summaryrefslogtreecommitdiffstats
path: root/usr.sbin
Commit message (Collapse)AuthorAgeFilesLines
* Add script to copy config.xml off an available USB drive after the ↵jim-p2017-07-123-1/+62
| | | | | | | installation is complete, similar to the old PFI behavior. Implements #7689 (cherry picked from commit ec316ce32d9b91fd07abc6392323f43d5365c6bd) (cherry picked from commit e471bc56255d0ba97d8ec1a9add892d069ebff42)
* Fix a crash in gpioctl, the flags list must be null terminated.Luiz Souza2017-06-241-0/+1
|
* Add initial GPIO PWM support.Luiz Souza2017-06-201-12/+54
|
* Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2017-05-119-29/+28
|\
| * Fix multiple vulnerabilities of ntp. [SA-17:03]delphij2017-04-129-29/+28
| | | | | | | | | | | | Xen migration enhancements. [EN-17:05] Approved by: so
* | Copy loader.conf.local to installed system when it's availableRenato Botelho2017-04-141-0/+4
| |
* | Merge r309649, r313048, r313083, r313104:glebius2017-02-102-33/+45
| | | | | | | | | | | | tcpdump 4.9.0 (cherry picked from commit ad0c9114e00a9a30168e0c13c17d8f65571aa67f)
* | Remove canmount=noauto from /var and /tmp. Ticket #7086Renato Botelho2017-01-201-2/+2
| |
* | Remove unnecessary partitions when using ZFS, ticket #7086Renato Botelho2017-01-191-19/+2
| |
* | Fix #7003: Use default loader.conf from chrootRenato Botelho2017-01-171-2/+2
| |
* | Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2017-01-0910-21/+42
|\ \ | |/
| * Fix multiple vulnerabilities of ntp.delphij2016-12-2210-21/+42
| | | | | | | | Approved by: so
* | Add licenseRenato Botelho2016-11-181-0/+26
| |
* | Use labels on fstab on Manual partitionRenato Botelho2016-11-181-0/+1
| |
* | Remove extraneous }Renato Botelho2016-11-181-1/+1
| |
* | mount was called before, do not mount it twiceRenato Botelho2016-11-181-1/+0
| |
* | Umount distdir after useRenato Botelho2016-11-181-0/+8
| |
* | Add a script to use labels on fstabRenato Botelho2016-11-183-1/+94
| |
* | Revert "Use MBR by default on BIOS systems. An increasing number of ↵Renato Botelho2016-11-181-4/+1
| | | | | | | | | | | | motherboards" This reverts commit 30a42c280eec3a4e23e3eab91b7e04cff697d312.
* | Really fix #6929 for CE and factoryRenato Botelho2016-11-151-2/+9
| |
* | Add zfs load to pfSense loader.conf. It should fix #6929Renato Botelho2016-11-151-1/+1
| |
* | Execute /root/factory.sh if it's presentRenato Botelho2016-11-081-0/+3
| |
* | Copy boot.config to target system if it's presentRenato Botelho2016-11-081-0/+4
| |
* | Copy loader.conf.pfSense to target system when it's availableRenato Botelho2016-11-081-0/+3
| |
* | Do not replace sysctl.conf or /boot/* on target systemRenato Botelho2016-11-041-2/+2
| |
* | Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2016-11-021-4/+4
|\ \ | |/
| * Revised SA-16:15. The initial patch didn't cover all possible overflowsglebius2016-10-251-4/+4
| | | | | | | | | | | | | | | | | | | | based on passing incorrect parameters to sysarch(2). [1] Fix unchecked array reference in the VGA device emulation code. [2] Security: SA-16:15 [1] Security: SA-16:32 [2] Approved by: so
* | Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2016-10-061-4/+11
|\ \ | |/
| * MFS r306418: portsnap: only move expected snapshot contents from snap/ to files/emaste2016-09-281-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | Previously it was possible to smuggle in addional files that would be used by later portsnap runs. Now we only move those files expected to be in the snapshot into files/ and require that there are no unexpected files. This was used by portsnap attacks 2, 3, and 4 in the "non-cryptanalytic attacks against FreeBSD update components" anonymous gist. Approved by: re (gjb)
| * Merge from stable/11 bspatch, portsnap, and libarchive fixes:emaste2016-09-271-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | === bspatch === MFS r306213: bspatch Capsicumization, sanity checks, and other improvements r304691: bspatch: apply style(9) Make style changes (and trivial refactoring of open calls) now in order to reduce noise in diffs for future capsicum changes. r304807 (allanjude): Capsicumize bspatch Move all of the fopen() and open() calls to the top of main() Restrict each FD to least privilege (read/seek only, write only, etc) cap_enter(), and make all except the output FD read/seek only. r304821: bspatch: remove output file in the case of error r305486: bspatch: add sanity checks on sizes to avoid integer overflow Note that this introduces an explicit 2GB limit, but this was already implicit in variable and function argument types. This is based on the "non-cryptanalytic attacks against freebsd update components" anonymous gist. Further refinement is planned. r305737: bspatch: remove superfluous newlines from errx strings r305822: bspatch: use #define for header size instead of magic number r306026: bspatch: Remove backwards-compatibility sys/capability.h support bspatch previously included sys/capability.h or sys/capsicum.h based on __FreeBSD_version, as FreeBSD is the upstream for bsdiff and we may see this file incorporated into other third-party software. The Capsicum header is now installed as sys/capsicum.h in stable/10 and FreeBSD 10.3, so we can just use sys/capsicum.h and simplify the logic. With this change, bspatch is identical between head, stable/11 and releng/11.0. === portsnap === MFS r305648 (delphij): MFC r305469: Ensure that we always open only files that is named by explicitly using shell redirections instead of having gzip(1) to decide what file to open. Issue reported in the "non-cryptanalytic attacks against freebsd update components" anonymous gist. === libarchive === MFS r305754 (mm): MFC r305422: Sync libarchive with vendor Vendor issues fixed: PR #777: Multiple bugfixes for setup_acls() This includes a bugfix for a bug that caused ACLs not to be read properly for files and directories inside subdirectories and as a result not being stored or being incorrectly stored in tar archives. MFS r306321 (mm): MFC r305819: Sync libarchive with vendor including important security fixes. Issues fixed (FreeBSD): PR #778: ACL error handling Issue #745: Symlink check prefix optimization is too aggressive Issue #746: Hard links with data can evade sandboxing restrictions This update fixes the vulnerability #3 and vulnerability #4 as reported in "non-cryptanalytic attacks against FreeBSD update components". https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4f Fix for vulnerability #2 has already been merged. Approved by: re (gjb), so (glebius)
* | Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2016-09-122-2/+2
|\ \ | |/
| * MFS r305423: cron: use existing maximum username constant MAXLOGNAMEemaste2016-09-052-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Approved by: re (kib) MFH: r305269
* | Merge remote-tracking branch 'origin/releng/11.0' into RELENG_2_4Renato Botelho2016-08-251-6/+20
|\ \ | |/
| * MFH (r304142): ensure stripe size is non-zero multiple of 4096des2016-08-191-6/+20
| | | | | | | | | | PR: 211361 Approved by: re (gjb)
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2016-08-084-7/+7
|\ \ | |/
| * MFC r303788vangyzen2016-08-081-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix some logic in PCIe HotPlug; display EI status The interpretation of the Electromechanical Interlock Status was inverted, so we disengaged the EI if a card was inserted. Fix it to engage the EI if a card is inserted. When displaying the slot capabilites/status with pciconf: - We inverted the sense of the Power Controller Control bit, saying the power was off when it was really on (according to this bit). Fix that. - Display the status of the Electromechanical Interlock: EI(engaged) EI(disengaged) Approved by: re (gjb) Sponsored by: Dell Inc.
| * MFC r303631:dim2016-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix non-functional bsdinstall services dialog. The most recent version of bsdinstall does not seem to respect any of the checkboxes in the "Choose the services you would like to be started at boot" dialog. None of the chosen services end up in the rc.conf file that is installed onto the target system. This is caused by the bsdinstall/scripts/hardening script, which implements the new hardening options dialog. The script starts by overwriting the previously written rc.conf.services file: echo -n > $BSDINSTALL_TMPETC/rc.conf.services which is obviously incorrect. It should clear out rc.conf.hardening instead. Approved by: re (kib) Reviewed by: allanjude PR: 211506 Differential Revision: https://reviews.freebsd.org/D7387
| * MFC r303410,r303419:bdrewery2016-08-022-5/+2
| | | | | | | | | | | | | | | | | | r303410: Reconnect pmcstudy, lost in r291021 r303419: Fix non-amd64 build from r292043 after reconnecting in r303410. Approved by: re (kib)
* | Copy etc files over, without it installed system will have no fstabRenato Botelho2016-08-031-1/+1
| |
* | Replace FreeBSD by pfSense on installer related filesRenato Botelho2016-08-019-25/+25
| |
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2016-08-015-9/+116
|\ \ | |/
| * MFC r302897:robak2016-07-284-1/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new System Hardening menu and options to bsdinstall. This patch add new 'hardening' file responsible for new bsdinstall 'System Hardening' menu allowing users to set some sane and carefully picked system security options (like random process id's, hiding other users/groups processes and others). All options are OFF by default in this patch due to POLA principle with intention to turn change some of them to ON by default in future. Reviewed by: adrian, allanjude, bdrewery, nwhitehorn Approved by: re@, adrian, allanjude
| * MFC 303109: Update crashinfo to work with newer gdb from ports.jhb2016-07-271-8/+27
| | | | | | | | | | | | | | | | | | | | | | If gdb from ports is installed, use it instead of the base system gdb to extract variables from a kernel. Note that base gdb and ports gdb do not support the same options for invoking a single command in batch mode, so a wrapper shell function is used. In addition, prefer kgdb from ports when generating a backtrace if present. PR: 193335 Approved by: re (gjb)
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2016-07-269-6/+169
|\ \ | |/
| * MFC: r302790, r302795allanjude2016-07-261-0/+38
| | | | | | | | | | | | | | | | Add new menu to bsdinstall to allow user to set date and time after selecting timezone. The 'skip' button is the default selection. Submitted by: des Approved by: re (gjb)
| * MFC: r302940allanjude2016-07-261-1/+2
| | | | | | | | | | | | | | | | Fix error in bsdinstall triggered when doing a GELI encrypted install to an MBR formatted disk Approved by: re (gjb) Sponsored by: ScaleEngine Inc.
| * MFC: r302941allanjude2016-07-261-0/+9
| | | | | | | | | | | | | | | | At the start of the installation process, all ZFS pools are exported and all GELI instances are detached, to allow a restarted install to proceed. PR: 210814 Approved by: re (gjb)
| * MFC r303091asomers2016-07-251-0/+1
| | | | | | | | | | | | | | Fix camdd for host-aware and host-managed SMR disks. This should've gone in as part of r300207 Approved by: re (gjb)
| * MFC r303199:np2016-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | ctld(8): Fix MaxBurstLength negotiation. The target must reply with the selected value of MaxBurstSize instead of just echoing back the initiator's offered value. Reviewed by: mav@ Approved by: re@ (gjb@) Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D7278
| * MFC r303132:trasz2016-07-242-2/+96
| | | | | | | | | | | | | | | | | | Add documentation for "ctld -u", the UCL configuration file format. Submitted by: jceel@ Approved by: re (kib) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D7222
OpenPOWER on IntegriCloud