1*39a11509Sderaadt# $OpenBSD: rc,v 1.574 2024/04/02 08:21:04 deraadt Exp $ 2df930be7Sderaadt 3300d0407Srpe# System startup script run by init on autoboot or after single-user. 4300d0407Srpe# Output and error are redirected to console by init, and the console is the 5300d0407Srpe# controlling terminal. 6df930be7Sderaadt 75116749bSrpe# Turn off Strict Bourne shell. 85116749bSrpeset +o sh 95116749bSrpe 105420764bSmillert# Subroutines (have to come first). 115420764bSmillert 12fcb22a03Srpe# Strip in- and whole-line comments from a file. 13fcb22a03Srpe# Strip leading and trailing whitespace if IFS is set. 14fcb22a03Srpe# Usage: stripcom /path/to/file 155420764bSmillertstripcom() { 16fcb22a03Srpe local _file=$1 _line 175420764bSmillert 18fcb22a03Srpe [[ -s $_file ]] || return 19fcb22a03Srpe 205420764bSmillert while read _line ; do 21fcb22a03Srpe _line=${_line%%#*} 22fcb22a03Srpe [[ -n $_line ]] && print -r -- "$_line" 23fcb22a03Srpe done <$_file 245420764bSmillert} 255420764bSmillert 26fcb22a03Srpe# Update resource limits based on login.conf settings. 27fcb22a03Srpe# Usage: update_limit -flag capability 280e47d797Smillertupdate_limit() { 29fcb22a03Srpe local _flag=$1 # ulimit flag 30fcb22a03Srpe local _cap=$2 _val # login.conf capability and its value 31fcb22a03Srpe local _suffix 320e47d797Smillert 33c1b505a4Sotto for _suffix in {,-max,-cur}; do 34fcb22a03Srpe _val=$(getcap -f /etc/login.conf -s ${_cap}${_suffix} daemon 2>/dev/null) 35fcb22a03Srpe [[ -n $_val ]] || continue 36fcb22a03Srpe [[ $_val == infinity ]] && _val=unlimited 37fcb22a03Srpe 38fcb22a03Srpe case $_suffix in 39fcb22a03Srpe -cur) ulimit -S $_flag $_val 400e47d797Smillert ;; 41fcb22a03Srpe -max) ulimit -H $_flag $_val 420e47d797Smillert ;; 43fcb22a03Srpe *) ulimit $_flag $_val 440e47d797Smillert return 450e47d797Smillert ;; 460e47d797Smillert esac 470e47d797Smillert done 480e47d797Smillert} 490e47d797Smillert 50c30b6886Srpe# Apply sysctl.conf(5) settings. 510e47d797Smillertsysctl_conf() { 529017c8e1Sbluhm # do not use a pipe as limits would only be applied to the subshell 539017c8e1Sbluhm set -- $(stripcom /etc/sysctl.conf) 549017c8e1Sbluhm while [[ $# > 0 ]] ; do 559017c8e1Sbluhm sysctl "$1" 566be3177eSmillert 579017c8e1Sbluhm case "$1" in 580e47d797Smillert kern.maxproc=*) 599017c8e1Sbluhm update_limit -p maxproc 609017c8e1Sbluhm ;; 610e47d797Smillert kern.maxfiles=*) 629017c8e1Sbluhm update_limit -n openfiles 639017c8e1Sbluhm ;; 640e47d797Smillert esac 659017c8e1Sbluhm shift 660e47d797Smillert done 670e47d797Smillert} 680e47d797Smillert 69c30b6886Srpe# Apply mixerctl.conf(5) settings. 70e5682fb9Srpemixerctl_conf() { 71c30b6886Srpe stripcom /etc/mixerctl.conf | 72c30b6886Srpe while read _line; do 73c30b6886Srpe mixerctl -q "$_line" 2>/dev/null 740e47d797Smillert done 750e47d797Smillert} 760e47d797Smillert 77c30b6886Srpe# Apply wsconsctl.conf(5) settings. 78e5682fb9Srpewsconsctl_conf() { 79c30b6886Srpe [[ -x /sbin/wsconsctl ]] || return 806be3177eSmillert 81c30b6886Srpe stripcom /etc/wsconsctl.conf | 82c30b6886Srpe while read _line; do 83a07f66abSrpe eval "wsconsctl $_line" 846be3177eSmillert done 856be3177eSmillert} 866be3177eSmillert 87a0d08aa9Srpe# Push the old seed into the kernel, create a future seed and create a seed 88a0d08aa9Srpe# file for the boot-loader. 89e5682fb9Srperandom_seed() { 9013a462f6Sbluhm dd if=/var/db/host.random of=/dev/random bs=65536 count=1 status=none 91d7e1c4e4Sderaadt chmod 600 /var/db/host.random 9213a462f6Sbluhm dd if=/dev/random of=/var/db/host.random bs=65536 count=1 status=none 9313a462f6Sbluhm dd if=/dev/random of=/etc/random.seed bs=512 count=1 status=none 9449be1d20Sderaadt chmod 600 /etc/random.seed 958f0921ecSdjm} 968f0921ecSdjm 97300d0407Srpe# Populate net.inet.(tcp|udp).baddynamic with the contents of /etc/services so 98300d0407Srpe# as to avoid randomly allocating source ports that correspond to well-known 99300d0407Srpe# services. 100d1aa7b7fSrpe# Usage: fill_baddynamic tcp|udp 101e5682fb9Srpefill_baddynamic() { 102484497f6Shalex local _service=$1 103e27ad5ceSdjm local _sysctl="net.inet.${_service}.baddynamic" 104d1aa7b7fSrpe 105484497f6Shalex stripcom /etc/services | 106484497f6Shalex { 107d1aa7b7fSrpe _ban= 108484497f6Shalex while IFS=" /" read _name _port _srv _junk; do 109d1aa7b7fSrpe [[ $_srv == $_service ]] || continue 110d1aa7b7fSrpe 111d1aa7b7fSrpe _ban="${_ban:+$_ban,}+$_port" 112d1aa7b7fSrpe 113e27ad5ceSdjm # Flush before argv gets too long 114d1aa7b7fSrpe if ((${#_ban} > 1024)); then 115d1aa7b7fSrpe sysctl -q "$_sysctl=$_ban" 116d1aa7b7fSrpe _ban= 117e27ad5ceSdjm fi 118484497f6Shalex done 119d1aa7b7fSrpe [[ -n $_ban ]] && sysctl -q "$_sysctl=$_ban" 120484497f6Shalex } 121e27ad5ceSdjm} 122e27ad5ceSdjm 123300d0407Srpe# Start daemon using the rc.d daemon control scripts. 124300d0407Srpe# Usage: start_daemon daemon1 daemon2 daemon3 125e5682fb9Srpestart_daemon() { 126d4d32436Srpe local _daemon 127d4d32436Srpe 128d4d32436Srpe for _daemon; do 129d4d32436Srpe eval "_do=\${${_daemon}_flags}" 130d4d32436Srpe [[ $_do != NO ]] && /etc/rc.d/${_daemon} start 131833ea469Srobert done 132833ea469Srobert} 133833ea469Srobert 13464702a80Stim# Generate keys for isakmpd, iked and sshd if they don't exist yet. 135e5682fb9Srpemake_keys() { 136d4d32436Srpe local _isakmpd_key=/etc/isakmpd/private/local.key 137d4d32436Srpe local _isakmpd_pub=/etc/isakmpd/local.pub 138d4d32436Srpe local _iked_key=/etc/iked/private/local.key 139d4d32436Srpe local _iked_pub=/etc/iked/local.pub 140b6013e36Snaddy local _ssh_pub=/etc/ssh/ssh_host_ed25519_key.pub _show_ssh_fp=false 141d4d32436Srpe 142d4d32436Srpe if [[ ! -f $_isakmpd_key ]]; then 143063d4903Stobhe echo -n "openssl: generating isakmpd RSA keys... " 144d4d32436Srpe if openssl genrsa -out $_isakmpd_key 2048 >/dev/null 2>&1 && 145d4d32436Srpe chmod 600 $_isakmpd_key && 146d4d32436Srpe openssl rsa -out $_isakmpd_pub -in $_isakmpd_key \ 147d4d32436Srpe -pubout >/dev/null 2>&1; then 1483e77ed4cSderaadt echo done. 1493e77ed4cSderaadt else 1503e77ed4cSderaadt echo failed. 1513e77ed4cSderaadt fi 1523e77ed4cSderaadt fi 1533e77ed4cSderaadt 154d4d32436Srpe if [[ ! -f $_iked_key ]]; then 155063d4903Stobhe echo -n "openssl: generating iked ECDSA keys... " 156063d4903Stobhe if openssl ecparam -genkey -name prime256v1 -out $_iked_key >/dev/null 2>&1 && 157063d4903Stobhe chmod 600 $_iked_key && 158063d4903Stobhe openssl ec -out $_iked_pub -in $_iked_key \ 159063d4903Stobhe -pubout >/dev/null 2>&1; then 160063d4903Stobhe echo done. 161063d4903Stobhe else 162063d4903Stobhe echo failed. 163063d4903Stobhe fi 1643e77ed4cSderaadt fi 1653e77ed4cSderaadt 166b6013e36Snaddy [[ -f $_ssh_pub ]] || _show_ssh_fp=true 1673e77ed4cSderaadt ssh-keygen -A 168b6013e36Snaddy $_show_ssh_fp && ssh-keygen -lf $_ssh_pub | 169b6013e36Snaddy (read sz fp comm type && echo "sshd: $type $fp") 17081acd49bSflorian 17181acd49bSflorian if [[ ! -f /etc/soii.key ]]; then 1720e5bd3a1Srpe openssl rand -hex 16 > /etc/soii.key && 17381acd49bSflorian chmod 600 /etc/soii.key && sysctl -q \ 17481acd49bSflorian "net.inet6.ip6.soiikey=$(</etc/soii.key)" 17581acd49bSflorian fi 1763e77ed4cSderaadt} 1773e77ed4cSderaadt 1782aff8cd6Srpe# Re-link libraries, placing the objects in a random order. 17990411c6cSrpereorder_libs() { 1808fb1a259Srpe local _error=false _dkdev _liba _libas _mp _ro_list _tmpdir 1815567e4dfSrpe local _relink=/usr/share/relink 18267c6ae01Stb 18367c6ae01Stb [[ $library_aslr == NO ]] && return 18467c6ae01Stb 1858fb1a259Srpe # Skip if /usr/lib, /usr/libexec or /usr/share/relink are on nfs mounted 1868fb1a259Srpe # filesystems, otherwise record which ones are mounted read-only. 18755ce135fSkn for _dkdev in $(df /usr/{lib,libexec} $_relink | 18855ce135fSkn sed '1d;s/ .*//' | sort -u); do 18955ce135fSkn _mp=$(mount -t ffs | grep "^$_dkdev") || return 19055ce135fSkn if [[ $_mp == *read-only* ]]; then 1918fb1a259Srpe _ro_list="$_ro_list ${_mp%% *}" 1928fb1a259Srpe fi 1938fb1a259Srpe done 194229d5e69Srpe 195036e2a92Sderaadt echo 'reordering:' 19690411c6cSrpe 197342eb06cSjsg # Remount the (read-only) filesystems in _ro_list as read-write. 1988fb1a259Srpe for _mp in $_ro_list; do 1998fb1a259Srpe if ! mount -u -w $_mp; then 20076a9e5e6Scheloha echo '(failed).' 20190411c6cSrpe return 20290411c6cSrpe fi 2038fb1a259Srpe done 20490411c6cSrpe 205a74de434Stb # Only choose the latest version of the libraries. 2065567e4dfSrpe for _liba in $_relink/usr/lib/lib{c,crypto}; do 207941122a8Szhuk _libas="$_libas $(ls $_liba.so.+([0-9.]).a | sort -rV | head -1)" 208a74de434Stb done 209a74de434Stb 2105567e4dfSrpe for _liba in $_relink/usr/libexec/ld.so.a $_libas; do 2115567e4dfSrpe _tmpdir=$(mktemp -dq $_relink/_rebuild.XXXXXXXXXXXX) && 212fa903907Srpe ( 2135c3fc979Sderaadt set -o errexit 214d125f366Skn _install='install -F -o root -g bin -m 0444' 215fa903907Srpe _lib=${_liba##*/} 2165c3fc979Sderaadt _lib=${_lib%.a} 2175567e4dfSrpe _lib_dir=${_liba#$_relink} 2188fb1a259Srpe _lib_dir=${_lib_dir%/*} 2195c3fc979Sderaadt cd $_tmpdir 220fa903907Srpe ar x $_liba 221fa903907Srpe if [[ $_lib == ld.so ]]; then 2225ea7b462Sflorian echo " $_lib" 223c0197e40Sguenther args="-g -x -e _dl_start \ 224fa903907Srpe --version-script=Symbols.map --shared -Bsymbolic \ 225c0197e40Sguenther --no-undefined" 226c0197e40Sguenther [[ -f ld.script ]] && args="$args -T ld.script" 227c0197e40Sguenther ld $args -o ld.so.test $(ls *.o | sort -R) 228fa903907Srpe chmod u+x test-ld.so 229fa903907Srpe [[ $(./test-ld.so ok) == './test-ld.so: ok!' ]] 230fa903907Srpe $_install /usr/libexec/ld.so /usr/libexec/ld.so.save 2318fb1a259Srpe $_install ld.so.test $_lib_dir/ld.so 232fa903907Srpe else 2335ea7b462Sflorian echo " ${_lib%%.*}" 234287d24a6Snaddy cc -shared -o $_lib $(ls *.so | sort -R) $(<.ldadd) 2355c3fc979Sderaadt [[ -s $_lib ]] && file $_lib | fgrep -q 'shared object' 2365c3fc979Sderaadt LD_BIND_NOW=1 LD_LIBRARY_PATH=$_tmpdir awk 'BEGIN {exit 0}' 2371c02e5edSderaadt LD_BIND_NOW=1 LD_LIBRARY_PATH=$_tmpdir openssl \ 2381c02e5edSderaadt x509 -in /etc/ssl/cert.pem -out /dev/null 2398fb1a259Srpe $_install $_lib $_lib_dir/$_lib 240fa903907Srpe fi 241dff3de36Srpe ) || { _error=true; break; } 2425c3fc979Sderaadt done 24390411c6cSrpe 244*39a11509Sderaadt for _bin in $_relink/usr/sbin/sshd $_relink/usr/bin/ssh-agent ; do 245036e2a92Sderaadt _tmpdir=$(mktemp -dq $_relink/_rebuild.XXXXXXXXXXXX) && 246036e2a92Sderaadt ( 247036e2a92Sderaadt set -o errexit 248036e2a92Sderaadt cd $_tmpdir 249036e2a92Sderaadt _binn=${_bin##*/} 250036e2a92Sderaadt _bint=${_bin}/${_binn}.tar 251036e2a92Sderaadt if [[ -f $_bint ]]; then 252036e2a92Sderaadt echo " $_binn" 253036e2a92Sderaadt tar xf $_bint 25436cf69b3Sderaadt if [[ -f install.sh ]]; then 25536cf69b3Sderaadt sh install.sh >/dev/null 2>&1 25636cf69b3Sderaadt else 257036e2a92Sderaadt make -f Makefile.relink relink >/dev/null 2>&1 258036e2a92Sderaadt fi 25936cf69b3Sderaadt fi 260036e2a92Sderaadt ) || { _error=true; break; } 261036e2a92Sderaadt done 262036e2a92Sderaadt 2635567e4dfSrpe rm -rf $_relink/_rebuild.* 264dff3de36Srpe 26590411c6cSrpe # Restore previous mount state if it was changed. 2668fb1a259Srpe for _mp in $_ro_list; do 2678fb1a259Srpe mount -u -r $_mp || _error=true 2688fb1a259Srpe done 26990411c6cSrpe 270dff3de36Srpe if $_error; then 27176a9e5e6Scheloha echo '(failed).' 272dff3de36Srpe else 27376a9e5e6Scheloha echo '.' 274dff3de36Srpe fi 2755c3fc979Sderaadt} 2765c3fc979Sderaadt 2775ea7b462Sflorian# Read output of reorder_libs co-process and output on console. 2785ea7b462Sflorianwait_reorder_libs() { 2795ea7b462Sflorian local _line 280ee5ad0adSkn 2810b442041Skn [[ $library_aslr == NO ]] && return 2820b442041Skn 2835ea7b462Sflorian while IFS= read -p _line; do 2845ea7b462Sflorian echo -n "$_line" 2855ea7b462Sflorian done 2865ea7b462Sflorian echo 2875ea7b462Sflorian} 2885ea7b462Sflorian 2892aff8cd6Srpe# Run rc.* script and email output to root. 2902aff8cd6Srpe# Usage: run_upgrade_script firsttime|sysmerge 29163fe92b2Sajacoutotrun_upgrade_script() { 29263fe92b2Sajacoutot local _suffix=$1 2935e8c7790Srpe 29463fe92b2Sajacoutot [[ -n $_suffix ]] || return 1 2955e8c7790Srpe 29663fe92b2Sajacoutot if [[ -f /etc/rc.$_suffix ]]; then 297d49e7124Sajacoutot echo "running rc.$_suffix" 29863fe92b2Sajacoutot mv /etc/rc.$_suffix /etc/rc.$_suffix.run 29963fe92b2Sajacoutot . /etc/rc.$_suffix.run 2>&1 | tee /dev/tty | 30063fe92b2Sajacoutot mail -Es "$(hostname) rc.$_suffix output" root >/dev/null 30163fe92b2Sajacoutot fi 30263fe92b2Sajacoutot rm -f /etc/rc.$_suffix.run 30363fe92b2Sajacoutot} 30463fe92b2Sajacoutot 30548d8ec78Srpe# Check filesystems, optionally by using a fsck(8) flag. 30648d8ec78Srpe# Usage: do_fsck [-flag] 307e5682fb9Srpedo_fsck() { 30848d8ec78Srpe fsck -p "$@" 30981896204Sclaudio case $? in 31048d8ec78Srpe 0) ;; 31148d8ec78Srpe 2) exit 1 31281896204Sclaudio ;; 31348d8ec78Srpe 4) echo "Rebooting..." 31481896204Sclaudio reboot 31581896204Sclaudio echo "Reboot failed; help!" 31681896204Sclaudio exit 1 31781896204Sclaudio ;; 31848d8ec78Srpe 8) echo "Automatic file system check failed; help!" 31981896204Sclaudio exit 1 32081896204Sclaudio ;; 32148d8ec78Srpe 12) echo "Boot interrupted." 32281896204Sclaudio exit 1 32381896204Sclaudio ;; 32448d8ec78Srpe 130) # Interrupt before catcher installed. 32581896204Sclaudio exit 1 32681896204Sclaudio ;; 32748d8ec78Srpe *) echo "Unknown error; help!" 32881896204Sclaudio exit 1 32981896204Sclaudio ;; 33081896204Sclaudio esac 33181896204Sclaudio} 33281896204Sclaudio 333300d0407Srpe# End subroutines. 3345420764bSmillert 335df930be7Sderaadtstty status '^T' 336df930be7Sderaadt 337300d0407Srpe# Set shell to ignore SIGINT (2), but not children; shell catches SIGQUIT (3) 338300d0407Srpe# and returns to single user after fsck. 339df930be7Sderaadttrap : 2 340300d0407Srpetrap : 3 # Shouldn't be needed. 341df930be7Sderaadt 342ff291771Srpeexport HOME=/ 343ff291771Srpeexport INRC=1 344ff291771Srpeexport PATH=/sbin:/bin:/usr/sbin:/usr/bin 345df930be7Sderaadt 3464f9a4669Sderaadt# /etc/myname contains my symbolic name. 3474f9a4669Sderaadtif [[ -f /etc/myname ]]; then 3484f9a4669Sderaadt hostname "$(stripcom /etc/myname)" 3494f9a4669Sderaadtfi 3504f9a4669Sderaadt 351300d0407Srpe# Must set the domainname before rc.conf, so YP startup choices can be made. 352423d4fbeSmiodif [[ -s /etc/defaultdomain && -z "$(sysctl -n kern.domainname)" ]]; then 353ff291771Srpe domainname "$(stripcom /etc/defaultdomain)" 35410cfcf00Sderaadtfi 35510cfcf00Sderaadt 356a0d08aa9Srpe# Get local functions from rc.subr to load rc.conf into scope. 3578799e9c8SrobertFUNCS_ONLY=1 . /etc/rc.d/rc.subr 3588799e9c8Srobert_rc_parse_conf 359d9f03edaSrobert 360a0d08aa9Srpe# If executed with the 'shutdown' parameter by the halt, reboot or shutdown: 361a0d08aa9Srpe# - update seed files 362a0d08aa9Srpe# - execute the rc.d scripts specified by $pkg_scripts in reverse order 363a0d08aa9Srpe# - bring carp interfaces down gracefully 364ff291771Srpeif [[ $1 == shutdown ]]; then 3650e5bd3a1Srpe if echo 2>/dev/null >>/var/db/host.random || 3667b987043Sbluhm echo 2>/dev/null >>/etc/random.seed; then 367a938e06dSrpe random_seed 3687b987043Sbluhm else 3697b987043Sbluhm echo warning: cannot write random seed to disk 3707b987043Sbluhm fi 371a938e06dSrpe 37264702a80Stim # If we are in secure level 0, assume single user mode. 373ff291771Srpe if (($(sysctl -n kern.securelevel) == 0)); then 374ff291771Srpe echo 'single user: not running shutdown scripts' 375ff291771Srpe else 376e47b98f0Srpe set -A _d -- $pkg_scripts 377e47b98f0Srpe _i=${#_d[*]} 378e47b98f0Srpe if ((_i)); then 379bbe1205bSajacoutot echo -n 'stopping package daemons:' 380e47b98f0Srpe while ((--_i >= 0)); do 381e47b98f0Srpe [[ -x /etc/rc.d/${_d[_i]} ]] && 382e47b98f0Srpe /etc/rc.d/${_d[_i]} stop 383bbe1205bSajacoutot done 384bbe1205bSajacoutot echo '.' 385bbe1205bSajacoutot fi 386ab772a24Sderaadt 38784a73675Ssthen if /etc/rc.d/vmd check > /dev/null; then 38884a73675Ssthen echo -n 'stopping VMs' 38984a73675Ssthen /etc/rc.d/vmd stop > /dev/null 39084a73675Ssthen echo '.' 39184a73675Ssthen fi 39284a73675Ssthen 393ff291771Srpe [[ -f /etc/rc.shutdown ]] && sh /etc/rc.shutdown 394ab772a24Sderaadt fi 3959e07bef9Smcbride 396ff291771Srpe ifconfig | while read _if _junk; do 397a9f6c829Srpe [[ $_if == carp+([0-9]): ]] && ifconfig ${_if%:} down 3989e07bef9Smcbride done 3992ee46d13Smcbride 40075a54d2eSderaadt exit 0 40175a54d2eSderaadtfi 40275a54d2eSderaadt 4036d6858e6Sderaadt# If bootblocks failed to give us random, try to cause some churn 4046d6858e6Sderaadt(dmesg; sysctl hw.{uuid,serialno,sensors} ) >/dev/random 2>&1 4056d6858e6Sderaadt 406ff291771Srpe# Add swap block-devices. 407638be0f1Smiodswapctl -A -t blk 408920abb1bSderaadt 409a0d08aa9Srpe# Run filesystem check unless a /fastboot file exists. 410ff291771Srpeif [[ -e /fastboot ]]; then 411df930be7Sderaadt echo "Fast boot: skipping disk checks." 412ff291771Srpeelif [[ $1 == autoboot ]]; then 413df930be7Sderaadt echo "Automatic boot in progress: starting file system checks." 41481896204Sclaudio do_fsck 415df930be7Sderaadtfi 416df930be7Sderaadt 417a0d08aa9Srpe# From now on, allow user to interrupt (^C) the boot process. 418df930be7Sderaadttrap "echo 'Boot interrupted.'; exit 1" 3 419df930be7Sderaadt 420a0d08aa9Srpe# Unmount all filesystems except root. 421df930be7Sderaadtumount -a >/dev/null 2>&1 422a0d08aa9Srpe 423a0d08aa9Srpe# Mount all filesystems except those of type NFS and VND. 4246e571508Sgrunkmount -a -t nonfs,vnd 425a0d08aa9Srpe 426a0d08aa9Srpe# Re-mount the root filesystem read/writeable. (root on nfs requires this, 427a0d08aa9Srpe# others aren't hurt.) 428a0d08aa9Srpemount -uw / 4297a94871bSderaadtchmod og-rwx /bsd 4307a1d3142Sderaadtln -fh /bsd /bsd.booted 431a0d08aa9Srpe 432a0d08aa9Srperm -f /fastboot 433df930be7Sderaadt 43425b65f1dStedu# Set flags on ttys. 435df930be7Sderaadtttyflags -a 436df930be7Sderaadt 437b892352dSrpe# Set keyboard encoding. 438b892352dSrpeif [[ -x /sbin/kbd && -s /etc/kbdtype ]]; then 439287d24a6Snaddy kbd "$(</etc/kbdtype)" 44048390b59Smcbridefi 44148390b59Smcbride 442cc294143Sderaadtwsconsctl_conf 443cc294143Sderaadt 444b892352dSrpe# Set initial temporary pf rule set. 445b892352dSrpeif [[ $pf != NO ]]; then 446a5daec8eSrpe RULES=" 44714a6b691Srpe block all 44814a6b691Srpe pass on lo0 44914a6b691Srpe pass in proto tcp from any to any port ssh keep state 45014a6b691Srpe pass out proto { tcp, udp } from any to any port domain keep state 45114a6b691Srpe pass out inet proto icmp all icmp-type echoreq keep state 45214a6b691Srpe pass out inet proto udp from any port bootpc to any port bootps 453a5daec8eSrpe pass in inet proto udp from any port bootps to any port bootpc" 45414a6b691Srpe 455e24e98b3Sgrange if ifconfig lo0 inet6 >/dev/null 2>&1; then 45614a6b691Srpe RULES="$RULES 45714a6b691Srpe pass out inet6 proto icmp6 all icmp6-type neighbrsol 4586fcd0d88Sphessler pass inet6 proto icmp6 all icmp6-type neighbradv no state 45914a6b691Srpe pass out inet6 proto icmp6 all icmp6-type routersol 46014a6b691Srpe pass in inet6 proto icmp6 all icmp6-type routeradv 46114a6b691Srpe pass out inet6 proto udp from any port dhcpv6-client to any port dhcpv6-server 46214a6b691Srpe pass in inet6 proto udp from any port dhcpv6-server to any port dhcpv6-client" 463e24e98b3Sgrange fi 46414a6b691Srpe 46514a6b691Srpe RULES="$RULES 46614a6b691Srpe pass in proto carp keep state (no-sync) 46714a6b691Srpe pass out proto carp !received-on any keep state (no-sync)" 46814a6b691Srpe 4690049eb19Snaddy if (($(sysctl -n vfs.mounts.nfs 2>/dev/null)+0 > 0)); then 470a5daec8eSrpe # Don't kill NFS. 47114a6b691Srpe RULES="set reassemble yes no-df 47214a6b691Srpe $RULES 47314a6b691Srpe pass in proto { tcp, udp } from any port { sunrpc, nfsd } to any 47414a6b691Srpe pass out proto { tcp, udp } from any to any port { sunrpc, nfsd } !received-on any" 475a9f6c829Srpe fi 476a5daec8eSrpe 477b892352dSrpe print -- "$RULES" | pfctl -f - 4784616f5d9Sdhartmei pfctl -e 4791097c023Skjellfi 4801097c023Skjell 481e27ad5ceSdjmfill_baddynamic udp 482e27ad5ceSdjmfill_baddynamic tcp 483e27ad5ceSdjm 4840e47d797Smillertsysctl_conf 485f753b29fSderaadt 486889fff72Sflorianmount -s /var >/dev/null 2>&1 # cannot be on NFS 487889fff72Sflorianmount -s /var/log >/dev/null 2>&1 # cannot be on NFS 488eb550c80Sderaadtmount -s /usr >/dev/null 2>&1 # if NFS, fstab must use IP address 489889fff72Sflorian 4905ea7b462Sflorianreorder_libs 2>&1 |& 4915ea7b462Sflorian 492889fff72Sflorianstart_daemon slaacd dhcpleased resolvd >/dev/null 2>&1 4938d7324fcSflorian 494df930be7Sderaadtecho 'starting network' 495b892352dSrpe 496b892352dSrpe# Set carp interlock by increasing the demotion counter. 497b892352dSrpe# Prevents carp from preempting until the system is booted. 4983667ef4eSteduifconfig -g carp carpdemote 128 499b892352dSrpe 50024492e87Sajacoutotsh /etc/netstart 501b892352dSrpe 502889fff72Sflorianstart_daemon unwind >/dev/null 2>&1 503db15c4ebSderaadt 5044ba63a1bSderaadtrandom_seed 5054ba63a1bSderaadt 5065ea7b462Sflorianwait_reorder_libs 5074ba63a1bSderaadt 508300d0407Srpe# Load pf rules and bring up pfsync interface. 509b892352dSrpeif [[ $pf != NO ]]; then 510b892352dSrpe if [[ -f /etc/pf.conf ]]; then 5113544dba0Sajacoutot pfctl -f /etc/pf.conf 5121097c023Skjell fi 513b892352dSrpe if [[ -f /etc/hostname.pfsync0 ]]; then 514b523182eSderaadt sh /etc/netstart pfsync0 515f5262b16Smpf fi 516df0568a3Sderaadtfi 5171097c023Skjell 518300d0407Srpe# Clean up left-over files. 51928e4bf3dSjcarm -f /etc/nologin /var/spool/lock/LCK.* 5202402d49fShenning(cd /var/run && { rm -rf -- *; install -c -m 664 -g utmp /dev/null utmp; }) 52123d49488Sbeck(cd /var/authpf && rm -rf -- *) 52223d49488Sbeck 523a0d08aa9Srpe# Save a copy of the boot messages. 524a0d08aa9Srpedmesg >/var/run/dmesg.boot 5256c0a0b4aSalex 5263e77ed4cSderaadtmake_keys 5273e77ed4cSderaadt 528cc027ce3Sderaadtecho -n 'starting early daemons:' 529166e2b08Stedustart_daemon syslogd ldattach pflogd nsd unbound ntpd 53081896204Sclaudiostart_daemon iscsid isakmpd iked sasyncd ldapd npppd 531833ea469Srobertecho '.' 532096ed560Sderaadt 533300d0407Srpe# Load IPsec rules. 534b892352dSrpeif [[ $ipsec != NO && -f /etc/ipsec.conf ]]; then 5353544dba0Sajacoutot ipsecctl -f /etc/ipsec.conf 53679ec6e47Shshoexerfi 53779ec6e47Shshoexer 538cc027ce3Sderaadtecho -n 'starting RPC daemons:' 5396cc61e20Sderaadtstart_daemon portmap 540b892352dSrpeif [[ -n $(domainname) ]]; then 5416cc61e20Sderaadt start_daemon ypldap ypserv ypbind 54247a1f8faSderaadtfi 5436bf0f2bdSdlgstart_daemon mountd nfsd lockd statd amd 544df930be7Sderaadtecho '.' 545df930be7Sderaadt 546b892352dSrpe# Check and mount remaining file systems and enable additional swap. 547cc3d9aa9Sottomount -a 548638be0f1Smiodswapctl -A -t noblk 54981896204Sclaudiodo_fsck -N 55081896204Sclaudiomount -a -N 55181896204Sclaudio 5522434f299Sderaadt# Build kvm(3) and /dev databases. 5532434f299Sderaadtkvm_mkdb 5542434f299Sderaadtdev_mkdb 5552434f299Sderaadt 556300d0407Srpe# /var/crash should be a directory or a symbolic link to the crash directory 557300d0407Srpe# if core dumps are to be saved. 558b892352dSrpeif [[ -d /var/crash ]]; then 559b892352dSrpe savecore $savecore_flags /var/crash 560df930be7Sderaadtfi 561df930be7Sderaadt 5620c3c058dSrpe# Store ACPI tables in /var/db/acpi to be used by sendbug(1). 5630c3c058dSrpeif [[ -x /usr/sbin/acpidump ]]; then 564b38e49aeSkettenis acpidump -q -o /var/db/acpi/ 5650c3c058dSrpefi 5660c3c058dSrpe 567b892352dSrpeif [[ $check_quotas == YES ]]; then 568df930be7Sderaadt echo -n 'checking quotas:' 569df930be7Sderaadt quotacheck -a 570df930be7Sderaadt echo ' done.' 571df930be7Sderaadt quotaon -a 57236a647e7Sdownsjfi 573df930be7Sderaadt 574b892352dSrpe# Set proper permission for the tty device files. 575e860cdbaSderaadtchmod 666 /dev/tty[pqrstuvwxyzPQRST]* 576a293d798Smillertchown root:wheel /dev/tty[pqrstuvwxyzPQRST]* 577df930be7Sderaadt 578a0d08aa9Srpe# Check for the password temp/lock file. 579ec003eaeSrpeif [[ -f /etc/ptmp ]]; then 580df930be7Sderaadt logger -s -p auth.err \ 581df930be7Sderaadt 'password file may be incorrect -- /etc/ptmp exists' 582df930be7Sderaadtfi 583df930be7Sderaadt 584e65724e6Smillertecho clearing /tmp 585e65724e6Smillert 586300d0407Srpe# Prune quickly with one rm, then use find to clean up /tmp/[lqv]* 587300d0407Srpe# (not needed with mfs /tmp, but doesn't hurt there...). 588c67deee9Sderaadt(cd /tmp && rm -rf [a-km-pr-uw-zA-Z]*) 58968b9454cSsthen(cd /tmp && 590ca51295aSmillert find . -maxdepth 1 ! -name . ! -name lost+found ! -name quota.user \ 591c67deee9Sderaadt ! -name quota.group ! -name vi.recover -execdir rm -rf -- {} \;) 592e65724e6Smillert 59348d8ec78Srpe# Create Unix sockets directories for X if needed and make sure they have 59448d8ec78Srpe# correct permissions. 59548d8ec78Srpe[[ -d /usr/X11R6/lib ]] && mkdir -m 1777 /tmp/.{X11,ICE}-unix 5963e77ed4cSderaadt 597ec003eaeSrpe[[ -f /etc/rc.securelevel ]] && sh /etc/rc.securelevel 598ec003eaeSrpe 599300d0407Srpe# rc.securelevel did not specifically set -1 or 2, so select the default: 1. 600ec003eaeSrpe(($(sysctl -n kern.securelevel) == 0)) && sysctl kern.securelevel=1 601ec003eaeSrpe 60241406ee4Sderaadt 603300d0407Srpe# Patch /etc/motd. 604ec003eaeSrpeif [[ ! -f /etc/motd ]]; then 605dc279d04Sderaadt install -c -o root -g wheel -m 664 /dev/null /etc/motd 606dc279d04Sderaadtfi 607ec003eaeSrpeif T=$(mktemp /tmp/_motd.XXXXXXXXXX); then 608dc279d04Sderaadt sysctl -n kern.version | sed 1q >$T 6093429c198Sschwarze sed -n '/^$/,$p' </etc/motd >>$T 610dc279d04Sderaadt cmp -s $T /etc/motd || cp $T /etc/motd 611dc279d04Sderaadt rm -f $T 6125b45527eSmillertfi 613dc279d04Sderaadt 614ec003eaeSrpeif [[ $accounting == YES ]]; then 615ec003eaeSrpe [[ ! -f /var/account/acct ]] && touch /var/account/acct 616ec003eaeSrpe echo 'turning on accounting' 617ec003eaeSrpe accton /var/account/acct 618df930be7Sderaadtfi 619df930be7Sderaadt 620ec003eaeSrpeif [[ -x /sbin/ldconfig ]]; then 6217e42516dSderaadt echo 'creating runtime link editor directory cache.' 622e28b5d22Srpe [[ -d /usr/local/lib ]] && shlib_dirs="/usr/local/lib $shlib_dirs" 623ec003eaeSrpe [[ -d /usr/X11R6/lib ]] && shlib_dirs="/usr/X11R6/lib $shlib_dirs" 6247e42516dSderaadt ldconfig $shlib_dirs 6257e42516dSderaadtfi 6267e42516dSderaadt 627747e271cSjasperecho 'preserving editor files.'; /usr/libexec/vi.recover 628f57929bcSmillert 62963fe92b2Sajacoutot# If rc.sysmerge exists, run it just once, and make sure it is deleted. 63063fe92b2Sajacoutotrun_upgrade_script sysmerge 63163fe92b2Sajacoutot 632833ea469Srobertecho -n 'starting network daemons:' 63326dd7583Sclaudiostart_daemon ldomd sshd snmpd ldpd ripd ospfd ospf6d bgpd ifstated 6348f860f43Sflorianstart_daemon relayd dhcpd dhcrelay mrouted dvmrpd radiusd eigrpd route6d 635c2691defSclaudiostart_daemon rad hostapd lpd smtpd slowcgi bgplgd httpd ftpd 636de442913Ssthenstart_daemon ftpproxy ftpproxy6 tftpd tftpproxy identd inetd rarpd bootparamd 6375f35002eSreykstart_daemon rbootd mopd vmd spamd spamlogd sndiod 638ac826d78Srobertecho '.' 639a2f190fbSrobert 640300d0407Srpe# If rc.firsttime exists, run it just once, and make sure it is deleted. 64163fe92b2Sajacoutotrun_upgrade_script firsttime 642fcbaa02fSderaadt 643300d0407Srpe# Run rc.d(8) scripts from packages. 644ec003eaeSrpeif [[ -n $pkg_scripts ]]; then 645bbe1205bSajacoutot echo -n 'starting package daemons:' 646ec003eaeSrpe for _daemon in $pkg_scripts; do 647ec003eaeSrpe if [[ -x /etc/rc.d/$_daemon ]]; then 648ec003eaeSrpe start_daemon $_daemon 649739cb2c2Sespie else 650ec003eaeSrpe echo -n " ${_daemon}(absent)" 651739cb2c2Sespie fi 652bbe1205bSajacoutot done 653bbe1205bSajacoutot echo '.' 654bbe1205bSajacoutotfi 655bbe1205bSajacoutot 656ec003eaeSrpe[[ -f /etc/rc.local ]] && sh /etc/rc.local 6578b7444a6Sderaadt 658a0d08aa9Srpe# Disable carp interlock. 6593667ef4eSteduifconfig -g carp -carpdemote 128 660f026f8beSmarc 661cc027ce3Sderaadtmixerctl_conf 662ec003eaeSrpe 663cc027ce3Sderaadtecho -n 'starting local daemons:' 6640e79390dSmatthieustart_daemon apmd sensorsd hotplugd watchdogd cron wsmoused xenodm 66574491808Smillertecho '.' 66674491808Smillert 6676248d275Srpe# Re-link the kernel, placing the objects in a random order. 6686248d275Srpe# Replace current with relinked kernel and inform root about it. 6696248d275Srpe/usr/libexec/reorder_kernel & 6705a176537Srpe 671df930be7Sderaadtdate 672df930be7Sderaadtexit 0 673