Index: stable/12/libexec/rc/rc.conf =================================================================== --- stable/12/libexec/rc/rc.conf (revision 354724) +++ stable/12/libexec/rc/rc.conf (revision 354725) @@ -1,762 +1,766 @@ #!/bin/sh # This is rc.conf - a file full of useful variables that you can set # to change the default startup behavior of your system. You should # not edit this file! Put any overrides into one of the ${rc_conf_files} # instead and you will be able to update these defaults later without # spamming your local configuration information. # # The ${rc_conf_files} files should only contain values which override # values set in this file. This eases the upgrade path when defaults # are changed and new features are added. # # All arguments must be in double or single quotes. # # For a more detailed explanation of all the rc.conf variables, please # refer to the rc.conf(5) manual page. # # $FreeBSD$ ############################################################## ### Important initial Boot-time options #################### ############################################################## # rc_debug can't be set here without interferring with rc.subr's setting it # when the kenv variable rc.debug is set. #rc_debug="NO" # Set to YES to enable debugging output from rc.d rc_info="NO" # Enables display of informational messages at boot. rc_startmsgs="YES" # Show "Starting foo:" messages at boot rcshutdown_timeout="90" # Seconds to wait before terminating rc.shutdown early_late_divider="FILESYSTEMS" # Script that separates early/late # stages of the boot process. Make sure you know # the ramifications if you change this. # See rc.conf(5) for more details. always_force_depends="NO" # Set to check that indicated dependencies are # running during boot (can increase boot time). apm_enable="NO" # Set to YES to enable APM BIOS functions (or NO). apmd_enable="NO" # Run apmd to handle APM event from userland. apmd_flags="" # Flags to apmd (if enabled). ddb_enable="NO" # Set to YES to load ddb scripts at boot. ddb_config="/etc/ddb.conf" # ddb(8) config file. devd_enable="YES" # Run devd, to trigger programs on device tree changes. devd_flags="" # Additional flags for devd(8). devmatch_enable="YES" # Demand load kernel modules based on device ids. devmatch_blacklist="" # List of modules (w/o .ko) to exclude from devmatch. #kld_list="" # Kernel modules to load after local disks are mounted kldxref_enable="YES" # Build linker.hints files with kldxref(8). kldxref_clobber="NO" # Overwrite old linker.hints at boot. kldxref_module_path="" # Override kern.module_path. A ';'-delimited list. powerd_enable="NO" # Run powerd to lower our power usage. powerd_flags="" # Flags to powerd (if enabled). tmpmfs="AUTO" # Set to YES to always create an mfs /tmp, NO to never tmpsize="20m" # Size of mfs /tmp if created tmpmfs_flags="-S" # Extra mdmfs options for the mfs /tmp varmfs="AUTO" # Set to YES to always create an mfs /var, NO to never varsize="32m" # Size of mfs /var if created varmfs_flags="-S" # Extra mount options for the mfs /var mfs_type="auto" # "md", "tmpfs", "auto" to prefer tmpfs with md as fallback populate_var="AUTO" # Set to YES to always (re)populate /var, NO to never cleanvar_enable="YES" # Clean the /var directory local_startup="/usr/local/etc/rc.d" # startup script dirs. script_name_sep=" " # Change if your startup scripts' names contain spaces rc_conf_files="/etc/rc.conf /etc/rc.conf.local" # ZFS support zfs_enable="NO" # Set to YES to automatically mount ZFS file systems # ZFSD support zfsd_enable="NO" # Set to YES to automatically start the ZFS fault # management daemon. gptboot_enable="YES" # GPT boot success/failure reporting. # Experimental - test before enabling gbde_autoattach_all="NO" # YES automatically mounts gbde devices from fstab gbde_devices="NO" # Devices to automatically attach (list, or AUTO) gbde_attach_attempts="3" # Number of times to attempt attaching gbde devices gbde_lockdir="/etc" # Where to look for gbde lockfiles # GELI disk encryption configuration. geli_devices="" # List of devices to automatically attach in addition to # GELI devices listed in /etc/fstab. geli_groups="" # List of groups containing devices to automatically # attach with the same keyfiles and passphrase geli_tries="" # Number of times to attempt attaching geli device. # If empty, kern.geom.eli.tries will be used. geli_default_flags="" # Default flags for geli(8). geli_autodetach="YES" # Automatically detach on last close. # Providers are marked as such when all file systems are # mounted. # Example use. #geli_devices="da1 mirror/home" #geli_da1_flags="-p -k /etc/geli/da1.keys" #geli_da1_autodetach="NO" #geli_mirror_home_flags="-k /etc/geli/home.keys" #geli_groups="storage backup" #geli_storage_flags="-k /etc/geli/storage.keys" #geli_storage_devices="ada0 ada1" #geli_backup_flags="-j /etc/geli/backup.passfile -k /etc/geli/backup.keys" #geli_backup_devices="ada2 ada3" root_rw_mount="YES" # Set to NO to inhibit remounting root read-write. root_hold_delay="30" # Time to wait for root mount hold release. fsck_y_enable="NO" # Set to YES to do fsck -y if the initial preen fails. fsck_y_flags="-T ffs:-R -T ufs:-R" # Additional flags for fsck -y background_fsck="YES" # Attempt to run fsck in the background where possible. background_fsck_delay="60" # Time to wait (seconds) before starting the fsck. growfs_enable="NO" # Set to YES to attempt to grow the root filesystem on boot netfs_types="nfs:NFS smbfs:SMB" # Net filesystems. extra_netfs_types="NO" # List of network extra filesystem types for delayed # mount at startup (or NO). ############################################################## ### Network configuration sub-section ###################### ############################################################## ### Basic network and firewall/security options: ### hostname="" # Set this! hostid_enable="YES" # Set host UUID. hostid_file="/etc/hostid" # File with hostuuid. nisdomainname="NO" # Set to NIS domain if using NIS (or NO). dhclient_program="/sbin/dhclient" # Path to dhcp client program. dhclient_flags="" # Extra flags to pass to dhcp client. #dhclient_flags_fxp0="" # Extra dhclient flags for fxp0 only background_dhclient="NO" # Start dhcp client in the background. #background_dhclient_fxp0="YES" # Start dhcp client on fxp0 in the background. synchronous_dhclient="NO" # Start dhclient directly on configured # interfaces during startup. defaultroute_delay="30" # Time to wait for a default route on a DHCP interface. defaultroute_carrier_delay="5" # Time to wait for carrier while waiting for a default route. netif_enable="YES" # Set to YES to initialize network interfaces netif_ipexpand_max="2048" # Maximum number of IP addrs in a range spec. wpa_supplicant_program="/usr/sbin/wpa_supplicant" wpa_supplicant_flags="-s" # Extra flags to pass to wpa_supplicant wpa_supplicant_conf_file="/etc/wpa_supplicant.conf" # firewall_enable="NO" # Set to YES to enable firewall functionality firewall_script="/etc/rc.firewall" # Which script to run to set up the firewall firewall_type="UNKNOWN" # Firewall type (see /etc/rc.firewall) firewall_quiet="NO" # Set to YES to suppress rule display firewall_logging="NO" # Set to YES to enable events logging firewall_logif="NO" # Set to YES to create logging-pseudo interface firewall_flags="" # Flags passed to ipfw when type is a file firewall_coscripts="" # List of executables/scripts to run after # firewall starts/stops firewall_client_net="192.0.2.0/24" # IPv4 Network address for "client" # firewall. #firewall_client_net_ipv6="2001:db8:2:1::/64" # IPv6 network prefix for # "client" firewall. firewall_simple_iif="ed1" # Inside network interface for "simple" # firewall. firewall_simple_inet="192.0.2.16/28" # Inside network address for "simple" # firewall. firewall_simple_oif="ed0" # Outside network interface for "simple" # firewall. firewall_simple_onet="192.0.2.0/28" # Outside network address for "simple" # firewall. #firewall_simple_iif_ipv6="ed1" # Inside IPv6 network interface for "simple" # firewall. #firewall_simple_inet_ipv6="2001:db8:2:800::/56" # Inside IPv6 network prefix # for "simple" firewall. #firewall_simple_oif_ipv6="ed0" # Outside IPv6 network interface for "simple" # firewall. #firewall_simple_onet_ipv6="2001:db8:2:0::/56" # Outside IPv6 network prefix # for "simple" firewall. firewall_myservices="" # List of ports/protocols on which this host # offers services for "workstation" firewall. firewall_allowservices="" # List of IPs which have access to # $firewall_myservices for "workstation" # firewall. firewall_trusted="" # List of IPs which have full access to this # host for "workstation" firewall. firewall_logdeny="NO" # Set to YES to log default denied incoming # packets for "workstation" firewall. firewall_nologports="135-139,445 1026,1027 1433,1434" # List of TCP/UDP ports # for which denied incoming packets are not # logged for "workstation" firewall. firewall_nat_enable="NO" # Enable kernel NAT (if firewall_enable == YES) firewall_nat_interface="" # Public interface or IPaddress to use firewall_nat_flags="" # Additional configuration parameters firewall_nat64_enable="NO" # Enable kernel NAT64 module. firewall_nptv6_enable="NO" # Enable kernel NPTv6 module. firewall_pmod_enable="NO" # Enable kernel protocols modification module. dummynet_enable="NO" # Load the dummynet(4) module ipfw_netflow_enable="NO" # Enable netflow logging via ng_netflow ip_portrange_first="NO" # Set first dynamically allocated port ip_portrange_last="NO" # Set last dynamically allocated port ike_enable="NO" # Enable IKE daemon (usually racoon or isakmpd) ike_program="/usr/local/sbin/isakmpd" # Path to IKE daemon ike_flags="" # Additional flags for IKE daemon ipsec_enable="NO" # Set to YES to run setkey on ipsec_file ipsec_file="/etc/ipsec.conf" # Name of config file for setkey natd_program="/sbin/natd" # path to natd, if you want a different one. natd_enable="NO" # Enable natd (if firewall_enable == YES). natd_interface="" # Public interface or IPaddress to use. natd_flags="" # Additional flags for natd. ipfilter_enable="NO" # Set to YES to enable ipfilter functionality ipfilter_program="/sbin/ipf" # where the ipfilter program lives ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see # /usr/src/contrib/ipfilter/rules for examples ipfilter_flags="" # additional flags for ipfilter ippool_enable="NO" # Set to YES to enable ip filter pools ippool_program="/sbin/ippool" # where the ippool program lives ippool_rules="/etc/ippool.tables" # rules definition file for ippool ippool_flags="" # additional flags for ippool ipnat_enable="NO" # Set to YES to enable ipnat functionality ipnat_program="/sbin/ipnat" # where the ipnat program lives ipnat_rules="/etc/ipnat.rules" # rules definition file for ipnat ipnat_flags="" # additional flags for ipnat ipmon_enable="NO" # Set to YES for ipmon; needs ipfilter or ipnat ipmon_program="/sbin/ipmon" # where the ipfilter monitor program lives ipmon_flags="-Ds" # typically "-Ds" or "-D /var/log/ipflog" ipfs_enable="NO" # Set to YES to enable saving and restoring # of state tables at shutdown and boot ipfs_program="/sbin/ipfs" # where the ipfs program lives ipfs_flags="" # additional flags for ipfs pf_enable="NO" # Set to YES to enable packet filter (pf) pf_rules="/etc/pf.conf" # rules definition file for pf (nonexistent # by default) pf_program="/sbin/pfctl" # where the pfctl program lives pf_flags="" # additional flags for pfctl pflog_enable="NO" # Set to YES to enable packet filter logging pflog_logfile="/var/log/pflog" # where pflogd should store the logfile pflog_program="/sbin/pflogd" # where the pflogd program lives pflog_flags="" # additional flags for pflogd ftpproxy_enable="NO" # Set to YES to enable ftp-proxy(8) for pf ftpproxy_flags="" # additional flags for ftp-proxy(8) pfsync_enable="NO" # Expose pf state to other hosts for syncing pfsync_syncdev="" # Interface for pfsync to work through pfsync_syncpeer="" # IP address of pfsync peer host pfsync_ifconfig="" # Additional options to ifconfig(8) for pfsync tcp_extensions="YES" # Set to NO to turn off RFC1323 extensions. log_in_vain="0" # >=1 to log connects to ports w/o listeners. tcp_keepalive="YES" # Enable stale TCP connection timeout (or NO). tcp_drop_synfin="NO" # Set to YES to drop TCP packets with SYN+FIN # NOTE: this violates the TCP specification icmp_drop_redirect="NO" # Set to YES to ignore ICMP REDIRECT packets icmp_log_redirect="NO" # Set to YES to log ICMP REDIRECT packets network_interfaces="auto" # List of network interfaces (or "auto"). cloned_interfaces="" # List of cloned network interfaces to create. #cloned_interfaces="gif0 gif1 gif2 gif3" # Pre-cloning GENERIC config. #ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration. #ifconfig_lo0_alias0="inet 127.0.0.254 netmask 0xffffffff" # Sample alias entry. #ifconfig_ed0_ipv6="inet6 2001:db8:1::1 prefixlen 64" # Sample IPv6 addr entry #ifconfig_ed0_alias0="inet6 2001:db8:2::1 prefixlen 64" # Sample IPv6 alias #ifconfig_fxp0_name="net0" # Change interface name from fxp0 to net0. #vlans_fxp0="101 vlan0" # vlan(4) interfaces for fxp0 device #create_args_vlan0="vlan 102" # vlan tag for vlan0 device #wlans_ath0="wlan0" # wlan(4) interfaces for ath0 device #wlandebug_wlan0="scan+auth+assoc" # Set debug flags with wlandebug(8) #ipv4_addrs_fxp0="192.168.0.1/24 192.168.1.1-5/28" # example IPv4 address entry. # #autobridge_interfaces="bridge0" # List of bridges to check #autobridge_bridge0="tap* vlan0" # Interface glob to automatically add to the bridge # # If you have any sppp(4) interfaces above, you might also want to set # the following parameters. Refer to spppcontrol(8) for their meaning. sppp_interfaces="" # List of sppp interfaces. #sppp_interfaces="...0" # example: sppp over ... #spppconfig_...0="authproto=chap myauthname=foo myauthsecret='top secret' hisauthname=some-gw hisauthsecret='another secret'" # User ppp configuration. ppp_enable="NO" # Start user-ppp (or NO). ppp_program="/usr/sbin/ppp" # Path to user-ppp program. ppp_mode="auto" # Choice of "auto", "ddial", "direct" or "dedicated". # For details see man page for ppp(8). Default is auto. ppp_nat="YES" # Use PPP's internal network address translation or NO. ppp_profile="papchap" # Which profile to use from /etc/ppp/ppp.conf. ppp_user="root" # Which user to run ppp as # Start multiple instances of ppp at boot time #ppp_profile="profile1 profile2 profile3" # Which profiles to use #ppp_profile1_mode="ddial" # Override ppp mode for profile1 #ppp_profile2_nat="NO" # Override nat mode for profile2 # profile3 uses default ppp_mode and ppp_nat ### Network daemon (miscellaneous) ### hostapd_program="/usr/sbin/hostapd" hostapd_enable="NO" # Run hostap daemon. syslogd_enable="YES" # Run syslog daemon (or NO). syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a different one. syslogd_flags="-s" # Flags to syslogd (if enabled). syslogd_oomprotect="YES" # Don't kill syslogd when swap space is exhausted. altlog_proglist="" # List of chrooted applicatioins in /var inetd_enable="NO" # Run the network daemon dispatcher (YES/NO). inetd_program="/usr/sbin/inetd" # path to inetd, if you want a different one. inetd_flags="-wW -C 60" # Optional flags to inetd iscsid_enable="NO" # iSCSI initiator daemon. iscsictl_enable="NO" # iSCSI initiator autostart. iscsictl_flags="-Aa" # Optional flags to iscsictl. hastd_enable="NO" # Run the HAST daemon (YES/NO). hastd_program="/sbin/hastd" # path to hastd, if you want a different one. hastd_flags="" # Optional flags to hastd. ctld_enable="NO" # CAM Target Layer / iSCSI target daemon. local_unbound_enable="NO" # Local caching resolver local_unbound_tls="NO" # Use DNS over TLS blacklistd_enable="NO" # Run blacklistd daemon (YES/NO). blacklistd_flags="" # Optional flags for blacklistd(8). resolv_enable="YES" # Enable resolv / resolvconf # # kerberos. Do not run the admin daemons on slave servers # kdc_enable="NO" # Run a kerberos 5 KDC (or NO). kdc_program="/usr/libexec/kdc" # path to kerberos 5 KDC kdc_flags="" # Additional flags to the kerberos 5 KDC kadmind_enable="NO" # Run kadmind (or NO) kadmind_program="/usr/libexec/kadmind" # path to kadmind kpasswdd_enable="NO" # Run kpasswdd (or NO) kpasswdd_program="/usr/libexec/kpasswdd" # path to kpasswdd kfd_enable="NO" # Run kfd (or NO) kfd_program="/usr/libexec/kfd" # path to kerberos 5 kfd daemon kfd_flags="" ipropd_master_enable="NO" # Run Heimdal incremental propagation daemon # (master daemon). ipropd_master_program="/usr/libexec/ipropd-master" ipropd_master_flags="" # Flags to ipropd-master. ipropd_master_keytab="/etc/krb5.keytab" # keytab for ipropd-master. ipropd_master_slaves="" # slave node names used for /var/heimdal/slaves. ipropd_slave_enable="NO" # Run Heimdal incremental propagation daemon # (slave daemon). ipropd_slave_program="/usr/libexec/ipropd-slave" ipropd_slave_flags="" # Flags to ipropd-slave. ipropd_slave_keytab="/etc/krb5.keytab" # keytab for ipropd-slave. ipropd_slave_master="" # master node name. gssd_enable="NO" # Run the gssd daemon (or NO). gssd_program="/usr/sbin/gssd" # Path to gssd. gssd_flags="" # Flags for gssd. rwhod_enable="NO" # Run the rwho daemon (or NO). rwhod_flags="" # Flags for rwhod rarpd_enable="NO" # Run rarpd (or NO). rarpd_flags="-a" # Flags to rarpd. bootparamd_enable="NO" # Run bootparamd (or NO). bootparamd_flags="" # Flags to bootparamd pppoed_enable="NO" # Run the PPP over Ethernet daemon. pppoed_provider="*" # Provider and ppp(8) config file entry. pppoed_flags="-P /var/run/pppoed.pid" # Flags to pppoed (if enabled). pppoed_interface="fxp0" # The interface that pppoed runs on. sshd_enable="NO" # Enable sshd sshd_program="/usr/sbin/sshd" # path to sshd, if you want a different one. sshd_flags="" # Additional flags for sshd. ftpd_enable="NO" # Enable stand-alone ftpd. ftpd_program="/usr/libexec/ftpd" # Path to ftpd, if you want a different one. ftpd_flags="" # Additional flags to stand-alone ftpd. ### Network daemon (NFS): All need rpcbind_enable="YES" ### amd_enable="NO" # Run amd service with $amd_flags (or NO). amd_program="/usr/sbin/amd" # path to amd, if you want a different one. amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map" amd_map_program="NO" # Can be set to "ypcat -k amd.master" autofs_enable="NO" # Run autofs daemons. automount_flags="" # Flags to automount(8) (if autofs enabled). automountd_flags="" # Flags to automountd(8) (if autofs enabled). autounmountd_flags="" # Flags to autounmountd(8) (if autofs enabled). nfs_client_enable="NO" # This host is an NFS client (or NO). nfs_access_cache="60" # Client cache timeout in seconds nfs_server_enable="NO" # This host is an NFS server (or NO). nfs_server_flags="-u -t" # Flags to nfsd (if enabled). nfs_server_managegids="NO" # The NFS server maps gids for AUTH_SYS (or NO). mountd_enable="NO" # Run mountd (or NO). mountd_flags="-r -S" # Flags to mountd (if NFS server enabled). weak_mountd_authentication="NO" # Allow non-root mount requests to be served. nfs_reserved_port_only="NO" # Provide NFS only on secure port (or NO). nfs_bufpackets="" # bufspace (in packets) for client rpc_lockd_enable="NO" # Run NFS rpc.lockd needed for client/server. rpc_lockd_flags="" # Flags to rpc.lockd (if enabled). rpc_statd_enable="NO" # Run NFS rpc.statd needed for client/server. rpc_statd_flags="" # Flags to rpc.statd (if enabled). rpcbind_enable="NO" # Run the portmapper service (YES/NO). rpcbind_program="/usr/sbin/rpcbind" # path to rpcbind, if you want a different one. rpcbind_flags="" # Flags to rpcbind (if enabled). rpc_ypupdated_enable="NO" # Run if NIS master and SecureRPC (or NO). keyserv_enable="NO" # Run the SecureRPC keyserver (or NO). keyserv_flags="" # Flags to keyserv (if enabled). nfsv4_server_enable="NO" # Enable support for NFSv4 nfscbd_enable="NO" # NFSv4 client side callback daemon nfscbd_flags="" # Flags for nfscbd nfsuserd_enable="NO" # NFSv4 user/group name mapping daemon nfsuserd_flags="" # Flags for nfsuserd ### Network Time Services options: ### timed_enable="NO" # Run the time daemon (or NO). timed_flags="" # Flags to timed (if enabled). ntpdate_enable="NO" # Run ntpdate to sync time on boot (or NO). ntpdate_program="/usr/sbin/ntpdate" # path to ntpdate, if you want a different one. ntpdate_flags="-b" # Flags to ntpdate (if enabled). ntpdate_config="/etc/ntp.conf" # ntpdate(8) configuration file ntpdate_hosts="" # Whitespace-separated list of ntpdate(8) servers. ntpd_enable="NO" # Run ntpd Network Time Protocol (or NO). ntpd_program="/usr/sbin/ntpd" # path to ntpd, if you want a different one. ntpd_config="/etc/ntp.conf" # ntpd(8) configuration file ntpd_sync_on_start="NO" # Sync time on ntpd startup, even if offset is high ntpd_flags="" # Additional flags to ntpd ntp_src_leapfile="/etc/ntp/leap-seconds" # Initial source for ntpd leapfile ntp_db_leapfile="/var/db/ntpd.leap-seconds.list" # Working copy (updated weekly) leapfile ntp_leapfile_sources="https://www.ietf.org/timezones/data/leap-seconds.list" # Source from which to fetch leapfile ntp_leapfile_fetch_opts="-mq" # Options to use for ntp leapfile fetch, # e.g. --no-verify-peer ntp_leapfile_expiry_days=30 # Check for new leapfile 30 days prior to # expiry. ntp_leapfile_fetch_verbose="NO" # Be verbose during NTP leapfile fetch # Network Information Services (NIS) options: All need rpcbind_enable="YES" ### nis_client_enable="NO" # We're an NIS client (or NO). nis_client_flags="" # Flags to ypbind (if enabled). nis_ypset_enable="NO" # Run ypset at boot time (or NO). nis_ypset_flags="" # Flags to ypset (if enabled). nis_server_enable="NO" # We're an NIS server (or NO). nis_server_flags="" # Flags to ypserv (if enabled). nis_ypxfrd_enable="NO" # Run rpc.ypxfrd at boot time (or NO). nis_ypxfrd_flags="" # Flags to rpc.ypxfrd (if enabled). nis_yppasswdd_enable="NO" # Run rpc.yppasswdd at boot time (or NO). nis_yppasswdd_flags="" # Flags to rpc.yppasswdd (if enabled). nis_ypldap_enable="NO" # Run ypldap at boot time (or NO). nis_ypldap_flags="" # Flags to ypldap (if enabled). ### SNMP daemon ### # Be sure to understand the security implications of running SNMP v1/v2 # in your network. bsnmpd_enable="NO" # Run the SNMP daemon (or NO). bsnmpd_flags="" # Flags for bsnmpd. ### Network routing options: ### defaultrouter="NO" # Set to default gateway (or NO). static_arp_pairs="" # Set to static ARP list (or leave empty). static_ndp_pairs="" # Set to static NDP list (or leave empty). static_routes="" # Set to static route list (or leave empty). gateway_enable="NO" # Set to YES if this host will be a gateway. routed_enable="NO" # Set to YES to enable a routing daemon. routed_program="/sbin/routed" # Name of routing daemon to use if enabled. routed_flags="-q" # Flags for routing daemon. arpproxy_all="NO" # replaces obsolete kernel option ARP_PROXYALL. forward_sourceroute="NO" # do source routing (only if gateway_enable is set to "YES") accept_sourceroute="NO" # accept source routed packets to us ### Bluetooth ### hcsecd_enable="NO" # Enable hcsecd(8) (or NO) hcsecd_config="/etc/bluetooth/hcsecd.conf" # hcsecd(8) configuration file sdpd_enable="NO" # Enable sdpd(8) (or NO) sdpd_control="/var/run/sdp" # sdpd(8) control socket sdpd_groupname="nobody" # set spdp(8) user/group to run as after sdpd_username="nobody" # it initializes bthidd_enable="NO" # Enable bthidd(8) (or NO) bthidd_config="/etc/bluetooth/bthidd.conf" # bthidd(8) configuration file bthidd_hids="/var/db/bthidd.hids" # bthidd(8) known HID devices file bthidd_evdev_support="AUTO" # AUTO depends on EVDEV_SUPPORT kernel option rfcomm_pppd_server_enable="NO" # Enable rfcomm_pppd(8) in server mode (or NO) rfcomm_pppd_server_profile="one two" # Profile to use from /etc/ppp/ppp.conf # #rfcomm_pppd_server_one_bdaddr="" # Override local bdaddr for 'one' rfcomm_pppd_server_one_channel="1" # Override local channel for 'one' #rfcomm_pppd_server_one_register_sp="NO" # Override SP and DUN register #rfcomm_pppd_server_one_register_dun="NO" # for 'one' # #rfcomm_pppd_server_two_bdaddr="" # Override local bdaddr for 'two' rfcomm_pppd_server_two_channel="3" # Override local channel for 'two' #rfcomm_pppd_server_two_register_sp="NO" # Override SP and DUN register #rfcomm_pppd_server_two_register_dun="NO" # for 'two' ubthidhci_enable="NO" # Switch an USB BT controller present on #ubthidhci_busnum="3" # bus 3 and addr 2 from HID mode to HCI mode. #ubthidhci_addr="2" # Check usbconfig list to find the correct # numbers for your system. ### Network link/usability verification options netwait_enable="NO" # Enable rc.d/netwait (or NO) #netwait_ip="" # Wait for ping response from any IP in this list. netwait_timeout="60" # Total number of seconds to perform pings. #netwait_if="" # Wait for active link on each intf in this list. netwait_if_timeout="30" # Total number of seconds to monitor link state. ### Miscellaneous network options: ### icmp_bmcastecho="NO" # respond to broadcast ping packets ### IPv6 options: ### ipv6_network_interfaces="auto" # List of IPv6 network interfaces # (or "auto" or "none"). ipv6_activate_all_interfaces="NO" # If NO, interfaces which have no # corresponding $ifconfig_IF_ipv6 is # marked as IFDISABLED for security # reason. ipv6_defaultrouter="NO" # Set to IPv6 default gateway (or NO). #ipv6_defaultrouter="2002:c058:6301::" # Use this for 6to4 (RFC 3068) ipv6_static_routes="" # Set to static route list (or leave empty). #ipv6_static_routes="xxx" # An example to set fec0:0000:0000:0006::/64 # route toward loopback interface. #ipv6_route_xxx="fec0:0000:0000:0006:: -prefixlen 64 ::1" ipv6_gateway_enable="NO" # Set to YES if this host will be a gateway. ipv6_cpe_wanif="NO" # Set to the upstream interface name if this # node will work as a router to forward IPv6 # packets not explicitly addressed to itself. ipv6_privacy="NO" # Use privacy address on RA-receiving IFs # (RFC 4941) route6d_enable="NO" # Set to YES to enable an IPv6 routing daemon. route6d_program="/usr/sbin/route6d" # Name of IPv6 routing daemon. route6d_flags="" # Flags to IPv6 routing daemon. #route6d_flags="-l" # Example for route6d with only IPv6 site local # addrs. #route6d_flags="-q" # If you want to run a routing daemon on an end # node, you should stop advertisement. #ipv6_network_interfaces="ed0 ep0" # Examples for router # or static configuration for end node. # Choose correct prefix value. #ipv6_prefix_ed0="fec0:0000:0000:0001 fec0:0000:0000:0002" # Examples for rtr. #ipv6_prefix_ep0="fec0:0000:0000:0003 fec0:0000:0000:0004" # Examples for rtr. ipv6_default_interface="NO" # Default output interface for scoped addrs. # This works only with # ipv6_gateway_enable="NO". rtsol_flags="" # Flags to IPv6 router solicitation. rtsold_enable="NO" # Set to YES to enable an IPv6 router # solicitation daemon. rtsold_flags="-a" # Flags to an IPv6 router solicitation # daemon. rtadvd_enable="NO" # Set to YES to enable an IPv6 router # advertisement daemon. If set to YES, # this router becomes a possible candidate # IPv6 default router for local subnets. rtadvd_interfaces="" # Interfaces rtadvd sends RA packets. stf_interface_ipv4addr="" # Local IPv4 addr for 6to4 IPv6 over IPv4 # tunneling interface. Specify this entry # to enable 6to4 interface. stf_interface_ipv4plen="0" # Prefix length for 6to4 IPv4 addr, # to limit peer addr range. Effective value # is 0-31. stf_interface_ipv6_ifid="0:0:0:1" # IPv6 interface id for stf0. # If you like, you can set "AUTO" for this. stf_interface_ipv6_slaid="0000" # IPv6 Site Level Aggregator for stf0 ipv6_ipv4mapping="NO" # Set to "YES" to enable IPv4 mapped IPv6 addr # communication. (like ::ffff:a.b.c.d) ipv6_ipfilter_rules="/etc/ipf6.rules" # rules definition file for ipfilter, # see /usr/src/contrib/ipfilter/rules # for examples ip6addrctl_enable="YES" # Set to YES to enable default address selection ip6addrctl_verbose="NO" # Set to YES to enable verbose configuration messages ip6addrctl_policy="AUTO" # A pre-defined address selection policy # (ipv4_prefer, ipv6_prefer, or AUTO) ############################################################## ### System console options ################################# ############################################################## keyboard="" # keyboard device to use (default /dev/kbd0). keymap="NO" # keymap in /usr/share/{syscons,vt}/keymaps/* (or NO). keyrate="NO" # keyboard rate to: slow, normal, fast (or NO). keybell="NO" # See kbdcontrol(1) for options. Use "off" to disable. keychange="NO" # function keys default values (or NO). cursor="NO" # cursor type {normal|blink|destructive} (or NO). scrnmap="NO" # screen map in /usr/share/syscons/scrnmaps/* (or NO). font8x16="NO" # font 8x16 from /usr/share/{syscons,vt}/fonts/* (or NO). font8x14="NO" # font 8x14 from /usr/share/{syscons,vt}/fonts/* (or NO). font8x8="NO" # font 8x8 from /usr/share/{syscons,vt}/fonts/* (or NO). blanktime="300" # blank time (in seconds) or "NO" to turn it off. saver="NO" # screen saver: Uses /boot/kernel/${saver}_saver.ko moused_nondefault_enable="YES" # Treat non-default mice as enabled unless # specifically overriden in rc.conf(5). moused_enable="NO" # Run the mouse daemon. moused_type="auto" # See man page for rc.conf(5) for available settings. moused_port="/dev/psm0" # Set to your mouse port. moused_flags="" # Any additional flags to moused. mousechar_start="NO" # if 0xd0-0xd3 default range is occupied in your # language code table, specify alternative range # start like mousechar_start=3, see vidcontrol(1) allscreens_flags="" # Set this vidcontrol mode for all virtual screens allscreens_kbdflags="" # Set this kbdcontrol mode for all virtual screens ############################################################## ### Mail Transfer Agent (MTA) options ###################### ############################################################## mta_start_script="/etc/rc.sendmail" # Script to start your chosen MTA, called by /etc/rc. # Settings for /etc/rc.sendmail and /etc/rc.d/sendmail: sendmail_enable="NO" # Run the sendmail inbound daemon (YES/NO). sendmail_pidfile="/var/run/sendmail.pid" # sendmail pid file sendmail_procname="/usr/sbin/sendmail" # sendmail process name sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server) sendmail_cert_create="YES" # Create a server certificate if none (YES/NO) #sendmail_cert_cn="CN" # CN of the generate certificate sendmail_submit_enable="YES" # Start a localhost-only MTA for mail submission sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost" # Flags for localhost-only MTA sendmail_outbound_enable="YES" # Dequeue stuck mail (YES/NO). sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only) sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO). sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m" # Flags for sendmail_msp_queue daemon. sendmail_rebuild_aliases="NO" # Run newaliases if necessary (YES/NO). ############################################################## ### Miscellaneous administrative options ################### ############################################################## auditd_enable="NO" # Run the audit daemon. auditd_program="/usr/sbin/auditd" # Path to the audit daemon. auditd_flags="" # Which options to pass to the audit daemon. auditdistd_enable="NO" # Run the audit daemon. auditdistd_program="/usr/sbin/auditdistd" # Path to the auditdistd daemon. auditdistd_flags="" # Which options to pass to the auditdistd daemon. cron_enable="YES" # Run the periodic job daemon. cron_program="/usr/sbin/cron" # Which cron executable to run (if enabled). cron_dst="YES" # Handle DST transitions intelligently (YES/NO) cron_flags="" # Which options to pass to the cron daemon. cfumass_enable="NO" # Create default LUN for cfumass(4). cfumass_dir="/var/cfumass" # File to LUN's contents. cfumass_image="/var/tmp/cfumass.img" # LUN's backing file path. lpd_enable="NO" # Run the line printer daemon. lpd_program="/usr/sbin/lpd" # path to lpd, if you want a different one. lpd_flags="" # Flags to lpd (if enabled). nscd_enable="NO" # Run the nsswitch caching daemon. chkprintcap_enable="NO" # Run chkprintcap(8) before running lpd. chkprintcap_flags="-d" # Create missing directories by default. dumpdev="NO" # Device to crashdump to (device name, AUTO, or NO). dumpon_flags="" # Options to pass to dumpon(8), followed by dumpdev. dumpdir="/var/crash" # Directory where crash dumps are to be stored savecore_enable="YES" # Extract core from dump devices if any savecore_flags="-m 10" # Used if dumpdev is enabled above, and present. # By default, only the 10 most recent kernel dumps # are saved. service_delete_empty="NO" # Have 'service delete' remove empty rc.conf.d files. crashinfo_enable="YES" # Automatically generate crash dump summary. crashinfo_program="/usr/sbin/crashinfo" # Script to generate crash dump summary. quota_enable="NO" # turn on quotas on startup (or NO). check_quotas="YES" # Check quotas on startup (or NO). quotaon_flags="-a" # Turn quotas on for all file systems (if enabled) quotaoff_flags="-a" # Turn quotas off for all file systems at shutdown quotacheck_flags="-a" # Check all file system quotas (if enabled) accounting_enable="NO" # Turn on process accounting (or NO). ibcs2_enable="NO" # Ibcs2 (SCO) emulation loaded at startup (or NO). ibcs2_loaders="coff" # List of additional Ibcs2 loaders (or NO). firstboot_sentinel="/firstboot" # Scripts with "firstboot" keyword are run if # this file exists. Should be on a R/W filesystem so # the file can be deleted after the boot completes. # Emulation/compatibility services provided by /etc/rc.d/abi sysvipc_enable="NO" # Load System V IPC primitives at startup (or NO). linux_enable="NO" # Linux binary compatibility loaded at startup (or NO). clear_tmp_enable="NO" # Clear /tmp at startup. clear_tmp_X="YES" # Clear and recreate X11-related directories in /tmp ldconfig_insecure="NO" # Set to YES to disable ldconfig security checks ldconfig_paths="/usr/lib/compat /usr/local/lib /usr/local/lib/compat/pkg" # shared library search paths ldconfig32_paths="/usr/lib32 /usr/lib32/compat" # 32-bit compatibility shared library search paths ldconfigsoft_paths="/usr/libsoft /usr/libsoft/compat /usr/local/libsoft" # soft float compatibility shared library search paths # Note: temporarily with extra stuff for transition ldconfig_paths_aout="/usr/lib/compat/aout /usr/local/lib/aout" # a.out shared library search paths ldconfig_local_dirs="/usr/local/libdata/ldconfig" # Local directories with ldconfig configuration files. ldconfig_local32_dirs="/usr/local/libdata/ldconfig32" # Local directories with 32-bit compatibility ldconfig # configuration files. ldconfig_localsoft_dirs="/usr/local/libdata/ldconfigsoft" # Local directories with soft float compatibility ldconfig # configuration files. kern_securelevel_enable="NO" # kernel security level (see security(7)) kern_securelevel="-1" # range: -1..3 ; `-1' is the most insecure # Note that setting securelevel to 0 will result # in the system booting with securelevel set to 1, as # init(8) will raise the level when rc(8) completes. update_motd="YES" # update version info in /etc/motd (or NO) entropy_boot_file="/boot/entropy" # Set to NO to disable very early # (used at early boot time) entropy caching through reboots. entropy_file="/entropy" # Set to NO to disable late (used when going multi-user) # entropy through reboots. # /var/db/entropy-file is preferred if / is not avail. entropy_dir="/var/db/entropy" # Set to NO to disable caching entropy via cron. entropy_save_sz="4096" # Size of the entropy cache files. entropy_save_num="8" # Number of entropy cache files to save. harvest_mask="511" # Entropy device harvests all but the very invasive sources. # (See 'sysctl kern.random.harvest' and random(4)) dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot watchdogd_enable="NO" # Start the software watchdog daemon watchdogd_flags="" # Flags to watchdogd (if enabled) +watchdogd_timeout="" # watchdogd timeout, overrides -t in watchdogd_flags +watchdogd_shutdown_timeout="" # Timeout to use after watchdogd is stopped. + # Has effect only for system shutdown. + # Overrides -x in watchdogd_flags. devfs_rulesets="/etc/defaults/devfs.rules /etc/devfs.rules" # Files containing # devfs(8) rules. devfs_system_ruleset="" # The name (NOT number) of a ruleset to apply to /dev devfs_set_rulesets="" # A list of /mount/dev=ruleset_name settings to # apply (must be mounted already, i.e. fstab(5)) devfs_load_rulesets="YES" # Enable to always load the default rulesets performance_cx_lowest="NONE" # Online CPU idle state performance_cpu_freq="NONE" # Online CPU frequency economy_cx_lowest="Cmax" # Offline CPU idle state economy_cpu_freq="NONE" # Offline CPU frequency virecover_enable="YES" # Perform housekeeping for the vi(1) editor ugidfw_enable="NO" # Load mac_bsdextended(4) rules on boot bsdextended_script="/etc/rc.bsdextended" # Default mac_bsdextended(4) # ruleset file. newsyslog_enable="YES" # Run newsyslog at startup. newsyslog_flags="-CN" # Newsyslog flags to create marked files mixer_enable="YES" # Run the sound mixer. opensm_enable="NO" # Opensm(8) for infiniband devices defaults to off # rctl(8) requires kernel options RACCT and RCTL rctl_enable="YES" # Load rctl(8) rules on boot rctl_rules="/etc/rctl.conf" # rctl(8) ruleset. See rctl.conf(5). iovctl_files="" # Config files for iovctl(8) ############################################################## ### Jail Configuration (see rc.conf(5) manual page) ########## ############################################################## jail_enable="NO" # Set to NO to disable starting of any jails jail_conf="/etc/jail.conf" # Configuration file for jail(8) jail_confwarn="YES" # Prevent warning about obsolete per-jail configuration jail_parallel_start="NO" # Start jails in the background jail_list="" # Space separated list of names of jails jail_reverse_stop="NO" # Stop jails in reverse order ############################################################## ### Define source_rc_confs, the mechanism used by /etc/rc.* ## ### scripts to source rc_conf_files overrides safely. ## ############################################################## if [ -z "${source_rc_confs_defined}" ]; then source_rc_confs_defined=yes source_rc_confs() { local i sourced_files for i in ${rc_conf_files}; do case ${sourced_files} in *:$i:*) ;; *) sourced_files="${sourced_files}:$i:" if [ -r $i ]; then . $i fi ;; esac done # Re-do process to pick up [possibly] redefined $rc_conf_files for i in ${rc_conf_files}; do case ${sourced_files} in *:$i:*) ;; *) sourced_files="${sourced_files}:$i:" if [ -r $i ]; then . $i fi ;; esac done } fi # Allow vendors to override FreeBSD defaults in /etc/default/rc.conf # without the need to carefully manage /etc/rc.conf. if [ -r /etc/defaults/vendor.conf ]; then . /etc/defaults/vendor.conf fi Index: stable/12/libexec/rc/rc.d/jail =================================================================== --- stable/12/libexec/rc/rc.d/jail (revision 354724) +++ stable/12/libexec/rc/rc.d/jail (revision 354725) @@ -1,600 +1,600 @@ #!/bin/sh # # $FreeBSD$ # # PROVIDE: jail # REQUIRE: LOGIN FILESYSTEMS # BEFORE: securelevel # KEYWORD: nojail shutdown . /etc/rc.subr name="jail" desc="Manage system jails" rcvar="jail_enable" start_cmd="jail_start" start_postcmd="jail_warn" stop_cmd="jail_stop" config_cmd="jail_config" console_cmd="jail_console" status_cmd="jail_status" extra_commands="config console status" : ${jail_program:=/usr/sbin/jail} : ${jail_consolecmd:=/usr/bin/login -f root} : ${jail_jexec:=/usr/sbin/jexec} : ${jail_jls:=/usr/sbin/jls} need_dad_wait= # extract_var jv name param num defval # Extract value from ${jail_$jv_$name} or ${jail_$name} and # set it to $param. If not defined, $defval is used. # When $num is [0-9]*, ${jail_$jv_$name$num} are looked up and # $param is set by using +=. $num=0 is optional (params may start at 1). # When $num is YN or NY, the value is interpreted as boolean. # When $num is @, the value is interpreted as an array separted by IFS. extract_var() { local i _jv _name _param _num _def _name1 _name2 _jv=$1 _name=$2 _param=$3 _num=$4 _def=$5 case $_num in YN) _name1=jail_${_jv}_${_name} _name2=jail_${_name} eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\" if checkyesno $_name1; then echo " $_param = 1;" else echo " $_param = 0;" fi ;; NY) _name1=jail_${_jv}_${_name} _name2=jail_${_name} eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\" if checkyesno $_name1; then echo " $_param = 0;" else echo " $_param = 1;" fi ;; [0-9]*) i=$_num while : ; do _name1=jail_${_jv}_${_name}${i} _name2=jail_${_name}${i} eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\" if [ -n "$_tmpargs" ]; then echo " $_param += \"$_tmpargs\";" elif [ $i != 0 ]; then break; fi i=$(($i + 1)) done ;; @) _name1=jail_${_jv}_${_name} _name2=jail_${_name} eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\" set -- $_tmpargs if [ $# -gt 0 ]; then echo -n " $_param = " while [ $# -gt 1 ]; do echo -n "\"$1\", " shift done echo "\"$1\";" fi ;; *) _name1=jail_${_jv}_${_name} _name2=jail_${_name} eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\" if [ -n "$_tmpargs" ]; then echo " $_param = \"$_tmpargs\";" fi ;; esac } # parse_options _j _jv # Parse options and create a temporary configuration file if necessary. # parse_options() { local _j _jv _p _j=$1 _jv=$2 _confwarn=0 if [ -z "$_j" ]; then warn "parse_options: you must specify a jail" return fi eval _jconf=\"\${jail_${_jv}_conf:-/etc/jail.${_j}.conf}\" eval _rootdir=\"\$jail_${_jv}_rootdir\" eval _hostname=\"\$jail_${_jv}_hostname\" if [ -z "$_rootdir" -o \ -z "$_hostname" ]; then if [ -r "$_jconf" ]; then _conf="$_jconf" return 0 elif [ -r "$jail_conf" ]; then _conf="$jail_conf" return 0 else warn "Invalid configuration for $_j " \ "(no jail.conf, no hostname, or no path). " \ "Jail $_j was ignored." fi return 1 fi eval _ip=\"\$jail_${_jv}_ip\" if [ -z "$_ip" ] && ! check_kern_features vimage; then warn "no ipaddress specified and no vimage support. " \ "Jail $_j was ignored." return 1 fi _conf=/var/run/jail.${_j}.conf # # To relieve confusion, show a warning message. # : ${jail_confwarn:=YES} checkyesno jail_confwarn && _confwarn=1 if [ -r "$jail_conf" -o -r "$_jconf" ]; then if ! checkyesno jail_parallel_start; then warn "$_conf is created and used for jail $_j." fi fi /usr/bin/install -m 0644 -o root -g wheel /dev/null $_conf || return 1 eval : \${jail_${_jv}_flags:=${jail_flags}} eval _exec=\"\$jail_${_jv}_exec\" eval _exec_start=\"\$jail_${_jv}_exec_start\" eval _exec_stop=\"\$jail_${_jv}_exec_stop\" if [ -n "${_exec}" ]; then # simple/backward-compatible execution _exec_start="${_exec}" _exec_stop="" else # flexible execution if [ -z "${_exec_start}" ]; then _exec_start="/bin/sh /etc/rc" if [ -z "${_exec_stop}" ]; then - _exec_stop="/bin/sh /etc/rc.shutdown" + _exec_stop="/bin/sh /etc/rc.shutdown jail" fi fi fi eval _interface=\"\${jail_${_jv}_interface:-${jail_interface}}\" eval _parameters=\"\${jail_${_jv}_parameters:-${jail_parameters}}\" eval _fstab=\"\${jail_${_jv}_fstab:-${jail_fstab:-/etc/fstab.$_j}}\" ( date +"# Generated by rc.d/jail at %Y-%m-%d %H:%M:%S" echo "$_j {" extract_var $_jv hostname host.hostname - "" extract_var $_jv rootdir path - "" if [ -n "$_ip" ]; then extract_var $_jv interface interface - "" jail_handle_ips_option $_ip $_interface alias=0 while : ; do eval _x=\"\$jail_${_jv}_ip_multi${alias}\" [ -z "$_x" ] && break jail_handle_ips_option $_x $_interface alias=$(($alias + 1)) done case $need_dad_wait in 1) # Sleep to let DAD complete before # starting services. echo " exec.start += \"sleep " \ $(($(${SYSCTL_N} net.inet6.ip6.dad_count) + 1)) \ "\";" ;; esac # These are applicable only to non-vimage jails. extract_var $_jv fib exec.fib - "" extract_var $_jv socket_unixiproute_only \ allow.raw_sockets NY YES else echo " vnet;" extract_var $_jv vnet_interface vnet.interface @ "" fi echo " exec.clean;" echo " exec.system_user = \"root\";" echo " exec.jail_user = \"root\";" extract_var $_jv exec_prestart exec.prestart 0 "" extract_var $_jv exec_poststart exec.poststart 0 "" extract_var $_jv exec_prestop exec.prestop 0 "" extract_var $_jv exec_poststop exec.poststop 0 "" echo " exec.start += \"$_exec_start\";" extract_var $_jv exec_afterstart exec.start 0 "" echo " exec.stop = \"$_exec_stop\";" extract_var $_jv consolelog exec.consolelog - \ /var/log/jail_${_j}_console.log if [ -r $_fstab ]; then echo " mount.fstab = \"$_fstab\";" fi eval : \${jail_${_jv}_devfs_enable:=${jail_devfs_enable:-NO}} if checkyesno jail_${_jv}_devfs_enable; then echo " mount.devfs;" eval _ruleset=\${jail_${_jv}_devfs_ruleset:-${jail_devfs_ruleset}} case $_ruleset in "") ;; [0-9]*) echo " devfs_ruleset = \"$_ruleset\";" ;; devfsrules_jail) # XXX: This is the default value, # Let jail(8) to use the default because # mount(8) only accepts an integer. # This should accept a ruleset name. ;; *) warn "devfs_ruleset must be an integer." ;; esac fi eval : \${jail_${_jv}_fdescfs_enable:=${jail_fdescfs_enable:-NO}} if checkyesno jail_${_jv}_fdescfs_enable; then echo " mount.fdescfs;" fi eval : \${jail_${_jv}_procfs_enable:=${jail_procfs_enable:-NO}} if checkyesno jail_${_jv}_procfs_enable; then echo " mount.procfs;" fi eval : \${jail_${_jv}_mount_enable:=${jail_mount_enable:-NO}} if checkyesno jail_${_jv}_mount_enable; then echo " allow.mount;" fi extract_var $_jv set_hostname_allow allow.set_hostname YN NO extract_var $_jv sysvipc_allow allow.sysvipc YN NO extract_var $_jv enforce_statfs enforce_statfs - 2 extract_var $_jv osreldate osreldate extract_var $_jv osrelease osrelease for _p in $_parameters; do echo " ${_p%\;};" done echo "}" ) >> $_conf return 0 } # jail_extract_address argument iface # The second argument is the string from one of the _ip # or the _multi variables. In case of a comma separated list # only one argument must be passed in at a time. # The function alters the _type, _iface, _addr and _mask variables. # jail_extract_address() { local _i _interface _i=$1 _interface=$2 if [ -z "${_i}" ]; then warn "jail_extract_address: called without input" return fi # Check if we have an interface prefix given and split into # iFace and rest. case "${_i}" in *\|*) # ifN|.. prefix there _iface=${_i%%|*} _r=${_i##*|} ;; *) _iface="" _r=${_i} ;; esac # In case the IP has no interface given, check if we have a global one. _iface=${_iface:-${_interface}} # Set address, cut off any prefix/netmask/prefixlen. _addr=${_r} _addr=${_addr%%[/ ]*} # Theoretically we can return here if interface is not set, # as we only care about the _mask if we call ifconfig. # This is not done because we may want to santize IP addresses # based on _type later, and optionally change the type as well. # Extract the prefix/netmask/prefixlen part by cutting off the address. _mask=${_r} _mask=`expr -- "${_mask}" : "${_addr}\(.*\)"` # Identify type {inet,inet6}. case "${_addr}" in *\.*\.*\.*) _type="inet" ;; *:*) _type="inet6" ;; *) warn "jail_extract_address: type not identified" ;; esac # Handle the special /netmask instead of /prefix or # "netmask xxx" case for legacy IP. # We do NOT support shortend class-full netmasks. if [ "${_type}" = "inet" ]; then case "${_mask}" in /*\.*\.*\.*) _mask=" netmask ${_mask#/}" ;; *) ;; esac # In case _mask is still not set use /32. _mask=${_mask:-/32} elif [ "${_type}" = "inet6" ]; then # In case _mask is not set for IPv6, use /128. _mask=${_mask:-/128} fi } # jail_handle_ips_option input iface # Handle a single argument imput which can be a comma separated # list of addresses (theoretically with an option interface and # prefix/netmask/prefixlen). # jail_handle_ips_option() { local _x _type _i _defif _x=$1 _defif=$2 if [ -z "${_x}" ]; then # No IP given. This can happen for the primary address # of each address family. return fi # Loop, in case we find a comma separated list, we need to handle # each argument on its own. while [ ${#_x} -gt 0 ]; do case "${_x}" in *,*) # Extract the first argument and strip it off the list. _i=`expr -- "${_x}" : '^\([^,]*\)'` _x=`expr -- "${_x}" : "^[^,]*,\(.*\)"` ;; *) _i=${_x} _x="" ;; esac _type="" _addr="" _mask="" _iface="" jail_extract_address $_i $_defif # make sure we got an address. case $_addr in "") continue ;; *) ;; esac # Append address to list of addresses for the jail command. case $_type in inet) echo " ip4.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";" ;; inet6) echo " ip6.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";" need_dad_wait=1 ;; esac done } jail_config() { local _j _jv case $1 in _ALL) return ;; esac for _j in $@; do _j=$(echo $_j | tr /. _) _jv=$(echo -n $_j | tr -c '[:alnum:]' _) if parse_options $_j $_jv; then echo "$_j: parameters are in $_conf." fi done } jail_console() { local _j _jv _cmd # One argument that is not _ALL. case $#:$1 in 0:*|1:_ALL) err 3 "Specify a jail name." ;; 1:*) ;; esac _j=$(echo $1 | tr /. _) _jv=$(echo -n $1 | tr -c '[:alnum:]' _) shift case $# in 0) eval _cmd=\${jail_${_jv}_consolecmd:-$jail_consolecmd} ;; *) _cmd=$@ ;; esac $jail_jexec $_j $_cmd } jail_status() { $jail_jls -N } jail_start() { local _j _jv _jid _id _name if [ $# = 0 ]; then return fi echo -n 'Starting jails:' case $1 in _ALL) command=$jail_program rc_flags=$jail_flags command_args="-f $jail_conf -c" if ! checkyesno jail_parallel_start; then command_args="$command_args -p1" fi _tmp=`mktemp -t jail` || exit 3 if $command $rc_flags $command_args >> $_tmp 2>&1; then $jail_jls jid name | while read _id _name; do echo -n " $_name" echo $_id > /var/run/jail_${_name}.id done else cat $_tmp fi rm -f $_tmp echo '.' return ;; esac if checkyesno jail_parallel_start; then # # Start jails in parallel and then check jail id when # jail_parallel_start is YES. # for _j in $@; do _j=$(echo $_j | tr /. _) _jv=$(echo -n $_j | tr -c '[:alnum:]' _) parse_options $_j $_jv || continue eval rc_flags=\${jail_${_jv}_flags:-$jail_flags} eval command=\${jail_${_jv}_program:-$jail_program} command_args="-i -f $_conf -c $_j" ( _tmp=`mktemp -t jail_${_j}` || exit 3 if $command $rc_flags $command_args \ >> $_tmp 2>&1 /var/run/jail_${_j}.id else echo " cannot start jail " \ "\"${_hostname:-${_j}}\": " cat $_tmp fi rm -f $_tmp ) & done wait else # # Start jails one-by-one when jail_parallel_start is NO. # for _j in $@; do _j=$(echo $_j | tr /. _) _jv=$(echo -n $_j | tr -c '[:alnum:]' _) parse_options $_j $_jv || continue eval rc_flags=\${jail_${_jv}_flags:-$jail_flags} eval command=\${jail_${_jv}_program:-$jail_program} command_args="-i -f $_conf -c $_j" _tmp=`mktemp -t jail` || exit 3 if $command $rc_flags $command_args \ >> $_tmp 2>&1 /var/run/jail_${_j}.id else echo " cannot start jail " \ "\"${_hostname:-${_j}}\": " cat $_tmp fi rm -f $_tmp done fi echo '.' } jail_stop() { local _j _jv if [ $# = 0 ]; then return fi echo -n 'Stopping jails:' case $1 in _ALL) command=$jail_program rc_flags=$jail_flags command_args="-f $jail_conf -r" if checkyesno jail_reverse_stop; then $jail_jls name | tail -r else $jail_jls name fi | while read _j; do echo -n " $_j" _tmp=`mktemp -t jail` || exit 3 $command $rc_flags $command_args $_j >> $_tmp 2>&1 if $jail_jls -j $_j > /dev/null 2>&1; then cat $_tmp else rm -f /var/run/jail_${_j}.id fi rm -f $_tmp done echo '.' return ;; esac checkyesno jail_reverse_stop && set -- $(reverse_list $@) for _j in $@; do _j=$(echo $_j | tr /. _) _jv=$(echo -n $_j | tr -c '[:alnum:]' _) parse_options $_j $_jv || continue if ! $jail_jls -j $_j > /dev/null 2>&1; then continue fi eval command=\${jail_${_jv}_program:-$jail_program} echo -n " ${_hostname:-${_j}}" _tmp=`mktemp -t jail` || exit 3 $command -q -f $_conf -r $_j >> $_tmp 2>&1 if $jail_jls -j $_j > /dev/null 2>&1; then cat $_tmp else rm -f /var/run/jail_${_j}.id fi rm -f $_tmp done echo '.' } jail_warn() { # To relieve confusion, show a warning message. case $_confwarn in 1) warn "Per-jail configuration via jail_* variables " \ "is obsolete. Please consider migrating to $jail_conf." ;; esac } load_rc_config $name case $# in 1) run_rc_command $@ ${jail_list:-_ALL} ;; *) jail_reverse_stop="no" run_rc_command $@ ;; esac Index: stable/12/libexec/rc/rc.d/watchdogd =================================================================== --- stable/12/libexec/rc/rc.d/watchdogd (revision 354724) +++ stable/12/libexec/rc/rc.d/watchdogd (revision 354725) @@ -1,46 +1,92 @@ #!/bin/sh # Copyright (c) 2003 Sean M. Kelly # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # # PROVIDE: watchdogd # REQUIRE: FILESYSTEMS syslogd # KEYWORD: nojail shutdown . /etc/rc.subr name="watchdogd" desc="Watchdog daemon" rcvar="watchdogd_enable" command="/usr/sbin/${name}" pidfile="/var/run/${name}.pid" +start_precmd="watchdogd_prestart" +stop_precmd="watchdogd_prestop" +stop_postcmd="watchdogd_poststop" +watchdog_command="/usr/sbin/watchdog" -load_rc_config $name +watchdogd_prestart() +{ + if [ -n "${watchdogd_timeout}" ] ; then + rc_flags="${rc_flags} -t ${watchdogd_timeout}" + fi + if [ -n "$watchdogd_shutdown_timeout" ] ; then + rc_flags="${rc_flags} -x ${watchdogd_shutdown_timeout}" + fi + return 0 +} -sig_stop="${watchdogd_sig_stop:-TERM}" +watchdogd_prestop() +{ + sig_stop="${watchdogd_sig_stop:-TERM}" +} +watchdogd_poststop() +{ + if [ ${watchdogd_shutdown_timeout:-0} -gt 0 ] ; then + case "${rc_shutdown}" in + "reboot") + info "watchdog timer is set to" \ + ${watchdogd_shutdown_timeout} "before shutdown" + return 0 + ;; + "single") + info "watchdog timer is disabled before going to" \ + "single user mode" + ${watchdog_command} -t 0 + ;; + "") + info "watchdog timer is disabled after administrative" \ + "${name} stop" + ${watchdog_command} -t 0 + ;; + *) + warn "unknown shutdown mode '${rc_shutdown}'" + warn "watchdog timer is set to ${watchdogd_shutdown_timeout}" + return 0 + ;; + esac + fi + return 0 +} + +load_rc_config $name run_rc_command "$1" Index: stable/12/libexec/rc/rc.shutdown =================================================================== --- stable/12/libexec/rc/rc.shutdown (revision 354724) +++ stable/12/libexec/rc/rc.shutdown (revision 354725) @@ -1,113 +1,115 @@ #!/bin/sh # # Copyright (c) 1997 Ollivier Robert # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # # Site-specific closing actions for daemons run by init on shutdown, # or before going single-user from multi-user. # Output and errors are directed to console by init, and the # console is the controlling terminal. stty status '^T' 2> /dev/null # Set shell to ignore SIGINT (2), but not children; # shell catches SIGQUIT (3) and returns to single user after fsck. trap : 2 trap : 3 # shouldn't be needed HOME=/ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin export HOME PATH +rc_shutdown=${1:-"unspecified"} + . /etc/rc.subr load_rc_config # reverse_list list # print the list in reverse order # reverse_list() { _revlist= for _revfile in $*; do _revlist="$_revfile${script_name_sep}$_revlist" done echo $_revlist } # If requested, start a watchdog timer in the background which # will terminate rc.shutdown if rc.shutdown doesn't complete # within the specified time. # _rcshutdown_watchdog= if [ -n "$rcshutdown_timeout" ]; then debug "Initiating watchdog timer." sleep $rcshutdown_timeout && ( _msg="$rcshutdown_timeout second watchdog" _msg="$_msg timeout expired. Shutdown terminated." logger -t rc.shutdown "$_msg" echo "$_msg" date kill -KILL $$ >/dev/null 2>&1 ) & _rcshutdown_watchdog=$! fi # Determine the shutdown order of the /etc/rc.d scripts, # and perform the operation # rcorder_opts="-k shutdown" if [ `/sbin/sysctl -n security.jail.jailed` -eq 1 ]; then rcorder_opts="$rcorder_opts -s nojail" if [ `/sbin/sysctl -n security.jail.vnet` -ne 1 ]; then rcorder_opts="$rcorder_opts -s nojailvnet" fi fi case ${local_startup} in [Nn][Oo] | '') ;; *) find_local_scripts_new ;; esac files=`rcorder ${rcorder_opts} /etc/rc.d/* ${local_rc} 2>/dev/null` for _rc_elem in `reverse_list $files`; do debug "run_rc_script $_rc_elem faststop" run_rc_script $_rc_elem faststop done # Terminate the background watchdog timer (if it is running) # if [ -n "$_rcshutdown_watchdog" ]; then pkill -TERM -P $_rcshutdown_watchdog >/dev/null 2>&1 fi # Insert other shutdown procedures here echo '.' exit 0 Index: stable/12/sbin/init/init.8 =================================================================== --- stable/12/sbin/init/init.8 (revision 354724) +++ stable/12/sbin/init/init.8 (revision 354725) @@ -1,449 +1,458 @@ .\" Copyright (c) 1980, 1991, 1993 .\" The Regents of the University of California. All rights reserved. .\" .\" This code is derived from software contributed to Berkeley by .\" Donn Seeley at Berkeley Software Design, Inc. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" 3. Neither the name of the University nor the names of its contributors .\" may be used to endorse or promote products derived from this software .\" without specific prior written permission. .\" .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" @(#)init.8 8.3 (Berkeley) 4/18/94 .\" $FreeBSD$ .\" -.Dd August 15, 2018 +.Dd August 6, 2019 .Dt INIT 8 .Os .Sh NAME .Nm init .Nd process control initialization .Sh SYNOPSIS .Nm .Nm .Oo .Cm 0 | 1 | 6 | .Cm c | q .Oc .Sh DESCRIPTION The .Nm utility is the last stage of the boot process. It normally runs the automatic reboot sequence as described in .Xr rc 8 , and if this succeeds, begins multi-user operation. If the reboot scripts fail, .Nm commences single-user operation by giving the super-user a shell on the console. The .Nm utility may be passed parameters from the boot program to prevent the system from going multi-user and to instead execute a single-user shell without starting the normal daemons. The system is then quiescent for maintenance work and may later be made to go to multi-user by exiting the single-user shell (with ^D). This causes .Nm to run the .Pa /etc/rc start up command file in fastboot mode (skipping disk checks). .Pp If the .Em console entry in the .Xr ttys 5 file is marked .Dq insecure , then .Nm will require that the super-user password be entered before the system will start a single-user shell. The password check is skipped if the .Em console is marked as .Dq secure . Note that the password check does not protect from variables such as .Va init_script being set from the .Xr loader 8 command line; see the .Sx SECURITY section of .Xr loader 8 . .Pp If the system security level (see .Xr security 7 ) is initially nonzero, then .Nm leaves it unchanged. Otherwise, .Nm raises the level to 1 before going multi-user for the first time. Since the level cannot be reduced, it will be at least 1 for subsequent operation, even on return to single-user. If a level higher than 1 is desired while running multi-user, it can be set before going multi-user, e.g., by the startup script .Xr rc 8 , using .Xr sysctl 8 to set the .Va kern.securelevel variable to the required security level. .Pp If .Nm is run in a jail, the security level of the .Dq host system will not be affected. Part of the information set up in the kernel to support a jail is a per-jail security level. This allows running a higher security level inside of a jail than that of the host system. See .Xr jail 8 for more information about jails. .Pp In multi-user operation, .Nm maintains processes for the terminal ports found in the file .Xr ttys 5 . The .Nm utility reads this file and executes the command found in the second field, unless the first field refers to a device in .Pa /dev which is not configured. The first field is supplied as the final argument to the command. This command is usually .Xr getty 8 ; .Nm getty opens and initializes the tty line and executes the .Xr login 1 program. The .Nm login program, when a valid user logs in, executes a shell for that user. When this shell dies, either because the user logged out or an abnormal termination occurred (a signal), the cycle is restarted by executing a new .Nm getty for the line. .Pp The .Nm utility can also be used to keep arbitrary daemons running, automatically restarting them if they die. In this case, the first field in the .Xr ttys 5 file must not reference the path to a configured device node and will be passed to the daemon as the final argument on its command line. This is similar to the facility offered in the .At V .Pa /etc/inittab . .Pp Line status (on, off, secure, getty, or window information) may be changed in the .Xr ttys 5 file without a reboot by sending the signal .Dv SIGHUP to .Nm with the command .Dq Li "kill -HUP 1" . On receipt of this signal, .Nm re-reads the .Xr ttys 5 file. When a line is turned off in .Xr ttys 5 , .Nm will send a SIGHUP signal to the controlling process for the session associated with the line. For any lines that were previously turned off in the .Xr ttys 5 file and are now on, .Nm executes the command specified in the second field. If the command or window field for a line is changed, the change takes effect at the end of the current login session (e.g., the next time .Nm starts a process on the line). If a line is commented out or deleted from .Xr ttys 5 , .Nm will not do anything at all to that line. .Pp The .Nm utility will terminate multi-user operations and resume single-user mode if sent a terminate .Pq Dv TERM signal, for example, .Dq Li "kill \-TERM 1" . If there are processes outstanding that are deadlocked (because of hardware or software failure), .Nm will not wait for them all to die (which might take forever), but will time out after 30 seconds and print a warning message. .Pp The .Nm utility will cease creating new processes and allow the system to slowly die away, if it is sent a terminal stop .Pq Dv TSTP signal, i.e.\& .Dq Li "kill \-TSTP 1" . A later hangup will resume full multi-user operations, or a terminate will start a single-user shell. This hook is used by .Xr reboot 8 and .Xr halt 8 . .Pp The .Nm utility will terminate all possible processes (again, it will not wait for deadlocked processes) and reboot the machine if sent the interrupt .Pq Dv INT signal, i.e.\& .Dq Li "kill \-INT 1". This is useful for shutting the machine down cleanly from inside the kernel or from X when the machine appears to be hung. .Pp The .Nm utility will do the same, except it will halt the machine if sent the user defined signal 1 .Pq Dv USR1 , or will halt and turn the power off (if hardware permits) if sent the user defined signal 2 .Pq Dv USR2 . .Pp When shutting down the machine, .Nm will try to run the .Pa /etc/rc.shutdown script. This script can be used to cleanly terminate specific programs such as .Nm innd (the InterNetNews server). If this script does not terminate within 120 seconds, .Nm will terminate it. The timeout can be configured via the .Xr sysctl 8 variable .Va kern.init_shutdown_timeout . +.Pp +.Nm init +passes +.Dq Li single +as the argument to the shutdown script if return to single-user mode +is requested. +Otherwise, +.Dq Li reboot +argument is used. .Pp The role of .Nm is so critical that if it dies, the system will reboot itself automatically. If, at bootstrap time, the .Nm process cannot be located, the system will panic with the message .Dq "panic: init died (signal %d, exit %d)" . .Pp If run as a user process as shown in the second synopsis line, .Nm will emulate .At V behavior, i.e., super-user can specify the desired .Em run-level on a command line, and .Nm will signal the original (PID 1) .Nm as follows: .Bl -column Run-level SIGTERM .It Sy "Run-level Signal Action" .It Cm 0 Ta Dv SIGUSR1 Ta "Halt" .It Cm 0 Ta Dv SIGUSR2 Ta "Halt and turn the power off" .It Cm 0 Ta Dv SIGWINCH Ta "Halt and turn the power off and then back on" .It Cm 1 Ta Dv SIGTERM Ta "Go to single-user mode" .It Cm 6 Ta Dv SIGINT Ta "Reboot the machine" .It Cm c Ta Dv SIGTSTP Ta "Block further logins" .It Cm q Ta Dv SIGHUP Ta Rescan the .Xr ttys 5 file .El .Sh KERNEL ENVIRONMENT VARIABLES The following .Xr kenv 2 variables are available as .Xr loader 8 tunables: .Bl -tag -width indent .It Va init_chroot If set to a valid directory in the root file system, it causes .Nm to perform a .Xr chroot 2 operation on that directory, making it the new root directory. That happens before entering single-user mode or multi-user mode (but after executing the .Va init_script if enabled). This functionality has generally been eclipsed by rerooting. See .Xr reboot 8 .Fl r for details. .It Va init_exec If set to a valid file name in the root file system, instructs .Nm to directly execute that file as the very first action, replacing .Nm as PID 1. .It Va init_script If set to a valid file name in the root file system, instructs .Nm to run that script as the very first action, before doing anything else. Signal handling and exit code interpretation is similar to running the .Pa /etc/rc script. In particular, single-user operation is enforced if the script terminates with a non-zero exit code, or if a SIGTERM is delivered to the .Nm process (PID 1). This functionality has generally been eclipsed by rerooting. See .Xr reboot 8 .Fl r for details. .It Va init_shell Defines the shell binary to be used for executing the various shell scripts. The default is .Dq Li /bin/sh . It is used for running the .Va init_exec or .Va init_script if set, as well as for the .Pa /etc/rc and .Pa /etc/rc.shutdown scripts. The value of the corresponding .Xr kenv 2 variable is evaluated every time .Nm calls a shell script, so it can be changed later on using the .Xr kenv 1 utility. In particular, if a non-default shell is used for running an .Va init_script , it might be desirable to have that script reset the value of .Va init_shell back to the default, so that the .Pa /etc/rc script is executed with the standard shell .Pa /bin/sh . .Sh FILES .Bl -tag -width /var/log/init.log -compact .It Pa /dev/console system console device .It Pa /dev/tty* terminal ports found in .Xr ttys 5 .It Pa /etc/ttys the terminal initialization information file .It Pa /etc/rc system startup commands .It Pa /etc/rc.shutdown system shutdown commands .It Pa /var/log/init.log log of .Xr rc 8 output if the system console device is not available .El .Sh DIAGNOSTICS .Bl -diag .It "getty repeating too quickly on port %s, sleeping." A process being started to service a line is exiting quickly each time it is started. This is often caused by a ringing or noisy terminal line. .Bf -emphasis Init will sleep for 30 seconds, then continue trying to start the process. .Ef .It "some processes would not die; ps axl advised." A process is hung and could not be killed when the system was shutting down. This condition is usually caused by a process that is stuck in a device driver because of a persistent device error condition. .El .Sh SEE ALSO .Xr kill 1 , .Xr login 1 , .Xr sh 1 , .Xr ttys 5 , .Xr security 7 , .Xr getty 8 , .Xr halt 8 , .Xr jail 8 , .Xr rc 8 , .Xr reboot 8 , .Xr shutdown 8 , .Xr sysctl 8 .Sh HISTORY An .Nm utility appeared in .At v1 . .Sh CAVEATS Systems without .Xr sysctl 8 behave as though they have security level \-1. .Pp Setting the security level above 1 too early in the boot sequence can prevent .Xr fsck 8 from repairing inconsistent file systems. The preferred location to set the security level is at the end of .Pa /etc/rc after all multi-user startup actions are complete. Index: stable/12/share/examples/jails/jail.xxx.conf =================================================================== --- stable/12/share/examples/jails/jail.xxx.conf (revision 354724) +++ stable/12/share/examples/jails/jail.xxx.conf (revision 354725) @@ -1,35 +1,35 @@ # $FreeBSD$ xxx { host.hostname = "xxx.yyy"; # hostname path = "/vm/xxx"; # root directory exec.clean; exec.system_user = "root"; exec.jail_user = "root"; # # NB: Below 4-lines required # vnet; # netgraph vnet.interface = "ng0_xxx"; # vnet interface(s) exec.prestart += "jng bridge xxx em0"; # bridge interface(s) exec.poststop += "jng shutdown xxx"; # destroy interface(s) # if_bridge #vnet.interface = "e0b_xxx"; # vnet interface(s) #exec.prestart += "jib addm xxx em0"; # bridge interface(s) #exec.poststop += "jib destroy xxx"; # destroy interface(s) # Standard recipe exec.start += "/bin/sh /etc/rc"; - exec.stop = "/bin/sh /etc/rc.shutdown"; + exec.stop = "/bin/sh /etc/rc.shutdown jail"; exec.consolelog = "/var/log/jail_xxx_console.log"; mount.devfs; # mount devfs # Optional (default off) #devfs_ruleset = "11"; # rule to unhide bpf for DHCP #allow.mount; # mount /etc/fstab.xxx #allow.set_hostname = 1; # Allow hostname to change #allow.sysvipc = 1; # Allow SysV Interprocess Comm. } Index: stable/12/share/examples/jails/jib =================================================================== --- stable/12/share/examples/jails/jib (revision 354724) +++ stable/12/share/examples/jails/jib (revision 354725) @@ -1,418 +1,418 @@ #!/bin/sh #- # Copyright (c) 2016 Devin Teske # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # ############################################################ IDENT(1) # # $Title: if_bridge(4) management script for vnet jails $ # ############################################################ INFORMATION # # Use this tool with jail.conf(5) (or rc.conf(5) ``legacy'' configuration) to # manage `vnet' interfaces for jails. Designed to automate the creation of vnet # interface(s) during jail `prestart' and destroy said interface(s) during jail # `poststop'. # # In jail.conf(5) format: # # ### BEGIN EXCERPT ### # # xxx { # host.hostname = "xxx.yyy"; # path = "/vm/xxx"; # # # # # NB: Below 2-lines required # # NB: The number of eNb_xxx interfaces should match the number of # # arguments given to `jib addm xxx' in exec.prestart value. # # # vnet; # vnet.interface = e0b_xxx, e1b_xxx, ...; # # exec.clean; # exec.system_user = "root"; # exec.jail_user = "root"; # # # # # NB: Below 2-lines required # # NB: The number of arguments after `jib addm xxx' should match # # the number of eNb_xxx arguments in vnet.interface value. # # # exec.prestart += "jib addm xxx em0 em1 ..."; # exec.poststop += "jib destroy xxx"; # # # Standard recipe # exec.start += "/bin/sh /etc/rc"; -# exec.stop = "/bin/sh /etc/rc.shutdown"; +# exec.stop = "/bin/sh /etc/rc.shutdown jail"; # exec.consolelog = "/var/log/jail_xxx_console.log"; # mount.devfs; # # # Optional (default off) # #allow.mount; # #allow.set_hostname = 1; # #allow.sysvipc = 1; # #devfs_ruleset = "11"; # rule to unhide bpf for DHCP # } # # ### END EXCERPT ### # # In rc.conf(5) ``legacy'' format (used when /etc/jail.conf does not exist): # # ### BEGIN EXCERPT ### # # jail_enable="YES" # jail_list="xxx" # # # # # Global presets for all jails # # # jail_devfs_enable="YES" # mount devfs # # # # # Global options (default off) # # # #jail_mount_enable="YES" # mount /etc/fstab.{name} # #jail_set_hostname_allow="YES" # Allow hostname to change # #jail_sysvipc_allow="YES" # Allow SysV Interprocess Comm. # # # xxx # jail_xxx_hostname="xxx.shxd.cx" # hostname # jail_xxx_rootdir="/vm/xxx" # root directory # jail_xxx_vnet_interfaces="e0b_xxx e1bxxx ..." # vnet interface(s) # jail_xxx_exec_prestart0="jib addm xxx em0 em1 ..." # bridge interface(s) # jail_xxx_exec_poststop0="jib destroy xxx" # destroy interface(s) # #jail_xxx_mount_enable="YES" # mount /etc/fstab.xxx # #jail_xxx_devfs_ruleset="11" # rule to unhide bpf for DHCP # # ### END EXCERPT ### # # Note that the legacy rc.conf(5) format is converted to # /var/run/jail.{name}.conf by /etc/rc.d/jail if jail.conf(5) is missing. # # ASIDE: dhclient(8) inside a vnet jail... # # To allow dhclient(8) to work inside a vnet jail, make sure the following # appears in /etc/devfs.rules (which should be created if it doesn't exist): # # [devfsrules_jail=11] # add include $devfsrules_hide_all # add include $devfsrules_unhide_basic # add include $devfsrules_unhide_login # add path 'bpf*' unhide # # And set ether devfs.ruleset="11" (jail.conf(5)) or # jail_{name}_devfs_ruleset="11" (rc.conf(5)). # # NB: While this tool can't create every type of desirable topology, it should # handle most setups, minus some which considered exotic or purpose-built. # ############################################################ GLOBALS pgm="${0##*/}" # Program basename # # Global exit status # SUCCESS=0 FAILURE=1 ############################################################ FUNCTIONS usage() { local action usage descr exec >&2 echo "Usage: $pgm action [arguments]" echo "Actions:" for action in \ addm \ show \ show1 \ destroy \ ; do eval usage=\"\$jib_${action}_usage\" [ "$usage" ] || continue eval descr=\"\$jib_${action}_descr\" printf "\t%s\n\t\t%s\n" "$usage" "$descr" done exit $FAILURE } action_usage() { local usage descr action="$1" eval usage=\"\$jib_${action}_usage\" echo "Usage: $pgm $usage" >&2 eval descr=\"\$jib_${action}_descr\" printf "\t%s\n" "$descr" exit $FAILURE } derive_mac() { local OPTIND=1 OPTARG __flag local __mac_num= __make_pair= while getopts 2n: __flag; do case "$__flag" in 2) __make_pair=1 ;; n) __mac_num=${OPTARG%%[^0-9]*} ;; esac done shift $(( $OPTIND - 1 )) if [ ! "$__mac_num" ]; then eval __mac_num=\${_${iface}_num:--1} __mac_num=$(( $__mac_num + 1 )) eval _${iface}_num=\$__mac_num fi local __iface="$1" __name="$2" __var_to_set="$3" __var_to_set_b="$4" local __iface_devid __new_devid __num __new_devid_b # # Calculate MAC address derived from given iface. # # The formula I'm using is ``NP:SS:SS:II:II:II'' where: # + N denotes 4 bits used as a counter to support branching # each parent interface up to 15 times under the same jail # name (see S below). # + P denotes the special nibble whose value, if one of # 2, 6, A, or E (but usually 2) denotes a privately # administered MAC address (while remaining routable). # + S denotes 16 bits, the sum(1) value of the jail name. # + I denotes bits that are inherited from parent interface. # # The S bits are a CRC-16 checksum of NAME, allowing the jail # to change link numbers in ng_bridge(4) without affecting the # MAC address. Meanwhile, if... # + the jail NAME changes (e.g., it was duplicated and given # a new name with no other changes) # + the underlying network interface changes # + the jail is moved to another host # the MAC address will be recalculated to a new, similarly # unique value preventing conflict. # __iface_devid=$( ifconfig $__iface ether | awk '/ether/,$0=$2' ) # ??:??:??:II:II:II __new_devid=${__iface_devid#??:??:??} # => :II:II:II # => :SS:SS:II:II:II __num=$( set -- `echo -n "$__name" | sum` && echo $1 ) __new_devid=$( printf :%02x:%02x \ $(( $__num >> 8 & 255 )) $(( $__num & 255 )) )$__new_devid # => P:SS:SS:II:II:II case "$__iface_devid" in ?2:*) __new_devid=a$__new_devid __new_devid_b=e$__new_devid ;; ?[Ee]:*) __new_devid=2$__new_devid __new_devid_b=6$__new_devid ;; *) __new_devid=2$__new_devid __new_devid_b=e$__new_devid esac # => NP:SS:SS:II:II:II __new_devid=$( printf %x $(( $__mac_num & 15 )) )$__new_devid __new_devid_b=$( printf %x $(( $__mac_num & 15 )) )$__new_devid_b # # Return derivative MAC address(es) # if [ "$__make_pair" ]; then if [ "$__var_to_set" -a "$__var_to_set_b" ]; then eval $__var_to_set=\$__new_devid eval $__var_to_set_b=\$__new_devid_b else echo $__new_devid $__new_devid_b fi else if [ "$__var_to_set" ]; then eval $__var_to_set=\$__new_devid else echo $__new_devid fi fi } mustberoot_to_continue() { if [ "$( id -u )" -ne 0 ]; then echo "Must run as root!" >&2 exit $FAILURE fi } jib_addm_usage="addm [-b BRIDGE_NAME] NAME [!]iface0 [[!]iface1 ...]" jib_addm_descr="Creates e0b_NAME [e1b_NAME ...]" jib_addm() { local OPTIND=1 OPTARG flag bridge=bridge while getopts b: flag; do case "$flag" in b) bridge="${OPTARG:-bridge}" ;; *) action_usage addm # NOTREACHED esac done shift $(( $OPTIND - 1 )) local name="$1" [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -gt 1 ] || action_usage addm # NOTREACHED shift 1 # name mustberoot_to_continue local iface eiface_devid_a eiface_devid_b local new no_derive num quad i=0 for iface in $*; do no_derive= case "$iface" in !*) iface=${iface#!} no_derive=1 ;; esac # Make sure the interface doesn't exist already if ifconfig "e${i}a_$name" > /dev/null 2>&1; then i=$(( $i + 1 )) continue fi # Bring the interface up ifconfig $iface up || return # Make sure the interface has been bridged if ! ifconfig "$iface$bridge" > /dev/null 2>&1; then new=$( ifconfig bridge create ) || return ifconfig $new addm $iface || return ifconfig $new name "$iface$bridge" || return ifconfig "$iface$bridge" up || return fi # Create a new interface to the bridge new=$( ifconfig epair create ) || return ifconfig "$iface$bridge" addm $new || return # Rename the new interface ifconfig $new name "e${i}a_$name" || return ifconfig ${new%a}b name "e${i}b_$name" || return ifconfig "e${i}a_$name" up || return ifconfig "e${i}b_$name" up || return # # Set the MAC address of the new interface using a sensible # algorithm to prevent conflicts on the network. # eiface_devid_a= eiface_devid_b= [ "$no_derive" ] || derive_mac -2 $iface "$name" \ eiface_devid_a eiface_devid_b if [ "$eiface_devid_a" -a "$eiface_devid_b" ]; then ifconfig "e${i}a_$name" ether $eiface_devid_a ifconfig "e${i}b_$name" ether $eiface_devid_b fi > /dev/null 2>&1 i=$(( $i + 1 )) done # for iface } jib_show_usage="show" jib_show_descr="List possible NAME values for \`show NAME'" jib_show1_usage="show NAME" jib_show1_descr="Lists e0b_NAME [e1b_NAME ...]" jib_show2_usage="show [NAME]" jib_show() { local OPTIND=1 OPTARG flag while getopts "" flag; do case "$flag" in *) action_usage show2 # NOTREACHED esac done shift $(( $OPTIND - 1 )) if [ $# -eq 0 ]; then ifconfig | awk ' /^[^:[:space:]]+:/ { iface = $1 sub(/:.*/, "", iface) next } $1 == "groups:" { for (n = split($0, group); n > 1; n--) { if (group[n] != "bridge") continue print iface next } }' | xargs -rn1 ifconfig | awk '$1 == "member:" && sub(/^e[[:digit:]]+a_/, "", $2), $0 = $2' | sort -u return fi ifconfig | awk -v name="$1" ' match($0, /^e[[:digit:]]+a_/) && sub(/:.*/, "") && substr($1, RSTART + RLENGTH) == name ' | sort } jib_destroy_usage="destroy NAME" jib_destroy_descr="Destroy e0b_NAME [e1b_NAME ...]" jib_destroy() { local OPTIND=1 OPTARG flag while getopts "" flag; do case "$flag" in *) action_usage destroy # NOTREACHED esac done shift $(( $OPTIND -1 )) local name="$1" [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || action_usage destroy # NOTREACHED mustberoot_to_continue jib_show "$name" | xargs -rn1 -I eiface ifconfig eiface destroy } ############################################################ MAIN # # Command-line arguments # action="$1" [ "$action" ] || usage # NOTREACHED # # Validate action argument # if [ "$BASH_VERSION" ]; then type="$( type -t "jib_$action" )" || usage # NOTREACHED else type="$( type "jib_$action" 2> /dev/null )" || usage # NOTREACHED fi case "$type" in *function) shift 1 # action eval "jib_$action" \"\$@\" ;; *) usage # NOTREACHED esac ################################################################################ # END ################################################################################ Index: stable/12/share/examples/jails/jng =================================================================== --- stable/12/share/examples/jails/jng (revision 354724) +++ stable/12/share/examples/jails/jng (revision 354725) @@ -1,509 +1,509 @@ #!/bin/sh #- # Copyright (c) 2016 Devin Teske # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # ############################################################ IDENT(1) # # $Title: netgraph(4) management script for vnet jails $ # ############################################################ INFORMATION # # Use this tool with jail.conf(5) (or rc.conf(5) ``legacy'' configuration) to # manage `vnet' interfaces for jails. Designed to automate the creation of vnet # interface(s) during jail `prestart' and destroy said interface(s) during jail # `poststop'. # # In jail.conf(5) format: # # ### BEGIN EXCERPT ### # # xxx { # host.hostname = "xxx.yyy"; # path = "/vm/xxx"; # # # # # NB: Below 2-lines required # # NB: The number of ngN_xxx interfaces should match the number of # # arguments given to `jng bridge xxx' in exec.prestart value. # # # vnet; # vnet.interface = ng0_xxx, ng1_xxx, ...; # # exec.clean; # exec.system_user = "root"; # exec.jail_user = "root"; # # # # # NB: Below 2-lines required # # NB: The number of arguments after `jng bridge xxx' should match # # the number of ngN_xxx arguments in vnet.interface value. # # # exec.prestart += "jng bridge xxx em0 em1 ..."; # exec.poststop += "jng shutdown xxx"; # # # Standard recipe # exec.start += "/bin/sh /etc/rc"; -# exec.stop = "/bin/sh /etc/rc.shutdown"; +# exec.stop = "/bin/sh /etc/rc.shutdown jail"; # exec.consolelog = "/var/log/jail_xxx_console.log"; # mount.devfs; # # # Optional (default off) # #allow.mount; # #allow.set_hostname = 1; # #allow.sysvipc = 1; # #devfs_ruleset = "11"; # rule to unhide bpf for DHCP # } # # ### END EXCERPT ### # # In rc.conf(5) ``legacy'' format (used when /etc/jail.conf does not exist): # # ### BEGIN EXCERPT ### # # jail_enable="YES" # jail_list="xxx" # # # # # Global presets for all jails # # # jail_devfs_enable="YES" # mount devfs # # # # # Global options (default off) # # # #jail_mount_enable="YES" # mount /etc/fstab.{name} # #jail_set_hostname_allow="YES" # Allow hostname to change # #jail_sysvipc_allow="YES" # Allow SysV Interprocess Comm. # # # xxx # jail_xxx_hostname="xxx.shxd.cx" # hostname # jail_xxx_rootdir="/vm/xxx" # root directory # jail_xxx_vnet_interfaces="ng0_xxx ng1xxx ..." # vnet interface(s) # jail_xxx_exec_prestart0="jng bridge xxx em0 em1 ..." # bridge interface(s) # jail_xxx_exec_poststop0="jng shutdown xxx" # destroy interface(s) # #jail_xxx_mount_enable="YES" # mount /etc/fstab.xxx # #jail_xxx_devfs_ruleset="11" # rule to unhide bpf for DHCP # # ### END EXCERPT ### # # Note that the legacy rc.conf(5) format is converted to # /var/run/jail.{name}.conf by /etc/rc.d/jail if jail.conf(5) is missing. # # ASIDE: dhclient(8) inside a vnet jail... # # To allow dhclient(8) to work inside a vnet jail, make sure the following # appears in /etc/devfs.rules (which should be created if it doesn't exist): # # [devfsrules_jail=11] # add include $devfsrules_hide_all # add include $devfsrules_unhide_basic # add include $devfsrules_unhide_login # add path 'bpf*' unhide # # And set ether devfs.ruleset="11" (jail.conf(5)) or # jail_{name}_devfs_ruleset="11" (rc.conf(5)). # # NB: While this tool can't create every type of desirable topology, it should # handle most setups, minus some which considered exotic or purpose-built. # ############################################################ GLOBALS pgm="${0##*/}" # Program basename # # Global exit status # SUCCESS=0 FAILURE=1 ############################################################ FUNCTIONS usage() { local action usage descr exec >&2 echo "Usage: $pgm action [arguments]" echo "Actions:" for action in \ bridge \ graph \ show \ show1 \ shutdown \ stats \ ; do eval usage=\"\$jng_${action}_usage\" [ "$usage" ] || continue eval descr=\"\$jng_${action}_descr\" printf "\t%s\n\t\t%s\n" "$usage" "$descr" done exit $FAILURE } action_usage() { local usage descr action="$1" eval usage=\"\$jng_${action}_usage\" echo "Usage: $pgm $usage" >&2 eval descr=\"\$jng_${action}_descr\" printf "\t%s\n" "$descr" exit $FAILURE } derive_mac() { local OPTIND=1 OPTARG __flag local __mac_num= __make_pair= while getopts 2n: __flag; do case "$__flag" in 2) __make_pair=1 ;; n) __mac_num=${OPTARG%%[^0-9]*} ;; esac done shift $(( $OPTIND - 1 )) if [ ! "$__mac_num" ]; then eval __mac_num=\${_${iface}_num:--1} __mac_num=$(( $__mac_num + 1 )) eval _${iface}_num=\$__mac_num fi local __iface="$1" __name="$2" __var_to_set="$3" __var_to_set_b="$4" local __iface_devid __new_devid __num __new_devid_b # # Calculate MAC address derived from given iface. # # The formula I'm using is ``NP:SS:SS:II:II:II'' where: # + N denotes 4 bits used as a counter to support branching # each parent interface up to 15 times under the same jail # name (see S below). # + P denotes the special nibble whose value, if one of # 2, 6, A, or E (but usually 2) denotes a privately # administered MAC address (while remaining routable). # + S denotes 16 bits, the sum(1) value of the jail name. # + I denotes bits that are inherited from parent interface. # # The S bits are a CRC-16 checksum of NAME, allowing the jail # to change link numbers in ng_bridge(4) without affecting the # MAC address. Meanwhile, if... # + the jail NAME changes (e.g., it was duplicated and given # a new name with no other changes) # + the underlying network interface changes # + the jail is moved to another host # the MAC address will be recalculated to a new, similarly # unique value preventing conflict. # __iface_devid=$( ifconfig $__iface ether | awk '/ether/,$0=$2' ) # ??:??:??:II:II:II __new_devid=${__iface_devid#??:??:??} # => :II:II:II # => :SS:SS:II:II:II __num=$( set -- `echo -n "$__name" | sum` && echo $1 ) __new_devid=$( printf :%02x:%02x \ $(( $__num >> 8 & 255 )) $(( $__num & 255 )) )$__new_devid # => P:SS:SS:II:II:II case "$__iface_devid" in ?2:*) __new_devid=a$__new_devid __new_devid_b=e$__new_devid ;; ?[Ee]:*) __new_devid=2$__new_devid __new_devid_b=6$__new_devid ;; *) __new_devid=2$__new_devid __new_devid_b=e$__new_devid esac # => NP:SS:SS:II:II:II __new_devid=$( printf %x $(( $__mac_num & 15 )) )$__new_devid __new_devid_b=$( printf %x $(( $__mac_num & 15 )) )$__new_devid_b # # Return derivative MAC address(es) # if [ "$__make_pair" ]; then if [ "$__var_to_set" -a "$__var_to_set_b" ]; then eval $__var_to_set=\$__new_devid eval $__var_to_set_b=\$__new_devid_b else echo $__new_devid $__new_devid_b fi else if [ "$__var_to_set" ]; then eval $__var_to_set=\$__new_devid else echo $__new_devid fi fi } mustberoot_to_continue() { if [ "$( id -u )" -ne 0 ]; then echo "Must run as root!" >&2 exit $FAILURE fi } jng_bridge_usage="bridge [-b BRIDGE_NAME] NAME [!|=]iface0 [[!|=]iface1 ...]" jng_bridge_descr="Create ng0_NAME [ng1_NAME ...]" jng_bridge() { local OPTIND=1 OPTARG flag bridge=bridge while getopts b: flag; do case "$flag" in b) bridge="$OPTARG" [ "$bridge" ] || action_usage bridge ;; # NOTREACHED *) action_usage bridge # NOTREACHED esac done shift $(( $OPTIND - 1 )) local name="$1" [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -gt 1 ] || action_usage bridge # NOTREACHED shift 1 # name mustberoot_to_continue local iface parent eiface eiface_devid local new clone_mac no_derive num quad i=0 for iface in $*; do clone_mac= no_derive= case "$iface" in =*) iface=${iface#=} clone_mac=1 ;; !*) iface=${iface#!} no_derive=1 ;; esac # Make sure the interface doesn't exist already eiface=ng${i}_$name if ngctl msg "$eiface:" getifname > /dev/null 2>&1; then i=$(( $i + 1 )) continue fi # Bring the interface up ifconfig $iface up || return # Set promiscuous mode and don't overwrite src addr ngctl msg $iface: setpromisc 1 || return ngctl msg $iface: setautosrc 0 || return # Make sure the interface has been bridged if ! ngctl info ${iface}bridge: > /dev/null 2>&1; then ngctl mkpeer $iface: bridge lower link0 || return ngctl connect $iface: $iface:lower upper link1 || return ngctl name $iface:lower ${iface}bridge || return fi # Optionally create a secondary bridge if [ "$bridge" != "bridge" ] && ! ngctl info "$iface$bridge:" > /dev/null 2>&1 then num=2 while ngctl msg ${iface}bridge: getstats $num \ > /dev/null 2>&1 do num=$(( $num + 1 )) done ngctl mkpeer $iface:lower bridge link$num link1 || return ngctl name ${iface}bridge:link$num "$iface$bridge" || return fi # Create a new interface to the bridge num=2 while ngctl msg "$iface$bridge:" getstats $num > /dev/null 2>&1 do num=$(( $num + 1 )) done ngctl mkpeer "$iface$bridge:" eiface link$num ether || return # Rename the new interface while [ ${#eiface} -gt 15 ]; do # OS limitation eiface=${eiface%?} done new=$( set -- `ngctl show -n "$iface$bridge:link$num"` && echo $2 ) || return ngctl name "$iface$bridge:link$num" $eiface || return ifconfig $new name $eiface || return ifconfig $eiface up || return # # Set the MAC address of the new interface using a sensible # algorithm to prevent conflicts on the network. # eiface_devid= if [ "$clone_mac" ]; then eiface_devid=$( ifconfig $iface ether | awk '/ether/,$0=$2' ) elif [ ! "$no_derive" ]; then derive_mac $iface "$name" eiface_devid fi [ "$eiface_devid" ] && ifconfig $eiface ether $eiface_devid > /dev/null 2>&1 i=$(( $i + 1 )) done # for iface } jng_graph_usage="graph [-f] [-T type] [-o output]" jng_graph_descr="Generate network graph (default output is \`jng.svg')" jng_graph() { local OPTIND=1 OPTARG flag local output=jng.svg output_type= force= while getopts fo:T: flag; do case "$flag" in f) force=1 ;; o) output="$OPTARG" ;; T) output_type="$OPTARG" ;; *) action_usage graph # NOTREACHED esac done shift $(( $OPTIND - 1 )) [ $# -eq 0 -a "$output" ] || action_usage graph # NOTREACHED mustberoot_to_continue if [ -e "$output" -a ! "$force" ]; then echo "$output: Already exists (use \`-f' to overwrite)" >&2 return $FAILURE fi if [ ! "$output_type" ]; then local valid suffix valid=$( dot -Txxx 2>&1 ) for suffix in ${valid##*:}; do [ "$output" != "${output%.$suffix}" ] || continue output_type=$suffix break done fi ngctl dot | dot ${output_type:+-T "$output_type"} -o "$output" } jng_show_usage="show" jng_show_descr="List possible NAME values for \`show NAME'" jng_show1_usage="show NAME" jng_show1_descr="Lists ng0_NAME [ng1_NAME ...]" jng_show2_usage="show [NAME]" jng_show() { local OPTIND=1 OPTARG flag while getopts "" flag; do case "$flag" in *) action_usage show2 # NOTREACHED esac done shift $(( $OPTIND - 1 )) mustberoot_to_continue if [ $# -eq 0 ]; then ngctl ls | awk '$4=="bridge",$0=$2' | xargs -rn1 -Ibridge ngctl show bridge: | awk 'sub(/^ng[[:digit:]]+_/, "", $2), $0 = $2' | sort -u return fi ngctl ls | awk -v name="$1" ' match($2, /^ng[[:digit:]]+_/) && substr($2, RSTART + RLENGTH) == name && $4 == "eiface", $0 = $2 ' | sort } jng_shutdown_usage="shutdown NAME" jng_shutdown_descr="Shutdown ng0_NAME [ng1_NAME ...]" jng_shutdown() { local OPTIND=1 OPTARG flag while getopts "" flag; do case "$flag" in *) action_usage shutdown # NOTREACHED esac done shift $(( $OPTIND -1 )) local name="$1" [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || action_usage shutdown # NOTREACHED mustberoot_to_continue jng_show "$name" | xargs -rn1 -I eiface ngctl shutdown eiface: } jng_stats_usage="stats NAME" jng_stats_descr="Show ng_bridge link statistics for NAME interfaces" jng_stats() { local OPTIND=1 OPTARG flag while getopts "" flag; do case "$flag" in *) action_usage stats # NOTREACHED esac done shift $(( $OPTIND -1 )) local name="$1" [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || action_usage stats # NOTREACHED mustberoot_to_continue for eiface in $( jng_show "$name" ); do echo "$eiface:" ngctl show $eiface: | awk ' $3 == "bridge" && $5 ~ /^link/ { bridge = $2 link = substr($5, 5) system(sprintf("ngctl msg %s: getstats %u", bridge, link)) }' | fmt 2 | awk ' /=/ && fl = index($0, "=") { printf "%20s = %s\n", substr($0, 0, fl-1), substr($0, 0, fl+1) } ' # END-QUOTE done } ############################################################ MAIN # # Command-line arguments # action="$1" [ "$action" ] || usage # NOTREACHED # # Validate action argument # if [ "$BASH_VERSION" ]; then type="$( type -t "jng_$action" )" || usage # NOTREACHED else type="$( type "jng_$action" 2> /dev/null )" || usage # NOTREACHED fi case "$type" in *function) shift 1 # action eval "jng_$action" \"\$@\" ;; *) usage # NOTREACHED esac ################################################################################ # END ################################################################################ Index: stable/12/share/man/man5/rc.conf.5 =================================================================== --- stable/12/share/man/man5/rc.conf.5 (revision 354724) +++ stable/12/share/man/man5/rc.conf.5 (revision 354725) @@ -1,4662 +1,4697 @@ .\" Copyright (c) 1995 .\" Jordan K. Hubbard .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" .Dd March 21, 2019 .Dt RC.CONF 5 .Os .Sh NAME .Nm rc.conf .Nd system configuration information .Sh DESCRIPTION The file .Nm contains descriptive information about the local host name, configuration details for any potential network interfaces and which services should be started up at system initial boot time. In new installations, the .Nm file is generally initialized by the system installation utility. .Pp The purpose of .Nm is not to run commands or perform system startup actions directly. Instead, it is included by the various generic startup scripts in .Pa /etc which conditionalize their internal actions according to the settings found there. .Pp The .Pa /etc/rc.conf file is included from the file .Pa /etc/defaults/rc.conf , which specifies the default settings for all the available options. Options need only be specified in .Pa /etc/rc.conf when the system administrator wishes to override these defaults. The file .Pa /etc/rc.conf.local is used to override settings in .Pa /etc/rc.conf for historical reasons. .Pp The sysrc(8) command provides a scripting interface to modify system config files. .Pp In addition to .Pa /etc/rc.conf.local you can also place smaller configuration files for each .Xr rc 8 script in the .Pa /etc/rc.conf.d directory or .Ao Ar dir Ac Ns Pa /rc.conf.d directories specified in .Va local_startup , which will be included by the .Va load_rc_config function. For jail configurations you could use the file .Pa /etc/rc.conf.d/jail to store jail specific configuration options. If .Va local_startup contains .Pa /usr/local/etc/rc.d and .Pa /opt/conf , .Pa /usr/local/rc.conf.d/jail and .Pa /opt/conf/rc.conf.d/jail will be loaded. If .Ao Ar dir Ac Ns Pa /rc.conf.d/ Ns Ao Ar name Ac is a directory, all of files in the directory will be loaded. Also see the .Va rc_conf_files variable below. .Pp Options are set with .Dq Ar name Ns Li = Ns Ar value assignments that use .Xr sh 1 syntax. The following list provides a name and short description for each variable that can be set in the .Nm file: .Bl -tag -width indent-two .It Va rc_debug .Pq Vt bool If set to .Dq Li YES , enable output of debug messages from rc scripts. This variable can be helpful in diagnosing mistakes when editing or integrating new scripts. Beware that this produces copious output to the terminal and .Xr syslog 3 . .It Va rc_info .Pq Vt bool If set to .Dq Li NO , disable informational messages from the rc scripts. Informational messages are displayed when a condition that is not serious enough to warrant a warning or an error occurs. .It Va rc_startmsgs .Pq Vt bool If set to .Dq Li YES , show .Dq Starting foo: when faststart is used (e.g., at boot time). .It Va early_late_divider .Pq Vt str The name of the script that should be used as the delimiter between the .Dq early and .Dq late stages of the boot process. The early stage should contain all the services needed to get the disks (local or remote) mounted so that the late stage can include scripts contained in the directories listed in the .Va local_startup variable (see below). Thus, the two likely candidates for this value are .Pa mountcritlocal for the typical system, and .Pa mountcritremote if the system needs remote file systems mounted to get access to the .Va local_startup directories; for example when .Pa /usr/local is NFS mounted. For .Pa rc.conf within a .Xr jail 8 .Pa NETWORKING is likely to be an appropriate value. Extreme care should be taken when changing this value, and before changing it one should ensure that there are adequate provisions to recover from a failed boot (such as physical contact with the machine, or reliable remote console access). .It Va always_force_depends .Pq Vt bool Various .Pa rc.d scripts use the force_depend function to check whether required services are already running, and to start them if necessary. By default during boot time this check is bypassed if the required service is enabled in .Pa /etc/rc.conf[.local] . Setting this option will bypass that check at boot time and always test whether or not the service is actually running. Enabling this option is likely to increase your boot time if services are enabled that utilize the force_depend check. .It Ao Ar name Ac Ns Va _chroot .Pq Vt str .Xr chroot 8 to this directory before running the service. .It Ao Ar name Ac Ns Va _user .Pq Vt str Run the service under this user account. .It Ao Ar name Ac Ns Va _group .Pq Vt str Run the chrooted service under this system group. Unlike the _user setting, this setting has no effect if the service is not chrooted. .It Ao Ar name Ac Ns Va _fib .Pq Vt int The .Xr setfib 1 value to run the service under. .It Ao Ar name Ac Ns Va _nice .Pq Vt int The .Xr nice 1 value to run the service under. .It Va apm_enable .Pq Vt bool If set to .Dq Li YES , enable support for Automatic Power Management with the .Xr apm 8 command. .It Va apmd_enable .Pq Vt bool Run .Xr apmd 8 to handle APM event from userland. This also enables support for APM. .It Va apmd_flags .Pq Vt str If .Va apmd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr apmd 8 daemon. .It Va devd_enable .Pq Vt bool Run .Xr devd 8 to handle device added, removed or unknown events from the kernel. .It Va ddb_enable .Pq Vt bool Run .Xr ddb 8 to install .Xr ddb 4 scripts at boot time. .It Va ddb_config .Pq Vt str Configuration file for .Xr ddb 8 . Default .Pa /etc/ddb.conf . .It Va kld_list .Pq Vt str A list of kernel modules to load right after the local disks are mounted. Loading modules at this point in the boot process is much faster than doing it via .Pa /boot/loader.conf for those modules not necessary for mounting local disk. .It Va kldxref_enable .Pq Vt bool Set to .Dq Li NO by default. Set to .Dq Li YES to automatically rebuild .Pa linker.hints files with .Xr kldxref 8 at boot time. .It Va kldxref_clobber .Pq Vt bool Set to .Dq Li NO by default. If .Va kldxref_enable is true, setting to .Dq Li YES will overwrite existing .Pa linker.hints files at boot time. Otherwise, only missing .Pa linker.hints files are generated. .It Va kldxref_module_path .Pq Vt str Empty by default. A semi-colon .Pq Ql \&; delimited list of paths containing .Xr kld 4 modules. If empty, the contents of the .Va kern.module_path .Xr sysctl 8 are used. .It Va powerd_enable .Pq Vt bool If set to .Dq Li YES , enable the system power control facility with the .Xr powerd 8 daemon. .It Va powerd_flags .Pq Vt str If .Va powerd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr powerd 8 daemon. .It Va tmpmfs Controls the creation of a .Pa /tmp memory file system. Always happens if set to .Dq Li YES and never happens if set to .Dq Li NO . If set to anything else, a memory file system is created if .Pa /tmp is not writable. .It Va tmpsize Controls the size of a created .Pa /tmp memory file system. .It Va tmpmfs_flags Extra options passed to the .Xr mdmfs 8 utility when the memory file system for .Pa /tmp is created. The default is .Dq Li "-S" , which inhibits the use of softupdates on .Pa /tmp so that file system space is freed without delay after file truncation or deletion. See .Xr mdmfs 8 for other options you can use in .Va tmpmfs_flags . .It Va varmfs Controls the creation of a .Pa /var memory file system. Always happens if set to .Dq Li YES and never happens if set to .Dq Li NO . If set to anything else, a memory file system is created if .Pa /var is not writable. .It Va varsize Controls the size of a created .Pa /var memory file system. .It Va varmfs_flags Extra options passed to the .Xr mdmfs 8 utility when the memory file system for .Pa /var is created. The default is .Dq Li "-S" , which inhibits the use of softupdates on .Pa /var so that file system space is freed without delay after file truncation or deletion. See .Xr mdmfs 8 for other options you can use in .Va varmfs_flags . .It Va populate_var Controls the automatic population of the .Pa /var file system. Always happens if set to .Dq Li YES and never happens if set to .Dq Li NO . If set to anything else, a memory file system is created if .Pa /var is not writable. Note that this process requires access to certain commands in .Pa /usr before .Pa /usr is mounted on normal systems. .It Va cleanvar_enable .Pq Vt bool Clean the .Pa /var directory. .It Va local_startup .Pq Vt str List of directories to search for startup script files. .It Va script_name_sep .Pq Vt str The field separator to use for breaking down the list of startup script files into individual filenames. The default is a space. It is not necessary to change this unless there are startup scripts with names containing spaces. .It Va hostapd_enable .Pq Vt bool Set to .Dq Li YES to start .Xr hostapd 8 at system boot time. .It Va hostname .Pq Vt str The fully qualified domain name (FQDN) of this host on the network. This should almost certainly be set to something meaningful, even if there is no network connection. If .Xr dhclient 8 is used to set the hostname via DHCP, this variable should be set to an empty string. Within a .Xr jail 8 the hostname is generally already set and this variable may absent. If this value remains unset when the system is done booting your console login will display the default hostname of .Dq Amnesiac . .It Va nisdomainname .Pq Vt str The NIS domain name of this host, or .Dq Li NO if NIS is not used. .It Va dhclient_program .Pq Vt str Path to the DHCP client program .Pa ( /sbin/dhclient , the .Ox DHCP client, is the default). .It Va dhclient_flags .Pq Vt str Additional flags to pass to the DHCP client program. For the .Ox DHCP client, see the .Xr dhclient 8 manpage for a description of the command line options available. .It Va dhclient_flags_ Ns Aq Ar iface Additional flags to pass to the DHCP client program running on .Ar iface only. When specified, this variable overrides .Va dhclient_flags . .It Va background_dhclient .Pq Vt bool Set to .Dq Li YES to start the DHCP client in background. This can cause trouble with applications depending on a working network, but it will provide a faster startup in many cases. .It Va background_dhclient_ Ns Aq Ar iface When specified, this variable overrides the .Va background_dhclient variable for interface .Ar iface only. .It Va synchronous_dhclient .Pq Vt bool Set to .Dq Li YES to start .Xr dhclient 8 synchronously at startup. This behavior can be overridden on a per-interface basis by replacing the .Dq Li DHCP keyword in the .Va ifconfig_ Ns Aq Ar interface variable with .Dq Li SYNCDHCP or .Dq Li NOSYNCDHCP . .It Va defaultroute_delay .Pq Vt int When set to a positive value, wait up to this long after configuring DHCP interfaces at startup to give the interfaces time to receive a lease. .It Va firewall_enable .Pq Vt bool Set to .Dq Li YES to load firewall rules at startup. If the kernel was not built with .Cd "options IPFIREWALL" , the .Pa ipfw.ko kernel module will be loaded. See also .Va ipfilter_enable . .It Va firewall_script .Pq Vt str This variable specifies the full path to the firewall script to run. The default is .Pa /etc/rc.firewall . .It Va firewall_type .Pq Vt str Names the firewall type from the selection in .Pa /etc/rc.firewall , or the file which contains the local firewall ruleset. Valid selections from .Pa /etc/rc.firewall are: .Pp .Bl -tag -width ".Li simple" -compact .It Li open unrestricted IP access .It Li closed all IP services disabled, except via .Dq Li lo0 .It Li client basic protection for a workstation .It Li simple basic protection for a LAN. .El .Pp If a filename is specified, the full path must be given. .It Va firewall_quiet .Pq Vt bool Set to .Dq Li YES to disable the display of firewall rules on the console during boot. .It Va firewall_logging .Pq Vt bool Set to .Dq Li YES to enable firewall event logging. This is equivalent to the .Dv IPFIREWALL_VERBOSE kernel option. .It Va firewall_logif .Pq Vt bool Set to .Dq Li YES to create pseudo interface .Li ipfw0 for logging. For more details, see .Xr ipfw 8 manual page. .It Va firewall_flags .Pq Vt str Flags passed to .Xr ipfw 8 if .Va firewall_type specifies a filename. .It Va firewall_coscripts .Pq Vt str List of executables and/or rc scripts to run after firewall starts/stops. Default is empty. .\" ----- firewall_nat_enable setting -------------------------------- .It Va firewall_nat_enable .Pq Vt bool The .Xr ipfw 8 equivalent of .Va natd_enable . Setting this to .Dq Li YES will automatically load the .Xr ipfw 8 NAT kernel module if .Va firewall_enable is also set to .Dq Li YES . .It Va firewall_nat_interface .Pq Vt str The .Xr ipfw 8 equivalent of .Va natd_interface . This is the name of the public interface or IP address on which kernel NAT should run. .It Va firewall_nat_flags .Pq Vt str Additional configuration parameters for kernel NAT should be placed here. .It Va firewall_nat64_enable .Pq Vt bool Setting this to .Dq Li YES will automatically load the .Xr ipfw 8 NAT64 kernel module if .Va firewall_enable is also set to .Dq Li YES . .It Va firewall_nptv6_enable .Pq Vt bool Setting this to .Dq Li YES will automatically load the .Xr ipfw 8 NPTv6 kernel module if .Va firewall_enable is also set to .Dq Li YES . .It Va firewall_pmod_enable .Pq Vt bool Setting this to .Dq Li YES will automatically load the .Xr ipfw 8 pmod kernel module if .Va firewall_enable is also set to .Dq Li YES . .It Va dummynet_enable .Pq Vt bool Setting this to .Dq Li YES will automatically load the .Xr dummynet 4 module if .Va firewall_enable is also set to .Dq Li YES . .\" ------------------------------------------------------------------- .It Va ipfw_netflow_enable .Pq Vt bool Setting this to .Dq Li YES will enable netflow logging via .Xr ng_netflow 4 .Pp By default a ipfw rule is inserted and all packets are duplicated with the ngtee command and netflow packets are sent to 127.0.0.1 on the netflow port using protocol version 5. .It Va ipfw_netflow_hook .Pq Vt int netflow hook name, must be numerical (default .Pa 9995 ) . .It Va ipfw_netflow_rule .Pq Vt int ipfw rule number (default .Pa 1000 ) . .It Va ipfw_netflow_ip .Pq Vt str Destination server ip for receiving netflow data (default .Pa 127.0.0.1 ) . .It Va ipfw_netflow_port .Pq Vt int Destination server port for receiving netflow data (default .Pa 9995 ) . .It Va ipfw_netflow_version .Pq Vt int Do not set for using version 5 of the netflow protocol, set it to 9 for using version 9. .It Va ipfw_netflow_fib .Pq Vt int Only match packet in FIB .Pa ipfw_netflow_fib (default is undefined meaning all FIBs). .It Va natd_program .Pq Vt str Path to .Xr natd 8 . .It Va natd_enable .Pq Vt bool Set to .Dq Li YES to enable .Xr natd 8 . .Va firewall_enable must also be set to .Dq Li YES , and .Xr divert 4 sockets must be enabled in the kernel. If the kernel was not built with .Cd "options IPDIVERT" , the .Pa ipdivert.ko kernel module will be loaded. .It Va natd_interface .Pq Vt str This is the name of the public interface on which .Xr natd 8 should run. The interface may be given as an interface name or as an IP address. .It Va natd_flags .Pq Vt str Additional .Xr natd 8 flags should be placed here. The .Fl n or .Fl a flag is automatically added with the above .Va natd_interface as an argument. .\" ----- ipfilter_enable setting -------------------------------- .It Va ipfilter_enable .Pq Vt bool Set to .Dq Li NO by default. Setting this to .Dq Li YES enables .Xr ipf 8 packet filtering. .Pp Typical usage will require putting .Bd -literal ipfilter_enable="YES" ipnat_enable="YES" ipmon_enable="YES" ipfs_enable="YES" .Ed .Pp into .Pa /etc/rc.conf and editing .Pa /etc/ipf.rules and .Pa /etc/ipnat.rules appropriately. .Pp Note that .Va ipfilter_enable and .Va ipnat_enable can be enabled independently. .Va ipmon_enable and .Va ipfs_enable both require at least one of .Va ipfilter_enable and .Va ipnat_enable to be enabled. .Pp Having .Bd -literal options IPFILTER options IPFILTER_LOG options IPFILTER_DEFAULT_BLOCK .Ed .Pp in the kernel configuration file is a good idea, too. .\" ----- ipfilter_program setting ------------------------------ .It Va ipfilter_program .Pq Vt str Path to .Xr ipf 8 (default .Pa /sbin/ipf ) . .\" ----- ipfilter_rules setting -------------------------------- .It Va ipfilter_rules .Pq Vt str Set to .Pa /etc/ipf.rules by default. This variable contains the name of the filter rule definition file. The file is expected to be readable for the .Xr ipf 8 command to execute. .\" ----- ipv6_ipfilter_rules setting --------------------------- .It Va ipv6_ipfilter_rules .Pq Vt str Set to .Pa /etc/ipf6.rules by default. This variable contains the IPv6 filter rule definition file. The file is expected to be readable for the .Xr ipf 8 command to execute. .\" ----- ipfilter_flags setting -------------------------------- .It Va ipfilter_flags .Pq Vt str Empty by default. This variable contains flags passed to the .Xr ipf 8 program. .\" ----- ipnat_enable setting ---------------------------------- .It Va ipnat_enable .Pq Vt bool Set to .Dq Li NO by default. Set it to .Dq Li YES to enable .Xr ipnat 8 network address translation. See .Va ipfilter_enable for a detailed discussion. .\" ----- ipnat_program setting --------------------------------- .It Va ipnat_program .Pq Vt str Path to .Xr ipnat 8 (default .Pa /sbin/ipnat ) . .\" ----- ipnat_rules setting ----------------------------------- .It Va ipnat_rules .Pq Vt str Set to .Pa /etc/ipnat.rules by default. This variable contains the name of the file holding the network address translation definition. This file is expected to be readable for the .Xr ipnat 8 command to execute. .\" ----- ipnat_flags setting ----------------------------------- .It Va ipnat_flags .Pq Vt str Empty by default. This variable contains flags passed to the .Xr ipnat 8 program. .\" ----- ipmon_enable setting ---------------------------------- .It Va ipmon_enable .Pq Vt bool Set to .Dq Li NO by default. Set it to .Dq Li YES to enable .Xr ipmon 8 monitoring (logging .Xr ipf 8 and .Xr ipnat 8 events). Setting this variable needs setting .Va ipfilter_enable or .Va ipnat_enable too. See .Va ipfilter_enable for a detailed discussion. .\" ----- ipmon_program setting --------------------------------- .It Va ipmon_program .Pq Vt str Path to .Xr ipmon 8 (default .Pa /sbin/ipmon ) . .\" ----- ipmon_flags setting ----------------------------------- .It Va ipmon_flags .Pq Vt str Set to .Dq Li -Ds by default. This variable contains flags passed to the .Xr ipmon 8 program. Another typical example would be .Dq Fl D Pa /var/log/ipflog to have .Xr ipmon 8 log directly to a file bypassing .Xr syslogd 8 . Make sure to adjust .Pa /etc/newsyslog.conf in such case like this: .Bd -literal /var/log/ipflog 640 10 100 * Z /var/run/ipmon.pid .Ed .\" ----- ipfs_enable setting ----------------------------------- .It Va ipfs_enable .Pq Vt bool Set to .Dq Li NO by default. Set it to .Dq Li YES to enable .Xr ipfs 8 saving the filter and NAT state tables during shutdown and reloading them during startup again. Setting this variable needs setting .Va ipfilter_enable or .Va ipnat_enable to .Dq Li YES too. See .Va ipfilter_enable for a detailed discussion. Note that if .Va kern_securelevel is set to 3, .Va ipfs_enable cannot be used because the raised securelevel will prevent .Xr ipfs 8 from saving the state tables at shutdown time. .\" ----- ipfs_program setting ---------------------------------- .It Va ipfs_program .Pq Vt str Path to .Xr ipfs 8 (default .Pa /sbin/ipfs ) . .\" ----- ipfs_flags setting ------------------------------------ .It Va ipfs_flags .Pq Vt str Empty by default. This variable contains flags passed to the .Xr ipfs 8 program. .\" ----- end of added ipf hook --------------------------------- .It Va pf_enable .Pq Vt bool Set to .Dq Li NO by default. Setting this to .Dq Li YES enables .Xr pf 4 packet filtering. .Pp Typical usage will require putting .Pp .Dl pf_enable="YES" .Pp into .Pa /etc/rc.conf and editing .Pa /etc/pf.conf appropriately. Adding .Pp .Dl "device pf" .Pp builds support for .Xr pf 4 into the kernel, otherwise the kernel module will be loaded. .It Va pf_rules .Pq Vt str Path to .Xr pf 4 ruleset configuration file (default .Pa /etc/pf.conf ) . .It Va pf_program .Pq Vt str Path to .Xr pfctl 8 (default .Pa /sbin/pfctl ) . .It Va pf_flags .Pq Vt str If .Va pf_enable is set to .Dq Li YES , these flags are passed to the .Xr pfctl 8 program when loading the ruleset. .It Va pflog_enable .Pq Vt bool Set to .Dq Li NO by default. Setting this to .Dq Li YES enables .Xr pflogd 8 which logs packets from the .Xr pf 4 packet filter. .It Va pflog_logfile .Pq Vt str If .Va pflog_enable is set to .Dq Li YES this controls where .Xr pflogd 8 stores the logfile (default .Pa /var/log/pflog ) . Check .Pa /etc/newsyslog.conf to adjust logfile rotation for this. .It Va pflog_program .Pq Vt str Path to .Xr pflogd 8 (default .Pa /sbin/pflogd ) . .It Va pflog_flags .Pq Vt str Empty by default. This variable contains additional flags passed to the .Xr pflogd 8 program. .It Va pflog_instances .Pq Vt str If logging to more than one .Xr pflog 4 interface is desired, .Va pflog_instances is set to the list of .Xr pflogd 8 instances that should be started at system boot time. If .Va pflog_instances is set, for each whitespace-separated .Ar element in the list, .Ao Ar element Ac Ns Va _dev and .Ao Ar element Ac Ns Va _logfile elements are assumed to exist. .Ao Ar element Ac Ns Va _dev must contain the .Xr pflog 4 interface to be watched by the named .Xr pflogd 8 instance. .Ao Ar element Ac Ns Va _logfile must contain the name of the logfile that will be used by the .Xr pflogd 8 instance. .It Va ftpproxy_enable .Pq Vt bool Set to .Dq Li NO by default. Setting this to .Dq Li YES enables .Xr ftp-proxy 8 which supports the .Xr pf 4 packet filter in translating ftp connections. .It Va ftpproxy_flags .Pq Vt str Empty by default. This variable contains additional flags passed to the .Xr ftp-proxy 8 program. .It Va ftpproxy_instances .Pq Vt str Empty by default. If multiple instances of .Xr ftp-proxy 8 are desired at boot time, .Va ftpproxy_instances should contain a whitespace-separated list of instance names. For each .Ar element in the list, a variable named .Ao Ar element Ac Ns Va _flags should be defined, containing the command-line flags to be passed to the .Xr ftp-proxy 8 instance. .It Va pfsync_enable .Pq Vt bool Set to .Dq Li NO by default. Setting this to .Dq Li YES enables exposing .Xr pf 4 state changes to other hosts over the network by means of .Xr pfsync 4 . The .Va pfsync_syncdev variable must also be set then. .It Va pfsync_syncdev .Pq Vt str Empty by default. This variable specifies the name of the network interface .Xr pfsync 4 should operate through. It must be set accordingly if .Va pfsync_enable is set to .Dq Li YES . .It Va pfsync_syncpeer .Pq Vt str Empty by default. This variable is optional. By default, state change messages are sent out on the synchronisation interface using IP multicast packets. The protocol is IP protocol 240, PFSYNC, and the multicast group used is 224.0.0.240. When a peer address is specified using the .Va pfsync_syncpeer option, the peer address is used as a destination for the pfsync traffic, and the traffic can then be protected using .Xr ipsec 4 . See the .Xr pfsync 4 manpage for more details about using .Xr ipsec 4 with .Xr pfsync 4 interfaces. .It Va pfsync_ifconfig .Pq Vt str Empty by default. This variable can contain additional options to be passed to the .Xr ifconfig 8 command used to set up .Xr pfsync 4 . .It Va tcp_extensions .Pq Vt bool Set to .Dq Li YES by default. Setting this to .Dq Li NO disables certain TCP options as described by .Rs .%T "RFC 1323" .Re Setting this to .Dq Li NO might help remedy such problems with connections as randomly hanging or other weird behavior. Some network devices are known to be broken with respect to these options. .It Va log_in_vain .Pq Vt int Set to 0 by default. The .Xr sysctl 8 variables, .Va net.inet.tcp.log_in_vain and .Va net.inet.udp.log_in_vain , as described in .Xr tcp 4 and .Xr udp 4 , are set to the given value. .It Va tcp_keepalive .Pq Vt bool Set to .Dq Li YES by default. Setting to .Dq Li NO will disable probing idle TCP connections to verify that the peer is still up and reachable. .It Va tcp_drop_synfin .Pq Vt bool Set to .Dq Li NO by default. Setting to .Dq Li YES will cause the kernel to ignore TCP frames that have both the SYN and FIN flags set. This prevents OS fingerprinting, but may break some legitimate applications. .It Va icmp_drop_redirect .Pq Vt bool Set to .Dq Li NO by default. Setting to .Dq Li YES will cause the kernel to ignore ICMP REDIRECT packets. Refer to .Xr icmp 4 for more information. .It Va icmp_log_redirect .Pq Vt bool Set to .Dq Li NO by default. Setting to .Dq Li YES will cause the kernel to log ICMP REDIRECT packets. Note that the log messages are not rate-limited, so this option should only be used for troubleshooting networks. Refer to .Xr icmp 4 for more information. .It Va icmp_bmcastecho .Pq Vt bool Set to .Dq Li YES to respond to broadcast or multicast ICMP ping packets. Refer to .Xr icmp 4 for more information. .It Va ip_portrange_first .Pq Vt int If not set to .Dq Li NO , this is the first port in the default portrange. Refer to .Xr ip 4 for more information. .It Va ip_portrange_last .Pq Vt int If not set to .Dq Li NO , this is the last port in the default portrange. Refer to .Xr ip 4 for more information. .It Va network_interfaces .Pq Vt str Set to the list of network interfaces to configure on this host or .Dq Li AUTO (the default) for all current interfaces. Setting the .Va network_interfaces variable to anything other than the default is deprecated. Interfaces that the administrator wishes to store configuration for, but not start at boot should be configured with the .Dq Li NOAUTO keyword in their .Va ifconfig_ Ns Aq Ar interface variables as described below. .Pp An .Va ifconfig_ Ns Aq Ar interface variable is also assumed to exist for each value of .Ar interface . When an interface name contains any of the characters .Dq Li .-/+ they are translated to .Dq Li _ before lookup. The variable can contain arguments to .Xr ifconfig 8 , as well as special case-insensitive keywords described below. Such keywords are removed before passing the value to .Xr ifconfig 8 while the order of the other arguments is preserved. .Pp It is possible to add IP alias entries using .Xr ifconfig 8 syntax with the address family keyword such as .Li inet . Assuming that the interface in question was .Li ed0 , it might look something like this: .Bd -literal ifconfig_ed0_alias0="inet 127.0.0.253 netmask 0xffffffff" ifconfig_ed0_alias1="inet 127.0.0.254 netmask 0xffffffff" .Ed .Pp It also possible to configure multiple IP addresses in Classless Inter-Domain Routing .Pq CIDR address notation, whose each address component can be a range like .Li inet 192.0.2.5-23/24 or .Li inet6 2001:db8:1-f::1/64 . This notation allows address and prefix length part only, not the other address modifiers. Note that the maximum number of the generated addresses from a range specification is limited to an integer value specified in .Va netif_ipexpand_max in .Nm because a small typo can unexpectedly generate a large number of addresses. The default value is .Li 2048 . It can be increased by adding the following line into .Nm : .Bd -literal netif_ipexpand_max="4096" .Ed .Pp In the case of .Li 192.0.2.5-23/24 , the address 192.0.2.5 will be configured with the netmask /24 and the addresses 192.0.2.6 to 192.0.2.23 with the non-conflicting netmask /32 as explained in the .Xr ifconfig 8 alias section. Note that this special netmask handling is only for .Li inet , not for the other address families such as .Li inet6 . .Pp With the interface in question being .Li ed0 , an example could look like: .Bd -literal ifconfig_ed0_alias2="inet 192.0.2.129/27" ifconfig_ed0_alias3="inet 192.0.2.1-5/28" .Ed .Pp and so on. .Pp Note that .Va ipv4_addrs_ Ns Aq Ar interface variable was supported for IPv4 CIDR address notation. It is now deprecated because the functionality was integrated into .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _alias Ns Aq Ar n though .Va ipv4_addrs_ Ns Aq Ar interface is still supported for backward compatibility. .Pp For each .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _alias Ns Aq Ar n entry with an address family keyword, its contents are passed to .Xr ifconfig 8 . Execution stops at the first unsuccessful access, so if something like this is present: .Bd -literal ifconfig_ed0_alias0="inet 127.0.0.251 netmask 0xffffffff" ifconfig_ed0_alias1="inet 127.0.0.252 netmask 0xffffffff" ifconfig_ed0_alias2="inet 127.0.0.253 netmask 0xffffffff" ifconfig_ed0_alias4="inet 127.0.0.254 netmask 0xffffffff" .Ed .Pp Then note that alias4 would .Em not be added since the search would stop with the missing .Dq Li alias3 entry. Because of this difficult to manage behavior, there is .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _aliases variable, which has the same functionality as .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _alias Ns Aq Ar n and can have all of entries in a variable like the following: .Bd -literal ifconfig_ed0_aliases="\\ inet 127.0.0.251 netmask 0xffffffff \\ inet 127.0.0.252 netmask 0xffffffff \\ inet 127.0.0.253 netmask 0xffffffff \\ inet 127.0.0.254 netmask 0xffffffff" .Ed .Pp It also supports CIDR notation. .Pp If the .Pa /etc/start_if. Ns Aq Ar interface file is present, it is read and executed by the .Xr sh 1 interpreter before configuring the interface as specified in the .Va ifconfig_ Ns Aq Ar interface and .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _alias Ns Aq Ar n variables. .Pp If a .Va vlans_ Ns Aq Ar interface variable is set, a .Xr vlan 4 interface will be created for each item in the list with the .Ar vlandev argument set to .Ar interface . If a vlan interface's name is a number, then that number is used as the vlan tag and the new vlan interface is named .Ar interface . Ns Ar tag . Otherwise, the vlan tag must be specified via a .Va vlan parameter in the .Va create_args_ Ns Aq Ar interface variable. .Pp To create a vlan device named .Li em0.101 on .Li em0 with the vlan tag 101 and the optional the IPv4 address 192.0.2.1/24: .Bd -literal vlans_em0="101" ifconfig_em0_101="inet 192.0.2.1/24" .Ed .Pp To create a vlan device named .Li myvlan on .Li em0 with the vlan tag 102: .Bd -literal vlans_em0="myvlan" create_args_myvlan="vlan 102" .Ed .Pp If a .Va wlans_ Ns Aq Ar interface variable is set, an .Xr wlan 4 interface will be created for each item in the list with the .Ar wlandev argument set to .Ar interface . Further wlan cloning arguments may be passed to the .Xr ifconfig 8 .Cm create command by setting the .Va create_args_ Ns Aq Ar interface variable. One or more .Xr wlan 4 devices must be created for each wireless devices as of .Fx 8.0 . Debugging flags for .Xr wlan 4 devices as set by .Xr wlandebug 8 may be specified with an .Va wlandebug_ Ns Aq Ar interface variable. The contents of this variable will be passed directly to .Xr wlandebug 8 . .Pp If the .Va ifconfig_ Ns Aq Ar interface contains the keyword .Dq Li NOAUTO then the interface will not be configured at boot or by .Pa /etc/pccard_ether when .Va network_interfaces is set to .Dq Li AUTO . .Pp It is possible to bring up an interface with DHCP by adding .Dq Li DHCP to the .Va ifconfig_ Ns Aq Ar interface variable. For instance, to initialize the .Li ed0 device via DHCP, it is possible to use something like: .Bd -literal ifconfig_ed0="DHCP" .Ed .Pp If you want to configure your wireless interface with .Xr wpa_supplicant 8 for use with WPA, EAP/LEAP or WEP, you need to add .Dq Li WPA to the .Va ifconfig_ Ns Aq Ar interface variable. .Pp On the other hand, if you want to configure your wireless interface with .Xr hostapd 8 , you need to add .Dq Li HOSTAP to the .Va ifconfig_ Ns Aq Ar interface variable. .Xr hostapd 8 will use the settings from .Pa /etc/hostapd- Ns Ao Ar interface Ac Ns .conf .Pp Finally, you can add .Xr ifconfig 8 options in this variable, in addition to the .Pa /etc/start_if. Ns Aq Ar interface file. For instance, to configure an .Xr ath 4 wireless device in station mode with an address obtained via DHCP, using WPA authentication and 802.11b mode, it is possible to use something like: .Bd -literal wlans_ath0="wlan0" ifconfig_wlan0="DHCP WPA mode 11b" .Ed .Pp In addition to the .Va ifconfig_ Ns Aq Ar interface form, a fallback variable .Va ifconfig_DEFAULT may be configured. It will be used for all interfaces with no .Va ifconfig_ Ns Aq Ar interface variable. This is intended to replace the no longer supported .Va pccard_ifconfig variable. .Pp It is also possible to rename an interface by doing: .Bd -literal ifconfig_ed0_name="net0" ifconfig_net0="inet 192.0.2.1 netmask 0xffffff00" .Ed .It Va ipv6_enable .Pq Vt bool This variable is deprecated. Use .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 and .Va ipv6_activate_all_interfaces if necessary. .Pp If the variable is .Dq Li YES , .Dq Li inet6 accept_rtadv is added to all of .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 and the .Va ipv6_activate_all_interfaces is defined as .Dq Li YES . .It Va ipv6_prefer .Pq Vt bool This variable is deprecated. Use .Va ip6addrctl_policy instead. .Pp If the variable is .Dq Li YES , the default address selection policy table set by .Xr ip6addrctl 8 will be IPv6-preferred. .Pp If the variable is .Dq Li NO , the default address selection policy table set by .Xr ip6addrctl 8 will be IPv4-preferred. .It Va ipv6_activate_all_interfaces .Pq Vt bool This controls initial configuration on IPv6-capable interfaces with no corresponding .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 variable. Note that it is not always necessary to set this variable to .Dq YES to use IPv6 functionality on .Fx . In most cases, just configuring .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 variables works. .Pp If the variable is .Dq Li NO , all interfaces which do not have a corresponding .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 variable will be marked as .Dq Li IFDISABLED at creation. This means that all of IPv6 functionality on that interface is completely disabled to enforce a security policy. If the variable is set to .Dq YES , the flag will be cleared on all of the interfaces. .Pp In most cases, just defining an .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 for an IPv6-capable interface should be sufficient. However, if an interface is added dynamically .Pq by some tunneling protocols such as PPP, for example , it is often difficult to define the variable in advance. In such a case, configuring the .Dq Li IFDISABLED flag can be disabled by setting this variable to .Dq YES . .Pp For more details of the .Dq Li IFDISABLED flag and keywords .Dq Li inet6 ifdisabled , see .Xr ifconfig 8 . .Pp Default is .Dq Li NO . .It Va ipv6_privacy .Pq Vt bool If the variable is .Dq Li YES privacy addresses will be generated for each IPv6 interface as described in RFC 4941. .It Va ipv6_network_interfaces .Pq Vt str This is the IPv6 equivalent of .Va network_interfaces . Normally manual configuration of this variable is not needed. .It Va ipv6_cpe_wanif .Pq Vt str If the variable is set to an interface name, the .Xr ifconfig 8 options .Dq inet6 -no_radr accept_rtadv will be added to the specified interface automatically before evaluating .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 , and two .Xr sysctl 8 variables .Va net.inet6.ip6.rfc6204w3 and .Va net.inet6.ip6.no_radr will be set to 1. .Pp This means the specified interface will accept ICMPv6 Router Advertisement messages on that link and add the discovered routers into the Default Router List. While the other interfaces can still accept RA messages if the .Dq inet6 accept_rtadv option is specified, adding routes into the Default Router List will be disabled by .Dq inet6 no_radr option by default. See .Xr ifconfig 8 for more details. .Pp Note that ICMPv6 Router Advertisement messages will be accepted even when .Va net.inet6.ip6.forwarding is 1 .Pq packet forwarding is enabled when .Va net.inet6.ip6.rfc6204w3 is set to 1. .Pp Default is .Dq Li NO . .It Va ifconfig_ Ns Ao Ar interface Ac Ns _descr .Pq Vt str This assigns arbitrary description to an interface. The .Xr sysctl 8 variable .Va net.ifdescr_maxlen limits its length. This static setting may be overridden by commands started with dynamic interface configuration utilities like .Xr dhclient 8 hooks. The description can be seen with .Xr ifconfig 8 command and it may be exported with .Xr bsnmpd 1 daemon using its MIB-2 module. .It Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 .Pq Vt str IPv6 functionality on an interface should be configured by .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 , instead of setting ifconfig parameters in .Va ifconfig_ Ns Aq Ar interface . If this variable is empty, all of IPv6 configurations on the specified interface by other variables such as .Va ipv6_prefix_ Ns Ao Ar interface Ac will be ignored. .Pp Aliases should be set by .Va ifconfig_ Ns Ao Ar interface Ac Ns Va _alias Ns Aq Ar n with .Dq Li inet6 keyword. For example: .Bd -literal ifconfig_ed0_ipv6="inet6 2001:db8:1::1 prefixlen 64" ifconfig_ed0_alias0="inet6 2001:db8:2::1 prefixlen 64" .Ed .Pp Interfaces that have an .Dq Li inet6 accept_rtadv keyword in .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 setting will be automatically configured by SLAAC .Pq StateLess Address AutoConfiguration described in .Rs .%T "RFC 4862" .Re .Pp Note that a link-local address will be automatically configured in addition to the configured global-scope addresses because the IPv6 specifications require it on each link. The address is calculated from the MAC address by using an algorithm defined in .Rs .%T "RFC 4862" .%O "Section 5.3" .Re .Pp If only a link-local address is needed on the interface, the following configuration can be used: .Bd -literal ifconfig_ed0_ipv6="inet6 auto_linklocal" .Ed .Pp A link-local address can also be configured manually. This is useful for the default router address of an IPv6 router so that it does not change when the network interface card is replaced. For example: .Bd -literal ifconfig_ed0_ipv6="inet6 fe80::1 prefixlen 64" .Ed .It Va ipv6_prefix_ Ns Aq Ar interface .Pq Vt str If one or more prefixes are defined in .Va ipv6_prefix_ Ns Aq Ar interface addresses based on each prefix and the EUI-64 interface index will be configured on that interface. Note that this variable will be ignored when .Va ifconfig_ Ns Ao Ar interface Ac Ns _ipv6 is empty. .Pp For example, the following configuration .Bd -literal ipv6_prefix_ed0="2001:db8:1:0 2001:db8:2:0" .Ed .Pp is equivalent to the following: .Bd -literal ifconfig_ed0_alias0="inet6 2001:db8:1:: eui64 prefixlen 64" ifconfig_ed0_alias1="inet6 2001:db8:1:: prefixlen 64 anycast" ifconfig_ed0_alias2="inet6 2001:db8:2:: eui64 prefixlen 64" ifconfig_ed0_alias3="inet6 2001:db8:2:: prefixlen 64 anycast" .Ed .Pp These Subnet-Router anycast addresses will be added only when .Va ipv6_gateway_enable is YES. .It Va ipv6_default_interface .Pq Vt str If not set to .Dq Li NO , this is the default output interface for scoped addresses. This works only with ipv6_gateway_enable="NO". .It Va ip6addrctl_enable .Pq Vt bool This variable is to enable configuring default address selection policy table .Pq RFC 3484 . The table can be specified in another variable .Va ip6addrctl_policy . For .Va ip6addrctl_policy the following keywords can be specified: .Dq Li ipv4_prefer , .Dq Li ipv6_prefer , or .Dq Li AUTO . .Pp If .Dq Li ipv4_prefer or .Dq Li ipv6_prefer is specified, .Xr ip6addrctl 8 installs a pre-defined policy table described in Section 2.1 .Pq IPv6-preferred or 10.3 .Pq IPv4-preferred of RFC 3484. .Pp If .Dq Li AUTO is specified, it attempts to read a file .Pa /etc/ip6addrctl.conf first. If this file is found, .Xr ip6addrctl 8 reads and installs it. If not found, a policy is automatically set according to .Va ipv6_activate_all_interfaces variable; if the variable is set to .Dq Li YES the IPv6-preferred one is used. Otherwise IPv4-preferred. .Pp The default value of .Va ip6addrctl_enable and .Va ip6addrctl_policy are .Dq Li YES and .Dq Li AUTO , respectively. .It Va cloned_interfaces .Pq Vt str Set to the list of clonable network interfaces to create on this host. Further cloning arguments may be passed to the .Xr ifconfig 8 .Cm create command for each interface by setting the .Va create_args_ Ns Aq Ar interface variable. If an interface name is specified with .Dq :sticky keyword, the interface will not be destroyed even when .Pa rc.d/netif script is invoked with .Dq stop argument. This is useful when reconfiguring the interface without destroying it. Entries in .Va cloned_interfaces are automatically appended to .Va network_interfaces for configuration. .It Va cloned_interfaces_sticky .Pq Vt bool This variable is to globally enable functionality of .Dq :sticky keyword in .Va cloned_interfaces for all interfaces. The default value is .Dq NO . Even if this variable is specified to .Dq YES , .Dq :nosticky keyword can be used to override it on per interface basis. .It Va gif_interfaces .Pq Vt str This variable is deprecated in favor of .Va cloned_interfaces . Set to the list of .Xr gif 4 tunnel interfaces to configure on this host. For each .Xr gif tunnel interface, set a variable named .Va ifconfig_ Ns Aq Ar interface with the parameters for the .Xr ifconfig 8 command to configure the link level for .Ar interface with the .Cm tunnel option. The value of this variable is used to configure the link layer of the tunnel using the .Cm tunnel option to .Xr ifconfig . For example, configure two .Xr gif interfaces with: .Bd -literal -offset indent gif_interfaces="gif0 gif1" ifconfig_gif0="tunnel src_addr0 dst_addr0" ifconfig_gif1="tunnel src_addr1 dst_addr1" .Ed .Pp Additionally, this option ensures that each listed interface is created via the .Cm create option to .Xr ifconfig . This example also works with .Va cloned_interfaces instead of .Va gif_interfaces . .It Va sppp_interfaces .Pq Vt str Set to the list of .Xr sppp 4 interfaces to configure on this host. A .Va spppconfig_ Ns Aq Ar interface variable is assumed to exist for each value of .Ar interface . Each interface should also be configured by a general .Va ifconfig_ Ns Aq Ar interface setting. Refer to .Xr spppcontrol 8 for more information about available options. .It Va ppp_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ppp 8 daemon. .It Va ppp_profile .Pq Vt str The name of the profile to use from .Pa /etc/ppp/ppp.conf . Also used for per-profile overrides of .Va ppp_mode and .Va ppp_nat , and .Va ppp_ Ns Ao Ar profile Ac Ns _unit . When the profile name contains any of the characters .Dq Li .-/+ they are translated to .Dq Li _ for the proposes of the override variable names. .It Va ppp_mode .Pq Vt str Mode in which to run the .Xr ppp 8 daemon. .It Va ppp_ Ns Ao Ar profile Ac Ns _mode .Pq Vt str Overrides the global .Va ppp_mode for .Ar profile . Accepted modes are .Dq Li auto , .Dq Li ddial , .Dq Li direct and .Dq Li dedicated . See the manual for a full description. .It Va ppp_nat .Pq Vt bool If set to .Dq Li YES , enables network address translation. Used in conjunction with .Va gateway_enable allows hosts on private network addresses access to the Internet using this host as a network address translating router. .It Va ppp_ Ns Ao Ar profile Ac Ns _nat .Pq Vt str Overrides the global .Va ppp_nat for .Ar profile . .It Va ppp_ Ns Ao Ar profile Ac Ns _unit .Pq Vt int Set the unit number to be used for this profile. See the manual description of .Fl unit Ns Ar N for details. .It Va ppp_user .Pq Vt str The name of the user under which .Xr ppp 8 should be started. By default, .Xr ppp 8 is started as .Dq Li root . .It Va rc_conf_files .Pq Vt str This option is used to specify a list of files that will override the settings in .Pa /etc/defaults/rc.conf . The files will be read in the order in which they are specified and should include the full path to the file. By default, the files specified are .Pa /etc/rc.conf and .Pa /etc/rc.conf.local .It Va zfs_enable .Pq Vt bool If set to .Dq Li YES , .Pa /etc/rc.d/zfs will attempt to automatically mount ZFS file systems and initialize ZFS volumes (ZVOLs). .It Va gptboot_enable .Pq Vt bool If set to .Dq Li YES , .Pa /etc/rc.d/gptboot will log if the system successfully (or not) booted from a GPT partition, which had the .Ar bootonce attribute set using .Xr gpart 8 utility. .It Va gbde_autoattach_all .Pq Vt bool If set to .Dq Li YES , .Pa /etc/rc.d/gbde will attempt to automatically initialize your .bde devices in .Pa /etc/fstab . .It Va gbde_devices .Pq Vt str List the devices that the script should try to attach, or .Dq Li AUTO . .It Va gbde_lockdir .Pq Vt str The directory where the .Xr gbde 4 lockfiles are located. The default lockfile directory is .Pa /etc . .Pp The lockfile for each individual .Xr gbde 4 device can be overridden by setting the variable .Va gbde_lock_ Ns Aq Ar device , where .Ar device is the encrypted device without the .Dq Pa /dev/ and .Dq Pa .bde parts. .It Va gbde_attach_attempts .Pq Vt int Number of times to attempt attaching to a .Xr gbde 4 device, i.e., how many times the user is asked for the pass-phrase. Default is 3. .It Va geli_devices .Pq Vt str List of devices to automatically attach on boot. Note that .eli devices from .Pa /etc/fstab are automatically appended to this list. .It Va geli_groups .Pq Vt str List of groups containing devices to automatically attach on boot with the same keyfiles and passphrase. This must be accompanied with a corresponding .Va geli_ Ns Ao Ar group Ac Ns Va _devices variable. .It Va geli_tries .Pq Vt int Number of times user is asked for the pass-phrase. If empty, it will be taken from .Va kern.geom.eli.tries sysctl variable. .It Va geli_default_flags .Pq Vt str Default flags to use by .Xr geli 8 when configuring disk encryption. Flags can be configured for every device separately by defining the .Va geli_ Ns Ao Ar device Ac Ns Va _flags variable, and for every group separately by defining the .Va geli_ Ns Ao Ar group Ac Ns Va _flags variable. .It Va geli_autodetach .Pq Vt str Specifies if GELI devices should be marked for detach on last close after file systems are mounted. Default is .Dq Li YES . This can be changed for every device separately by defining the .Va geli_ Ns Ao Ar device Ac Ns Va _autodetach variable. .It Va root_rw_mount .Pq Vt bool Set to .Dq Li YES by default. After the file systems are checked at boot time, the root file system is remounted as read-write if this is set to .Dq Li YES . Diskless systems that mount their root file system from a read-only remote NFS share should set this to .Dq Li NO in their .Pa rc.conf . .It Va fsck_y_enable .Pq Vt bool If set to .Dq Li YES , .Xr fsck 8 will be run with the .Fl y flag if the initial preen of the file systems fails. .It Va background_fsck .Pq Vt bool If set to .Dq Li NO , the system will not attempt to run .Xr fsck 8 in the background where possible. .It Va background_fsck_delay .Pq Vt int The amount of time in seconds to sleep before starting a background .Xr fsck 8 . It defaults to sixty seconds to allow large applications such as the X server to start before disk I/O bandwidth is monopolized by .Xr fsck 8 . If set to a negative number, the background file system check will be delayed indefinitely to allow the administrator to run it at a more convenient time. For example it may be run from .Xr cron 8 by adding a line like .Pp .Dl "0 4 * * * root /etc/rc.d/bgfsck forcestart" .Pp to .Pa /etc/crontab . .It Va netfs_types .Pq Vt str List of file system types that are network-based. This list should generally not be modified by end users. Use .Va extra_netfs_types instead. .It Va extra_netfs_types .Pq Vt str If set to something other than .Dq Li NO (the default), this variable extends the list of file system types for which automatic mounting at startup by .Xr rc 8 should be delayed until the network is initialized. It should contain a whitespace-separated list of network file system descriptor pairs, each consisting of a file system type as passed to .Xr mount 8 and a human-readable, one-word description, joined with a colon .Pq Ql \&: . Extending the default list in this way is only necessary when third party file system types are used. .It Va syslogd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr syslogd 8 daemon. .It Va syslogd_program .Pq Vt str Path to .Xr syslogd 8 (default .Pa /usr/sbin/syslogd ) . .It Va syslogd_flags .Pq Vt str If .Va syslogd_enable is set to .Dq Li YES , these are the flags to pass to .Xr syslogd 8 . .It Va inetd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr inetd 8 daemon. .It Va inetd_program .Pq Vt str Path to .Xr inetd 8 (default .Pa /usr/sbin/inetd ) . .It Va inetd_flags .Pq Vt str If .Va inetd_enable is set to .Dq Li YES , these are the flags to pass to .Xr inetd 8 . .It Va hastd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr hastd 8 daemon. .It Va hastd_program .Pq Vt str Path to .Xr hastd 8 (default .Pa /sbin/hastd ) . .It Va hastd_flags .Pq Vt str If .Va hastd_enable is set to .Dq Li YES , these are the flags to pass to .Xr hastd 8 . .It Va local_unbound_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr unbound 8 daemon as a local caching resolver. .It Va kdc_enable .Pq Vt bool Set to .Dq Li YES to start a Kerberos 5 authentication server at boot time. .It Va kdc_program .Pq Vt str If .Va kdc_enable is set to .Dq Li YES this is the path to Kerberos 5 Authentication Server. .It Va kdc_flags .Pq Vt str Empty by default. This variable contains additional flags to be passed to the Kerberos 5 authentication server. .It Va kadmind_enable .Pq Vt bool Set to .Dq Li YES to start .Xr kadmind 8 , the Kerberos 5 Administration Daemon; set to .Dq Li NO on a slave server. .It Va kadmind_program .Pq Vt str If .Va kadmind_enable is set to .Dq Li YES this is the path to Kerberos 5 Administration Daemon. .It Va kpasswdd_enable .Pq Vt bool Set to .Dq Li YES to start .Xr kpasswdd 8 , the Kerberos 5 Password-Changing Daemon; set to .Dq Li NO on a slave server. .It Va kpasswdd_program .Pq Vt str If .Va kpasswdd_enable is set to .Dq Li YES this is the path to Kerberos 5 Password-Changing Daemon. .It Va kfd_enable .Pq Vt bool Set to .Dq Li YES to start .Xr kfd 8 , the Kerberos 5 ticket forwarding daemon, at the boot time. .It Va kfd_program .Pq Vt str Path to .Xr kfd 8 (default .Pa /usr/libexec/kfd ) . .It Va rwhod_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rwhod 8 daemon at boot time. .It Va rwhod_flags .Pq Vt str If .Va rwhod_enable is set to .Dq Li YES , these are the flags to pass to it. .It Va amd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr amd 8 daemon at boot time. .It Va amd_flags .Pq Vt str If .Va amd_enable is set to .Dq Li YES , these are the flags to pass to it. See the .Xr amd 8 manpage for more information. .It Va amd_map_program .Pq Vt str If set, the specified program is run to get the list of .Xr amd 8 maps. For example, if the .Xr amd 8 maps are stored in NIS, one can set this to run .Xr ypcat 1 to get a list of .Xr amd 8 maps from the .Pa amd.master NIS map. .It Va update_motd .Pq Vt bool If set to .Dq Li YES , .Pa /etc/motd will be updated at boot time to reflect the kernel release being run. If set to .Dq Li NO , .Pa /etc/motd will not be updated. .It Va nfs_client_enable .Pq Vt bool If set to .Dq Li YES , run the NFS client daemons at boot time. .It Va nfs_access_cache .Pq Vt int If .Va nfs_client_enable is set to .Dq Li YES , this can be set to .Dq Li 0 to disable NFS ACCESS RPC caching, or to the number of seconds for which NFS ACCESS results should be cached. A value of 2-10 seconds will substantially reduce network traffic for many NFS operations. .It Va nfs_server_enable .Pq Vt bool If set to .Dq Li YES , run the NFS server daemons at boot time. .It Va nfs_server_flags .Pq Vt str If .Va nfs_server_enable is set to .Dq Li YES , these are the flags to pass to the .Xr nfsd 8 daemon. .It Va nfsv4_server_enable .Pq Vt bool If .Va nfs_server_enable is set to .Dq Li YES and .Va nfsv4_server_enable are set to .Dq Li YES , enable the server for NFSv4 as well as NFSv2 and NFSv3. .It Va nfsuserd_enable .Pq Vt bool If .Va nfsuserd_enable is set to .Dq Li YES , run the nfsuserd daemon, which is needed for NFSv4 in order to map between user/group names vs uid/gid numbers. If .Va nfsv4_server_enable is set to .Dq Li YES , this will be forced enabled. .It Va nfsuserd_flags .Pq Vt str If .Va nfsuserd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr nfsuserd 8 daemon. .It Va nfscbd_enable .Pq Vt bool If .Va nfscbd_enable is set to .Dq Li YES , run the nfscbd daemon, which enables callbacks/delegations for the NFSv4 client. .It Va nfscbd_flags .Pq Vt str If .Va nfscbd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr nfscbd 8 daemon. .It Va mountd_enable .Pq Vt bool If set to .Dq Li YES , and no .Va nfs_server_enable is set, start .Xr mountd 8 , but not .Xr nfsd 8 daemon. It is commonly needed to run CFS without real NFS used. .It Va mountd_flags .Pq Vt str If .Va mountd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr mountd 8 daemon. .It Va weak_mountd_authentication .Pq Vt bool If set to .Dq Li YES , allow services like PCNFSD to make non-privileged mount requests. .It Va nfs_reserved_port_only .Pq Vt bool If set to .Dq Li YES , provide NFS services only on a secure port. .It Va nfs_bufpackets .Pq Vt int If set to a number, indicates the number of packets worth of socket buffer space to reserve on an NFS client. The kernel default is typically 4. Using a higher number may be useful on gigabit networks to improve performance. The minimum value is 2 and the maximum is 64. .It Va rpc_lockd_enable .Pq Vt bool If set to .Dq Li YES and also an NFS server or client, run .Xr rpc.lockd 8 at boot time. .It Va rpc_lockd_flags .Pq Vt str If .Va rpc_lockd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rpc.lockd 8 daemon. .It Va rpc_statd_enable .Pq Vt bool If set to .Dq Li YES and also an NFS server or client, run .Xr rpc.statd 8 at boot time. .It Va rpc_statd_flags .Pq Vt str If .Va rpc_statd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rpc.statd 8 daemon. .It Va rpcbind_program .Pq Vt str Path to .Xr rpcbind 8 (default .Pa /usr/sbin/rpcbind ) . .It Va rpcbind_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rpcbind 8 service at boot time. .It Va rpcbind_flags .Pq Vt str If .Va rpcbind_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rpcbind 8 daemon. .It Va keyserv_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr keyserv 8 daemon on boot for running Secure RPC. .It Va keyserv_flags .Pq Vt str If .Va keyserv_enable is set to .Dq Li YES , these are the flags to pass to .Xr keyserv 8 daemon. .It Va pppoed_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr pppoed 8 daemon at boot time to provide PPP over Ethernet services. .It Va pppoed_ Ns Aq Ar provider .Pq Vt str .Xr pppoed 8 listens to requests to this .Ar provider and ultimately runs .Xr ppp 8 with a .Ar system argument of the same name. .It Va pppoed_flags .Pq Vt str Additional flags to pass to .Xr pppoed 8 . .It Va pppoed_interface .Pq Vt str The network interface to run .Xr pppoed 8 on. This is mandatory when .Va pppoed_enable is set to .Dq Li YES . .It Va timed_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr timed 8 service at boot time. This command is intended for networks of machines where a consistent .Dq "network time" for all hosts must be established. This is often useful in large NFS environments where time stamps on files are expected to be consistent network-wide. .It Va timed_flags .Pq Vt str If .Va timed_enable is set to .Dq Li YES , these are the flags to pass to the .Xr timed 8 service. .It Va ntpdate_enable .Pq Vt bool If set to .Dq Li YES , run .Xr ntpdate 8 at system startup. This command is intended to synchronize the system clock only .Em once from some standard reference. .Pp Note that the use of the .Va ntpd_sync_on_start variable is a preferred alternative to the .Xr ntpdate 8 utility as .Xr ntpdate 8 is to be retired from the NTP distribution. .It Va ntpdate_config .Pq Vt str Configuration file for .Xr ntpdate 8 . Default .Pa /etc/ntp.conf . .It Va ntpdate_hosts .Pq Vt str A whitespace-separated list of NTP servers to synchronize with at startup. The default is to use the servers listed in .Va ntpdate_config , if that file exists. .It Va ntpdate_program .Pq Vt str Path to .Xr ntpdate 8 (default .Pa /usr/sbin/ntpdate ) . .It Va ntpdate_flags .Pq Vt str If .Va ntpdate_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ntpdate 8 command (typically a hostname). .It Va ntpd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ntpd 8 command at boot time. .It Va ntpd_program .Pq Vt str Path to .Xr ntpd 8 (default .Pa /usr/sbin/ntpd ) . .It Va ntpd_config .Pq Vt str Path to .Xr ntpd 8 configuration file. Default .Pa /etc/ntp.conf . .It Va ntpd_flags .Pq Vt str If .Va ntpd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ntpd 8 daemon. .It Va ntpd_sync_on_start .Pq Vt bool If set to .Dq Li YES , .Xr ntpd 8 is run with the .Fl g flag, which syncs the system's clock on startup. See .Xr ntpd 8 for more information regarding the .Fl g option. This is a preferred alternative to using .Xr ntpdate 8 or specifying the .Va ntpdate_enable variable. .It Va nis_client_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ypbind 8 service at system boot time. .It Va nis_client_flags .Pq Vt str If .Va nis_client_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ypbind 8 service. .It Va nis_ypldap_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ypldap 8 daemon at system boot time. .It Va nis_ypldap_flags .Pq Vt str If .Va nis.ypldap_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ypldap 8 daemon. .It Va nis_ypset_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ypset 8 daemon at system boot time. .It Va nis_ypset_flags .Pq Vt str If .Va nis_ypset_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ypset 8 daemon. .It Va nis_server_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr ypserv 8 daemon at system boot time. .It Va nis_server_flags .Pq Vt str If .Va nis_server_enable is set to .Dq Li YES , these are the flags to pass to the .Xr ypserv 8 daemon. .It Va nis_ypxfrd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rpc.ypxfrd 8 daemon at system boot time. .It Va nis_ypxfrd_flags .Pq Vt str If .Va nis_ypxfrd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rpc.ypxfrd 8 daemon. .It Va nis_yppasswdd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rpc.yppasswdd 8 daemon at system boot time. .It Va nis_yppasswdd_flags .Pq Vt str If .Va nis_yppasswdd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rpc.yppasswdd 8 daemon. .It Va rpc_ypupdated_enable .Pq Vt bool If set to .Dq Li YES , run the .Nm rpc.ypupdated daemon at system boot time. .It Va bsnmpd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr bsnmpd 1 daemon at system boot time. Be sure to understand the security implications of running SNMP daemon on your host. .It Va bsnmpd_flags .Pq Vt str If .Va bsnmpd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr bsnmpd 1 daemon. .It Va defaultrouter .Pq Vt str If not set to .Dq Li NO , create a default route to this host name or IP address (use an IP address if this router is also required to get to the name server!). .It Va ipv6_defaultrouter .Pq Vt str The IPv6 equivalent of .Va defaultrouter . .It Va static_arp_pairs .Pq Vt str Set to the list of static ARP pairs that are to be added at system boot time. For each whitespace separated .Ar element in the value, a .Va static_arp_ Ns Aq Ar element variable is assumed to exist whose contents will later be passed to a .Dq Nm arp Cm -S operation. For example .Bd -literal static_arp_pairs="gw" static_arp_gw="192.168.1.1 00:01:02:03:04:05" .Ed .It Va static_ndp_pairs .Pq Vt str Set to the list of static NDP pairs that are to be added at system boot time. For each whitespace separated .Ar element in the value, a .Va static_ndp_ Ns Aq Ar element variable is assumed to exist whose contents will later be passed to a .Dq Nm ndp Cm -s operation. For example .Bd -literal static_ndp_pairs="gw" static_ndp_gw="2001:db8:3::1 00:01:02:03:04:05" .Ed .It Va static_routes .Pq Vt str Set to the list of static routes that are to be added at system boot time. If not set to .Dq Li NO then for each whitespace separated .Ar element in the value, a .Va route_ Ns Aq Ar element variable is assumed to exist whose contents will later be passed to a .Dq Nm route Cm add operation. For example: .Bd -literal static_routes="ext mcast:gif0 gif0local:gif0" route_ext="-net 10.0.0.0/24 -gateway 192.168.0.1" route_mcast="-net 224.0.0.0/4 -iface gif0" route_gif0local="-host 169.254.1.1 -iface lo0" .Ed .Pp When an .Ar element is in the form of .Li name:ifname , the route is specific to the interface .Li ifname . .It Va ipv6_static_routes .Pq Vt str The IPv6 equivalent of .Va static_routes . If not set to .Dq Li NO then for each whitespace separated .Ar element in the value, a .Va ipv6_route_ Ns Aq Ar element variable is assumed to exist whose contents will later be passed to a .Dq Nm route Cm add Fl inet6 operation. .It Va gateway_enable .Pq Vt bool If set to .Dq Li YES , configure host to act as an IP router, e.g.\& to forward packets between interfaces. .It Va ipv6_gateway_enable .Pq Vt bool The IPv6 equivalent of .Va gateway_enable . .It Va routed_enable .Pq Vt bool If set to .Dq Li YES , run a routing daemon of some sort, based on the settings of .Va routed_program and .Va routed_flags . .It Va route6d_enable .Pq Vt bool The IPv6 equivalent of .Va routed_enable . If set to .Dq Li YES , run a routing daemon of some sort, based on the settings of .Va route6d_program and .Va route6d_flags . .It Va routed_program .Pq Vt str If .Va routed_enable is set to .Dq Li YES , this is the name of the routing daemon to use. .It Va route6d_program .Pq Vt str The IPv6 equivalent of .Va routed_program . .It Va routed_flags .Pq Vt str If .Va routed_enable is set to .Dq Li YES , these are the flags to pass to the routing daemon. .It Va route6d_flags .Pq Vt str The IPv6 equivalent of .Va routed_flags . .It Va rtadvd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rtadvd 8 daemon at boot time. The .Xr rtadvd 8 utility sends ICMPv6 Router Advertisement messages to the interfaces specified in .Va rtadvd_interfaces . This should only be enabled with great care. You may want to fine-tune .Xr rtadvd.conf 5 . .It Va rtadvd_interfaces .Pq Vt str If .Va rtadvd_enable is set to .Dq Li YES this is the list of interfaces to use. .It Va arpproxy_all .Pq Vt bool If set to .Dq Li YES , enable global proxy ARP. .It Va forward_sourceroute .Pq Vt bool If set to .Dq Li YES and .Va gateway_enable is also set to .Dq Li YES , source-routed packets are forwarded. .It Va accept_sourceroute .Pq Vt bool If set to .Dq Li YES , the system will accept source-routed packets directed at it. .It Va rarpd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr rarpd 8 daemon at system boot time. .It Va rarpd_flags .Pq Vt str If .Va rarpd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr rarpd 8 daemon. .It Va bootparamd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr bootparamd 8 daemon at system boot time. .It Va bootparamd_flags .Pq Vt str If .Va bootparamd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr bootparamd 8 daemon. .It Va stf_interface_ipv4addr .Pq Vt str If not set to .Dq Li NO , this is the local IPv4 address for 6to4 (IPv6 over IPv4 tunneling interface). Specify this entry to enable the 6to4 interface. .It Va stf_interface_ipv4plen .Pq Vt int Prefix length for 6to4 IPv4 addresses, to limit peer address range. An effective value is 0-31. .It Va stf_interface_ipv6_ifid .Pq Vt str IPv6 interface ID for .Xr stf 4 . This can be set to .Dq Li AUTO . .It Va stf_interface_ipv6_slaid .Pq Vt str IPv6 Site Level Aggregator for .Xr stf 4 . .It Va ipv6_ipv4mapping .Pq Vt bool If set to .Dq Li YES this enables IPv4 mapped IPv6 address communication (like .Li ::ffff:a.b.c.d ) . .It Va rtsold_enable .Pq Vt bool Set to .Dq Li YES to enable the .Xr rtsold 8 daemon to send ICMPv6 Router Solicitation messages. .It Va rtsold_flags .Pq Vt str If .Va rtsold_enable is set to .Dq Li YES , these are the flags to pass to .Xr rtsold 8 . .It Va rtsol_flags .Pq Vt str For interfaces configured with the .Dq Li inet6 accept_rtadv keyword, these are the flags to pass to .Xr rtsol 8 . .Pp Note that .Va rtsold_enable is mutually exclusive to .Va rtsol_flags ; .Va rtsold_enable takes precedence. .It Va keybell .Pq Vt str The keyboard bell sound. Set to .Dq Li normal , .Dq Li visual , .Dq Li off , or .Dq Li NO if the default behavior is desired. For details, refer to the .Xr kbdcontrol 1 manpage. .It Va keyboard .Pq Vt str If set to a non-null string, the virtual console's keyboard input is set to this device. .It Va keymap .Pq Vt str If set to .Dq Li NO , no keymap is installed, otherwise the value is used to install the keymap file found in .Pa /usr/share/syscons/keymaps/ Ns Ao Ar value Ac Ns Pa .kbd (if using .Xr syscons 4 ) or .Pa /usr/share/vt/keymaps/ Ns Ao Ar value Ac Ns Pa .kbd (if using .Xr vt 4 ) . .It Va keyrate .Pq Vt str The keyboard repeat speed. Set to .Dq Li slow , .Dq Li normal , .Dq Li fast , or .Dq Li NO if the default behavior is desired. .It Va keychange .Pq Vt str If not set to .Dq Li NO , attempt to program the function keys with the value. The value should be a single string of the form: .Dq Ar funkey_number new_value Op Ar funkey_number new_value ... . .It Va cursor .Pq Vt str Can be set to the value of .Dq Li normal , .Dq Li blink , .Dq Li destructive , or .Dq Li NO to set the cursor behavior explicitly or choose the default behavior. .It Va scrnmap .Pq Vt str If set to .Dq Li NO , no screen map is installed, otherwise the value is used to install the screen map file in .Pa /usr/share/syscons/scrnmaps/ Ns Aq Ar value . This parameter is ignored when using .Xr vt 4 as the console driver. .It Va font8x16 .Pq Vt str If set to .Dq Li NO , the default 8x16 font value is used for screen size requests, otherwise the value in .Pa /usr/share/syscons/fonts/ Ns Aq Ar value or .Pa /usr/share/vt/fonts/ Ns Aq Ar value is used (depending on the console driver being used). .It Va font8x14 .Pq Vt str If set to .Dq Li NO , the default 8x14 font value is used for screen size requests, otherwise the value in .Pa /usr/share/syscons/fonts/ Ns Aq Ar value or .Pa /usr/share/vt/fonts/ Ns Aq Ar value is used (depending on the console driver being used). .It Va font8x8 .Pq Vt str If set to .Dq Li NO , the default 8x8 font value is used for screen size requests, otherwise the value in .Pa /usr/share/syscons/fonts/ Ns Aq Ar value or .Pa /usr/share/vt/fonts/ Ns Aq Ar value is used (depending on the console driver being used). .It Va blanktime .Pq Vt int If set to .Dq Li NO , the default screen blanking interval is used, otherwise it is set to .Ar value seconds. .It Va saver .Pq Vt str If not set to .Dq Li NO , this is the actual screen saver to use .Li ( blank , snake , daemon , etc). .It Va moused_nondefault_enable .Pq Vt str If set to .Dq Li NO , the mouse device specified on the command line is not automatically treated as enabled by the .Pa /etc/rc.d/moused script. Having this variable set to .Dq Li YES allows a .Xr usb 4 mouse, for example, to be enabled as soon as it is plugged in. .It Va moused_enable .Pq Vt str If set to .Dq Li YES , the .Xr moused 8 daemon is started for doing cut/paste selection on the console. .It Va moused_type .Pq Vt str This is the protocol type of the mouse connected to this host. This variable must be set if .Va moused_enable is set to .Dq Li YES . The .Xr moused 8 daemon is able to detect the appropriate mouse type automatically in many cases. Set this variable to .Dq Li auto to let the daemon detect it, or select one from the following list if the automatic detection fails. .Pp If the mouse is attached to the PS/2 mouse port, choose .Dq Li auto or .Dq Li ps/2 , regardless of the brand and model of the mouse. Likewise, if the mouse is attached to the bus mouse port, choose .Dq Li auto or .Dq Li busmouse . All other protocols are for serial mice and will not work with the PS/2 and bus mice. If this is a USB mouse, .Dq Li auto is the only protocol type which will work. .Pp .Bl -tag -width ".Li x10mouseremote" -compact .It Li microsoft Microsoft mouse (serial) .It Li intellimouse Microsoft IntelliMouse (serial) .It Li mousesystems Mouse systems Corp.\& mouse (serial) .It Li mmseries MM Series mouse (serial) .It Li logitech Logitech mouse (serial) .It Li busmouse A bus mouse .It Li mouseman Logitech MouseMan and TrackMan (serial) .It Li glidepoint ALPS GlidePoint (serial) .It Li thinkingmouse Kensington ThinkingMouse (serial) .It Li ps/2 PS/2 mouse .It Li mmhittab MM HitTablet (serial) .It Li x10mouseremote X10 MouseRemote (serial) .It Li versapad Interlink VersaPad (serial) .El .Pp Even if the mouse is not in the above list, it may be compatible with one in the list. Refer to the manual page for .Xr moused 8 for compatibility information. .Pp It should also be noted that while this is enabled, any other client of the mouse (such as an X server) should access the mouse through the virtual mouse device, .Pa /dev/sysmouse , and configure it as a .Dq Li sysmouse type mouse, since all mouse data is converted to this single canonical format when using .Xr moused 8 . If the client program does not support the .Dq Li sysmouse type, specify the .Dq Li mousesystems type. It is the second preferred type. .It Va moused_port .Pq Vt str If .Va moused_enable is set to .Dq Li YES , this is the actual port the mouse is on. It might be .Pa /dev/cuau0 for a COM1 serial mouse, .Pa /dev/psm0 for a PS/2 mouse or .Pa /dev/mse0 for a bus mouse, for example. .It Va moused_flags .Pq Vt str If .Va moused_flags is set, its value is used as an additional set of flags to pass to the .Xr moused 8 daemon. .It Va "moused_" Ns Ar XXX Ns Va "_flags" When .Va moused_nondefault_enable is enabled, and a .Xr moused 8 daemon is started for a non-default port, the .Va "moused_" Ns Ar XXX Ns Va "_flags" set of options has precedence over and replaces the default .Va moused_flags (where .Ar XXX is the name of the non-default port, i.e.,\& .Ar ums0 ) . By setting .Va "moused_" Ns Ar XXX Ns Va "_flags" it is possible to set up a different set of default flags for each .Xr moused 8 instance. For example, you can use .Dq Li "-3" for the default .Va moused_flags to make your laptop's touchpad more comfortable to use, but an empty set of options for .Va moused_ums0_flags when your .Xr usb 4 mouse has three or more buttons. .It Va mousechar_start .Pq Vt int If set to .Dq Li NO , the default mouse cursor character range .Li 0xd0 Ns - Ns Li 0xd3 is used, otherwise the range start is set to .Ar value character, see .Xr vidcontrol 1 . Use if the default range is occupied in the language code table. .It Va allscreens_flags .Pq Vt str If set, .Xr vidcontrol 1 is run with these options for each of the virtual terminals .Pq Pa /dev/ttyv* . For example, .Dq Fl m Cm on will enable the mouse pointer on all virtual terminals if .Va moused_enable is set to .Dq Li YES . .It Va allscreens_kbdflags .Pq Vt str If set, .Xr kbdcontrol 1 is run with these options for each of the virtual terminals .Pq Pa /dev/ttyv* . For example, .Dq Fl h Li 200 will set the .Xr syscons 4 or .Xr vt 4 scrollback (history) buffer to 200 lines. .It Va cron_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr cron 8 daemon at system boot time. .It Va cron_program .Pq Vt str Path to .Xr cron 8 (default .Pa /usr/sbin/cron ) . .It Va cron_flags .Pq Vt str If .Va cron_enable is set to .Dq Li YES , these are the flags to pass to .Xr cron 8 . .It Va cron_dst .Pq Vt bool If set to .Dq Li YES , enable the special handling of transitions to and from the Daylight Saving Time in .Xr cron 8 (equivalent to using the flag .Fl s ) . .It Va lpd_program .Pq Vt str Path to .Xr lpd 8 (default .Pa /usr/sbin/lpd ) . .It Va lpd_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr lpd 8 daemon at system boot time. .It Va lpd_flags .Pq Vt str If .Va lpd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr lpd 8 daemon. .It Va chkprintcap_enable .Pq Vt bool If set to .Dq Li YES , run the .Xr chkprintcap 8 command before starting the .Xr lpd 8 daemon. .It Va chkprintcap_flags .Pq Vt str If .Va lpd_enable and .Va chkprintcap_enable are set to .Dq Li YES , these are the flags to pass to the .Xr chkprintcap 8 program. The default is .Dq Li -d , which causes missing directories to be created. .It Va mta_start_script .Pq Vt str This variable specifies the full path to the script to run to start a mail transfer agent. The default is .Pa /etc/rc.sendmail . The .Va sendmail_* variables which .Pa /etc/rc.sendmail uses are documented in the .Xr rc.sendmail 8 manual page. .It Va dumpdev .Pq Vt str Indicates the device (usually a swap partition) to which a crash dump should be written in the event of a system crash. If the value of this variable is .Dq Li AUTO , the first suitable swap device listed in .Pa /etc/fstab will be used as dump device. Otherwise, the value of this variable is passed as the argument to .Xr dumpon 8 . To disable crash dumps, set this variable to .Dq Li NO . .It Va dumpon_flags .Pq Vt str Flags to pass to .Xr dumpon 8 when configuring .Va dumpdev as the system dump device. .It Va dumpdir .Pq Vt str When the system reboots after a crash and a crash dump is found on the device specified by the .Va dumpdev variable, .Xr savecore 8 will save that crash dump and a copy of the kernel to the directory specified by the .Va dumpdir variable. The default value is .Pa /var/crash . Set to .Dq Li NO to not run .Xr savecore 8 at boot time when .Va dumpdir is set. .It Va savecore_enable .Pq Vt bool If set to .Dq Li NO , disable automatic extraction of the crash dump from the .Va dumpdev . .It Va savecore_flags .Pq Vt str If crash dumps are enabled, these are the flags to pass to the .Xr savecore 8 utility. .It Va quota_enable .Pq Vt bool Set to .Dq Li YES to turn on user and group disk quotas on system startup via the .Xr quotaon 8 command for all file systems marked as having quotas enabled in .Pa /etc/fstab . The kernel must be built with .Cd "options QUOTA" for disk quotas to function. .It Va check_quotas .Pq Vt bool Set to .Dq Li YES to enable user and group disk quota checking via the .Xr quotacheck 8 command. .It Va quotacheck_flags .Pq Vt str If .Va quota_enable is set to .Dq Li YES , and .Va check_quotas is set to .Dq Li YES , these are the flags to pass to the .Xr quotacheck 8 utility. The default is .Dq Li "-a" , which checks quotas for all file systems with quotas enabled in .Pa /etc/fstab . .It Va quotaon_flags .Pq Vt str If .Va quota_enable is set to .Dq Li YES , these are the flags to pass to the .Xr quotaon 8 utility. The default is .Dq Li "-a" , which enables quotas for all file systems with quotas enabled in .Pa /etc/fstab . .It Va quotaoff_flags .Pq Vt str If .Va quota_enable is set to .Dq Li YES , these are the flags to pass to the .Xr quotaoff 8 utility when shutting down the quota system. The default is .Dq Li "-a" , which disables quotas for all file systems with quotas enabled in .Pa /etc/fstab . .It Va accounting_enable .Pq Vt bool Set to .Dq Li YES to enable system accounting through the .Xr accton 8 facility. .It Va ibcs2_enable .Pq Vt bool Set to .Dq Li YES to enable iBCS2 (SCO) binary emulation at system initial boot time. .It Va ibcs2_loaders .Pq Vt str If not set to .Dq Li NO and if .Va ibcs2_enable is set to .Dq Li YES , this specifies a list of additional iBCS2 loaders to enable. .It Va firstboot_sentinel .Pq Vt str This variable specifies the full path to a .Dq first boot sentinel file. If a file exists with this path, .Pa rc.d scripts with the .Dq firstboot keyword will be run on startup and the sentinel file will be deleted after the boot process completes. The sentinel file must be located on a writable file system which is mounted no later than .Va early_late_divider to function properly. The default is .Pa /firstboot . .It Va linux_enable .Pq Vt bool Set to .Dq Li YES to enable Linux/ELF binary emulation at system initial boot time. .It Va sysvipc_enable .Pq Vt bool If set to .Dq Li YES , load System V IPC primitives at boot time. .It Va clear_tmp_enable .Pq Vt bool Set to .Dq Li YES to have .Pa /tmp cleaned at startup. .It Va clear_tmp_X .Pq Vt bool Set to .Dq Li NO to disable removing of X11 lock files, and the removal and (secure) recreation of the various socket directories for X11 related programs. .It Va ldconfig_paths .Pq Vt str Set to the list of shared library paths to use with .Xr ldconfig 8 . NOTE: .Pa /usr/lib will always be added first, so it need not appear in this list. .It Va ldconfig32_paths .Pq Vt str Set to the list of 32-bit compatibility shared library paths to use with .Xr ldconfig 8 . .It Va ldconfig_paths_aout .Pq Vt str Set to the list of shared library paths to use with .Xr ldconfig 8 legacy .Xr a.out 5 support. .It Va ldconfig_insecure .Pq Vt bool The .Xr ldconfig 8 utility normally refuses to use directories which are writable by anyone except root. Set this variable to .Dq Li YES to disable that security check during system startup. .It Va ldconfig_local_dirs .Pq Vt str Set to the list of local .Xr ldconfig 8 directories. The names of all files in the directories listed will be passed as arguments to .Xr ldconfig 8 . .It Va ldconfig_local32_dirs .Pq Vt str Set to the list of local 32-bit compatibility .Xr ldconfig 8 directories. The names of all files in the directories listed will be passed as arguments to .Dq Nm ldconfig Fl 32 . .It Va kern_securelevel_enable .Pq Vt bool Set to .Dq Li YES to set the kernel security level at system startup. .It Va kern_securelevel .Pq Vt int The kernel security level to set at startup. The allowed range of .Ar value ranges from \-1 (the compile time default) to 3 (the most secure). See .Xr security 7 for the list of possible security levels and their effect on system operation. .It Va sshd_program .Pq Vt str Path to the SSH server program .Pa ( /usr/sbin/sshd is the default). .It Va sshd_enable .Pq Vt bool Set to .Dq Li YES to start .Xr sshd 8 at system boot time. .It Va sshd_flags .Pq Vt str If .Va sshd_enable is set to .Dq Li YES , these are the flags to pass to the .Xr sshd 8 daemon. .It Va ftpd_program .Pq Vt str Path to the FTP server program .Pa ( /usr/libexec/ftpd is the default). .It Va ftpd_enable .Pq Vt bool Set to .Dq Li YES to start .Xr ftpd 8 as a stand-alone daemon at system boot time. .It Va ftpd_flags .Pq Vt str If .Va ftpd_enable is set to .Dq Li YES , these are the additional flags to pass to the .Xr ftpd 8 daemon. .It Va watchdogd_enable .Pq Vt bool If set to .Dq Li YES , start the .Xr watchdogd 8 daemon at boot time. This requires that the kernel have been compiled with a .Xr watchdog 4 compatible device. .It Va watchdogd_flags .Pq Vt str If .Va watchdogd_enable is set to .Dq Li YES , these are the flags passed to the .Xr watchdogd 8 daemon. +.It Va watchdogd_timeout +.Pq Vt int +If +.Va watchdogd_enable +is set to +.Dq Li YES , +this is a timeout that will be used by the +.Xr watchdogd 8 +daemon. +If this option is set, it overrides +.Fl t +in +.Va watchdogd_flags . +.It Va watchdogd_shutdown_timeout +.Pq Vt int +If +.Va watchdogd_enable +is set to +.Dq Li YES , +this is a timeout that will be set by the +.Xr watchdogd 8 +daemon when it exits during the system shutdown. +This timeout will not be set when returning to the single-user mode +or when the watchdogd service is stopped individually using the +.Xr service 8 +command or the rc.d script. +Note that the timeout will be applied if +.Xr watchdogd 8 +is stopped outside of +.Xr rc 8 +framework. +If this option is set, it overrides +.Fl x +in +.Va watchdogd_flags . .It Va devfs_rulesets .Pq Vt str List of files containing sets of rules for .Xr devfs 8 . .It Va devfs_system_ruleset .Pq Vt str Rule name(s) to apply to the system .Pa /dev itself. .It Va devfs_set_rulesets .Pq Vt str Pairs of already-mounted .Pa dev directories and rulesets that should be applied to them. For example: /mount/dev=ruleset_name .It Va devfs_load_rulesets .Pq Vt bool If set, always load the default rulesets listed in .Va devfs_rulesets . .It Va performance_cx_lowest .Pq Vt str CPU idle state to use while on AC power. The string .Dq Li LOW indicates that .Xr acpi 4 should use the lowest power state available while .Dq Li HIGH indicates that the lowest latency state (less power savings) should be used. .It Va performance_cpu_freq .Pq Vt str CPU clock frequency to use while on AC power. The string .Dq Li LOW indicates that .Xr cpufreq 4 should use the lowest frequency available while .Dq Li HIGH indicates that the highest frequency (less power savings) should be used. .It Va economy_cx_lowest .Pq Vt str CPU idle state to use when off AC power. The string .Dq Li LOW indicates that .Xr acpi 4 should use the lowest power state available while .Dq Li HIGH indicates that the lowest latency state (less power savings) should be used. .It Va economy_cpu_freq .Pq Vt str CPU clock frequency to use when off AC power. The string .Dq Li LOW indicates that .Xr cpufreq 4 should use the lowest frequency available while .Dq Li HIGH indicates that the highest frequency (less power savings) should be used. .It Va jail_enable .Pq Vt bool If set to .Dq Li NO , any configured jails will not be started. .It Va jail_conf .Pq Vt str The configuration filename used by .Xr jail 8 utility. The default value is .Pa /etc/jail.conf . .It Va jail_parallel_start .Pq Vt bool If set to .Dq Li YES , all configured jails will be started in the background (in parallel). .It Va jail_flags .Pq Vt str Unset by default. When set, use as default value for .Va jail_ Ns Ao Ar jname Ac Ns Va _flags for every jail in .Va jail_list . .It Va jail_list .Pq Vt str A space-delimited list of jail names. When left empty, all of the .Xr jail 8 instances defined in the configuration file are started. The names specified in this list control the jail startup order. .Xr jail 8 instances missing from .Va jail_list must be started manually. Note that a jail's .Va depend parameter in the configuration file may override this list. .It Va jail_reverse_stop .Pq Vt bool When set to .Dq Li YES , all configured jails in .Va jail_list are stopped in reverse order. .It Va jail_* variables Note that older releases supported per-jail configuration via .Nm variables. For example, hostname of a jail named .Li vjail was able to be set by .Li jail_vjail_hostname . These per-jail configuration variables are now obsolete in favor of .Xr jail 8 configuration file. For backward compatibility, when per-jail configuration variables are defined, .Xr jail 8 configuration files are created as .Pa /var/run/jail. Ns Ao Ar jname Ac Ns Pa .conf and used. .Pp The following per-jail parameters are handled by .Pa rc.d/jail script out of their corresponding .Nm variables. In addition to them, parameters in .Va jail_ Ns Ao Ar jname Ac Ns Va _parameters will be added to the configuration file. They must be a semi-colon .Pq Ql \&; delimited list of .Dq key=value . For more details, see .Xr jail 8 manual page. .Bl -tag -width "host.hostname" -offset indent .It Li path set from .Va jail_ Ns Ao Ar jname Ac Ns Va _rootdir .It Li host.hostname set from .Va jail_ Ns Ao Ar jname Ac Ns Va _hostname .It Li exec.consolelog set from .Va jail_ Ns Ao Ar jname Ac Ns Va _consolelog . The default value is .Pa /var/log/jail_ Ao Ar jname Ac Pa _console.log . .It Li interface set from .Va jail_ Ns Ao Ar jname Ac Ns Va _interface . .It Li vnet.interface set from .Va jail_ Ns Ao Ar jname Ac Ns Va _vnet_interface . This implies .Li vnet parameter will be enabled and cannot be specified with .Va jail_ Ns Ao Ar jname Ac Ns Va _interface , .Va jail_ Ns Ao Ar jname Ac Ns Va _ip and/or .Va jail_ Ns Ao Ar jname Ac Ns Va _ip_multi Ns Aq Ar n at the same time. .It Li fstab set from .Va jail_ Ns Ao Ar jname Ac Ns Va _fstab .It Li mount set from .Va jail_ Ns Ao Ar jname Ac Ns Va _procfs_enable . .It Li exec.fib set from .Va jail_ Ns Ao Ar jname Ac Ns Va _fib .It Li exec.start set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_start . The parameter name was .Li command in some older releases. .It Li exec.prestart set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_prestart .It Li exec.poststart set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_poststart .It Li exec.stop set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_stop .It Li exec.prestop set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_prestop .It Li exec.poststop set from .Va jail_ Ns Ao Ar jname Ac Ns Va _exec_poststop .It Li ip4.addr set if .Va jail_ Ns Ao Ar jname Ac Ns Va _ip or .Va jail_ Ns Ao Ar jname Ac Ns Va _ip_multi Ns Aq Ar n contain IPv4 addresses .It Li ip6.addr set if .Va jail_ Ns Ao Ar jname Ac Ns Va _ip or .Va jail_ Ns Ao Ar jname Ac Ns Va _ip_multi Ns Aq Ar n contain IPv6 addresses .It Li allow.mount set from .Va jail_ Ns Ao Ar jname Ac Ns Va _mount_enable .It Li mount.devfs set from .Va jail_ Ns Ao Ar jname Ac Ns Va _devfs_enable .It Li devfs_ruleset set from .Va jail_ Ns Ao Ar jname Ac Ns Va _devfs_ruleset . This must be an integer, not a string. .It Li mount.fdescfs set from .Va jail_ Ns Ao Ar jname Ac Ns Va _fdescfs_enable .It Li allow.set_hostname set from .Va jail_ Ns Ao Ar jname Ac Ns Va _set_hostname_allow .It Li allow.rawsocket set from .Va jail_ Ns Ao Ar jname Ac Ns Va _socket_unixiproute_only .It Li allow.sysvipc set from .Va jail_ Ns Ao Ar jname Ac Ns Va _sysvipc_allow .El .\" ----------------------------------------------------- .It Va harvest_mask .Pq Vt int Set to a bit-mask representing the entropy sources you wish to harvest. Refer to .Xr random 4 for more information. .It Va entropy_dir .Pq Vt str Set to .Dq Li NO to disable caching entropy via .Xr cron 8 . Otherwise set to the directory in which the entropy files are stored. To be useful, there must be a system cron job that regularly writes and rotates files here. All files found will be used at boot time. The default is .Pa /var/db/entropy . .It Va entropy_file .Pq Vt str Set to .Dq Li NO to disable caching entropy through reboots. Otherwise set to the name of a file used to store cached entropy. This file should be located on a file system that is readable before all the volumes specified in .Xr fstab 5 are mounted. By default, .Pa /entropy is used, but if .Pa /var/db/entropy-file is found it will also be used. This will be of some use to .Xr bsdinstall 8 . .It Va entropy_boot_file .Pq Vt str Set to .Dq Li NO to disable very early caching entropy through reboots. Otherwise set to the filename used to read very early reboot cached entropy. This file should be located where .Xr loader 8 can read it. See also .Xr loader.conf 5 . The default location is .Pa /boot/entropy . .It Va entropy_save_sz .Pq Vt int Size of the entropy cache files saved by .Nm save-entropy periodically. .It Va entropy_save_num .Pq Vt int Number of entropy cache files to save by .Nm save-entropy periodically. .It Va ipsec_enable .Pq Vt bool Set to .Dq Li YES to run .Xr setkey 8 on .Va ipsec_file at boot time. .It Va ipsec_file .Pq Vt str Configuration file for .Xr setkey 8 . .It Va dmesg_enable .Pq Vt bool Set to .Dq Li YES to save .Xr dmesg 8 to .Pa /var/run/dmesg.boot on boot. .It Va rcshutdown_timeout .Pq Vt int If set, start a watchdog timer in the background which will terminate .Pa rc.shutdown if .Xr shutdown 8 has not completed within the specified time (in seconds). Notice that in addition to this soft timeout, .Xr init 8 also applies a hard timeout for the execution of .Pa rc.shutdown . This is configured via .Xr sysctl 8 variable .Va kern.init_shutdown_timeout and defaults to 120 seconds. Setting the value of .Va rcshutdown_timeout to more than 120 seconds will have no effect until the .Xr sysctl 8 variable .Va kern.init_shutdown_timeout is also increased. .It Va virecover_enable .Pq Vt bool Set to .Dq Li NO to prevent the system from trying to recover pre-maturely terminated .Xr vi 1 sessions. .It Va ugidfw_enable .Pq Vt bool Set to .Dq Li YES to load the .Xr mac_bsdextended 4 module upon system initialization and load a default ruleset file. .It Va bsdextended_script .Pq Vt str The default .Xr mac_bsdextended 4 ruleset file to load. The default value of this variable is .Pa /etc/rc.bsdextended . .It Va newsyslog_enable .Pq Vt bool If set to .Dq Li YES , run .Xr newsyslog 8 command at startup. .It Va newsyslog_flags .Pq Vt str If .Va newsyslog_enable is set to .Dq Li YES , these are the flags to pass to the .Xr newsyslog 8 program. The default is .Dq Li -CN , which causes log files flagged with a .Cm C to be created. .It Va mdconfig_md Ns Aq Ar X .Pq Vt str Arguments to .Xr mdconfig 8 for .Xr md 4 device .Ar X . At minimum a .Fl t Ar type must be specified and either a .Fl s Ar size for malloc or swap backed .Xr md 4 devices or a .Fl f Ar file for vnode backed .Xr md 4 devices. Note that .Va mdconfig_md Ns Aq Ar X variables are evaluated until one variable is unset or null. .It Va mdconfig_md Ns Ao Ar X Ac Ns Va _newfs .Pq Vt str Optional arguments passed to .Xr newfs 8 to initialize .Xr md 4 device .Ar X . .It Va mdconfig_md Ns Ao Ar X Ac Ns Va _owner .Pq Vt str An ownership specification passed to .Xr chown 8 after the specified .Xr md 4 device .Ar X has been mounted. Both the .Xr md 4 device and the mount point will be changed. .It Va mdconfig_md Ns Ao Ar X Ac Ns Va _perms .Pq Vt str A mode string passed to .Xr chmod 1 after the specified .Xr md 4 device .Ar X has been mounted. Both the .Xr md 4 device and the mount point will be changed. .It Va mdconfig_md Ns Ao Ar X Ac Ns Va _files .Pq Vt str Files to be copied to the mount point of the .Xr md 4 device .Ar X after it has been mounted. .It Va mdconfig_md Ns Ao Ar X Ac Ns Va _cmd .Pq Vt str Command to execute after the specified .Xr md 4 device .Ar X has been mounted. Note that the command is passed to .Ic eval and that both .Va _dev and .Va _mp variables can be used to reference respectively the .Xr md 4 device and the mount point. Assuming that the .Xr md 4 device is .Li md0 , one could set the following: .Bd -literal mdconfig_md0_cmd="tar xfzC /var/file.tgz \e${_mp}" .Ed .It Va autobridge_interfaces .Pq Vt str Set to the list of bridge interfaces that will have newly arriving interfaces checked against to be automatically added. If not set to .Dq Li NO then for each whitespace separated .Ar element in the value, a .Va autobridge_ Ns Aq Ar element variable is assumed to exist which has a whitespace separated list of interface names to match, these names can use wildcards. For example: .Bd -literal autobridge_interfaces="bridge0" autobridge_bridge0="tap* dc0 vlan[345]" .Ed .It Va mixer_enable .Pq Vt bool If set to .Dq Li YES , enable support for sound mixer. .It Va hcsecd_enable .Pq Vt bool If set to .Dq Li YES , enable Bluetooth security daemon. .It Va hcsecd_config .Pq Vt str Configuration file for .Xr hcsecd 8 . Default .Pa /etc/bluetooth/hcsecd.conf . .It Va sdpd_enable .Pq Vt bool If set to .Dq Li YES , enable Bluetooth Service Discovery Protocol daemon. .It Va sdpd_control .Pq Vt str Path to .Xr sdpd 8 control socket. Default .Pa /var/run/sdp . .It Va sdpd_groupname .Pq Vt str Sets .Xr sdpd 8 group to run as after it initializes. Default .Dq Li nobody . .It Va sdpd_username .Pq Vt str Sets .Xr sdpd 8 user to run as after it initializes. Default .Dq Li nobody . .It Va bthidd_enable .Pq Vt bool If set to .Dq Li YES , enable Bluetooth Human Interface Device daemon. .It Va bthidd_config .Pq Vt str Configuration file for .Xr bthidd 8 . Default .Pa /etc/bluetooth/bthidd.conf . .It Va bthidd_hids .Pq Vt str Path to a file, where .Xr bthidd 8 will store information about known HID devices. Default .Pa /var/db/bthidd.hids . .It Va rfcomm_pppd_server_enable .Pq Vt bool If set to .Dq Li YES , enable Bluetooth RFCOMM PPP wrapper daemon. .It Va rfcomm_pppd_server_profile .Pq Vt str The name of the profile to use from .Pa /etc/ppp/ppp.conf . Multiple profiles can be specified here. Also used to specify per-profile overrides. When the profile name contains any of the characters .Dq Li .-/+ they are translated to .Dq Li _ for the proposes of the override variable names. .It Va rfcomm_pppd_server_ Ns Ao Ar profile Ac Ns _bdaddr .Pq Vt str Overrides local address to listen on. By default .Xr rfcomm_pppd 8 will listen on .Dq Li ANY address. The address can be specified as BD_ADDR or name. .It Va rfcomm_pppd_server_ Ns Ao Ar profile Ac Ns _channel .Pq Vt str Overrides local RFCOMM channel to listen on. By default .Xr rfcomm_pppd 8 will listen on RFCOMM channel 1. Must set properly if multiple profiles used in the same time. .It Va rfcomm_pppd_server_ Ns Ao Ar profile Ac Ns _register_sp .Pq Vt bool Tells .Xr rfcomm_pppd 8 if it should register Serial Port service on the specified RFCOMM channel. Default .Dq Li NO . .It Va rfcomm_pppd_server_ Ns Ao Ar profile Ac Ns _register_dun .Pq Vt bool Tells .Xr rfcomm_pppd 8 if it should register Dial-Up Networking service on the specified RFCOMM channel. Default .Dq Li NO . .It Va ubthidhci_enable .Pq Vt bool If set to .Dq Li YES , change the USB Bluetooth controller from HID mode to HCI mode. You also need to specify the location of USB Bluetooth controller with the .Va ubthidhci_busnum and .Va ubthidhci_addr variables. .It Va ubthidhci_busnum Bus number where the USB Bluetooth controller is located. Check the output of .Xr usbconfig 8 on your system to find this information. .It Va ubthidhci_addr Bus address of the USB Bluetooth controller. Check the output of .Xr usbconfig 8 on your system to find this information. .It Va netwait_enable .Pq Vt bool If set to .Dq Li YES , delays the start of network-reliant services until .Va netwait_if is up and ICMP packets to a destination defined in .Va netwait_ip are flowing. Link state is examined first, followed by .Dq Li pinging an IP address to verify network usability. If no destination can be reached or timeouts are exceeded, network services are started anyway with no guarantee that the network is usable. Use of this variable requires both .Va netwait_ip and .Va netwait_if to be set. .It Va netwait_ip .Pq Vt str Empty by default. This variable contains a space-delimited list of IP addresses to .Xr ping 8 . DNS hostnames should not be used as resolution is not guaranteed to be functional at this point. If multiple IP addresses are specified, each will be tried until one is successful or the list is exhausted. .It Va netwait_timeout .Pq Vt int Indicates the total number of seconds to perform a .Dq Li ping against each IP address in .Va netwait_ip , at a rate of one ping per second. If any of the pings are successful, full network connectivity is considered reliable. The default is 60. .It Va netwait_if .Pq Vt str Empty by default. Defines the name of the network interface on which watch for link. .Xr ifconfig 8 is used to monitor the interface, looking for .Dq Li status: no carrier . Once gone, the link is considered up. This can be a .Xr vlan 4 interface if desired. .It Va netwait_if_timeout .Pq Vt int Defines the total number of seconds to wait for link to become usable, polled at a 1-second interval. The default is 30. .It Va rctl_enable .Pq Vt bool If set to .Dq Li YES , load .Xr rctl 8 rules from the defined ruleset. The kernel must be built with .Cd "options RACCT" and .Cd "options RCTL" . .It Va rctl_rules .Pq Vt str Set to .Pa /etc/rctl.conf by default. This variables contains the .Xr rctl.conf 5 ruleset to load for .Xr rctl 8 . .It Va iovctl_files .Pq Vt str A space-separated list of configuration files used by .Xr iovctl 8 . The default value is an empty string. .It Va autofs_enable .Pq Vt bool If set to .Dq Li YES , start the .Xr automount 8 utility and the .Xr automountd 8 and .Xr autounmountd 8 daemons at boot time. .It Va automount_flags .Pq Vt str If .Va autofs_enable is set to .Dq Li YES , these are the flags to pass to the .Xr automount 8 program. By default no flags are passed. .It Va automountd_flags .Pq Vt str If .Va autofs_enable is set to .Dq Li YES , these are the flags to pass to the .Xr automountd 8 daemon. By default no flags are passed. .It Va autounmountd_flags .Pq Vt str If .Va autofs_enable is set to .Dq Li YES , these are the flags to pass to the .Xr autounmountd 8 daemon. By default no flags are passed. .It Va ctld_enable .Pq Vt bool If set to .Dq Li YES , start the .Xr ctld 8 daemon at boot time. .It Va iscsid_enable .Pq Vt bool If set to .Dq Li YES , start the .Xr iscsid 8 daemon at boot time. .It Va iscsictl_enable .Pq Vt bool If set to .Dq Li YES , start the .Xr iscsictl 8 utility at boot time. .It Va iscsictl_flags .Pq Vt str If .Va iscsictl_enable is set to .Dq Li YES , these are the flags to pass to the .Xr iscsictl 8 program. The default is .Dq Li -Aa , which configures sessions based on the .Pa /etc/iscsi.conf configuration file. .It Va cfumass_enable .Pq Vt bool If set to .Dq Li YES , create and export an USB LUN using .Xr cfumass 4 at boot time. .It Va cfumass_dir .Pq Vt str The directory where the files exported by USB LUN are located. The default directory is .Pa /var/cfumass . .It Va service_delete_empty .Pq Vt bool If set to .Dq Li YES , .Ql Li service delete removes empty .Dq Li rc.conf.d files. .El .Sh FILES .Bl -tag -width ".Pa /etc/defaults/rc.conf" -compact .It Pa /etc/defaults/rc.conf .It Pa /etc/rc.conf .It Pa /etc/rc.conf.local .El .Sh SEE ALSO .Xr chmod 1 , .Xr gdb 1 , .Xr info 1 , .Xr kbdcontrol 1 , .Xr makewhatis 1 , .Xr sh 1 , .Xr vi 1 , .Xr vidcontrol 1 , .Xr bridge 4 , .Xr dummynet 4 , .Xr ip 4 , .Xr ipf 4 , .Xr ipfw 4 , .Xr ipnat 4 , .Xr kld 4 , .Xr pf 4 , .Xr pflog 4 , .Xr pfsync 4 , .Xr tcp 4 , .Xr udp 4 , .Xr exports 5 , .Xr fstab 5 , .Xr ipf 5 , .Xr ipnat 5 , .Xr jail.conf 5 , .Xr loader.conf 5 , .Xr motd 5 , .Xr newsyslog.conf 5 , .Xr pf.conf 5 , .Xr security 7 , .Xr accton 8 , .Xr amd 8 , .Xr apm 8 , .Xr bsdinstall 8 , .Xr bthidd 8 , .Xr chkprintcap 8 , .Xr chown 8 , .Xr cron 8 , .Xr devfs 8 , .Xr dhclient 8 , .Xr ftpd 8 , .Xr geli 8 , .Xr hcsecd 8 , .Xr ifconfig 8 , .Xr inetd 8 , .Xr iovctl 8 , .Xr ipf 8 , .Xr ipfw 8 , .Xr ipnat 8 , .Xr jail 8 , .Xr kldxref 8 , .Xr loader 8 , .Xr lpd 8 , .Xr mdconfig 8 , .Xr mdmfs 8 , .Xr mixer 8 , .Xr mountd 8 , .Xr moused 8 , .Xr newfs 8 , .Xr newsyslog 8 , .Xr nfsd 8 , .Xr ntpd 8 , .Xr ntpdate 8 , .Xr pfctl 8 , .Xr pflogd 8 , .Xr ping 8 , .Xr powerd 8 , .Xr quotacheck 8 , .Xr quotaon 8 , .Xr rc 8 , .Xr rc.sendmail 8 , .Xr rfcomm_pppd 8 , .Xr route 8 , .Xr routed 8 , .Xr rpc.lockd 8 , .Xr rpc.statd 8 , .Xr rpcbind 8 , .Xr rwhod 8 , .Xr savecore 8 , .Xr sdpd 8 , .Xr service 8 , .Xr sshd 8 , .Xr swapon 8 , .Xr sysctl 8 , .Xr syslogd 8 , .Xr sysrc 8 , .Xr timed 8 , .Xr unbound 8 , .Xr usbconfig 8 , .Xr wlandebug 8 , .Xr yp 8 , .Xr ypbind 8 , .Xr ypserv 8 , .Xr ypset 8 .Sh HISTORY The .Nm file appeared in .Fx 2.2.2 . .Sh AUTHORS .An Jordan K. Hubbard . Index: stable/12/share/man/man8/rc.8 =================================================================== --- stable/12/share/man/man8/rc.8 (revision 354724) +++ stable/12/share/man/man8/rc.8 (revision 354725) @@ -1,570 +1,578 @@ .\" Copyright (c) 1980, 1991, 1993 .\" The Regents of the University of California. All rights reserved. .\" .\" Portions of this manual page are Copyrighted by .\" The NetBSD Foundation. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" 3. Neither the name of the University nor the names of its contributors .\" may be used to endorse or promote products derived from this software .\" without specific prior written permission. .\" .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" @(#)rc.8 8.2 (Berkeley) 12/11/93 .\" $FreeBSD$ .\" .Dd August 7, 2019 .Dt RC 8 .Os .Sh NAME .Nm rc .Nd command scripts for auto-reboot and daemon startup .Sh SYNOPSIS .Nm .Nm rc.conf .Nm rc.conf.local .Nm rc.d/ .Nm rc.firewall .Nm rc.local .Nm rc.resume .Nm rc.shutdown .Nm rc.subr .Sh DESCRIPTION The .Nm utility is the command script which controls the automatic boot process after being called by .Xr init 8 . The .Nm rc.local script contains commands which are pertinent only to a specific site. Typically, the .Pa /usr/local/etc/rc.d/ mechanism is used instead of .Nm rc.local these days but if you want to use .Nm rc.local , it is still supported. In this case, it should source .Pa /etc/rc.conf and contain additional custom startup code for your system. The best way to handle .Nm rc.local , however, is to separate it out into .Nm rc.d/ style scripts and place them under .Pa /usr/local/etc/rc.d/ . The .Nm rc.conf file contains the global system configuration information referenced by the startup scripts, while .Nm rc.conf.local contains the local system configuration. See .Xr rc.conf 5 for more information. .Pp The .Nm rc.d/ directories contain scripts which will be automatically executed at boot time and shutdown time. .Pp The .Xr service 8 command provides a convenient interface to manage rc.d services. .Pp The .Xr sysrc 8 command provides a scripting interface to modify system config files. .Ss Operation of Nm .Bl -enum .It If autobooting, set .Va autoboot Ns = Ns Li yes and enable a flag .Pq Va rc_fast Ns = Ns Li yes , which prevents the .Nm rc.d/ scripts from performing the check for already running processes (thus speeding up the boot process). This .Va rc_fast Ns = Ns Li yes speedup will not occur when .Nm is started up after exiting the single-user shell. .It Determine whether the system is booting diskless, and if so run the .Pa /etc/rc.initdiskless script. .It Source .Pa /etc/rc.subr to load various .Xr rc.subr 8 shell functions to use. .It Load the configuration files. .It Determine if booting in a jail, and add .Dq Li nojail (no jails allowed) or .Dq Li nojailvnet (only allow vnet-enabled jails) to the list of KEYWORDS to skip in .Xr rcorder 8 . .It If the file .Va ${firstboot_sentinel} does not exist, add .Dq Li firstboot to the list of KEYWORDS to skip in .Xr rcorder 8 . .It Invoke .Xr rcorder 8 to order the files in .Pa /etc/rc.d/ that do not have a .Dq Li nostart KEYWORD (refer to .Xr rcorder 8 Ns 's .Fl s flag). .It Call each script in turn using .Fn run_rc_script (from .Xr rc.subr 8 ) , which sets .Va $1 to .Dq Li start , and sources the script in a subshell. Stop processing when the script that is the value of the .Va $early_late_divider has been run. .It Check again to see if the file .Va ${firstboot_sentinel} exists (in case it is located on a newly mounted file system) and adjust the list of KEYWORDs to skip appropriately. .It Re-run .Xr rcorder 8 , this time including the scripts in the .Va $local_startup directories. Ignore everything up to the .Va $early_late_divider , then start executing the scripts as described above. .It If the file .Va ${firstboot_sentinel} exists, delete it. If the file .Va ${firstboot_sentinel}-reboot also exists (because it was created by a script), then delete it and reboot. .El .Ss Operation of Nm rc.shutdown .Bl -enum .It +Set +.Va rc_shutdown +to the value of the first argument passed to +.Nm rc.shutdown +or to +.Dq Li unspecified +if no argument was passed. +.It Source .Pa /etc/rc.subr to load various .Xr rc.subr 8 shell functions to use. .It Load the configuration files. .It Invoke .Xr rcorder 8 to order the files in .Pa /etc/rc.d/ and the .Va $local_startup directories that have a .Dq Li shutdown KEYWORD (refer to .Xr rcorder 8 Ns 's .Fl k flag), reverse that order, and assign the result to a variable. .It Call each script in turn using .Fn run_rc_script (from .Xr rc.subr 8 ) , which sets .Va $1 to .Dq Li faststop , and sources the script in a subshell. .El .Ss Contents of Nm rc.d/ .Nm rc.d/ is located in .Pa /etc/rc.d/ . The following file naming conventions are currently used in .Nm rc.d/ : .Bl -tag -width ".Pa ALLUPPERCASE" -offset indent .It Pa ALLUPPERCASE Scripts that are .Dq placeholders to ensure that certain operations are performed before others. In order of startup, these are: .Bl -tag -width ".Pa NETWORKING" .It Pa NETWORKING Ensure basic network services are running, including general network configuration. .It Pa SERVERS Ensure basic services exist for services that start early (such as .Pa nisdomain ) , because they are required by .Pa DAEMON below. .It Pa DAEMON Check-point before all general purpose daemons such as .Pa lpd and .Pa ntpd . .It Pa LOGIN Check-point before user login services .Pa ( inetd and .Pa sshd ) , as well as services which might run commands as users .Pa ( cron and .Pa sendmail ) . .El .It Pa bar Scripts that are sourced in a subshell. The boot does not stop if such a script terminates with a non-zero status, but a script can stop the boot if necessary by invoking the .Fn stop_boot function (from .Xr rc.subr 8 ) . .El .Pp Each script should contain .Xr rcorder 8 keywords, especially an appropriate .Dq Li PROVIDE entry, and if necessary .Dq Li REQUIRE and .Dq Li BEFORE keywords. .Pp Each script is expected to support at least the following arguments, which are automatically supported if it uses the .Fn run_rc_command function: .Bl -tag -width ".Cm restart" -offset indent .It Cm start Start the service. This should check that the service is to be started as specified by .Xr rc.conf 5 . Also checks if the service is already running and refuses to start if it is. This latter check is not performed by standard .Fx scripts if the system is starting directly to multi-user mode, to speed up the boot process. If .Cm forcestart is given, ignore the .Xr rc.conf 5 check and start anyway. .It Cm stop If the service is to be started as specified by .Xr rc.conf 5 , stop the service. This should check that the service is running and complain if it is not. If .Cm forcestop is given, ignore the .Xr rc.conf 5 check and attempt to stop. .It Cm restart Perform a .Cm stop then a .Cm start . .It Cm status If the script starts a process (rather than performing a one-off operation), show the status of the process. Otherwise it is not necessary to support this argument. Defaults to displaying the process ID of the program (if running). .It Cm enable Enable the service in .Xr rc.conf 5 . .It Cm disable Disable the service in .Xr rc.conf 5 . .It Cm delete Remove the service from .Xr rc.conf 5 . If .Ql Li service_delete_empty is set to .Dq Li YES , .Pa /etc/rc.conf.d/$servicename will be deleted if empty after modification. .It Cm describe Print a short description of what the script does. .It Cm extracommands Print the script's non-standard commands. .It Cm poll If the script starts a process (rather than performing a one-off operation), wait for the command to exit. Otherwise it is not necessary to support this argument. .It Cm enabled Return 0 if the service is enabled and 1 if it is not. This command does not print anything. .It Cm rcvar Display which .Xr rc.conf 5 variables are used to control the startup of the service (if any). .El .Pp If a script must implement additional commands it can list them in the .Va extra_commands variable, and define their actions in a variable constructed from the command name (see the .Sx EXAMPLES section). .Pp The following key points apply to old-style scripts in .Pa /usr/local/etc/rc.d/ : .Bl -bullet .It Scripts are only executed if their .Xr basename 1 matches the shell globbing pattern .Pa *.sh , and they are executable. Any other files or directories present within the directory are silently ignored. .It When a script is executed at boot time, it is passed the string .Dq Li start as its first and only argument. At shutdown time, it is passed the string .Dq Li stop as its first and only argument. All .Nm rc.d/ scripts are expected to handle these arguments appropriately. If no action needs to be taken at a given time (either boot time or shutdown time), the script should exit successfully and without producing an error message. .It The scripts within each directory are executed in lexicographical order. If a specific order is required, numbers may be used as a prefix to the existing filenames, so for example .Pa 100.foo would be executed before .Pa 200.bar ; without the numeric prefixes the opposite would be true. .It The output from each script is traditionally a space character, followed by the name of the software package being started or shut down, .Em without a trailing newline character (see the .Sx EXAMPLES section). .El .Sh SCRIPTS OF INTEREST When an automatic reboot is in progress, .Nm is invoked with the argument .Cm autoboot . One of the scripts run from .Pa /etc/rc.d/ is .Pa /etc/rc.d/fsck . This script runs .Xr fsck 8 with option .Fl p and .Fl F to .Dq preen all the disks of minor inconsistencies resulting from the last system shutdown. If this fails, then checks/repairs of serious inconsistencies caused by hardware or software failure will be performed in the background at the end of the booting process. If .Cm autoboot is not set, when going from single-user to multi-user mode for example, the script does not do anything. .Pp The .Pa /etc/rc.d/local script can execute scripts from multiple .Nm rc.d/ directories. The default location includes .Pa /usr/local/etc/rc.d/ , but these may be overridden with the .Va local_startup .Xr rc.conf 5 variable. .Pp The .Pa /etc/rc.d/serial script is used to set any special configurations for serial devices. .Pp The .Nm rc.firewall script is used to configure rules for the kernel based firewall service. It has several possible options: .Pp .Bl -tag -width ".Ar filename" -compact -offset indent .It Cm open will allow anyone in .It Cm client will try to protect just this machine .It Cm simple will try to protect a whole network .It Cm closed totally disables IP services except via .Pa lo0 interface .It Cm UNKNOWN disables the loading of firewall rules .It Ar filename will load the rules in the given filename (full path required). .El .Pp Most daemons, including network related daemons, have their own script in .Pa /etc/rc.d/ , which can be used to start, stop, and check the status of the service. .Pp Any architecture specific scripts, such as .Pa /etc/rc.d/apm for example, specifically check that they are on that architecture before starting the daemon. .Pp Following tradition, all startup files reside in .Pa /etc . .Sh FILES .Bl -tag -compact -width Pa .It Pa /etc/rc .It Pa /etc/rc.conf .It Pa /etc/rc.conf.local .It Pa /etc/rc.d/ .It Pa /etc/rc.firewall .It Pa /etc/rc.local .It Pa /etc/rc.shutdown .It Pa /etc/rc.subr .It Pa /var/run/dmesg.boot .Xr dmesg 8 results soon after the .Nm process begins. Useful when .Xr dmesg 8 buffer in the kernel no longer has this information. .El .Sh EXAMPLES The following is a minimal .Nm rc.d/ style script. Most scripts require little more than the following. .Bd -literal -offset indent #!/bin/sh # # PROVIDE: foo # REQUIRE: bar_service_required_to_precede_foo \&. /etc/rc.subr name="foo" rcvar=foo_enable command="/usr/local/bin/foo" load_rc_config $name run_rc_command "$1" .Ed .Pp Certain scripts may want to provide enhanced functionality. The user may access this functionality through additional commands. The script may list and define as many commands at it needs. .Bd -literal -offset indent #!/bin/sh # # PROVIDE: foo # REQUIRE: bar_service_required_to_precede_foo # BEFORE: baz_service_requiring_foo_to_precede_it \&. /etc/rc.subr name="foo" rcvar=foo_enable command="/usr/local/bin/foo" extra_commands="nop hello" hello_cmd="echo Hello World." nop_cmd="do_nop" do_nop() { echo "I do nothing." } load_rc_config $name run_rc_command "$1" .Ed .Pp As all processes are killed by .Xr init 8 at shutdown, the explicit .Xr kill 1 is unnecessary, but is often included. .Sh SEE ALSO .Xr kill 1 , .Xr rc.conf 5 , .Xr init 8 , .Xr rc.resume 8 , .Xr rc.subr 8 , .Xr rcorder 8 , .Xr reboot 8 , .Xr savecore 8 , .Xr service 8 , .Xr sysrc 8 .Sh HISTORY The .Nm utility appeared in .Bx 4.0 . Index: stable/12/usr.sbin/jail/jail.8 =================================================================== --- stable/12/usr.sbin/jail/jail.8 (revision 354724) +++ stable/12/usr.sbin/jail/jail.8 (revision 354725) @@ -1,1404 +1,1404 @@ .\" Copyright (c) 2000, 2003 Robert N. M. Watson .\" Copyright (c) 2008-2012 James Gritton .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd November 27, 2018 +.Dd August 6, 2019 .Dt JAIL 8 .Os .Sh NAME .Nm jail .Nd "manage system jails" .Sh SYNOPSIS .Nm .Op Fl dhilqv .Op Fl J Ar jid_file .Op Fl u Ar username .Op Fl U Ar username .Op Fl cmr .Ar param Ns = Ns Ar value ... .Op Cm command Ns = Ns Ar command ... .Nm .Op Fl dqv .Op Fl f Ar conf_file .Op Fl p Ar limit .Op Fl cmr .Op Ar jail .Nm .Op Fl qv .Op Fl f Ar conf_file .Op Fl e Ar separator .Op Fl rR .Op Cm * | Ar jail ... .Nm .Op Fl dhilqv .Op Fl J Ar jid_file .Op Fl u Ar username .Op Fl U Ar username .Op Fl n Ar jailname .Op Fl s Ar securelevel .Op Ar path hostname [ Ar ip Ns [ Ns Ar ,... Ns ]] Ar command ... .Sh DESCRIPTION The .Nm utility creates new jails, or modifies or removes existing jails. It can also print a list of configured jails and their parameters. A jail .Pq or Dq prison is specified via parameters on the command line, or in the .Xr jail.conf 5 file. .Pp At least one of the options .Fl c , .Fl e , .Fl m or .Fl r must be specified. These options are used alone or in combination to describe the operation to perform: .Bl -tag -width indent .It Fl c Create a new jail. The jail .Va jid and .Va name parameters (if specified on the command line) must not refer to an existing jail. .It Fl e Ar separator Exhibit a list of all configured non-wildcard jails and their parameters. No jail creation, modification or removal performed if this option is used. The .Ar separator string is used to separate parameters. Use .Xr jls 8 utility to list running jails. .It Fl m Modify an existing jail. One of the .Va jid or .Va name parameters must exist and refer to an existing jail. Some parameters may not be changed on a running jail. .It Fl r Remove the .Ar jail specified by jid or name. All jailed processes are killed, and all jails that are children of this jail are also removed. .It Fl rc Restart an existing jail. The jail is first removed and then re-created, as if .Dq Nm Fl r and .Dq Nm Fl c were run in succession. .It Fl cm Create a jail if it does not exist, or modify the jail if it does exist. .It Fl mr Modify an existing jail. The jail may be restarted if necessary to modify parameters than could not otherwise be changed. .It Fl cmr Create a jail if it doesn't exist, or modify (and possibly restart) the jail if it does exist. .El .Pp Other available options are: .Bl -tag -width indent .It Fl d Allow making changes to a dying jail, equivalent to the .Va allow.dying parameter. .It Fl f Ar conf_file Use configuration file .Ar conf_file instead of the default .Pa /etc/jail.conf . .It Fl h Resolve the .Va host.hostname parameter (or .Va hostname ) and add all IP addresses returned by the resolver to the list of addresses for this jail. This is equivalent to the .Va ip_hostname parameter. .It Fl i Output (only) the jail identifier of the newly created jail(s). This implies the .Fl q option. .It Fl J Ar jid_file Write a .Ar jid_file file, containing the parameters used to start the jail. .It Fl l Run commands in a clean environment. This is deprecated and is equivalent to the exec.clean parameter. .It Fl n Ar jailname Set the jail's name. This is deprecated and is equivalent to the .Va name parameter. .It Fl p Ar limit Limit the number of commands from .Va exec.* that can run simultaneously. .It Fl q Suppress the message printed whenever a jail is created, modified or removed. Only error messages will be printed. .It Fl R A variation of the .Fl r option that removes an existing jail without using the configuration file. No removal-related parameters for this jail will be used \(em the jail will simply be removed. .It Fl s Ar securelevel Set the .Va kern.securelevel MIB entry to the specified value inside the newly created jail. This is deprecated and is equivalent to the .Va securelevel parameter. .It Fl u Ar username The user name from host environment as whom jailed commands should run. This is deprecated and is equivalent to the .Va exec.jail_user and .Va exec.system_jail_user parameters. .It Fl U Ar username The user name from the jailed environment as whom jailed commands should run. This is deprecated and is equivalent to the .Va exec.jail_user parameter. .It Fl v Print a message on every operation, such as running commands and mounting filesystems. .El .Pp If no arguments are given after the options, the operation (except remove) will be performed on all jails specified in the .Xr jail.conf 5 file. A single argument of a jail name will operate only on the specified jail. The .Fl r and .Fl R options can also remove running jails that aren't in the .Xr jail.conf 5 file, specified by name or jid. .Pp An argument of .Dq * is a wildcard that will operate on all jails, regardless of whether they appear in .Xr jail.conf 5 ; this is the surest way for .Fl r to remove all jails. If hierarchical jails exist, a partial-matching wildcard definition may be specified. For example, an argument of .Dq foo.* would apply to jails with names like .Dq foo.bar and .Dq foo.bar.baz . .Pp A jail may be specified with parameters directly on the command line. In this case, the .Xr jail.conf 5 file will not be used. For backward compatibility, the command line may also have four fixed parameters, without names: .Ar path , .Ar hostname , .Ar ip , and .Ar command . This mode will always create a new jail, and the .Fl c and .Fl m options do not apply (and must not be present). .Ss Jail Parameters Parameters in the .Xr jail.conf 5 file, or on the command line, are generally of the form .Dq name=value . Some parameters are boolean, and do not have a value but are set by the name alone with or without a .Dq no prefix, e.g. .Va persist or .Va nopersist . They can also be given the values .Dq true and .Dq false . Other parameters may have more than one value, specified as a comma-separated list or with .Dq += in the configuration file (see .Xr jail.conf 5 for details). .Pp The .Nm utility recognizes two classes of parameters. There are the true jail parameters that are passed to the kernel when the jail is created, which can be seen with .Xr jls 8 , and can (usually) be changed with .Dq Nm Fl m . Then there are pseudo-parameters that are only used by .Nm itself. .Pp Jails have a set of core parameters, and kernel modules can add their own jail parameters. The current set of available parameters can be retrieved via .Dq Nm sysctl Fl d Va security.jail.param . Any parameters not set will be given default values, often based on the current environment. The core parameters are: .Bl -tag -width indent .It Va jid The jail identifier. This will be assigned automatically to a new jail (or can be explicitly set), and can be used to identify the jail for later modification, or for such commands as .Xr jls 8 or .Xr jexec 8 . .It Va name The jail name. This is an arbitrary string that identifies a jail (except it may not contain a .Sq \&. ) . Like the .Va jid , it can be passed to later .Nm commands, or to .Xr jls 8 or .Xr jexec 8 . If no .Va name is supplied, a default is assumed that is the same as the .Va jid . The .Va name parameter is implied by the .Xr jail.conf 5 file format, and need not be explicitly set when using the configuration file. .It Va path The directory which is to be the root of the jail. Any commands run inside the jail, either by .Nm or from .Xr jexec 8 , are run from this directory. .It Va ip4.addr A list of IPv4 addresses assigned to the jail. If this is set, the jail is restricted to using only these addresses. Any attempts to use other addresses fail, and attempts to use wildcard addresses silently use the jailed address instead. For IPv4 the first address given will be used as the source address when source address selection on unbound sockets cannot find a better match. It is only possible to start multiple jails with the same IP address if none of the jails has more than this single overlapping IP address assigned to itself. .It Va ip4.saddrsel A boolean option to change the formerly mentioned behaviour and disable IPv4 source address selection for the jail in favour of the primary IPv4 address of the jail. Source address selection is enabled by default for all jails and the .Va ip4.nosaddrsel setting of a parent jail is not inherited for any child jails. .It Va ip4 Control the availability of IPv4 addresses. Possible values are .Dq inherit to allow unrestricted access to all system addresses, .Dq new to restrict addresses via .Va ip4.addr , and .Dq disable to stop the jail from using IPv4 entirely. Setting the .Va ip4.addr parameter implies a value of .Dq new . .It Va ip6.addr , Va ip6.saddrsel , Va ip6 A set of IPv6 options for the jail, the counterparts to .Va ip4.addr , .Va ip4.saddrsel and .Va ip4 above. .It Va vnet Create the jail with its own virtual network stack, with its own network interfaces, addresses, routing table, etc. The kernel must have been compiled with the .Sy VIMAGE option for this to be available. Possible values are .Dq inherit to use the system network stack, possibly with restricted IP addresses, and .Dq new to create a new network stack. .It Va host.hostname The hostname of the jail. Other similar parameters are .Va host.domainname , .Va host.hostuuid and .Va host.hostid . .It Va host Set the origin of hostname and related information. Possible values are .Dq inherit to use the system information and .Dq new for the jail to use the information from the above fields. Setting any of the above fields implies a value of .Dq new . .It Va securelevel The value of the jail's .Va kern.securelevel sysctl. A jail never has a lower securelevel than its parent system, but by setting this parameter it may have a higher one. If the system securelevel is changed, any jail securelevels will be at least as secure. .It Va devfs_ruleset The number of the devfs ruleset that is enforced for mounting devfs in this jail. A value of zero (default) means no ruleset is enforced. Descendant jails inherit the parent jail's devfs ruleset enforcement. Mounting devfs inside a jail is possible only if the .Va allow.mount and .Va allow.mount.devfs permissions are effective and .Va enforce_statfs is set to a value lower than 2. Devfs rules and rulesets cannot be viewed or modified from inside a jail. .Pp NOTE: It is important that only appropriate device nodes in devfs be exposed to a jail; access to disk devices in the jail may permit processes in the jail to bypass the jail sandboxing by modifying files outside of the jail. See .Xr devfs 8 for information on how to use devfs rules to limit access to entries in the per-jail devfs. A simple devfs ruleset for jails is available as ruleset #4 in .Pa /etc/defaults/devfs.rules . .It Va children.max The number of child jails allowed to be created by this jail (or by other jails under this jail). This limit is zero by default, indicating the jail is not allowed to create child jails. See the .Sx "Hierarchical Jails" section for more information. .It Va children.cur The number of descendants of this jail, including its own child jails and any jails created under them. .It Va enforce_statfs This determines what information processes in a jail are able to get about mount points. It affects the behaviour of the following syscalls: .Xr statfs 2 , .Xr fstatfs 2 , .Xr getfsstat 2 , and .Xr fhstatfs 2 (as well as similar compatibility syscalls). When set to 0, all mount points are available without any restrictions. When set to 1, only mount points below the jail's chroot directory are visible. In addition to that, the path to the jail's chroot directory is removed from the front of their pathnames. When set to 2 (default), above syscalls can operate only on a mount-point where the jail's chroot directory is located. .It Va persist Setting this boolean parameter allows a jail to exist without any processes. Normally, a command is run as part of jail creation, and then the jail is destroyed as its last process exits. A new jail must have either the .Va persist parameter or .Va exec.start or .Va command pseudo-parameter set. .It Va cpuset.id The ID of the cpuset associated with this jail (read-only). .It Va dying This is true if the jail is in the process of shutting down (read-only). .It Va parent The .Va jid of the parent of this jail, or zero if this is a top-level jail (read-only). .It Va osrelease The string for the jail's .Va kern.osrelease sysctl and uname -r. .It Va osreldate The number for the jail's .Va kern.osreldate and uname -K. .It Va allow.* Some restrictions of the jail environment may be set on a per-jail basis. With the exception of .Va allow.set_hostname and .Va allow.reserved_ports , these boolean parameters are off by default. .Bl -tag -width indent .It Va allow.set_hostname The jail's hostname may be changed via .Xr hostname 1 or .Xr sethostname 3 . .It Va allow.sysvipc A process within the jail has access to System V IPC primitives. This is deprecated in favor of the per-module parameters (see below). When this parameter is set, it is equivalent to setting .Va sysvmsg , .Va sysvsem , and .Va sysvshm all to .Dq inherit . .It Va allow.raw_sockets The jail root is allowed to create raw sockets. Setting this parameter allows utilities like .Xr ping 8 and .Xr traceroute 8 to operate inside the jail. If this is set, the source IP addresses are enforced to comply with the IP address bound to the jail, regardless of whether or not the .Dv IP_HDRINCL flag has been set on the socket. Since raw sockets can be used to configure and interact with various network subsystems, extra caution should be used where privileged access to jails is given out to untrusted parties. .It Va allow.chflags Normally, privileged users inside a jail are treated as unprivileged by .Xr chflags 2 . When this parameter is set, such users are treated as privileged, and may manipulate system file flags subject to the usual constraints on .Va kern.securelevel . .It Va allow.mount privileged users inside the jail will be able to mount and unmount file system types marked as jail-friendly. The .Xr lsvfs 1 command can be used to find file system types available for mount from within a jail. This permission is effective only if .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.devfs privileged users inside the jail will be able to mount and unmount the devfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. The devfs ruleset should be restricted from the default by using the .Va devfs_ruleset option. .It Va allow.quotas The jail root may administer quotas on the jail's filesystem(s). This includes filesystems that the jail may share with other jails or with non-jailed parts of the system. .It Va allow.read_msgbuf Jailed users may read the kernel message buffer. If the .Va security.bsd.unprivileged_read_msgbuf MIB entry is zero, this will be restricted to the root user. .It Va allow.socket_af Sockets within a jail are normally restricted to IPv4, IPv6, local (UNIX), and route. This allows access to other protocol stacks that have not had jail functionality added to them. .It Va allow.mlock Locking or unlocking physical pages in memory are normally not available within a jail. When this parameter is set, users may .Xr mlock 2 or .Xr munlock 2 memory subject to .Va security.bsd.unprivileged_mlock and resource limits. .It Va allow.reserved_ports The jail root may bind to ports lower than 1024. .El .El .Pp Kernel modules may add their own parameters, which only exist when the module is loaded. These are typically headed under a parameter named after the module, with values of .Dq inherit to give the jail full use of the module, .Dq new to encapsulate the jail in some module-specific way, and .Dq disable to make the module unavailable to the jail. There also may be other parameters to define jail behavior within the module. Module-specific parameters include: .Bl -tag -width indent .It Va allow.mount.fdescfs privileged users inside the jail will be able to mount and unmount the fdescfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.fusefs privileged users inside the jail will be able to mount and unmount fuse-based file systems. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.nullfs privileged users inside the jail will be able to mount and unmount the nullfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.procfs privileged users inside the jail will be able to mount and unmount the procfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.linprocfs privileged users inside the jail will be able to mount and unmount the linprocfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.linsysfs privileged users inside the jail will be able to mount and unmount the linsysfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.tmpfs privileged users inside the jail will be able to mount and unmount the tmpfs file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. .It Va allow.mount.zfs privileged users inside the jail will be able to mount and unmount the ZFS file system. This permission is effective only together with .Va allow.mount and only when .Va enforce_statfs is set to a value lower than 2. See .Xr zfs 8 for information on how to configure the ZFS filesystem to operate from within a jail. .It Va allow.vmm The jail may access .Xr vmm 4 . This flag is only available when the .Xr vmm 4 kernel module is loaded. .It Va linux Determine how a jail's Linux emulation environment appears. A value of .Dq inherit will keep the same environment, and .Dq new -will give the jail it's own environment (still originally inherited when +will give the jail its own environment (still originally inherited when the jail is created). .It Va linux.osname , linux.osrelease , linux.oss_version The Linux OS name, OS release, and OSS version associated with this jail. .It Va sysvmsg Allow access to SYSV IPC message primitives. If set to .Dq inherit , all IPC objects on the system are visible to this jail, whether they were created by the jail itself, the base system, or other jails. If set to .Dq new , the jail will have its own key namespace, and can only see the objects that it has created; the system (or parent jail) has access to the jail's objects, but not to its keys. If set to .Dq disable , the jail cannot perform any sysvmsg-related system calls. .It Va sysvsem, sysvshm Allow access to SYSV IPC semaphore and shared memory primitives, in the same manner as .Va sysvmsg. .El .Pp There are pseudo-parameters that are not passed to the kernel, but are used by .Nm to set up the jail environment, often by running specified commands when jails are created or removed. The .Va exec.* command parameters are .Xr sh 1 command lines that are run in either the system or jail environment. They may be given multiple values, which would run the specified commands in sequence. All commands must succeed (return a zero exit status), or the jail will not be created or removed, as appropriate. .Pp The pseudo-parameters are: .Bl -tag -width indent .It Va exec.prestart Command(s) to run in the system environment before a jail is created. .It Va exec.created Command(s) to run in the system environment right after a jail has been created, but before commands (or services) get executed in the jail. .It Va exec.start Command(s) to run in the jail environment when a jail is created. A typical command to run is .Dq sh /etc/rc . .It Va command A synonym for .Va exec.start for use when specifying a jail directly on the command line. Unlike other parameters whose value is a single string, .Va command uses the remainder of the .Nm command line as its own arguments. .It Va exec.poststart Command(s) to run in the system environment after a jail is created, and after any .Va exec.start commands have completed. .It Va exec.prestop Command(s) to run in the system environment before a jail is removed. .It Va exec.stop Command(s) to run in the jail environment before a jail is removed, and after any .Va exec.prestop commands have completed. A typical command to run is -.Dq sh /etc/rc.shutdown . +.Dq sh /etc/rc.shutdown jail . .It Va exec.poststop Command(s) to run in the system environment after a jail is removed. .It Va exec.clean Run commands in a clean environment. The environment is discarded except for .Ev HOME , SHELL , TERM and .Ev USER . .Ev HOME and .Ev SHELL are set to the target login's default values. .Ev USER is set to the target login. .Ev TERM is imported from the current environment. The environment variables from the login class capability database for the target login are also set. .It Va exec.jail_user The user to run commands as, when running in the jail environment. The default is to run the commands as the current user. .It Va exec.system_jail_user This boolean option looks for the .Va exec.jail_user in the system .Xr passwd 5 file, instead of in the jail's file. .It Va exec.system_user The user to run commands as, when running in the system environment. The default is to run the commands as the current user. .It Va exec.timeout The maximum amount of time to wait for a command to complete, in seconds. If a command is still running after this timeout has passed, the jail will not be created or removed, as appropriate. .It Va exec.consolelog A file to direct command output (stdout and stderr) to. .It Va exec.fib The FIB (routing table) to set when running commands inside the jail. .It Va stop.timeout The maximum amount of time to wait for a jail's processes to exit after sending them a .Dv SIGTERM signal (which happens after the .Va exec.stop commands have completed). After this many seconds have passed, the jail will be removed, which will kill any remaining processes. If this is set to zero, no .Dv SIGTERM is sent and the jail is immediately removed. The default is 10 seconds. .It Va interface A network interface to add the jail's IP addresses .Va ( ip4.addr and .Va ip6.addr ) to. An alias for each address will be added to the interface before the jail is created, and will be removed from the interface after the jail is removed. .It Va ip4.addr In addition to the IP addresses that are passed to the kernel, an interface, netmask and additional parameters (as supported by .Xr ifconfig 8 Ns ) may also be specified, in the form .Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar netmask param ... . If an interface is given before the IP address, an alias for the address will be added to that interface, as it is with the .Va interface parameter. If a netmask in either dotted-quad or CIDR form is given after an IP address, it will be used when adding the IP alias. If additional parameters are specified then they will also be used when adding the IP alias. .It Va ip6.addr In addition to the IP addresses that are passed to the kernel, an interface, prefix and additional parameters (as supported by .Xr ifconfig 8 Ns ) may also be specified, in the form .Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar prefix param ... . .It Va vnet.interface A network interface to give to a vnet-enabled jail after is it created. The interface will automatically be released when the jail is removed. .It Va ip_hostname Resolve the .Va host.hostname parameter and add all IP addresses returned by the resolver to the list of addresses .Po Va ip4.addr or .Va ip6.addr Pc for this jail. This may affect default address selection for outgoing IPv4 connections from jails. The address first returned by the resolver for each address family will be used as the primary address. .It Va mount A filesystem to mount before creating the jail (and to unmount after removing it), given as a single .Xr fstab 5 line. .It Va mount.fstab An .Xr fstab 5 format file containing filesystems to mount before creating a jail. .It Va mount.devfs Mount a .Xr devfs 5 filesystem on the chrooted .Pa /dev directory, and apply the ruleset in the .Va devfs_ruleset parameter (or a default of ruleset 4: devfsrules_jail) to restrict the devices visible inside the jail. .It Va mount.fdescfs Mount a .Xr fdescfs 5 filesystem on the chrooted .Pa /dev/fd directory. .It Va mount.procfs Mount a .Xr procfs 5 filesystem on the chrooted .Pa /proc directory. .It Va allow.dying Allow making changes to a .Va dying jail. .It Va depend Specify a jail (or jails) that this jail depends on. When this jail is to be created, any jail(s) it depends on must already exist. If not, they will be created automatically, up to the completion of the last .Va exec.poststart command, before any action will taken to create this jail. When jails are removed the opposite is true: this jail will be removed, up to the last .Va exec.poststop command, before any jail(s) it depends on are stopped. .El .Sh EXAMPLES Jails are typically set up using one of two philosophies: either to constrain a specific application (possibly running with privilege), or to create a .Dq "virtual system image" running a variety of daemons and services. In both cases, a fairly complete file system install of .Fx is required, so as to provide the necessary command line tools, daemons, libraries, application configuration files, etc. However, for a virtual server configuration, a fair amount of additional work is required so as to replace the .Dq boot process. This manual page documents the configuration steps necessary to support either of these steps, although the configuration steps may need to be refined based on local requirements. .Ss "Setting up a Jail Directory Tree" To set up a jail directory tree containing an entire .Fx distribution, the following .Xr sh 1 command script can be used: .Bd -literal D=/here/is/the/jail cd /usr/src mkdir -p $D make world DESTDIR=$D make distribution DESTDIR=$D .Ed .Pp In many cases this example would put far more in the jail than needed. In the other extreme case a jail might contain only one file: the executable to be run in the jail. .Pp We recommend experimentation, and caution that it is a lot easier to start with a .Dq fat jail and remove things until it stops working, than it is to start with a .Dq thin jail and add things until it works. .Ss "Setting Up a Jail" Do what was described in .Sx "Setting Up a Jail Directory Tree" to build the jail directory tree. For the sake of this example, we will assume you built it in .Pa /data/jail/testjail , for a jail named .Dq testjail . Substitute below as needed with your own directory, IP address, and hostname. .Ss "Setting up the Host Environment" First, set up the real system's environment to be .Dq jail-friendly . For consistency, we will refer to the parent box as the .Dq "host environment" , and to the jailed virtual machine as the .Dq "jail environment" . Since jails are implemented using IP aliases, one of the first things to do is to disable IP services on the host system that listen on all local IP addresses for a service. If a network service is present in the host environment that binds all available IP addresses rather than specific IP addresses, it may service requests sent to jail IP addresses if the jail did not bind the port. This means changing .Xr inetd 8 to only listen on the appropriate IP address, and so forth. Add the following to .Pa /etc/rc.conf in the host environment: .Bd -literal -offset indent sendmail_enable="NO" inetd_flags="-wW -a 192.0.2.23" rpcbind_enable="NO" .Ed .Pp .Li 192.0.2.23 is the native IP address for the host system, in this example. Daemons that run out of .Xr inetd 8 can be easily configured to use only the specified host IP address. Other daemons will need to be manually configured \(em for some this is possible through .Xr rc.conf 5 flags entries; for others it is necessary to modify per-application configuration files, or to recompile the application. The following frequently deployed services must have their individual configuration files modified to limit the application to listening to a specific IP address: .Pp To configure .Xr sshd 8 , it is necessary to modify .Pa /etc/ssh/sshd_config . .Pp To configure .Xr sendmail 8 , it is necessary to modify .Pa /etc/mail/sendmail.cf . .Pp For .Xr named 8 , it is necessary to modify .Pa /etc/namedb/named.conf . .Pp In addition, a number of services must be recompiled in order to run them in the host environment. This includes most applications providing services using .Xr rpc 3 , such as .Xr rpcbind 8 , .Xr nfsd 8 , and .Xr mountd 8 . In general, applications for which it is not possible to specify which IP address to bind should not be run in the host environment unless they should also service requests sent to jail IP addresses. Attempting to serve NFS from the host environment may also cause confusion, and cannot be easily reconfigured to use only specific IPs, as some NFS services are hosted directly from the kernel. Any third-party network software running in the host environment should also be checked and configured so that it does not bind all IP addresses, which would result in those services also appearing to be offered by the jail environments. .Pp Once these daemons have been disabled or fixed in the host environment, it is best to reboot so that all daemons are in a known state, to reduce the potential for confusion later (such as finding that when you send mail to a jail, and its sendmail is down, the mail is delivered to the host, etc.). .Ss "Configuring the Jail" Start any jail for the first time without configuring the network interface so that you can clean it up a little and set up accounts. As with any machine (virtual or not), you will need to set a root password, time zone, etc. Some of these steps apply only if you intend to run a full virtual server inside the jail; others apply both for constraining a particular application or for running a virtual server. .Pp Start a shell in the jail: .Bd -literal -offset indent jail -c path=/data/jail/testjail mount.devfs \\ host.hostname=testhostname ip4.addr=192.0.2.100 \\ command=/bin/sh .Ed .Pp Assuming no errors, you will end up with a shell prompt within the jail. You can now run .Xr bsdconfig 8 and do the post-install configuration to set various configuration options, or perform these actions manually by editing .Pa /etc/rc.conf , etc. .Pp .Bl -bullet -offset indent -compact .It Configure .Pa /etc/resolv.conf so that name resolution within the jail will work correctly. .It Run .Xr newaliases 1 to quell .Xr sendmail 8 warnings. .It Set a root password, probably different from the real host system. .It Set the timezone. .It Add accounts for users in the jail environment. .It Install any packages the environment requires. .El .Pp You may also want to perform any package-specific configuration (web servers, SSH servers, etc), patch up .Pa /etc/syslog.conf so it logs as you would like, etc. If you are not using a virtual server, you may wish to modify .Xr syslogd 8 in the host environment to listen on the syslog socket in the jail environment; in this example, the syslog socket would be stored in .Pa /data/jail/testjail/var/run/log . .Pp Exit from the shell, and the jail will be shut down. .Ss "Starting the Jail" You are now ready to restart the jail and bring up the environment with all of its daemons and other programs. Create an entry for the jail in .Pa /etc/jail.conf : .Bd -literal -offset indent testjail { path = /tmp/jail/testjail; mount.devfs; host.hostname = testhostname; ip4.addr = 192.0.2.100; interface = ed0; exec.start = "/bin/sh /etc/rc"; - exec.stop = "/bin/sh /etc/rc.shutdown"; + exec.stop = "/bin/sh /etc/rc.shutdown jail"; } .Ed .Pp To start a virtual server environment, .Pa /etc/rc is run to launch various daemons and services, and .Pa /etc/rc.shutdown is run to shut them down when the jail is removed. If you are running a single application in the jail, substitute the command used to start the application for .Dq /bin/sh /etc/rc ; there may be some script available to cleanly shut down the application, or it may be sufficient to go without a stop command, and have .Nm send .Dv SIGTERM to the application. .Pp Start the jail by running: .Bd -literal -offset indent jail -c testjail .Ed .Pp A few warnings may be produced; however, it should all work properly. You should be able to see .Xr inetd 8 , .Xr syslogd 8 , and other processes running within the jail using .Xr ps 1 , with the .Ql J flag appearing beside jailed processes. To see an active list of jails, use .Xr jls 8 . If .Xr sshd 8 is enabled in the jail environment, you should be able to .Xr ssh 1 to the hostname or IP address of the jailed environment, and log in using the accounts you created previously. .Pp It is possible to have jails started at boot time. Please refer to the .Dq jail_* variables in .Xr rc.conf 5 for more information. .Ss "Managing the Jail" Normal machine shutdown commands, such as .Xr halt 8 , .Xr reboot 8 , and .Xr shutdown 8 , cannot be used successfully within the jail. To kill all processes from within a jail, you may use one of the following commands, depending on what you want to accomplish: .Bd -literal -offset indent kill -TERM -1 kill -KILL -1 .Ed .Pp This will send the .Dv SIGTERM or .Dv SIGKILL signals to all processes in the jail \(em be careful not to run this from the host environment! Once all of the jail's processes have died, unless the jail was created with the .Va persist parameter, the jail will be removed. Depending on the intended use of the jail, you may also want to run .Pa /etc/rc.shutdown from within the jail. .Pp To shut down the jail from the outside, simply remove it with .Nm .Ar -r , which will run any commands specified by .Va exec.stop , and then send .Dv SIGTERM and eventually .Dv SIGKILL to any remaining jailed processes. .Pp The .Pa /proc/ Ns Ar pid Ns Pa /status file contains, as its last field, the name of the jail in which the process runs, or .Dq Li - to indicate that the process is not running within a jail. The .Xr ps 1 command also shows a .Ql J flag for processes in a jail. .Pp You can also list/kill processes based on their jail ID. To show processes and their jail ID, use the following command: .Pp .Dl "ps ax -o pid,jid,args" .Pp To show and then kill processes in jail number 3 use the following commands: .Bd -literal -offset indent pgrep -lfj 3 pkill -j 3 .Ed or: .Pp .Dl "killall -j 3" .Ss "Jails and File Systems" It is not possible to .Xr mount 8 or .Xr umount 8 any file system inside a jail unless the file system is marked jail-friendly, the jail's .Va allow.mount parameter is set, and the jail's .Va enforce_statfs parameter is lower than 2. .Pp Multiple jails sharing the same file system can influence each other. For example, a user in one jail can fill the file system, leaving no space for processes in the other jail. Trying to use .Xr quota 1 to prevent this will not work either, as the file system quotas are not aware of jails but only look at the user and group IDs. This means the same user ID in two jails share a single file system quota. One would need to use one file system per jail to make this work. .Ss "Sysctl MIB Entries" The read-only entry .Va security.jail.jailed can be used to determine if a process is running inside a jail (value is one) or not (value is zero). .Pp The variable .Va security.jail.max_af_ips determines how may address per address family a jail may have. The default is 255. .Pp Some MIB variables have per-jail settings. Changes to these variables by a jailed process do not affect the host environment, only the jail environment. These variables are .Va kern.securelevel , .Va kern.hostname , .Va kern.domainname , .Va kern.hostid , and .Va kern.hostuuid . .Ss "Hierarchical Jails" By setting a jail's .Va children.max parameter, processes within a jail may be able to create jails of their own. These child jails are kept in a hierarchy, with jails only able to see and/or modify the jails they created (or those jails' children). Each jail has a read-only .Va parent parameter, containing the .Va jid of the jail that created it; a .Va jid of 0 indicates the jail is a child of the current jail (or is a top-level jail if the current process isn't jailed). .Pp Jailed processes are not allowed to confer greater permissions than they themselves are given, e.g., if a jail is created with .Va allow.nomount , it is not able to create a jail with .Va allow.mount set. Similarly, such restrictions as .Va ip4.addr and .Va securelevel may not be bypassed in child jails. .Pp A child jail may in turn create its own child jails if its own .Va children.max parameter is set (remember it is zero by default). These jails are visible to and can be modified by their parent and all ancestors. .Pp Jail names reflect this hierarchy, with a full name being an MIB-type string separated by dots. For example, if a base system process creates a jail .Dq foo , and a process under that jail creates another jail .Dq bar , then the second jail will be seen as .Dq foo.bar in the base system (though it is only seen as .Dq bar to any processes inside jail .Dq foo ) . Jids on the other hand exist in a single space, and each jail must have a unique jid. .Pp Like the names, a child jail's .Va path appears relative to its creator's own .Va path . This is by virtue of the child jail being created in the chrooted environment of the first jail. .Sh SEE ALSO .Xr killall 1 , .Xr lsvfs 1 , .Xr newaliases 1 , .Xr pgrep 1 , .Xr pkill 1 , .Xr ps 1 , .Xr quota 1 , .Xr jail_set 2 , .Xr vmm 4 , .Xr devfs 5 , .Xr fdescfs 5 , .Xr jail.conf 5 , .Xr linprocfs 5 , .Xr linsysfs 5 , .Xr procfs 5 , .Xr rc.conf 5 , .Xr sysctl.conf 5 , .Xr bsdconfig 8 , .Xr chroot 8 , .Xr devfs 8 , .Xr halt 8 , .Xr ifconfig 8 , .Xr inetd 8 , .Xr jexec 8 , .Xr jls 8 , .Xr mount 8 , .Xr named 8 , .Xr reboot 8 , .Xr rpcbind 8 , .Xr sendmail 8 , .Xr shutdown 8 , .Xr sysctl 8 , .Xr syslogd 8 , .Xr umount 8 .Sh HISTORY The .Nm utility appeared in .Fx 4.0 . Hierarchical/extensible jails were introduced in .Fx 8.0 . The configuration file was introduced in .Fx 9.1 . .Sh AUTHORS .An -nosplit The jail feature was written by .An Poul-Henning Kamp for R&D Associates who contributed it to .Fx . .Pp .An Robert Watson wrote the extended documentation, found a few bugs, added a few new features, and cleaned up the userland jail environment. .Pp .An Bjoern A. Zeeb added multi-IP jail support for IPv4 and IPv6 based on a patch originally done by .An Pawel Jakub Dawidek for IPv4. .Pp .An James Gritton added the extensible jail parameters, hierarchical jails, and the configuration file. .Sh BUGS It might be a good idea to add an address alias flag such that daemons listening on all IPs .Pq Dv INADDR_ANY will not bind on that address, which would facilitate building a safe host environment such that host daemons do not impose on services offered from within jails. Currently, the simplest answer is to minimize services offered on the host, possibly limiting it to services offered from .Xr inetd 8 which is easily configurable. .Sh NOTES Great care should be taken when managing directories visible within the jail. For example, if a jailed process has its current working directory set to a directory that is moved out of the jail's chroot, then the process may gain access to the file space outside of the jail. It is recommended that directories always be copied, rather than moved, out of a jail. .Pp In addition, there are several ways in which an unprivileged user outside the jail can cooperate with a privileged user inside the jail and thereby obtain elevated privileges in the host environment. Most of these attacks can be mitigated by ensuring that the jail root is not accessible to unprivileged users in the host environment. Regardless, as a general rule, untrusted users with privileged access to a jail should not be given access to the host environment. Index: stable/12/usr.sbin/jail/jail.conf.5 =================================================================== --- stable/12/usr.sbin/jail/jail.conf.5 (revision 354724) +++ stable/12/usr.sbin/jail/jail.conf.5 (revision 354725) @@ -1,231 +1,231 @@ .\" Copyright (c) 2012 James Gritton .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" $FreeBSD$ .\" -.Dd February 13, 2014 +.Dd August 6, 2019 .Dt JAIL.CONF 5 .Os .Sh NAME .Nm jail.conf .Nd configuration file for .Xr jail 8 .Sh DESCRIPTION A .Xr jail 8 configuration file consists of one or more jail definitions statements, and parameter or variable statements within those jail definitions. A jail definition statement looks something like a C compound statement. A parameter statement looks like a C assignment, including a terminating semicolon. .Pp The general syntax of a jail definition is: .Bd -literal -offset indent jailname { parameter = "value"; parameter = "value"; ... } .Ed .Pp Each jail is required to have a .Va name at the front of its definition. This is used by .Xr jail 8 to specify a jail on the command line and report the jail status, and is also passed to the kernel when creating the jail. .Ss Parameters A jail is defined by a set of named parameters, specified inside the jail definition. See .Xr jail 8 for a list of jail parameters passed to the kernel, as well as internal parameters used when creating and removing jails. .Pp A typical parameter has a name and a value. Some parameters are boolean and may be specified with values of .Dq true or .Dq false , or as valueless shortcuts, with a .Dq no prefix indicating a false value. For example, these are equivalent: .Bd -literal -offset indent allow.mount = "false"; allow.nomount; .Ed .Pp Other parameters may have more than one value. A comma-separated list of values may be set in a single statement, or an existing parameter list may be appended to using .Dq += : .Bd -literal -offset indent ip4.addr = 10.1.1.1, 10.1.1.2, 10.1.1.3; ip4.addr = 10.1.1.1; ip4.addr += 10.1.1.2; ip4.addr += 10.1.1.3; .Ed .Pp Note the .Va name parameter is implicitly set to the name in the jail definition. .Ss String format Parameter values, including jail names, can be single tokens or quoted strings. A token is any sequence of characters that aren't considered special in the syntax of the configuration file (such as a semicolon or whitespace). If a value contains anything more than letters, numbers, dots, dashes and underscores, it is advisable to put quote marks around that value. Either single or double quotes may be used. .Pp Special characters may be quoted by preceding them with a backslash. Common C-style backslash character codes are also supported, including control characters and octal or hex ASCII codes. A backslash at the end of a line will ignore the subsequent newline and continue the string at the start of the next line. .Ss Variables A string may use shell-style variable substitution. A parameter or variable name preceded by a dollar sign, and possibly enclosed in braces, will be replaced with the value of that parameter or variable. For example, a jail's path may be defined in terms of its name or hostname: .Bd -literal -offset indent path = "/var/jail/$name"; path = "/var/jail/${host.hostname}"; .Ed .Pp Variable substitution occurs in unquoted tokens or in double-quoted strings, but not in single-quote strings. .Pp A variable is defined in the same way a parameter is, except that the variable name is preceded with a dollar sign: .Bd -literal -offset indent $parentdir = "/var/jail"; path = "$parentdir/$name"; .Ed .Pp The difference between parameters and variables is that variables are only used for substitution, while parameters are used both for substitution and for passing to the kernel. .Ss Wildcards A jail definition with a name of .Dq * is used to define wildcard parameters. Every defined jail will contain both the parameters from its own definition statement, as well as any parameters in a wildcard definition. .Pp Variable substitution is done on a per-jail basis, even when that substitution is for a parameter defined in a wildcard section. This is useful for wildcard parameters based on e.g. a jail's name. .Pp Later definitions in the configuration file supersede earlier ones, so a wildcard section placed before (above) a jail definition defines parameters that could be changed on a per-jail basis. Or a wildcard section placed after (below) all jails would contain parameters that always apply to every jail. Multiple wildcard statements are allowed, and wildcard parameters may also be specified outside of a jail definition statement. .Pp If hierarchical jails are defined, a partial-matching wildcard definition may be specified. For example, a definition with a name of .Dq foo.* would apply to jails with names like .Dq foo.bar and .Dq foo.bar.baz . .Ss Comments The configuration file may contain comments in the common C, C++, and shell formats: .Bd -literal -offset indent /* This is a C style comment. * It may span multiple lines. */ // This is a C++ style comment. # This is a shell style comment. .Ed .Pp Comments are legal wherever whitespace is allowed, i.e. anywhere except in the middle of a string or a token. .Sh EXAMPLES .Bd -literal # Typical static defaults: # Use the rc scripts to start and stop jails. Mount jail's /dev. exec.start = "/bin/sh /etc/rc"; -exec.stop = "/bin/sh /etc/rc.shutdown"; +exec.stop = "/bin/sh /etc/rc.shutdown jail"; exec.clean; mount.devfs; # Dynamic wildcard parameter: # Base the path off the jail name. path = "/var/jail/$name"; # A typical jail. foo { host.hostname = "foo.com"; ip4.addr = 10.1.1.1, 10.1.1.2, 10.1.1.3; } # This jail overrides the defaults defined above. bar { exec.start = ''; exec.stop = ''; path = /; mount.nodevfs; persist; // Required because there are no processes } .Ed .Sh SEE ALSO .Xr jail_set 2 , .Xr rc.conf 5 , .Xr jail 8 , .Xr jls 8 .Sh HISTORY The .Xr jail 8 utility appeared in .Fx 4.0 . The .Nm file was added in .Fx 9.1 . .Sh AUTHORS .An -nosplit The jail feature was written by .An Poul-Henning Kamp for R&D Associates who contributed it to .Fx . .Pp .An James Gritton added the extensible jail parameters and configuration file. Index: stable/12 =================================================================== --- stable/12 (revision 354724) +++ stable/12 (revision 354725) Property changes on: stable/12 ___________________________________________________________________ Modified: svn:mergeinfo ## -0,0 +0,1 ## Merged /head:r353039