aboutsummaryrefslogtreecommitdiff
path: root/libexec
Commit message (Collapse)AuthorAgeFilesLines
* rc.d/dumpon: minor hardening/tightening upEnji Cooper2026-07-161-5/+8
| | | | | | | | | - Scope local variables properly to each function. - Quote variables that should be treated as single words. - Replace `${cmd}; if [ $? -eq 0 ]` with `if ${cmd}` for simplicity. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57899
* rtld: unify the return path for map_object()Konstantin Belousov2026-06-291-6/+4
| | | | | | | Reviewed by: kevans Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* rtld: stop using unbound alloca()Konstantin Belousov2026-06-293-25/+63
| | | | | | | | | | | | | | | | | For DoneList allocations, its size depends on the number of loaded DSOs. Small images could be served by alloca(), but large donelists need to go into heap. For map_object(), alloca size is the number of segments in the object. In both cases, over-grown situations would cause a stack overflow. PR: 295991 Noted and reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* rtld: add spinlock around the crt malloc callsKonstantin Belousov2026-06-292-26/+71
| | | | | | | | | | | | | Right now, the rtld malloc is called under the write-locked rtld bind lock. A future change adds places where only read-locked rtld bind lock is held, and then the spinlock protects the malloc structures from the parallel updates. Reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
* pflog: create bpf tapping points without ifnet(9)Kristof Provost2026-06-281-17/+5
| | | | | | | | | | | | | | | | | | | | Just as was done for ipfw's log device stop creating entire struct ifnet's for pflog devices. Create only a bpf_t. This does mean we lose the create/destroy infrastructure provided by the clone interface. Rather than implement this ourselves we allow users to configure the number of pflog interfaces using the net.pflog.if_count sysctl. We default to 8 devices, but allow up to 256. The /etc/rc.d/pflog script will create extra devices as required. While it was possible to rename pflog devices pfctl expected the pflogX name, so it's safe to assume users never did this. Requested by: glebius Reviewed by: glebius Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D57851
* rc.d: fix lockd and statd flags processing after scvjAlexander Leidinger2026-06-272-2/+4
| | | | | | | | | | | | | | | | | | The documented flags are named differently than the script name, this requires special handling of the flags. The Service Jails feature requires the handling of the variable to be differently than it was initially. The change back then did not work, which resulted in the flags to be ignored. This commit fixes the issue in head. This affects 15.0 and 15.1 too. PR: 296233 Reported by: Robert Blayzor <rblayzor@inoc.net> Tested by: Robert Blayzor <rblayzor@inoc.net> Fixes: f99f0ee14e3af81c2 - rc.d: add a service jails config to all base system services MFC after: 1 month MFC to: 15-stable
* rc.d/tmp: Fix dupe mount checkDag-Erling Smørgrav2026-06-261-4/+9
| | | | | | | | | | | | | | | Before mounting a new mfs on /tmp, we check if there already is one. However, the dupe check only takes /dev/md[0-9]* into account, while the default mfs type these days is tmpfs. Rewrite it to look for tmpfs as well. Note that the dupe check is redundant in the tmpmfs=auto case, but we leave moving it for later. PR: 182035 MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57682
* rc.d/ddb: Really silently exitDag-Erling Smørgrav2026-06-261-2/+2
| | | | | | | | | | | | | | | | | The comment says “silently exit if ddb is not enabled”, but we'd exit with an error message. Note that I switched the sysctl variable used to test for the presence of ddb from debug.ddb.scripting.scripts to d.d.s.script, which has a smaller value if set. While here, drop a pointless fork-exec, and use ${SYSCTL_N} for consistency. PR: 177217 MFC after: 1 week Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57686
* rc.firewall: Support on-disk listsDag-Erling Smørgrav2026-06-262-15/+39
| | | | | | | | | | | | | | | For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679
* rc.firewall: Use checkyesno for boolean variablesDag-Erling Smørgrav2026-06-261-34/+19
| | | | | | | | | | Use the checkyesno function from rc.subr instead of hardcoded checks for boolean variables. Also drop an incorrect comment about the default logamount value; the actual default is zero (unlimited). MFC after: 1 week Reviewed by: kevans, allanjude Differential Revision: https://reviews.freebsd.org/D57678
* rc: Make devmatch use load_kldDag-Erling Smørgrav2026-06-231-2/+4
| | | | | | | | | | | | | The default behavior of load_kld is now robust enough for devmatch. Switching means settings from /etc/sysctl.kld.d are now properly applied when the corresponding modules are loaded by devmatch. While here, reduce the amount of output produced by devmatch from one line per module to a single line. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57707
* rc: Improve load_kldDag-Erling Smørgrav2026-06-233-16/+19
| | | | | | | | | | | | | | | | | * Centralize the usage message. * Document and enforce that -e and -m are mutually exclusive; previously, speficying both would result in only -e being applied. * If -e was not specified, and -m was not specified or did not match, fall back to `kldstat -n file` which will always work for modules that aren't built into the kernel. This means the kld and ntpd scripts can now rely on load_kld to dtrt. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57706
* rc: Fix improper use of load_kldDag-Erling Smørgrav2026-06-234-9/+9
| | | | | | | | | | | Fix scripts that needlessly used -e when the simpler -m would work, or that used -m when the module and file name are the same, or, in one particularly egregious case, used -m with the wrong name when using nothing at all would have worked just fine. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57705
* zfskeys - only prompt if zfskeys and zfskeys_prompt are enabledDoug Ambrisko2026-06-232-7/+10
| | | | | | | | | | | | | | By default don't block booting with a prompt if a zpool needs a keyboard password to unlock it. To enable prompting for keyboard password during boot require: zfskeys_enable="YES" zfskeys_prompt_enable="YES" to both be enabled. This returns to POLA of prior behaviour. PR: 296130 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57750
* rtld: Check for -1 as an-end-of-section markerDaniel Levin2026-06-221-2/+4
| | | | | | | | | | | | | | | | rtld calls functions in the .init_array section one at a time, until it finds a distinguished sentinel value. The C runtime does the same thing (in crtend.c). However, that checks for the sentinel -1 and not 1. If one is using a linker that unifies .ctors and .init_array, then rtld will miss the sentinel value. I believe the author of this code intended to write -1 instead of 1. Indeed, changing the code to also check for -1 prevents rtld from attempting to call a non-existent function. The same is true of .dtors and .fini_array. Signed-off-by: Daniel Levin <daniellevin2607@gmail.com> Reviewed by: kib MFC after: 3 days Pull Request: https://github.com/freebsd/freebsd-src/pull/2270
* rtld-elf: add some tests for parse_integer()Konstantin Belousov2026-06-142-0/+45
| | | | | | | Reviewed by: des, dim Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57549
* rtld parse_integer(): support binary, octal, and hex C notationsKonstantin Belousov2026-06-141-9/+34
| | | | | | | Reviewed by: des, dim Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57549
* rc.d/routing: Silence errors for loopback routesPouria Mousavizadeh Tehrani2026-06-121-3/+16
| | | | | | | | | | | | | _loopback entry in `static_routes` ensures a loopback route exists in all routing tables. However, loopback routes may already be added by the kernel. Therefore, re-adding them triggers an `EEXIST` error on every boot. This change suppresses those harmless errors. PR: 259553 MFC after: 1 week Reviewed by: glebius, jlduran, markj Differential Revision: https://reviews.freebsd.org/D57470
* nuageinit: validate set-name to prevent shell injection in variable namesBaptiste Daroussin2026-06-091-2/+6
| | | | | | | Shell variable names cannot be safely quoted with shell_escape() — only alphanumeric characters are valid. Add validation that set-name only matches [a-zA-Z0-9]+; invalid values are rejected with a warning and the rename is skipped entirely.
* nuageinit: fix shell injection in power_state_change delay and add testBaptiste Daroussin2026-06-092-2/+2
|
* nuageinit: fix shell command injection in multiple rc.conf.d writesBaptiste Daroussin2026-06-092-82/+53
|
* nuageinit: use single-quote shell escaping for hostname in rc.conf.dBaptiste Daroussin2026-06-094-9/+9
| | | | | | | | | | | | | | | | | The hostname value was written inside double quotes in /etc/rc.conf.d/hostname. POSIX shell performs command substitution inside double quotes, so a hostname containing $() or backticks would be executed when the file is sourced (e.g., by rc(8)). Switch to using the existing shell_escape() helper, which wraps values in single quotes. In POSIX shell, single-quoted strings are completely literal — no expansion or substitution of any kind is performed. While the hostname is already validated to contain only [a-zA-Z0-9.-], this change provides defense-in-depth so the output format is safe regardless of future validation changes. Reported by: Yazdan Soltani <yazdan.soltani@gmail.com>
* nuageinit: Create parent directories in write_filesJesús Daniel Colmenares Oviedo2026-06-082-2/+3
| | | | | | | | | | | | | | | | | | | Currently, 'write_files' does not create parent directories, and 'runcmd' cannot be used here, since those scripts run after the files have been written. The only workaround is to create the files in an existing directory, such as '/root' or '/tmp', and then move those files using 'runcmd', but this is cumbersome when there are many files, even if they are small. With this change, nuageinit now creates the parent directories for each file using the path field, which mimics the same behavior as in cloud-init. Permissions and ownership can also be configured using 'runcmd'. Reviewed by: bapt@ Approved by: bapt@ Differential Revision: https://reviews.freebsd.org/D57395
* nuageinit: install certs in /usr/share/certs/trustedBaptiste Daroussin2026-06-063-4/+4
| | | | Suggested by: kevans
* nuageinit: update documentation for phone_home and final_messageBaptiste Daroussin2026-06-061-1/+32
|
* nuageinit: expose decode_base64 to fix testsBaptiste Daroussin2026-06-061-0/+1
|
* nuageinit: implement phone_home supportBaptiste Daroussin2026-06-052-2/+122
| | | | | | | | Posts instance data (hostname, instance_id, public keys) to a URL using fetch(1). Supports: - url: target URL - post: list of data items to send, or 'all' - tries: number of retry attempts (default 1)
* nuageinit: implement final_message supportBaptiste Daroussin2026-06-052-0/+41
|
* nuage.lua: add encode_base64 helperBaptiste Daroussin2026-06-062-0/+50
|
* nuageinit: implement power_state_change and locale supportBaptiste Daroussin2026-06-053-0/+166
|
* nuageinit: implement MIME multipart user-data supportBaptiste Daroussin2026-06-054-0/+132
| | | | | Add support for MIME multipart/mixed user-data, allowing a single user-data blob to contain multiple parts with different content types.
* nuageinit: implement ca_certs supportBaptiste Daroussin2026-06-053-0/+67
| | | | | | Add support for the 'ca_certs' cloud-config key which manages CA certificates by writing them to /etc/ssl/certs/ and running certctl rehash.
* nuageinit: implement ntp supportBaptiste Daroussin2026-06-053-0/+86
| | | | | Add support for the 'ntp' cloud-config key which configures NTP by writing /etc/ntp.conf with server and pool entries.
* Revert "libc: Constify the getcap API"Dag-Erling Smørgrav2026-06-051-1/+6
| | | | | | This broke cross-building on Linux and macOS. This reverts commit 823d00b2d447247f1c5860e3bbc61f6fd19a70e5.
* rc: Bail if /dev/null is not a deviceDag-Erling Smørgrav2026-06-051-0/+5
| | | | | | | | | | | | | On startup, check that /dev/null exists and is a character device. Otherwise, one of two things will happen: either /dev is a writable directory and we will immediately create /dev/null as a regular file and dump garbage into it, or it does not and we will spit out a stream of error messages about failing to create /dev/null. PR: 295782 MFC after: 1 week Reviewed by: jhb, emaste Differential Revision: https://reviews.freebsd.org/D57447
* nuageinit: implement ssh_authkey_fingerprints supportBaptiste Daroussin2026-06-053-0/+50
| | | | | Add support for the 'ssh_authkey_fingerprints' cloud-config key which logs SSH host key fingerprints to the console via ssh-keygen.
* nuageinit: implement keyboard supportBaptiste Daroussin2026-06-053-1/+73
|
* nuageinit: implement resolv_conf supportBaptiste Daroussin2026-06-054-0/+87
| | | | | Add support for the 'resolv_conf' cloud-config key which writes directly to /etc/resolv.conf.
* nuageinit: implement mounts supportBaptiste Daroussin2026-06-054-1/+144
| | | | | | Add support for the 'mounts' cloud-config key which configures mount points by appending entries to /etc/fstab and creating the corresponding directories.
* nuageinit: add tests for bootcmd, ssh_deletekeys, disable_root, manage_etc_hostsBaptiste Daroussin2026-06-051-0/+167
|
* nuageinit: implement manage_etc_hosts supportBaptiste Daroussin2026-06-053-6/+99
| | | | | | | | Add support for adding the instance hostname to /etc/hosts on the 127.0.0.1 and ::1 localhost lines, matching cloud-init's default behaviour (manage_etc_hosts: true). create a revolve_hostname helper to avoid code duplucation.
* nuageinit: implement bootcmd supportBaptiste Daroussin2026-06-053-0/+27
| | | | | | | | | | | | | | Add support for the 'bootcmd' cloud-config directive, which allows running commands very early in the boot process, before the hostname is set and before the network is configured. - nuageinit: bootcmd() function follows the same pattern as runcmd(), writing commands to /var/cache/nuageinit/bootcmds instead of runcmds. It is the first entry in the pre_network_calls table. - rc.d/nuageinit: execute /var/cache/nuageinit/bootcmds immediately after /usr/libexec/nuageinit completes, before unmounting the config drive. This ensures bootcmd runs before NETWORKING per cloud-init spec.
* libc: Constify the getcap APIDag-Erling Smørgrav2026-06-041-6/+1
| | | | | | | MFC after: 1 week Inspired by: NetBSD Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D57252
* nuageinit: complete SSH support with ssh_deletekeys and disable_rootBaptiste Daroussin2026-06-043-0/+70
| | | | | | | | | | | | | | | | Add missing SSH cloud-config options from cloud-init spec: - ssh_deletekeys: remove existing SSH host keys on first boot so new ones are generated automatically by sshd(8). Implemented as delete_ssh_host_keys() in nuage.lua using lfs.dir() with a directory existence guard via lfs.attributes(). - disable_root: set PermitRootLogin to 'no' (or a custom value via disable_root_opts) in /etc/ssh/sshd_config. - disable_root_opts: optional string or array to override the PermitRootLogin value used when disable_root is true. Only the first array element is used.
* nuageinit: refactor goto abuse in chpasswd()Baptiste Daroussin2026-06-041-17/+11
| | | | | | Replace goto next/list pattern with proper elseif/else control structure. The goto-based flow was fragile and hard to follow; the elseif chain makes the validation logic explicit and linear.
* nuageinit: fix update_sshd_config crash when file does not existBaptiste Daroussin2026-06-042-12/+38
| | | | | | | | | | | | Previously update_sshd_config() would assert-fail if sshd_config did not exist. Now it creates a new file with the given key/value. Also replace the fragile simultaneous r+ + temp file approach with a cleaner read-then-write pattern: read all lines into memory, modify as needed, then write to a temp file and rename. All assert() calls replaced with proper error handling via warnmsg(). Add test case for missing file creation.
* nuageinit: fix TOCTOU in addsshkey, adddoas, addsudoBaptiste Daroussin2026-06-041-40/+52
| | | | | | | | | | | | | | | Replace check-then-create patterns with direct creation: - addsshkey: check what exists before creation, use mkdir_p() for .ssh directory, handle errors with warnmsg() instead of assert(). Apply chmod/chown only on newly created files/directories. - adddoas: same pattern for doas.conf and the etc directory. - addsudo: same pattern for the sudoers file and sudoers.d directory. All three functions now use warnmsg() for error handling instead of returning nil,err or using assert().
* nuageinit: fix non-standard f:close(cmd) and remove dead precmdBaptiste Daroussin2026-06-041-4/+3
| | | | | | - f:close(cmd) -> f:close() in adduser() and exec_change_password(): the 'cmd' argument is not standard Lua and is silently ignored. - Remove dead 'precmd' variable in adduser().
* nuageinit: remove dead checkgroup(), inline check in purge_group()Baptiste Daroussin2026-06-041-13/+9
| | | | | | Call getgroups() once instead of N times per call. Inline the membership check directly, removing the now-unused checkgroup() helper function.
* nuageinit: add hostname validation (RFC 952/1123) to sethostname()Baptiste Daroussin2026-06-043-1/+96
| | | | | | | | | | | | | Validate hostnames before writing them: - Reject empty hostnames - Reject hostnames longer than 253 characters - Reject hostnames with invalid characters - Reject hostnames starting or ending with dot/hyphen - Reject labels longer than 63 characters - Reject labels starting or ending with hyphen Expand the sethostname test to cover all rejection cases. Update nuage.sh sethostname_body to ignore stderr (warnings).
generated by cgit v1.3 (git 2.53.0) at 2026-09-01 23:53:48 +0000