rc.d: add a service jails config to all base system services

This gives more permissions to services (e.g. network access to
services which require this) when they are started as an automatic
servic

rc.d: add a service jails config to all base system services

This gives more permissions to services (e.g. network access to
services which require this) when they are started as an automatic
service jail.

The sshd patch is important for the sshd-related functionality as
described in the man-page in the service jails part.

The location of the added env vars is supposed to allow overriding them
in rc.conf, and to hard-disable the use of svcj for some parts where it
doesn't make sense or will not work.

Only a subset of all of the services are fully tested (I'm running this
since more than a year with various services started as service jails).
The untested parts should be most of the time ok, in some edge-cases
more permissions are needed inside the service jail.
Differential Revision: https://reviews.freebsd.org/D40371

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Remove dependency on files in /usr/bin

In order to reduce the pre-requisites of this file, implement the
pattern matching and creation of a temporary test directory without
use of grep respectively

Remove dependency on files in /usr/bin

In order to reduce the pre-requisites of this file, implement the
pattern matching and creation of a temporary test directory without
use of grep respectively mktemp.

The new version makes it possible to provide a writable /tmp in any
case and independently of other local or remote file systems (except /
and /dev) being mounted.

The use of "dd if=/dev/random" has the same dependency on /dev/random
being operational as the previous version that used "mktemp". If this
is found to be an issue on platforms that do not have gathered
sufficient entropy at the time when this scriot is run, I suggest to
replace the "dd" command with "ps lauxww" to get a somewhat random
test directory name.

Approved by: rgrimes, glebius, cy
MFC after: 4 weeks
Differential Revision: https://reviews.freebsd.org/D28209

show more ...

Revert 97ec6eba653a07. There shouldn't be a dependency of 'tmp' on
remote filesystems. Discussed this with Brooks and he can't find
evidence that provoked the change in 2005. If anything gets brok

Revert 97ec6eba653a07. There shouldn't be a dependency of 'tmp' on
remote filesystems. Discussed this with Brooks and he can't find
evidence that provoked the change in 2005. If anything gets broken
I will fix it in a different way, not via rc sequence change.

Discussed with: brooks
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D28097

show more ...

Revert that!

Oops missed Makefile.config

Move the rc framework out of sbin/init into libexec/rc.

The reasons for this are forward looking to pkgbase:
* /sbin/init is a special binary; try not to replace it with
every package update bec

Move the rc framework out of sbin/init into libexec/rc.

The reasons for this are forward looking to pkgbase:
* /sbin/init is a special binary; try not to replace it with
every package update because an rc script was touched.
(a follow-up commit will make init its own package)
* having rc in its own place will allow more easy replacement
of the rc framework with alternatives, such as openrc.

Discussed with: brd (during BSDCam), kmoore
Requested by: cem, bz
PR: 231522
Approved by: re (gjb)

show more ...

Move rc startup scripts from etc/ to sbin/init/

This keeps most startup scripts as CONFS per discussion on src-committers from
back during BSDCan.

Approved by: will (mentor)
Differential Revision:

Move rc startup scripts from etc/ to sbin/init/

This keeps most startup scripts as CONFS per discussion on src-committers from
back during BSDCan.

Approved by: will (mentor)
Differential Revision: https://reviews.freebsd.org/D16466

show more ...

- Add descriptions to most of the rc scripts. Those are mostly taken from their
daemon's manpage and probably improved.
- Consistently use "filesystem" not "file system".

Approved by: bapt, brueff

- Add descriptions to most of the rc scripts. Those are mostly taken from their
daemon's manpage and probably improved.
- Consistently use "filesystem" not "file system".

Approved by: bapt, brueffer
Differential Revision: D452

show more ...

MFP4 214344:
Tighten the regular expression that checks for an md /tmp such that
no /tmp mount and an md / isn't improperly matched.

Sponsored by: DARPA/AFRL

Whitespace nit

Create a function for the code from r192246 so that it can be used both
times mount is called.

Limit the automatic behavior to when AUTO is specified (as it is in
etc/defaults/rc.conf) and for every

Create a function for the code from r192246 so that it can be used both
times mount is called.

Limit the automatic behavior to when AUTO is specified (as it is in
etc/defaults/rc.conf) and for everything else take advantage of all
of the goodness in checkyesno.

show more ...

Use an unique directory name instead of hardcoded /tmp/.diskless.
A malicious user could create a file named /tmp/.diskless and cause
the script to misbehave.

PR: conf/141258
Reported by: Jon Passk

Use an unique directory name instead of hardcoded /tmp/.diskless.
A malicious user could create a file named /tmp/.diskless and cause
the script to misbehave.

PR: conf/141258
Reported by: Jon Passki
MFC after: 1 week

show more ...

- do not create and mount new file systems on top of the old ones on every
invocation of this script once we already have one
(in case tmpmfs="YES").

Reviewed by: dougb

As previously discussed, add the svn:executable property to all scripts

Add an empty stop_cmd to the remaining scripts that don't start
daemons and don't already have one.

Remove two unnecessary and useless sub-shell constructs.

Brooks pointed out a case where tmp needs to be run after
mountcritremote, so force it the other way instead.

Force this script to run before mountcritremote to avoid
non-deterministic behavior when introducing local_startup
scripts to rcorder.

Add two new rc.conf options: tmpmfs_flags and varmfs_flags.

These can be used to pass extra options to the mdmfs(8) utility,
to customize the finer details of the md file system creation
(i.e. to tu

Add two new rc.conf options: tmpmfs_flags and varmfs_flags.

These can be used to pass extra options to the mdmfs(8) utility,
to customize the finer details of the md file system creation
(i.e. to turn on/off softupdates, to specify a default owner for md
filesystem, etc).

Use these two new flags to mount tmpmfs and varmfs without
softupdates, since it doesn't make much sense to use SU on
malloc-backed file systems.

Reviewed by: mtm
Inspired by: J. D. Bronson, jbronson at wixb dot com

show more ...

Remove the requirement for the FreeBSD keyword as it no longer
makes any sense.

Discussed with: dougb, brooks
MFC after: 3 days

A power failure left the temporary /var/.diskless directory
on my system, and since then my /var was always created as
MFS which was very surprising. Fix this for /tmp and /var.

Overhaul the /etc/rc.d/diskless script by splitting it out into
hostname, resolve, tmp, and var scripts. The latter three are new and
were repo copied. These scripts no longer depend on being boote

Overhaul the /etc/rc.d/diskless script by splitting it out into
hostname, resolve, tmp, and var scripts. The latter three are new and
were repo copied. These scripts no longer depend on being booted with
and NFS root instead attempt to automaticly create mfs /tmp and /var
volumes if the they are not writable. This behavior can be overridden
in /etc/rc.conf.

Reviewed by: luigi, pjd

show more ...

Mark scripts as not usable inside a jail by adding keyword 'nojail'.

Some suggestions from: rwatson, Ruben de Groot <mail25@bzerk.org>

Don't run newaliases if sendmail_enable=NONE.

Submitted by: Matt Peterson <matt at peterson dot org>
Approved by: silence on freebsd-rc