MFC 362321:

Improve periodic(8) manual page presentation

- Update synopsis to present all available arguments.
- Consistently call the argument specifying an arbitrary directory a
"directory".
- Do not put macros into -width argument to Bl. They do not expand there.
- Stylize command modifiers like "daily" with Cm instead of Pa. While
technically periodic(8) operates on directories with such names, it is
confusing from the perspective of the manual page reader as Pa and Ar are
stylized the same way. Also, I cannot recall a single manual page where
Pa would be used to describe the syntax of command-line arguments.

MFC r351192, r351203

r351192:
periodic: fix anticongestion for scripts run after security

Revision 316342, which introduced the anticongestion feature, failed to
consider that the periodic scripts are executed by a recursive invocation of
periodic. The recursive invocation wrongly cleaned up a temporary file that
should've been cleaned up only by the original invocation. The result is
that if the first script that requests an anticongestion sleep runs after
the security scripts, the sleep won't happen.

Fix this bug by delaying cleanup until the end of the original invocation.

PR: 236564
Submitted by: Yasuhiro KIMURA <yasu@utahime.org>
Reviewed by: imp

r351203:
periodic: replace "tty" with "test -t 0"

Apparently using tty for this purpose has been deprecated since 4.4 Lite.

Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D21318

MFC r326041:

periodic: fix exit status for nonexistent arguments

When called with an absolute pathname, periodic should attempt to execute
every script in that directory. If the directory does not exist, it should
print an error and exit 1. Due to a copy/paste mistake in r231568, it exits
0 in that case.

Reported by: devel/hs-ShellCheck
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D13070

MFC r320135:

periodic(8): delete trailing whitespace

MFC r316342, r316358

r316342:
Consolidate random sleeps in periodic scripts

Multiple periodic scripts sleep for a random amount of time in order to
mitigate the thundering herd problem. This is bad, because the sum of
multiple uniformly distributed random variables approaches a normal
distribution, so the problem isn't mitigated as effectively as it would be
with a single sleep.

This change creates a single configurable anticongestion sleep. periodic
will only sleep if at least one script requires it, and it will never sleep
more than once per invocation. It also won't sleep if periodic was run
interactively, fixing an unrelated longstanding bug.

PR: 217055
PR: 210188
Reviewed by: cy
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10211

r316358:
Fix man page typo from r316342

Reported by: rgrimes
MFC after: 20 days
X-MFC-With: 316342

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Better document security_show_{success,info,badconfig} in /etc/periodic.conf

periodic(8) already handles the security_show_{success,info,badconfig}
variables correctly. However, those variables aren't explicitly set in
/etc/defaults/periodic.conf or anywhere else, which suggests to the user
that they shouldn't be used.

etc/defaults/periodic.conf
Explicitly set defaults for security_show_{success,info,badconfig}

usr.sbin/periodic/periodic.sh
Update usage string

usr.sbin/periodic/periodic.8
Minor man page updates

One thing I'm _not_ doing is recommending setting security_output to
/var/log/security.log or adding that file to /etc/newsyslog.conf, because
periodic(8) would create it with default permissions, usually 644, and
that's probably a bad idea.

Reviewed by: brd
MFC after: 4 weeks
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D6477

Add META_MODE support.

Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision: D2796
Reviewed by: brooks imp

use .Mt to mark up email addresses consistently (part2)

PR: 191174
Submitted by: Franco Fichtner <franco@lastsummer.de>

Include the calling context in the mail subject, if any.

More concretely, periodic security scripts defaults to being
called from daily ones -- daily context -- so the mail subject
will now be "${HOST} daily security run output" instead of
"{HOST} security run output".

If you switch the period of some security checks to weekly, you
will receive another email "${HOST} weekly security run output".

Export a PERIODIC environment variable from periodic(8). This will
allow periodic security scripts to know if they have been called in
a daily or a weekly context.

Prevent periodic scripts that run longer than the expected period from
starting up before the previous script finishes. This prevents an
infinite number of them from piling up and slowing a system down.

Since all the refactoring to make this happen required churning the
indenting of most of this file, make the indentation more consistent.

Reviewed by: simon
MFC after: 1 week

mdoc: order prologue macros consistently by Dd/Dt/Os

Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.

Reviewed by: ru
Approved by: philip, ed (mentors)

- The weekly periodic runs occur on Saturday mornings, not on Sunday mornings

PR: docs/113975
Submitted by: Marian Cerny <jojo@matfyz.cz>
Reviewed by: keramida
Approved by: re (bmah)

Stop mentioning /usr/X11R6.

Approved by: re (hrs)

Add an option to make periodic(8) quiet when no output was generated.

The man page part of the patch is my fault, the changes to the
periodic script is Dominik's.

PR: 88486
Submitted by: Dominik Brettnacher <domi@saargate.de>
Reviewed by: brian
Approved by: re
MFC after: 1 month

Sort sections.

Added the EXIT STATUS section where appropriate.

The .Nm utility

Mention the ``end of output'' for each periodic script.

Submitted by: David Wolfskill <david@catwhisker.org>
PR: 37036
MFC after: 1 week

mdoc(7) police: fix markup in revision 1.25.

Long ago, there was just /etc/daily. Then /etc/security was split out
of /etc/daily. Some time later, /etc/daily became a set of periodic(8)
scripts. Now, this evolution continues, and /etc/security has been
broken into periodic(8) scripts to make local customization easier and
more maintainable.

Reviewed by: ru
Approved by: ru

Add a BUGS section noting that the basename of a directory containing
periodic(8) scripts must be useable as a sh(1) variable.

MFC after: 2 days

mdoc(7) police: Fix markup.

mdoc(7) police: expand plain text xrefs.

Remove whitespace at EOL.

mdoc(7) police: removed HISTORY info from the .Os call.

mdoc(7) police: normalize .Nd.

Grammar police: "its", not "it's", is the possessive form of "it".

beforeinstall -> SCRIPTS.

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

mdoc(7) police: fixed broken references.

mdoc(7) police: removed history info from the .Os FreeBSD call.

mdoc(7) police: use canonical form of .Dd macro.

Properly fix the temporary file creation in the case of multiple
command-line arguments.

Noticed by: dynamo <dynamo@ime.net>

mdoc(7) police: use the new features of the Nm macro.

Don't use a trivially predictable temporary filename and keep recreating
it again and again, practically begging the Bad Man to insert his symlink
underneath it and send us down the path to oblivion.

Noticed by: David Lary <dlary@secureworks.net>

Fix a typo

Spotted by: Manfred Antar <null@pozo.com>

Put temporary output in ${TMPDIR:-/tmp}
If $<basedir>_output is not set, don't redirect output

PR: 21395

Don't clobber $? before using it.

Submitted by: James Barkley <jbarkley@wgate.com>

Fix situations where none of the scripts executed produce output,
so that we don't see any more ``null message body, hope that's
ok'' messages.

We now see something like ``No output from the 3 files processed''.

Lump all output for a given periodic argument together so that
people with /usr/local/etc/periodic/daily (for example) will
get the output of those jobs together with the normal daily run
rather than getting a second email.

Prompted by: ben

Another overhaul of the periodic stuff.

All periodic sub-scripts <larf> now have their return codes interpreted
by periodic(8). Output may be masked based on variable values in
periodic.conf.

It's also now possible to email periodic output to arbitrary addresses,
or to send it to a log file, examples of which can be found in
newsyslog.conf.

The upshot of it all should be no discernable changes to the default
behaviour of periodic(8).

PR: 21250

Introduce /etc/defaults/periodic.conf, similar in concept to rc.conf.
The only change in the default functionality should be that
the output reports are slightly more verbose WRT files deleted.

Not objected to by: freebsd-arch

Update periodic to use the function source_rc_confs that
/etc/defaults/rc.conf now exports.

export host after setting it.

This is needed so passwd diffs show the hostname instead of
" passwd diffs:"

PR: 17651
Submitted by: Giorgos Keramidas <keramida@ceid.upatras.gr>

$Id$ -> $FreeBSD$

local_cron -> local_periodic

PR: docs/11253

Look in correct rc.conf file.

Submitted by: Kevin Street <street@iname.com

Make periodic(8) and the security mailings reflect the full FQDN, as opposed
to a hostname. This will help those who keep a cluster of machines all with
the same hostname but different domain names.

PR: bin/9091
Submitted By: Heikki Suonsivu <hsu@clinet.fi>
No Response From: -current mailing list

Directories aren't executable.

Submitted by: Dennis Glatting <dennis.glatting@software-munitions.com>
(misc/9147)

Misplaced comma.

.Sh AUTHOR -> .Sh AUTHORS. Use .An/.Aq.

Sort cross refereces in section SEE ALSO.

Change local_cron to local_periodic.
Submitted by: bde

Use /etc/periodic

Fix mdoc directives

Back out the fancy directory sorting, it's more pain that its worth,
and it's there in the CVS repository in case someone things that this
idea is superkeen.

Incorporate some ideas that came up during discussion with msmith.

This commit was generated by cvs2svn to compensate for changes in r28112,
which included commits to RCS files with non-trunk default branches.