.
Obtained from:	NetBSD
X-MFC after:	6.2-RELEASE
2006-11-26 22:02:09 +00:00
flz
15f017fe4d Remove leading dollar sign in rcvar command output.
There's no dollar use in variable assignment in sh.
Assuming this is can be expected behavior for some
people, this change won't be MFC'ed to RELENG_6.

Discussed with:	yar on -rc
2006-11-26 19:03:19 +00:00
ache
0f6ab68217 Back out 1.120, it was premature. 2006-11-12 12:02:34 +00:00
des
c2c5b4471a Back out 1.122, it was poorly thought out. 2006-11-11 23:26:08 +00:00
des
e013709c26 Back out 1.121, it was premature. 2006-11-11 22:23:49 +00:00
ceri
4e3a86984a Ensure that the load of rules into the alternate ruleset worked before
loading them into the live one too.

PR:		conf/97311
Submitted by:	David Bushong
Reviewed by:	silence on rc@
Approved by:	ru (mentor)
MFC after:	10 days
2006-11-11 10:48:34 +00:00
des
2fdb0b5663 Add share/xsl.
MFC after:	1 week
2006-11-10 22:57:39 +00:00
des
a9a2f810d6 Add locales for nb_NO and nn_NO.
Reviewed by:	philip
2006-11-09 18:10:34 +00:00
rwatson
9463ede042 Add auditd_program variable to defaults, in order to make it more clear
how to change the auditd instance.  When using a port/package-based
OpenBSM, changing the auditd pointer may be desirable.

Obtained from:	TrustedBSD Project
MFC after:	3 weeks
2006-11-06 15:11:24 +00:00
obrien
ea874b999e Switch default proto to TCP. 2006-11-06 01:42:11 +00:00
pjd
ac6b680a94 Hook up gjournal bits to the build.
Sponsored by:	home.pl
2006-10-31 22:22:30 +00:00
harti
969c298091 Bind to INADDR_ANY in the default configuration. This makes bsnmpd(1)
automatically work on multi-homed hosts and without explicite specification
of the hostname in the config file.

Submitted by:	jmg
2006-10-31 10:23:28 +00:00
mlaier
e7bc018a5c Do not try to rtsol on pflog or pfsync devices. 2006-10-29 13:29:49 +00:00
phk
417527cc24 Give rc.firewall a polish and a new method.
Factor out the loopback setup

Use "me" instead of hardcoded $ip where possible.

Add "workstation" which protects just this machine with stateful
    firewalling.  Put the variables for this in rc.conf.

Submitted by:	Flemming Jacobsen <fj@batmule.dk>
Reviewed by:	cperciva
2006-10-28 20:08:12 +00:00
avatar
07cb91236d Re-sync'ing pf rules in post command as we already did for ipfilter.
With this patch, pf rules with dynamically created devices such like tun0
works without further intervention.

Reviewed by:	mlaier
MFC after:	3 days
2006-10-26 00:29:43 +00:00
delphij
d95f4fb5ef Synchronize pf.os with OpenBSD.
Obtained from:	OpenBSD
MFC After:	3 days
Approved by:	mlaier (maintainer)
2006-10-23 05:09:44 +00:00
hrs
1b1b112c84 Suppress a spurious warning message when a kernel without INET6 is
used.

Spotted by:	ru
Reviewed by:	ume
MFC after:	3 days
2006-10-22 17:21:03 +00:00
flz
cbad7c02dc Add 'reload' to the list of available commands for the amd rc.d script.
PR:		conf/104507
Submitted by:	Douglas K. Rand <rand@meridian-enviro.com>
MFC after:	3 days
2006-10-18 15:56:11 +00:00
yar
26039aabd1 Improve cleartmp in a number of aspects:
+ Use rc.subr(8) features properly.
+ Do the whole job of obliterating /tmp contents in find(1).
+ Leave lost+found and quota.{user,group} in /tmp only if root-owned.
+ Make the overall structure clearer by first removing the X dirs
  (perhaps along with the rest of /tmp) and then re-creating them.
+ Use "find -exec rm -rf {} +" for efficiency: each rm instance gets
  a chance to kill as much files in /tmp as ARG_MAX permits.

PR:		bin/104044
Submitted by:	Andrey Simonenko <see PR for email>
Hacked by:	yar
MFC after:	1 month
2006-10-16 13:01:45 +00:00
ceri
e4ea7afca1 Add idmapd_flags to defaults/rc.conf.
Document it and idmapd_enable.
2006-10-15 15:55:00 +00:00
ceri
7b28cc9b2f RC script for idmapd(8), defaulting to off. 2006-10-15 14:19:06 +00:00
ru
34fd4e5d2b Replace duplicate and not quite accurate capabilities
description with a reference to the disktab(5) manpage.

PR:		doc/48105
2006-10-14 16:39:03 +00:00
ume
73c8098699 Revert the default value of net.inet6.ip6.auto_linklocal to 1.
If ipv6_enable is not set to "YES", net.inet6.ip6.auto_linklocal
is turned to 0 at boot.

Discussed with:	re@, gnn@
MFC after:	3 days
2006-10-13 12:41:36 +00:00
piso
5696dc1060 Fix a regression: let natd load libalias modules before /usr is mounted
renaming /lib/libalias_*.so.4 to /lib/libalias_*.so.

Approved by: glebius
Reviewed by: glebius, ru
2006-10-08 14:02:00 +00:00
ume
364695cff6 Restore the behavior that net.inet6.ip6.auto_linklocal=0 could
be coexist with ipv6_enable="YES".

MFC after:	3 days
2006-10-07 15:45:56 +00:00
flz
8587b166ef Introduce mixer_enable (default: YES).
PR:		conf/101268
Submitted by:	Eugene Grosbein <eugen@grosbein.pp.ru>
Approved by:	cperciva (mentor)
X-MFC after:	6.2-RELEASE
Sponsored by:	FreeBSD Test-Bugathon
2006-10-06 23:22:13 +00:00
ru
f53bc81fe1 A GEOM cache can speed up read performance by sending fixed size
read requests to its consumer.  It has been developed to address
the problem of a horrible read performance of a 64k blocksize FS
residing on a RAID3 array with 8 data components, where a single
disk component would only get 8k read requests, thus effectively
killing disk performance under high load.  Documentation will be
provided later.  I'd like to thank Vsevolod Lobko for his bright
ideas, and Pawel Jakub Dawidek for helping me fix the nasty bug.
2006-10-06 08:27:07 +00:00
brooks
120ed3e161 Pull in /etc/rc.conf.d/network so that ifconfig_<if> variables can be
set there.  This is required for consistency with /etc/rc.d/netif.

PR:		conf/103893
Submitted by:	Nick Hibma <nick at anywi.com>
MFC after:	3 days
2006-10-02 18:50:58 +00:00
gnn
3b143b31f6 Turn off automatic link local address if ipv6_enable is not set to YES
in rc.conf

Reviewed by:    KAME core team, cperciva
MFC after:      3 days
2006-10-02 10:13:30 +00:00
yar
53d4e5c17e debug() shouldn't misidentify itself to logger(1).
Noticed by:	David Thompson <dat1965 yahoo com>
2006-10-02 08:20:37 +00:00
ache
38c8b0a34c Add mn_MN.UTF-8 2006-10-02 00:23:14 +00:00
ru
a929436732 Create section 8 man subdirectories for PowerPC. 2006-09-30 09:02:38 +00:00