HardenedBSD/etc/rc.shutdown

#!/bin/sh
#
# Copyright (c) 1997  Ollivier Robert
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# $FreeBSD$
#

# Site-specific closing actions for daemons run by init on shutdown,
# or before going single-user from multi-user.
# Output and errors are directed to console by init, and the
# console is the controlling terminal.

stty status '^T'

# Set shell to ignore SIGINT (2), but not children;
# shell catches SIGQUIT (3) and returns to single user after fsck.
trap : 2
trap : 3	# shouldn't be needed

HOME=/
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
export HOME PATH

# If there is a global system configuration file, suck it in.
# XXX - It's only purpose is to catch rc_ng="YES".
#
if [ -r /etc/defaults/rc.conf ]; then
	. /etc/defaults/rc.conf
	source_rc_confs
elif [ -r /etc/rc.conf ]; then
	. /etc/rc.conf
fi

case ${rc_ng} in
[Yy][Ee][Ss])
	. /etc/rc.subr

	load_rc_config 'XXX'

	# If requested, start a watchdog timer in the background which
	# will terminate rc.shutdown if rc.shutdown doesn't complete
	# within the specified time.
	#
	_rcshutdown_watchdog=
	if [ -n "$rcshutdown_timeout" ]; then
		debug "Initiating watchdog timer."
		sleep $rcshutdown_timeout && ( 
			_msg="$rcshutdown_timeout second watchdog" \
			    " timeout expired. Shutdown terminated."
			logger -t rc.shutdown "$_msg"
			echo "$_msg"
			date
			kill -KILL $$ >/dev/null 2>&1
		) &
		_rcshutdown_watchdog=$!
	fi

	# Determine the shutdown order of the /etc/rc.d scripts,
	# and perform the operation
	# XXX - rcorder(8) with multiple -k switches works as a logical OR,
	#       so, we can't do this: rcorder -k shutdown -k FreeBSD.
	#
	files=`eval grep -l \'^# KEYWORD:.*FreeBSD\' \`rcorder -k shutdown /etc/rc.d/*\``

	for _rc_elem in `reverse_list $files`; do
		debug "run_rc_script $_rc_elem stop"
		run_rc_script $_rc_elem stop
	done

	# Terminate the background watchdog timer (if it is running)
	#
	if [ -n "$_rcshutdown_watchdog" ]; then
		kill -TERM $_rcshutdown_watchdog >/dev/null 2>&1
	fi

	echo '.'
	exit 0
	;;
*)
	# fall-through to the old rc scripts
	;;
esac

# reverse_list list
#	print the list in reverse order
#
reverse_list()
{
	_revlist=
	for _revfile in $*; do
		_revlist="$_revfile${script_name_sep}$_revlist"
	done
	echo $_revlist
}

# Write some entropy so the rebooting /dev/random can reseed
#
case ${entropy_file} in
[Nn][Oo] | '')
	;;
*)
	echo -n 'Writing entropy file:'
	rm -f ${entropy_file}
	oumask=`umask`
	umask 077
	if touch ${entropy_file} ; then
		entropy_file_confirmed="${entropy_file}"
	else
		# Try this as a reasonable alternative for read-only
		# roots, diskless workstations, etc.
		rm -f /var/db/entropy
		if touch /var/db/entropy ; then
			entropy_file_confirmed=/var/db/entropy
		fi
	fi
	case ${entropy_file_confirmed} in
	'')
		echo ' ERROR - entropy file write failed'
		;;
	*)
		dd if=/dev/random of=${entropy_file_confirmed} \
		   bs=4096 count=1 2> /dev/null
		echo '.'
		;;
	esac
	umask ${oumask}
	;;
esac

# Check if /var/db/mounttab is clean.
case $1 in
reboot)
	if [ -f /var/db/mounttab ]; then
		rpc.umntall
	fi
	;;
esac

echo -n 'Shutting down daemon processes:'

# for each valid dir in $local_startup, search for init scripts matching *.sh
case ${local_startup} in
[Nn][Oo] | '')
	;;
*)
	slist=""
	if [ -z "${script_name_sep}" ]; then
		script_name_sep=" "
	fi
	for dir in ${local_startup}; do
		if [ -d "${dir}" ]; then
			for script in ${dir}/*.sh; do
				slist="${slist}${script_name_sep}${script}"
			done
		fi
	done
	script_save_sep="$IFS"
	IFS="${script_name_sep}"
	for script in `reverse_list ${slist}`; do
		if [ -x "${script}" ]; then
			(set -T
			trap 'exit 1' 2
			${script} stop)
		fi
	done
	IFS="${script_save_sep}"
	echo '.'
	;;
esac

# Insert other shutdown procedures here

# Saving firewall state tables should be done last
echo -n 'Saving firewall state tables:'

# Save IP-filter state tables
case ${ipfs_enable} in
[Yy][Ee][Ss])
	echo -n ' ipfs'
	${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
	;;
esac

echo '.'
exit 0