add a rescue/sh sanity check for installing on the running system

[emaste]

Summary

FreeBSD does not guarantee kernel forward compatibility (that is, running a newer userland on an older kernel). The documented upgrade procedure specifies that installkernel should be performed, followed by a reboot and then installworld. As a sanity check when installing onto the running system (DESTDIR is / or unset), attempt to run the objdir rescue "sh echo OK" as a sanity check before proceeding with installworld. If rescue fails (e.g., because the system has not been rebooted and the "old" kernel lacks a system call required by the to-be-installed world), abort the installation.

[emaste]

• correct make target (_installcheck_world with only one leading _)
• use false instead of exit 1 as elsewhere

[allanjude]

Seems like a reasonable approach, I like this idea.

[kib]

Checking rescue is a good idea. But with the direct exec mode in ld-elf.so.1 it is easy to run real sh with real libraries from the target environment, activated by real dynamic linker. Since ld-elf.so.1 is involved into the test, the check is even more useful for safety insurance.

Also, I think that there are some minor but important cases where a knob to disable the checks would be useful. Like -DI_KNOW_WHAT_I_DO_THANKS.

[emaste]

Add a bypass knob as requested by kib

[emaste]

But with the direct exec mode in ld-elf.so.1 it is easy to run real sh with real libraries from the target environment, activated by real dynamic linker.

Oh, a really good point. I'd like to get this simple change in as soon as possible to prevent foot-shooting as folks continue to upgrade past ino64, and then revisit this to introduce a more extensive test like that.

[emaste]

ktrace /usr/obj/usr/src/rescue/rescue/rescue sh -c 'echo OK' shows invocations of the new fstatat syscall.

[bdrewery]

Very nice.