| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
protocol flaw. [09:15]
Correctly handle failures from unsetenv resulting from a corrupt
environment in rtld-elf. [09:16]
Fix permissions in freebsd-update in order to prevent leakage of
sensitive files. [09:17]
Approved by: so (cperciva)
Security: FreeBSD-SA-09:15.ssl
Security: FreeBSD-SA-09:16.rtld
Security: FreeBSD-SA-09:17.freebsd-udpate
|
|
|
|
|
|
| |
repository.
Sponsored by: FreeBSD security development fundraiser
|
|
|
|
|
|
| |
delegated to non-administrators.
Obtained from: TrustedBSD Project
|
|
|
|
| |
Obtained from: TrustedBSD Project
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
fast, lightweight, and generally good way for users to keep their
ports trees up to date.
This is version 0.9.4 from the ports tree (sysutils/portsnap) with
the following changes:
1. The experimental pipelined http code is enabled. No seatbelts
in -CURRENT. (^_^)
2. The working directory has moved from /usr/local/portsnap to
/var/db/portsnap (as discussed on -arch two days ago).
3. Portsnap now fetches a list of mirrors (distributed as DNS SRV
records) and selects one randomly. This should help to avoid the
uneven loading which plagues the cvsup mirror network.
4. The license is now 2-clause BSD instead of 3-clause BSD.
5. Various incidental changes to make portsnap fit into the base
system's build mechanics.
X-MFC-After: 6.0-RELEASE
X-MFC-Before: 5.5-RELEASE
X-MFC-To: RELENG_6, RELENG_5, ports
discussed on: -arch and several other places
"yes please" from: simon, remko, flz, Diane Bruce
thinks this is a great idea: bsdimp
Hopes he didn't forget any files: cperciva
|
|
|
|
| |
Forgotten by: dougb
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
by default when named is enabled. Also, improve our default directory
layout by creating /var/named/etc/namedb/{master|slave} directories,
and use the former for the generated localhost* files.
Rather than using pax to copy device entries, mount devfs in the
chroot directory.
There may be some corner cases where things need to be adjusted,
but overall this structure has been well tested on a production
network, and should serve the needs of the vast majority of users.
UPDATING has instructions on how to do the conversion for those
with existing configurations.
|
|
|
|
| |
ports that use the new OPTIONS infrastructure)
|
|
|
|
| |
Approved by: re (rwatson)
|
| |
|
|
|
|
| |
"utility-like" games and everyone's favourite, fortune(6).
|
|
|
|
|
| |
instead of the user immutable flag, now that mergemaster handles
schg directories in its /var/tmp/temproot.
|
|
|
|
|
| |
/var/empty, because it makes it difficult for mergemaster(8) to remove
/var/tmp/temproot/var.
|
|
|
|
|
|
|
|
|
|
| |
which needs an empty directory into which to chroot(2).
Hint to the operator that this directory really _should_ be empty
by creating it with mode 0555 and the system immutable flag (schg)
set.
Reviewed by: des
|
| |
|
|
|
|
|
|
|
|
| |
the creation of /var/spool/clientmqueue and therefore the need for the
smmsp user and group if NO_SENDMAIL is defined. This required breaking out
the creation of the directory into a new BSD.sendmail.dist mtree file.
MFC after: 1 week
|
| |
|
| |
|
| |
|
|
|
|
| |
previous commit yesterday may wish to check /var/run for junk.
|
|
|
|
|
|
| |
PR: bin/29966
Approved by: brian
MFC after: 4
|
| |
|
| |
|
|
|
|
| |
Not sure about other dirs with the same damage (0755) by recent commit.
|
| |
|
|
|
|
| |
PR: 27070
|
| |
|
|
|
|
| |
freebsd-uucp port.
|
|
|
|
| |
Change pidfile location to /var/run/named/pid.
|
| |
|
|
|
|
| |
Submitted by: Rich Morin <rdm@cfcl.com>
|
|
|
|
| |
README file before making changes here. Fix them once again.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
it at boot time closer to the way we want it to be in the final version.
* Move the default directory to /var/db/entropy
* Run the entropy saving cron job every 11 minutes. This seems
to be a better default, although still bikeshed material.
* Feed /dev/random some cheesy "entropy" from various commands
and files before the disks are mounted. This gives /dev/random
a better chance of running without blocking early.
* Move the reseeding with previously stored entropy to the point
immediately after the disks are mounted.
* Make the harvesting script a little safer in regards to the
possibility of accidentally overwriting something other
than a regular file.
|
| |
|
|
|
|
| |
commit is easier to understand.
|
|
|
|
|
|
| |
much a diff as lines with the wrong stuff on it.
Add references in mtree data files to the README.
|
| |
|
|
|
|
| |
Submitted by: John Hay <jhay@mikom.csir.co.za>
|
|
|
|
| |
uname/gname overrides and /sets.
|
|
|
|
| |
Partially reviewed by: bde
|
| |
|
| |
|
|
|
|
| |
non-setuid back
|
| |
|
|
|
|
|
| |
Reviewed by: maybe@yes.no
Obtained from: OpenBSD (mostly deraadt@openbsd.org)
|
|
|
|
| |
otherwise due to safeopen
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
to 0775.
This does *not* instantly make any program which "ensures"
mail spool consistency by creating lock files safe in any way
since other tools, like mail.local, will be using flock() semantics
and any such lock file will simply be ignored. It does, however,
allow a lot of things which are currently suid root in order to create
such bogus lockfiles to, at least, be bogus at a much lower level of
privilege (and this is good). Ultimately, of course, everybody should
just use flock.
|
|
|
|
| |
Closes PR# 1944.
|
| |
|
|
|
|
|
|
|
|
| |
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.
Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.
|