Convert almost all /sbin/sysctl calls to php functions

22 files changed, 125 insertions, 122 deletions

diff --git a/etc/ecl.php b/etc/ecl.php
index 0fd0e74..683c2a7 100755
--- a/etc/ecl.php
+++ b/etc/ecl.php
@@ -61,9 +61,8 @@ function get_disk_slices($disk) {
 function get_disks() {
 	global $g, $debug;
 	$disks_array = array();
-	$disks = exec("/sbin/sysctl -n kern.disks");
-	$disks_s = explode(" ", $disks);
-	foreach($disks_s as $disk) 
+	$disks_s = explode(" ", get_single_sysctl("kern.disks"));
+	foreach($disks_s as $disk)
 		if(trim($disk))
 			$disks_array[] = $disk;
 	return $disks_array;
diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index 6e00224..000db23 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -36,7 +36,7 @@
 	added rules which may have been created by other per-user code (index.php, etc).
 	These changes are (c) 2004 Keycom PLC.
 	
-	pfSense_BUILDER_BINARIES:	/sbin/ipfw	/sbin/sysctl	/sbin/route
+	pfSense_BUILDER_BINARIES:	/sbin/ipfw	/sbin/route
 	pfSense_BUILDER_BINARIES:	/usr/local/sbin/lighttpd	/usr/local/bin/minicron /sbin/pfctl
 	pfSense_BUILDER_BINARIES:	/bin/hostname	/bin/cp 
 	pfSense_MODULE: captiveportal
@@ -151,16 +151,18 @@ function captiveportal_load_modules() {
 	if (!is_module_loaded("ipfw.ko")) {
 		mwexec("/sbin/kldload ipfw");
 		/* make sure ipfw is not on pfil hooks */
-		mwexec("/sbin/sysctl net.inet.ip.pfil.inbound=\"pf\" net.inet6.ip6.pfil.inbound=\"pf\"" .
-		       " net.inet.ip.pfil.outbound=\"pf\" net.inet6.ip6.pfil.outbound=\"pf\"");
+		set_sysctl(array(
+			"net.inet.ip.pfil.inbound" => "pf", "net.inet6.ip6.pfil.inbound" => "pf",
+			"net.inet.ip.pfil.outbound" => "pf", "net.inet6.ip6.pfil.outbound" => "pf")
+		);
 	}
 	/* Activate layer2 filtering */
-	mwexec("/sbin/sysctl net.link.ether.ipfw=1 net.inet.ip.fw.one_pass=1");
+	set_sysctl(array("net.link.ether.ipfw" => "1", "net.inet.ip.fw.one_pass" => "1"));
 
 	/* Always load dummynet now that even allowed ip and mac passthrough use it. */
 	if (!is_module_loaded("dummynet.ko")) {
 		mwexec("/sbin/kldload dummynet");
-		mwexec("/sbin/sysctl net.inet.ip.dummynet.io_fast=1 net.inet.ip.dummynet.hash_size=256");
+		set_sysctl(array("net.inet.ip.dummynet.io_fast" => "1", "net.inet.ip.dummynet.hash_size" => "256"));
 	}
 	unmute_kernel_msgs();
 }
@@ -361,7 +363,7 @@ EOD;
 		mwexec("/sbin/ipfw zone {$cpzoneid} destroy", true);
 
 		if (empty($config['captiveportal']))
-			mwexec("/sbin/sysctl net.link.ether.ipfw=0");
+			set_single_sysctl("net.link.ether.ipfw", "0");
 		else {
 			/* Deactivate ipfw(4) if not needed */
 			$cpactive = false;
@@ -374,8 +376,8 @@ EOD;
 				}
 			}
 			if ($cpactive === false)
-				mwexec("/sbin/sysctl net.link.ether.ipfw=0");
-				
+				set_single_sysctl("net.link.ether.ipfw", "0");
+
 		}
 	}
 
diff --git a/etc/inc/config.console.inc b/etc/inc/config.console.inc
index 6c290c0..256486c 100644
--- a/etc/inc/config.console.inc
+++ b/etc/inc/config.console.inc
@@ -38,7 +38,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 
 
-	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/sysctl	/sbin/umount	/sbin/halt	/sbin/fsck
+	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/umount	/sbin/halt	/sbin/fsck
 	pfSense_MODULE:	config
 */
 
diff --git a/etc/inc/config.gui.inc b/etc/inc/config.gui.inc
index 0e00d44..3eec795 100644
--- a/etc/inc/config.gui.inc
+++ b/etc/inc/config.gui.inc
@@ -38,7 +38,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 
 
-	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/sysctl	/sbin/umount	/sbin/halt	/sbin/fsck
+	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/umount	/sbin/halt	/sbin/fsck
 	pfSense_MODULE:	config
 */
 
diff --git a/etc/inc/config.inc b/etc/inc/config.inc
index 7ce4d72..e027062 100644
--- a/etc/inc/config.inc
+++ b/etc/inc/config.inc
@@ -38,7 +38,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 
 
-	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/sysctl	/sbin/umount	/sbin/halt	/sbin/fsck
+	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/umount	/sbin/halt	/sbin/fsck
 	pfSense_MODULE:	config
 */
 
@@ -137,7 +137,7 @@ else if ($g['booting'] and !file_exists($g['cf_conf_path'] . "/config.xml")  ) {
 		} else {
 			if($g['booting']) echo ".";
 			/* probe kernel known disks until we find one with config.xml */
-			$disks = explode(" ", trim(exec("/sbin/sysctl -n kern.disks")));
+			$disks = explode(" ", get_single_sysctl("kern.disks"));
 			foreach ($disks as $mountdisk) {
 				/* skip mfs mounted filesystems */
 				if (strstr($mountdisk, "md"))
diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc
index 69a4811..d186d97 100644
--- a/etc/inc/config.lib.inc
+++ b/etc/inc/config.lib.inc
@@ -39,7 +39,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 
 
-	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/sysctl	/sbin/umount	/sbin/halt	/sbin/fsck
+	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/umount	/sbin/halt	/sbin/fsck
 	pfSense_MODULE:	config
 */
 
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 3619bda..767056c 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -33,7 +33,7 @@
 	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 	POSSIBILITY OF SUCH DAMAGE.
 
-	pfSense_BUILDER_BINARIES:	/sbin/sysctl	/sbin/kldload	/usr/sbin/tcpdump	/sbin/pfctl	/bin/rm
+	pfSense_BUILDER_BINARIES:	/sbin/kldload	/usr/sbin/tcpdump	/sbin/pfctl	/bin/rm
 	pfSense_BUILDER_BINARIES:	/usr/sbin/inetd
 	pfSense_MODULE:	filter
 */
@@ -95,7 +95,7 @@ function flowtable_configure() {
 	global $config, $g;
 
 	if (empty($config['system']['flowtable'])) {
-		mwexec("/sbin/sysctl net.inet.flowtable.enable=0", true);
+		set_single_sysctl("net.inet.flowtable.enable", "0");
 		return;
 	}
 
@@ -106,13 +106,15 @@ function flowtable_configure() {
 	else
 		$maxstates = 150000;
 	// nmbflows cpu count * ($maxstates * 2)
-	$cpus = trim(exec('/sbin/sysctl -n kern.smp.cpus'), " \n");
+	$cpus = get_single_sysctl('kern.smp.cpus');
 	$nmbflows = ($cpus*($maxstates*2));
 	// Flowtable currently only works on 8.0
 	if(get_freebsd_version() == "8") {
-		mwexec("/sbin/sysctl net.inet.flowtable.nmbflows={$nmbflows}");
-		mwexec("/sbin/sysctl net.inet.ip.output_flowtable_size={$maxstates}");
-		mwexec("/sbin/sysctl net.inet.flowtable.enable=1");
+		set_sysctl(array(
+			"net.inet.flowtable.nmbflows" => $nmbflows,
+			"net.inet.ip.output_flowtable_size" => $maxstates,
+			"net.inet.flowtable.enable" => "1")
+		);
 	}
 }
 
@@ -3514,9 +3516,9 @@ function filter_generate_ipsec_rules($log = array()) {
 	$ipfrules = "\n# VPN Rules\n";
 	/* Is IP Compression enabled? */
 	if(isset($config['ipsec']['ipcomp']))
-		exec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=1");
+		set_single_sysctl("net.inet.ipcomp.ipcomp_enable" , "1");
 	else
-		exec("/sbin/sysctl net.inet.ipcomp.ipcomp_enable=0");
+		set_single_sysctl("net.inet.ipcomp.ipcomp_enable" , "0");
 
 	if(isset($config['ipsec']['enable']) &&
 		is_array($config['ipsec']['phase1'])) {
diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index 9115308..a221283 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -1951,8 +1951,10 @@ function interfaces_carp_setup() {
 		unset($pfsyncenabled);
 	}
 
-	mwexec("/sbin/sysctl net.inet.carp.preempt=1", true);
-	mwexec("/sbin/sysctl net.inet.carp.log=1", true);
+	set_sysctl(array(
+		"net.inet.carp.preempt" => "1",
+		"net.inet.carp.log" => "1")
+	);
 
 	if (!empty($pfsyncinterface))
 		$carp_sync_int = get_real_interface($pfsyncinterface);
@@ -1986,9 +1988,9 @@ function interfaces_carp_setup() {
 	}
 
 	if($config['virtualip']['vip'])
-		mwexec("/sbin/sysctl net.inet.carp.allow=1", true);
+		set_single_sysctl("net.inet.carp.allow", "1");
 	else
-		mwexec("/sbin/sysctl net.inet.carp.allow=0", true);
+		set_single_sysctl("net.inet.carp.allow", "0");
 
 	if ($g['booting']) {
 		unmute_kernel_msgs();
@@ -3642,7 +3644,7 @@ function interface_dhcpv6_configure($interface = "wan", $wancfg) {
 	@chmod("{$g['varetc_path']}/rtsold_{$wanif}_script.sh", 0755);
 
 	/* accept router advertisements for this interface */
-	mwexec("/sbin/sysctl -w net.inet6.ip6.accept_rtadv=1");
+	set_single_sysctl("net.inet6.ip6.accept_rtadv", "1");
 	log_error("Accept router advertisements on interface {$wanif} ");
 	mwexec("/sbin/ifconfig {$wanif} inet6 accept_rtadv");
 
diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 56d85f2..5b5c1dc 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -34,7 +34,7 @@
  */
 
 /*
-	pfSense_BUILDER_BINARIES:	/sbin/sysctl	/sbin/ifconfig	/sbin/pfctl	/usr/local/bin/php /usr/bin/netstat
+	pfSense_BUILDER_BINARIES:	/sbin/ifconfig	/sbin/pfctl	/usr/local/bin/php /usr/bin/netstat
 	pfSense_BUILDER_BINARIES:	/bin/df	/usr/bin/grep	/usr/bin/awk	/bin/rm	/usr/sbin/pwd_mkdb	/usr/bin/host
 	pfSense_BUILDER_BINARIES:	/sbin/kldload
 	pfSense_MODULE:	utils
@@ -265,16 +265,16 @@ function setup_polling() {
 	global $g, $config;
 
 	if (isset($config['system']['polling']))
-		mwexec("/sbin/sysctl kern.polling.idle_poll=1");
+		set_single_sysctl("kern.polling.idle_poll", "1");
 	else
-		mwexec("/sbin/sysctl kern.polling.idle_poll=0");
+		set_single_sysctl("kern.polling.idle_poll", "0");
 
 	if($config['system']['polling_each_burst'])
-		mwexec("/sbin/sysctl kern.polling.each_burst={$config['system']['polling_each_burst']}");
+		set_single_sysctl("kern.polling.each_burst", $config['system']['polling_each_burst']);
 	if($config['system']['polling_burst_max'])
-		mwexec("/sbin/sysctl kern.polling.burst_max={$config['system']['polling_burst_max']}");
+		set_single_sysctl("kern.polling.burst_max", $config['system']['polling_burst_max']);
 	if($config['system']['polling_user_frac'])
-		mwexec("/sbin/sysctl kern.polling.user_frac={$config['system']['polling_user_frac']}");
+		set_single_sysctl("kern.polling.user_frac", $config['system']['polling_user_frac']);
 }
 
 /****f* pfsense-utils/setup_microcode
@@ -305,7 +305,7 @@ function setup_microcode() {
  ******/
 function get_carp_status() {
 	/* grab the current status of carp */
-	$status = `/sbin/sysctl -n net.inet.carp.allow`;
+	$status = get_single_sysctl('net.inet.carp.allow');
 	return (intval($status) > 0);
 }
 
@@ -1415,14 +1415,14 @@ function get_interface_info($ifdescr) {
 
 //returns cpu speed of processor. Good for determining capabilities of machine
 function get_cpu_speed() {
-	return exec("/sbin/sysctl -n hw.clockrate");
+	return get_single_sysctl("hw.clockrate");
 }
 
 function get_uptime_sec() {
 	$boottime = "";
 	$matches = "";
-	exec("/sbin/sysctl -n kern.boottime", $boottime);
-	preg_match("/sec = (\d+)/", $boottime[0], $matches);
+	$boottime = get_single_sysctl("kern.boottime");
+	preg_match("/sec = (\d+)/", $boottime, $matches);
 	$boottime = $matches[1];
 	if(intval($boottime) == 0)
 		return 0;
@@ -2156,7 +2156,7 @@ function nanobsd_switch_boot_slice() {
 	$ACOMPLETE_PATH="{$BOOT_DRIVE}s{$ASLICE}a";
 	$ABOOTFLASH="{$BOOT_DRIVE}s{$AOLDSLICE}";
 	conf_mount_rw();
-	exec("sysctl kern.geom.debugflags=16");
+	set_single_sysctl("kern.geom.debugflags", "16");
 	exec("gpart set -a active -i {$ASLICE} {$BOOT_DRIVE}");
 	exec("/usr/sbin/boot0cfg -s {$ASLICE} -v /dev/{$BOOT_DRIVE}");
 	// We can't update these if they are mounted now.
@@ -2164,7 +2164,7 @@ function nanobsd_switch_boot_slice() {
 		exec("/sbin/tunefs -L ${AGLABEL_SLICE} /dev/$ACOMPLETE_PATH");
 		nanobsd_update_fstab($AGLABEL_SLICE, $ACOMPLETE_PATH, $AOLD_UFS_ID, $AUFS_ID);
 	}
-	exec("/sbin/sysctl kern.geom.debugflags=0");
+	set_single_sysctl("kern.geom.debugflags", "0");
 	conf_mount_ro();
 }
 function nanobsd_clone_slice() {
@@ -2175,12 +2175,12 @@ function nanobsd_clone_slice() {
 
 	for ($i = 0; $i < ob_get_level(); $i++) { ob_end_flush(); }
 	ob_implicit_flush(1);
-	exec("/sbin/sysctl kern.geom.debugflags=16");
+	set_single_sysctl("kern.geom.debugflags", "16");
 	exec("/bin/dd if=/dev/zero of=/dev/{$TOFLASH} bs=1m count=1");
 	exec("/bin/dd if=/dev/{$BOOTFLASH} of=/dev/{$TOFLASH} bs=64k");
 	exec("/sbin/tunefs -L {$GLABEL_SLICE} /dev/{$COMPLETE_PATH}");
 	$status = nanobsd_update_fstab($GLABEL_SLICE, $COMPLETE_PATH, $OLD_UFS_ID, $UFS_ID);
-	exec("/sbin/sysctl kern.geom.debugflags=0");
+	set_single_sysctl("kern.geom.debugflags", "0");
 	if($status) {
 		return false;
 	} else {
diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc
index 35bfd67..9146e72 100644
--- a/etc/inc/shaper.inc
+++ b/etc/inc/shaper.inc
@@ -4477,7 +4477,10 @@ function filter_generate_dummynet_rules() {
 	if (!empty($dn_rules)) {
 		if (!is_module_loaded("dummynet.ko")) {
 			mwexec("/sbin/kldload dummynet");
-			mwexec("/sbin/sysctl net.inet.ip.dummynet.io_fast=1 net.inet.ip.dummynet.hash_size=256");
+			set_sysctl(array(
+				"net.inet.ip.dummynet.io_fast" => "1",
+				"net.inet.ip.dummynet.hash_size" => "256"
+			));
 		}
 		file_put_contents("{$g['tmp_path']}/rules.limiter", $dn_rules);
 		mwexec("/sbin/ipfw {$g['tmp_path']}/rules.limiter");
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 1e2657a..3f23694 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -30,7 +30,7 @@
 */
 
 /*
-	pfSense_BUILDER_BINARIES:	/usr/sbin/powerd	/usr/bin/killall	/sbin/sysctl	/sbin/route
+	pfSense_BUILDER_BINARIES:	/usr/sbin/powerd	/usr/bin/killall	/sbin/route
 	pfSense_BUILDER_BINARIES:	/bin/hostname	/bin/ls	/usr/sbin/syslogd	
 	pfSense_BUILDER_BINARIES:	/usr/sbin/pccardd	/usr/local/sbin/lighttpd	/bin/chmod 	/bin/mkdir
 	pfSense_BUILDER_BINARIES:	/usr/bin/tar		/usr/local/sbin/ntpd	/usr/local/sbin/ntpdate
@@ -70,23 +70,29 @@ function get_default_sysctl_value($id) {
 
 function activate_sysctls() {
 	global $config, $g;
+
 	if ($g['platform'] == 'jail')
 		return;
-	exec("/sbin/sysctl net.enc.out.ipsec_bpf_mask=0x0001");
-	exec("/sbin/sysctl net.enc.out.ipsec_filter_mask=0x0001");
-	exec("/sbin/sysctl net.enc.in.ipsec_bpf_mask=0x0002");
-	exec("/sbin/sysctl net.enc.in.ipsec_filter_mask=0x0002");
+
+	$sysctls = array(
+		"net.enc.out.ipsec_bpf_mask" => "0x0001",
+		"net.enc.out.ipsec_filter_mask" => "0x0001",
+		"net.enc.in.ipsec_bpf_mask" => "0x0002",
+		"net.enc.in.ipsec_filter_mask" => "0x0002"
+	);
 
 	if(is_array($config['sysctl'])) {
 		foreach($config['sysctl']['item'] as $tunable) {
-			if($tunable['value'] == "default") {
+			if($tunable['value'] == "default")
 				$value = get_default_sysctl_value($tunable['tunable']);
-				mwexec("/sbin/sysctl " . $tunable['tunable'] . "=\"" . $value .  "\"", true);
-			} else { 
-				mwexec("/sbin/sysctl " . $tunable['tunable'] . "=\"" . $tunable['value'] .  "\"", true);
-			}
+			else
+				$value = $tunable['value'];
+
+			$sysctls[$tunable['tunable']] = $value;
 		}
 	}
+
+	set_sysctl($sysctls);
 }
 
 function system_resolvconf_generate($dynupdate = false) {
@@ -588,8 +594,11 @@ function system_routing_enable() {
 		echo "system_routing_enable() being called $mt\n";
 	}
 
-	mwexec("/sbin/sysctl net.inet.ip.forwarding=1");
-	mwexec("/sbin/sysctl net.inet6.ip6.forwarding=1");
+	set_sysctl(array(
+		"net.inet.ip.forwarding" => "1",
+		"net.inet6.ip6.forwarding" => "1"
+	));
+
 	return;
 }
 
@@ -1802,7 +1811,7 @@ function system_set_harddisk_standby() {
 		if (is_numeric($standby)) {
 			// Sync the disk(s)
 			pfSense_sync();
-			if (!mwexec('/sbin/sysctl hw.ata.standby=' . ((int)$standby))) {
+			if (set_single_sysctl('hw.ata.standby', (int)$standby)) {
 				// Reinitialize ATA-drives
 				mwexec('/usr/local/sbin/atareinit');
 				if ($g['booting']) {
@@ -1837,8 +1846,10 @@ function system_disable_arp_wrong_if() {
 		$mt = microtime();
 		echo "system_disable_arp_wrong_if() being called $mt\n";
 	}
-	mwexec("/sbin/sysctl -n net.link.ether.inet.log_arp_wrong_iface=0");
-	mwexec("/sbin/sysctl -n net.link.ether.inet.log_arp_movements=0");
+	set_sysctl(array(
+		"net.link.ether.inet.log_arp_wrong_iface" => "0",
+		"net.link.ether.inet.log_arp_movements" => "0"
+	));
 }
 
 function system_enable_arp_wrong_if() {
@@ -1847,8 +1858,10 @@ function system_enable_arp_wrong_if() {
 		$mt = microtime();
 		echo "system_enable_arp_wrong_if() being called $mt\n";
 	}
-	mwexec("/sbin/sysctl -n net.link.ether.inet.log_arp_wrong_iface=1");
-	mwexec("/sbin/sysctl -n net.link.ether.inet.log_arp_movements=1");
+	set_sysctl(array(
+		"net.link.ether.inet.log_arp_wrong_iface" => "1",
+		"net.link.ether.inet.log_arp_movements" => "1"
+	));
 }
 
 function enable_watchdog() {
@@ -1920,9 +1933,7 @@ function system_identify_specific_platform() {
 	if ($g['platform'] != 'nanobsd')
 		return array('name' => $g['platform'], 'descr' => $g['platform']);
 
-	unset($output);
-	$_gb = exec('/sbin/sysctl -n hw.model', $output);
-	$dmesg = $output[0];
+	$dmesg = get_single_sysctl('hw.model');
 
 	if (strpos($dmesg, "PC Engines WRAP") !== false)
 		return array('name' => 'wrap', 'descr' => gettext('PC Engines WRAP'));
diff --git a/etc/inc/unbound.inc b/etc/inc/unbound.inc
index b5de82f..f9b3340 100644
--- a/etc/inc/unbound.inc
+++ b/etc/inc/unbound.inc
@@ -45,7 +45,7 @@ function unbound_optimization() {
      * Set the number of threads equal to number of CPUs.
      * Use 1 to disable threading, if for some reason this sysctl fails.
      */
-    $numprocs = intval(trim(exec('/sbin/sysctl -n kern.smp.cpus')));
+    $numprocs = intval(get_single_sysctl('kern.smp.cpus'));
     if ($numprocs > 0)
         $optimization['number_threads'] = "num-threads: {$numprocs}";
     else
diff --git a/etc/inc/util.inc b/etc/inc/util.inc
index d4c7730..402ef3e 100644
--- a/etc/inc/util.inc
+++ b/etc/inc/util.inc
@@ -1638,14 +1638,8 @@ function set_single_sysctl($name, $value) {
  *     [1] real (actual) memory of the system, should be the size of the RAM card/s - e.g. 256 MBytes
  */
 function get_memory() {
-
-	$output = "";
-	$_gb = exec("/sbin/sysctl -n hw.physmem", $output);
-	$physmem = trim($output[0], " \n");
-	unset($output);
-	$_gb = exec("/sbin/sysctl -n hw.realmem", $output);
-	$realmem = trim($output[0], " \n");
-	unset($output, $_gb);
+	$physmem = get_single_sysctl("hw.physmem");
+	$realmem = get_single_sysctl("hw.realmem");
 	/* convert from bytes to megabytes */
 	return array(($physmem/1048576),($realmem/1048576));
 }
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 9beb1ad..02da0c2 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -34,7 +34,7 @@
 */
 
 /*
-	pfSense_BUILDER_BINARIES:	/sbin/ifconfig	/sbin/sysctl
+	pfSense_BUILDER_BINARIES:	/sbin/ifconfig
 	pfSense_BUILDER_BINARIES:	/usr/local/sbin/ipsec	/usr/local/libexec/ipsec/charon /usr/local/libexec/ipsec/starter
 	pfSense_BUILDER_BINARIES:	/usr/local/sbin/filterdns	/usr/local/sbin/mpd4
 	pfSense_MODULE:	vpn
@@ -124,12 +124,12 @@ function vpn_ipsec_configure($ipchg = false)
 
 		/* disallow IPSEC, it is off */
 		mwexec("/sbin/ifconfig enc0 down");
-		exec("/sbin/sysctl net.inet.ip.ipsec_in_use=0");
+		set_single_sysctl("net.inet.ip.ipsec_in_use", "0");
 
 		return 0;
 	} else {
 		mwexec("/sbin/ifconfig enc0 up");
-		mwexec("/sbin/sysctl net.inet.ip.ipsec_in_use=1");
+		set_single_sysctl("net.inet.ip.ipsec_in_use", "1");
 		/* needed for config files */
 		if (!is_dir("{$g['varetc_path']}/ipsec"))
 			mkdir("{$g['varetc_path']}/ipsec");
@@ -157,7 +157,7 @@ function vpn_ipsec_configure($ipchg = false)
 			echo gettext("Configuring IPsec VPN... ");
 
 		/* fastforwarding is not compatible with ipsec tunnels */
-		mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0");
+		set_single_sysctl("net.inet.ip.fastforwarding", "0");
 
 		/* resolve all local, peer addresses and setup pings */
 		$ipmap = array();
@@ -1506,9 +1506,9 @@ EOD;
 function vpn_ipsec_configure_preferoldsa() {
 	global $config;
 	if(isset($config['ipsec']['preferoldsa']))
-		mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30");
+		set_single_sysctl("net.key.preferred_oldsa", "-30");
 	else
-		mwexec("/sbin/sysctl net.key.preferred_oldsa=0");
+		set_single_sysctl("net.key.preferred_oldsa", "0");
 }
 
 ?>
diff --git a/etc/phpshellsessions/disablecarp b/etc/phpshellsessions/disablecarp
index 5868158..1ad71ae 100644
--- a/etc/phpshellsessions/disablecarp
+++ b/etc/phpshellsessions/disablecarp
@@ -3,7 +3,7 @@ require_once("config.inc");
 require_once("interfaces.inc");
 require_once("util.inc");
 
-mwexec("/sbin/sysctl net.inet.carp.allow=0");
+set_single_sysctl("net.inet.carp.allow", "0");
 if(is_array($config['virtualip']['vip'])) {
 	$viparr = &$config['virtualip']['vip'];
 	foreach ($viparr as $vip) {
diff --git a/etc/phpshellsessions/enablecarp b/etc/phpshellsessions/enablecarp
index 6eb7083..d486c04 100644
--- a/etc/phpshellsessions/enablecarp
+++ b/etc/phpshellsessions/enablecarp
@@ -15,4 +15,4 @@ if(is_array($config['virtualip']['vip'])) {
 	}
 }
 interfaces_carp_setup();
-mwexec("/sbin/sysctl net.inet.carp.allow=1");
+set_single_sysctl("net.inet.carp.allow", "1");
diff --git a/etc/rc.bootup b/etc/rc.bootup
index 815480a..69eb486 100755
--- a/etc/rc.bootup
+++ b/etc/rc.bootup
@@ -392,16 +392,19 @@ if($config['system']['afterbootupshellcmd'] <> "") {
 if($physmem < $g['minimum_ram_warning']) {
 	require_once("/etc/inc/notices.inc");
 	file_notice("{$g['product_name']}MemoryRequirements", "{$g['product_name']} requires at least {$g['minimum_ram_warning_text']} of RAM.  Expect unusual performance.  This platform is not supported.", "Memory", "", 1);
-	mwexec("/sbin/sysctl net.inet.tcp.recvspace=4096");
-	mwexec("/sbin/sysctl net.inet.tcp.sendspace=4096");
+	set_sysctl(array(
+		"net.inet.tcp.recvspace" => "4096",
+		"net.inet.tcp.sendspace" => "4096"
+	));
 }
 
 /* if we are operating at 1000 then increase timeouts.
    this was never accounted for after moving to 1000 hz */
-$kern_hz = `/sbin/sysctl kern.clockrate | /usr/bin/awk '{ print $5 }' | /usr/bin/cut -d"," -f1`;
-$kern_hz = trim($kern_hz, "\r\n");
+$kern_hz = get_single_sysctl('kern.clockrate');
+$kern_hz = substr($kern_hz, strpos($kern_hz, "hz = ") + 5);
+$kern_hz = substr($kern_hz, 0, strpos($kern_hz, ","));
 if($kern_hz == "1000") 
-	mwexec("/sbin/sysctl net.inet.tcp.rexmit_min=30");
+	set_single_sysctl("net.inet.tcp.rexmit_min" , "30");
 
 /* start the igmpproxy daemon */
 services_igmpproxy_configure();
diff --git a/usr/local/www/carp_status.php b/usr/local/www/carp_status.php
index 30251d5..192875e 100644
--- a/usr/local/www/carp_status.php
+++ b/usr/local/www/carp_status.php
@@ -34,7 +34,6 @@
 ##|-PRIV
 
 /*
-	pfSense_BUILDER_BINARIES:	/sbin/sysctl	
 	pfSense_MODULE:	carp
 */
 
@@ -56,7 +55,7 @@ if($_POST['carp_maintenancemode'] <> "") {
 }
 if($_POST['disablecarp'] <> "") {
 	if($status == true) {
-		mwexec("/sbin/sysctl net.inet.carp.allow=0");
+		set_single_sysctl('net.inet.carp.allow', '0');
 		if(is_array($config['virtualip']['vip'])) {
 			$viparr = &$config['virtualip']['vip'];
 			foreach ($viparr as $vip) {
@@ -83,7 +82,7 @@ if($_POST['disablecarp'] <> "") {
 			}
 		}
 		interfaces_carp_setup();
-		mwexec("/sbin/sysctl net.inet.carp.allow=1");
+		set_single_sysctl('net.inet.carp.allow', '1');
 	}
 }
 
diff --git a/usr/local/www/diag_nanobsd.php b/usr/local/www/diag_nanobsd.php
index 139d764..2d5998a 100644
--- a/usr/local/www/diag_nanobsd.php
+++ b/usr/local/www/diag_nanobsd.php
@@ -28,7 +28,7 @@
 
 /*	
 	pfSense_BUILDER_BINARIES:	/sbin/mount	/sbin/glabel	/usr/bin/grep	/usr/bin/cut	/usr/bin/head	/bin/cp
-	pfSense_BUILDER_BINARIES:	/usr/sbin/boot0cfg	/bin/mkdir	/sbin/fsck_ufs	/sbin/mount	/sbin/sysctl	/bin/dd	/sbin/tunefs
+	pfSense_BUILDER_BINARIES:	/usr/sbin/boot0cfg	/bin/mkdir	/sbin/fsck_ufs	/sbin/mount	/bin/dd	/sbin/tunefs
 	pfSense_MODULE:	nanobsd
 */
 
diff --git a/usr/local/www/includes/functions.inc.php b/usr/local/www/includes/functions.inc.php
index 78043e8..48bc408 100644
--- a/usr/local/www/includes/functions.inc.php
+++ b/usr/local/www/includes/functions.inc.php
@@ -114,9 +114,9 @@ function get_uptime() {
 function cpu_usage() {
 	$duration = 1;
 	$diff = array('user', 'nice', 'sys', 'intr', 'idle');
-	$cpuTicks = array_combine($diff, explode(" ", `/sbin/sysctl -n kern.cp_time`));
+	$cpuTicks = array_combine($diff, explode(" ", get_single_sysctl('kern.cp_time')));
 	sleep($duration);
-	$cpuTicks2 = array_combine($diff, explode(" ", `/sbin/sysctl -n kern.cp_time`));
+	$cpuTicks2 = array_combine($diff, explode(" ", get_single_sysctl('kern.cp_time')));
 
 	$totalStart = array_sum($cpuTicks);
 	$totalEnd = array_sum($cpuTicks2);
@@ -180,15 +180,12 @@ function get_mbuf($percent=false) {
 }
 
 function get_temp() {
-	$temp_out = "";
-	exec("/sbin/sysctl dev.cpu.0.temperature | /usr/bin/awk '{ print $2 }' | /usr/bin/cut -d 'C' -f 1", $dfout);
-	$temp_out = trim($dfout[0]);
-	if ($temp_out == "") {
-		exec("/sbin/sysctl hw.acpi.thermal.tz0.temperature | /usr/bin/awk '{ print $2 }' | /usr/bin/cut -d 'C' -f 1", $dfout);
-		$temp_out = trim($dfout[0]);
-	}
+	$temp_out = get_single_sysctl("dev.cpu.0.temperature");
+	if ($temp_out == "")
+		$temp_out = get_single_sysctl("hw.acpi.thermal.tz0.temperature");
 
-	return $temp_out;
+	// Remove 'C' from the end
+	return rtrim($temp_out, 'C');
 }
 
 /* Get mounted filesystems and usage. Do not display entries for virtual filesystems (e.g. devfs, nullfs, unionfs) */
@@ -232,16 +229,14 @@ function swap_usage() {
 }
 
 function mem_usage() {
-	$memory = "";
-	exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
-		"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);
-
-	$totalMem = $memory[0];
-	$availMem = $memory[1] + $memory[2] + $memory[3];
-	$usedMem = $totalMem - $availMem;
-	if ($totalMem > 0)
+	$totalMem = get_single_sysctl("vm.stats.vm.v_page_count");
+	if ($totalMem > 0) {
+		$inactiveMem = get_single_sysctl("vm.stats.vm.v_inactive_count");
+		$cachedMem = get_single_sysctl("vm.stats.vm.v_cache_count");
+		$freeMem = get_single_sysctl("vm.stats.vm.v_free_count");
+		$usedMem = $totalMem - ($inactiveMem + $cachedMem + $freeMem);
 		$memUsage = round(($usedMem * 100) / $totalMem, 0);
-	else
+	} else
 		$memUsage = "NA";
 
 	return $memUsage;
@@ -255,22 +250,18 @@ function update_date_time() {
 function get_cpufreq() {
 	$cpufreqs = "";
 	$out = "";
-	exec("/sbin/sysctl -n dev.cpu.0.freq_levels", $cpufreqs);
-	$cpufreqs = explode(" ", trim($cpufreqs[0]));
+	$cpufreqs = explode(" ", get_single_sysctl('dev.cpu.0.freq_levels'));
 	$maxfreq = explode("/", $cpufreqs[0]);
 	$maxfreq = $maxfreq[0];
 	$curfreq = "";
-	exec("/sbin/sysctl -n dev.cpu.0.freq", $curfreq);
-	$curfreq = trim($curfreq[0]);
+	$curfreq = get_single_sysctl('dev.cpu.0.freq');
 	if (($curfreq > 0) && ($curfreq != $maxfreq))
 		$out = "Current: {$curfreq} MHz, Max: {$maxfreq} MHz";
 	return $out;
 }
 
 function get_cpu_count($show_detail = false) {
-	$cpucount = "";
-	exec("/sbin/sysctl -n kern.smp.cpus", $cpucount);
-	$cpucount = $cpucount[0];
+	$cpucount = get_single_sysctl('kern.smp.cpus');
 
 	if ($show_detail) {
 		$cpudetail = "";
diff --git a/usr/local/www/widgets/include/thermal_sensors.inc b/usr/local/www/widgets/include/thermal_sensors.inc
index 2ebc31d..e193b15 100644
--- a/usr/local/www/widgets/include/thermal_sensors.inc
+++ b/usr/local/www/widgets/include/thermal_sensors.inc
@@ -19,7 +19,7 @@ $thermal_sensors_widget_title = "Thermal Sensors";
 //NOTE: depends on proper cofing in System >> Advanced >> Miscellaneous tab >> Thermal Sensors section.
 function getThermalSensorsData() {
 
-	exec("/sbin/sysctl -a | grep temperature", $dfout);
+	$_gb = exec("/sbin/sysctl -a | grep temperature", $dfout);
 	$thermalSensorsData = join("|", $dfout);
 	return $thermalSensorsData;
 	
diff --git a/usr/local/www/widgets/widgets/system_information.widget.php b/usr/local/www/widgets/widgets/system_information.widget.php
index 3705937..694eefd 100644
--- a/usr/local/www/widgets/widgets/system_information.widget.php
+++ b/usr/local/www/widgets/widgets/system_information.widget.php
@@ -167,10 +167,7 @@ $filesystems = get_mounted_filesystems();
 			<td width="25%" class="vncellt"><?=gettext("CPU Type");?></td>
 			<td width="75%" class="listr">
 			<?php 
-				$cpumodel = "";
-				exec("/sbin/sysctl -n hw.model", $cpumodel);
-				$cpumodel = implode(" ", $cpumodel);
-				echo (htmlspecialchars($cpumodel));
+				echo (htmlspecialchars(get_single_sysctl("hw.model")));
 			?>
 			<div id="cpufreq"><?= get_cpufreq(); ?></div>
 		<?php	$cpucount = get_cpu_count();
@@ -264,7 +261,7 @@ $filesystems = get_mounted_filesystems();
 			<td width="75%" class="listr">
 				<?php $memUsage = mem_usage(); ?>
 				<div id="memUsagePB"></div>
-				<span id="memusagemeter"><?= $memUsage.'%'; ?></span> of <?= sprintf("%.0f", `/sbin/sysctl -n hw.physmem` / (1024*1024)) ?> MB
+				<span id="memusagemeter"><?= $memUsage.'%'; ?></span> of <?= sprintf("%.0f", get_single_sysctl('hw.physmem') / (1024*1024)) ?> MB
 			</td>
 		</tr>
 		<?php if($showswap == true): ?>