- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

init: Set kernel login class and CPU mask on new processes.

In particular, this makes the kernel login class on processes started from
/etc/rc "daemon" instead of "default".

Reviewed by: trasz

init: Remove unnecessary 2-second delay before calling reboot(2).

Properly clear the O_NONBLOCK flag after opening the TTY.

Though we should open the TTY with O_NONBLOCK to prevent rc(8) execution
from potentially stalling, we must not forget to clear the flag later
on, to prevent read(2) calls from failing later on.

This prevented the shell pathname prompt from working properly.

Reported by: kib

mdoc: terminate quoted strings.

Reviewed by: brueffer

Make init(8) slightly more robust when /dev/console is missing.

If the environment doesn't offer a working /dev/console, the existing
version of init(8) will simply refuse running rc(8) scripts. This means
you'll only have a system running init(8) and nothing else.

Change the code to do the following:

- Open /dev/console like we used to do, but make it more robust to use
O_NONBLOCK to prevent blocking on a carrier.
- If this fails, use /dev/null as stdin and /var/log/init.log as stdout
and stderr.
- If even this fails, use /dev/null as stdin, stdout and stderr.

So why us this useful? Well, if you remove the `getpid() == 1' check in
main(), you can now use init(8) inside jails to properly execute rc(8).
It still requires some polishing, as existing tools assume init(8) has
PID 1.

Also it is now possible to use use init(8) on `headless' devices that
don't even have a serial boot console.

Fix whitespace.

MFC after: 1 week

Handle NULL return from crypt(3). Mostly from DragonFly

Move utmpx handling out of init(8).

This has the following advantages:

- During boot, the BOOT_TIME record is now written right after the file
systems become writable, but before users are allowed to log in. This
means that they can't cause `hidden logins' by logging in right before
init(8) kicks in.

- The pututxline(3) function may potentially block on file locking,
though this is very rare to occur. By placing it in an rc script, the
user can still kill it with ^C if needed.

- Most importantly: jails don't use init(8). This means that a force
reboot of a system running jails will leave stale entries in the
accounting database of the jails individually.

Add missing static keywords for global variables to tools in sbin/.

These tools declare global variables without using the static keyword,
even though their use is limited to a single C-file, or without placing
an extern declaration of them in the proper header file.

- change "is is" to "is" or "it is"
- change "the the" to "the"

Approved by: lstewart
Approved by: sahil (mentor)
MFC after: 3 days

init(8): Document that login(1) is now responsible for recording logouts.

init(8) only uses utmpx for recording reboots and shutdowns.

init: Only run /etc/rc.shutdown if /etc/rc was run.

It does not make sense to shut down daemons that were not started. In
particular, this fixes loss of mixer settings when shutting down using
shutdown(8), init(8) or ctrl+alt+del from single-user mode.

If /etc/rc reboots, /etc/rc.shutdown is not run.

Also fix segfaults and other erratic behaviour if init receives SIGHUP or
SIGTSTP while in single-user mode.

This commit does not attempt to fix any badness with signal handlers
(assumption that pointers can be read and written atomically, EINTR race
condition). I believe it does not make this badness any worse.

Silence on: -arch@

Remove stale inclusion of <ulog.h>.

This tool doesn't require libulog anymore.

Remove stale references to utmp(5) and its corresponding filenames.

I removed utmp and its manpage, but not other manpages referring to it.

Migrate init(8) towards utmpx.

According to a comment, we cannot safely remove utmpx entries here
anymore. This is because the libc routines may block on file locking. In
an ideal world login(1) should just remove the entries, which is why I'm
disabling this code for now. If it turns out we get lots of stale
entries here, we should figure out a way to deal with that.

Let init(8) and reboot(8) use utmpx to log wtmp entries.

logwtmp() gets called with the raw strings that are written to disk. For
regular user entries, this isn't too bad, but when booting/shutting
down, the contents get rather cryptic.

Just call the standardized pututxline().

Switch the default WARNS level for sbin/ to 6.

Submitted by: Ulrich Spörlein

Remove redundant code from runshutdown() now tcsetsid(3) works reliably.

We can now just call setctty() without any problems. This means the
shell running the shutdown script is now the session leader, just like
on startup.

Fix the staircase issue properly this time.

Even though I thought this bug was somewhere in the TTY layer, it turns
out init(8) doesn't make sure /dev/console is opened initially properly.
I've added revoke() to two pieces of code:

- death(): Apart from killing the gettys on shutdown, this doesn't
guarantee the TTY to be closed immediately.
- runshutdown(): Just like setctty(), we should revoke /dev/console.
Applications like syslogd may have file descriptors to the console.

Static-ify procedures in init(8).

Addition style(9) change.

style(9)

I understood the MLINK part incorrectly, it should be the other way around
also remove the init mlink to securelevel.

Discussed with and sharing pointyhat with: brueffer

Patches to allow one to allow one to specify a directory to chroot to.
This includes support for running a script to setup that directory.
The kenv variables init_chroot and init_script control this behavior,
and are documented in loader(8) that's about to be committed (along
with the other variables like init_path...).

Submitted by: Oliver Fromme
Reviewed by: myself, jhb (earlier versions)

Fix typo: effected -> affected

Submitted by: Gordon Stratton <tsr2600 (at) gmail (dot) com>

Reparent the process that executes the window= command from the ttys
to the init. This prevents zombies from being accumulated.

PR: bin/64198
Tested by: Eugene Grosbein <eugen at www svzserv kemerovo su>
Approved by: kan (mentor)
MFC after: 1 month

use standard mode instead of 500 for /sbin/init.

As discussed on -current, there is no sensitive info in /sbin/init
to prevent reading it from non-privileged users, nor any reason to
remove the 'x' bit as the first thing the program does is check the
uid and exit if it is not run by root.

Instead (and this is why i make the change), mode 500 prevents
operation when exporting the partition without -maproot=0 to diskless
clients.

All previuos releases are affected by the same problem, so a merge
to RELENG_6 at least would be appropriate (after proper re@ approval
of course).

-mdoc sweep.

Fix system shutdown timeout handling by again supporting longer running
shutdown procedures (which have a duration of more than 120 seconds).

We have two user-space affecting shutdown timeouts: a "soft" one in
/etc/rc.shutdown and a "hard" one in init(8). The first one can be
configured via /etc/rc.conf variable "rcshutdown_timeout" and defaults
to 30 seconds. The second one was originally (in 1998) intended to be
configured via sysctl(8) variable "kern.shutdown_timeout" and defaults
to 120 seconds.

Unfortunately, the "kern.shutdown_timeout" was declared "unused" in 1999
(as it obviously is actually not used within the kernel itself) and
hence was intentionally but misleadingly removed in revision 1.107 from
init_main.c. Kernel sysctl(8) variables are certainly a wrong way to
control user-space processes in general, but in this particular case the
sysctl(8) variable should have remained as it supports init(8), which
isn't passed command line flags (which in turn could have been set via
/etc/rc.conf), etc.

As there is already a similar "kern.init_path" sysctl(8) variable which
directly affects init(8), resurrect the init(8) shutdown timeout under
sysctl(8) variable "kern.init_shutdown_timeout". But this time document
it as being intentionally unused within the kernel and used by init(8).
Also document it in the manpages init(8) and rc.conf(5).

Reviewed by: phk
MFC after: 2 weeks

Moved descriptions of securelevels from init(7) to security(7).

Files used both "securelevel" and either "secure level" or
"security level"; all are now "security level".

PR: docs/84266
Submitted by: garys
Approved by: keramida
MFC after: 3 days

Sort sections.

Make WARNS=6 happy with our init(8):
- Use more ``const''s where suitable.
- Define strk() as a static function in global scope.
This avoids the "nested extern declaration" warnings.
- Use static initialization of strings, rather than
referring string constants through char *.
- Bump WARNS from 0 to 6.

NOSHARED -> NO_SHARED

Introduce the PRECIOUSPROG knob in bsd.prog.mk, similar
to PRECIOUSLIB from bsd.lib.mk. The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.

Reviewed by: oliver

Turns out that revision 1.52 was a bad idea. It broke the long
standing ability to list a non-existant device in /etc/ttys to keep it
from dying. This is a documented feature of init(8):
The init utility can also be used to keep arbitrary daemons running,
automatically restarting them if they die. In this case, the first field
in the ttys(5) file must not reference the path to a configured device
node and will be passed to the daemon as the final argument on its com-
mand line. This is similar to the facility offered in the AT&T System V
UNIX /etc/inittab.

So rather than fix the man page to 'break' this feature, back out the change.

At the time this change was made, people felt that the spamage from
getty was annoying on headless consoles. Andrew Gallatin noted:
> Most of my machines are headless without video cards and use a serial
> console. With devfs this means that /dev/ttyv[1-N] do not exist and
> getty bitches like this:
>
> Sep 26 11:00:11 monet getty[543]: open /dev/ttyv1: No such file or directory

and we went off and applied this hack rather than fixing getty to
sleep forever when it gets an unknown device, as was Andrew's other
suggestion. Since it breaks things, I'm off to do that instead.

Add references to pf(4) and pfctl(8) at the description of
securelevel = 3.

PR: docs/69417
Submitted by: Janos Mohacsi (mohacsi(at)niif(dot)hu)

Mechanically kill hard sentence breaks.

Assorted markup, grammar, and spelling fixes.

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp

Fixed misspellings of 0 as NULL.

style.Makefile(5):
Use WARNS?= instead of WARNS=.

Mention that securelevel 1 also blocks access to /dev/io if it
exists (not all platforms have it).

Fix the case where one goes from zero to more than zero items enabled
in /etc/ttys. Before this fix, once the count of active services
reaches 0, one could never restart any more without a reboot.

Steve Passe did the leg work on this patch. After he found the fix,
we discovered that an identical fix had been made to NetBSD.

Approved by: re@ <scottl>
Approval tool: peril sensitive sunglasses

Make init statically linked by default. It's not worth the pain of having
a dynamically linked init as recently seen by ia64 woes.

Approved by: re (jhb)

- Add some information about how init, securelevel, and jails
interact with each other.
- Minor markup fix (.Dq -> .Va for a variable)

Reviewed by: rwatson
Approved by: blackend (mentor)

Add section number to .Xr

There are 5 securelevels, not 4.

PR: docs/50049
Submitted by: Colin Percival <cperciva@sfu.ca>

mdoc(7) police: markup laundry.

Back out the previous commit, since there could be dire consequences if
/etc/rc were accidentally executed (as requested by other committeers).

/home/green/tmp/cvsSFosXg

Give up on a tty if opening it's special file returns ENOENT like we do for
ENXIO.

Glanced at by: imp, gallatin

s/filesystem/file system/g as discussed on -developers

can not -> cannot.

I should have committed this ages ago...
Convert init(8) to use nmount() instead of mount() when
it has to mount devfs. This doesn't happen normally,
since the kernel is supposed to mount devfs itself.

The .Nm utility

o remove __P
o Use ansi function definitions
o unifdef -D__STDC__

Remove 'register' keyword.
It does not help modern compilers, and some may take some hit from it.
(I also found several functions that listed *every* of its 10 local vars with
"register" -- just how many free registers do people think machines have?)

Default to WARNS=2.
Binary builds that cannot handle this must explicitly set WARNS=0.

Reviewed by: mike

Allow reboot during runcom.

PR: bin/28116
Submitted by: Valentin Nechayev <netch@netch.kiev.ua>
MFC in: 1 week

Silence non-constant format string warnings by marking functions
as __printflike()/__printf0like(), adding const, or adding missing "%s"
format strings, as appropriate.

MFC after: 2 weeks

mdoc(7) police: protect trailing full stops of abbreviations
with a trailing zero-width space: `e.g.\&'.

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

Use STD{ERR,IN,OUT}_FILENO instead of their numeric values. The
definitions are more readable, and it's possible that they're
more portable to pathalogical platforms.

Submitted by: David Hill <david@phobia.ms>

Remove whitespace at EOL.

mdoc(7) police: removed HISTORY info from the .Os call.

Fix typo which could lead to memory leak.

PR: misc/28283
MFC after: 2 weeks

Use new backup feature of install(1).

Back out most of revision 1.28: lists of diagnostics must use -diag,
not -tag. Instead, put a period after the error messages to aide
those using dumb terminals not capable of properly displaying markup.

Requested by: ru

Make the list in the DIAGNOSTICS section "-tag" instead of "-diag":
the former makes it more obvious as to there the error message starts
and the explanation begins.

PR: 26431

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for sbin/ to 8.

Fix typo present since 1997: single used mode -> single user mode.

Fix a cosmetic problem with some very defensive programming: The devfs
mount would show up as "/dev/", loose that trailing slash.

Further tidy up the sbin/init and release builds.

This is not necessarily the correct fix, but at least sbin/init compiles
in a sterile environment like "make release"

Prepare for mdoc(7)NG.

Add `_PATH_DEVZERO'.
Use _PATH_* where where possible.

Explicitly document the fact that securelevel > 0 means that kernel modules
may not be (un)loaded.

PR: 23350
Submitted by: Gordon Tetlow <gordont@bluemtn.net>

mdoc(7) police: use the new features of the Nm macro.

Improve the clarification of the handling of the securelevel.

Submitted by: bde

Clarify the handling of the securelevel.

PR: 20974

Mount DEVFS with no options.

Add MLINK init.8 --> securelevel.8

Requested by: Brett Glass <brett@lariat.org>
PR: 13792
Submitted by: nik

Remove unused include.

Add include of errno.h where needed, remove extern int errno where not.

These commits were inspired by a similar commit to netbsd.

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

Change DISTRIBUTION to match new world order.

detect deleted tty lines in /etc/ttys.

Document that securelevel >= 2 clamps time changes to at most one second.

PR: docs/14449
Submitted by: James FitzGibbon <james@targetnet.com>

Correct the ttys.5 and init.8 manpages with respect to the incorrect
assumption that only getty processes can be managed. Describe the
SysV-like ability to keep arbitrary long-running processes alive
using a non-device first field in /etc/ttys.

PR: 12767
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>

Finish up umntall support. init now passed an argument to the
rundown script 'reboot' or 'single'. ISO support (which never
worked) has been removed from mount_nfs. mount_nfs and umount
now use mounttab, which allows umntall to work properly. The
rc scripts now call umntall as appropriate.

Submitted by: Martin Blapp <mb@imp.ch>

FreeBSD kernel doesn't allow any process to decrease securelevel. So,
init(8) cannot decrease securelevel. The manual page explains this
and single_user() doesn't try to downgrade kernel to insecure mode.

Reviewed by: bde (manual page)

$Id$ -> $FreeBSD$

Backup existing init(8) as /sbin/init.bak.

PR: 12976
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>

Fix a non-critical memory leak.

PR: 12769
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>

"Cannot" is one word. "Can not" has a different meaning if taken
literally.

Turn System V command line syntax ``on'' by default.

Requested by: peter
Reviewed by: des, billf

Bring in System V run-level patches (turned off by default).
While I'm here, fix some typos in the manpage.

Requested by: des

Init(8) will halt the system if sent USR1 signal,
or halt and turn the power off if sent SIGUSR2.

PR: 5451
Submitted by: Leif Neland <leifn@image.dk>
Reworked by: ru
Reviewed by: -hackers

Mention securelevel 3 as affecting ipfw and dummynet. Generalize comment
about fdisk and securelevel 2.
PR: docs/7785

Memory management error in init.

PR: 7320
Reviewed by: phk
Submitted by: Anders Thulin <Anders.X.Thulin@telia.se>

Correct .Nm use. Add rcsid. Use min for minutes instead of mn.

Fixes per PR 2850:
(a) Note that the default securelevel value is -1, in -current and -stable.
(b) Mention kernel sysctl variable that controls securelevel.
(c) Add warning the `fsck' will fail if securelevel >= 2.
(d) Suggest end of /etc/rc as the right place to raise securelevel.

and one spelling fix.

PR: 2850

Don't assume sigset_t and int are equivalent.

Removed definition of _NEW_VFSCONF. The new vfsconf interface is now
the default.

This has always bugged me. At single user, the implied example it gives
is not valid - it says that "sh" is the default, but you can't
actually type "sh" at this prompt - it has to be /bin/sh or some other
full pathname.

".if exists(${CURDIR}/../../secure)" rather than testing relative to the
object directory.

Test that rc.shutdown exists before attempting to run it - silently
return success if it doesn't to prevent any unwanted error msgs.

runshutdown(): get rid of getdtablesize loop, it gains nothing now
but can waste time if many descriptors are available

rc.shutdown fixes:
1) revoke -> HUP
2) controlling terminal already present
3) add missing setprocresources call

Add /etc/rc.shutdown capability to init.
Add sample /etc/rc.shutdown (which is just a shell for now).
Submitted by: Ollivier Robert <roberto@keltia.freenix.fr>

Move logwtmp(shutdown) call before any real action in death().

1. Replace malloc+bzero by calloc
2. Revoke internal active session list only now, not whole /etc/ttys

Add -D_NEW_VFSCONF to eliminate compilation warning

death: revoke all lines listed in /etc/ttys instead of sending HUP
to all processes

Include <libutil.h> instead of private declarations

Remove unneded cast in login_getclassbyname which cause warning

Attempt to open the device for reading before actually adding the device
to the session list. If the device comes back as unconfigured, just
ignore that line in /etc/ttys. If someone HUP's init, we'll try again.

This change stops getty's from hanging on vty and sio ports that don't
exist, either due to LKM drivers not being loaded, or probes failing.
Reviewed by: bde

Use err(3).

Be more specific as to which flags may not be turned off when the
system is running in secure mode.

Obtained from: NetBSD PR# 3299

Fix mount call for devfs.

Submitted by: bde

Revert $FreeBSD$ to $Id$

Protect from stack overrun via /etc/ttys, which could possibly allow a
root user to change the securelevel. Pointed out by Thomas H. Ptacek
<tqbf@enteract.com>.

Part two of a "fix-and-move". There were some macros declared in ../sbin's
Makefile that were a) broken and b) bogusly placed. This brings the
repeared macros in.

Pointed-out-by: BDE

typo

Style police.

Impose login_cap resource limits on processes started by init.
/etc/rc started with "daemon" settings.
"window=" started with "default" settings
gettys started with "default" settings.
This should open the way to junk kernel options MAX_{OPEN,CHILD}
and the corresponding sysctl vars.

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Sort cross references.

If passed the -d flag, mount devfs on /dev

Rewrote the section about the "normal" setting of the security level to
match reality.

Say that secured devices `may not be opened for writing' instead of
`are read-only'.

Fixed DPADD.

Better method of choosing libdescrypt/libscrypt.

Correct some man page xrefs, and some other minor changes to bring some
man pages up to mdoc guidelines and fix some minor formatting glitches.
Also fixed a number of man pages to not abuse the .Xr macro to
display functions and path names and a lot of other junk.

The DES-based init(8) belongs to the "des" distribution.

If root does not have a password, `init' should not ask to enter it.
otherwise it's not possible to get into single-user mode, if root
does not have password and console insecure.

Define TRUE & FALSE rather than depending on bogus #includes.

Fix $Id$.

Make this make work the same way as passwd and xntpd. Here it will allow
secure/sbin/init to be cleaned out, and sbin/Makefile to be tidied up.

Fix init to correctly detect processes that are exiting multiple
times per second.

nspace count was incremented only in child, so warning never displayed
Pointed by: Mike Pritchard <mpp@mpp.minn.net>

Remove trailing whitespace.

Add better argument handling
Submitted by: jmz

revision 1.6
date: 1994/03/06 08:55:02; author: ache; state: Exp; lines: +4 -1
Stop count getty spacing problem, if we issue kill -1 1
----------------------------
revision 1.5
date: 1994/03/04 17:51:39; author: ache; state: Exp; lines: +9 -2
I got a lot of
"getty repeating too quickly on port %s, sleeping"
from init.bsdi, it means that getty start and exit in five seconds.
This is common situation for poor quality Russian phone lines:
modem got CONNECT message and after retries got NO CARRIER.
So I introduce spacing count, it means that this warning and
sleep occurse only after GETTY_NSPACE times of sequental attempts.
----------------------------
revision 1.4
date: 1994/02/28 21:53:52; author: ache; state: Exp; lines: +71 -10
I found (and fix) ugly bugs in init.bsdi (this bugs not present
in old init)

1) Init don't setup TERM environment variable for default terminal
type from /etc/ttys before calling getty/window.

2) When "kill -1 1" issued, init don't restart getty when
/etc/ttys parameters was changed (it only kill "off" end empty entries).

3) Small memory leak if "window" /etc/ttys parameter specified and
"kill -1 1" issued.

Obtained from: FreeBSD 1.x

What cretin named both a global and a function "reboot"? Global
changed to Reboot.
Submitted by: jkh

Bring in my changes from the 1.1 init.bsdi which causes a reboot (was a
halt before) if init is sent an interrupt signal. This is necessary
for <CTL><ALT><DEL> to do the right thing if enabled.

Nuked the 2 second DTR wait; this is handled correctly in the sio driver.

`init' needs crypt() for insecure consoles.

Convert to our man installation style. Also fixed long-standing bug
in `fastboot'/`fasthalt' in which the interpreter would hang around
after `reboot' or `halt' is run, causing an irritating ``Killed'' message.

This commit was generated by cvs2svn to compensate for changes in r1558,
which included commits to RCS files with non-trunk default branches.