HardenedBSD/etc/rc

#!/bin/sh
#	$FreeBSD$
#	From: @(#)rc	5.27 (Berkeley) 6/5/91

# System startup script run by init on autoboot
# or after single-user.
# Output and error are redirected to console by init,
# and the console is the controlling terminal.

# Note that almost all the user-configurable behavior is no longer in
# this file, but rather in /etc/sysconfig.  Please check this file
# first before contemplating any changes here.

stty status '^T'

# Set shell to ignore SIGINT (2), but not children;
# shell catches SIGQUIT (3) and returns to single user after fsck.
trap : 2
trap : 3	# shouldn't be needed

HOME=/; export HOME
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
export PATH

# Configure ccd devices.
if [ -f /etc/ccd.conf ]
then
	ccdconfig -C
fi

swapon -a

if [ $1x = autobootx ]
then
	echo Automatic reboot in progress...
	fsck -p
	case $? in
	0)
		;;
	2)
		exit 1
		;;
	4)
		reboot
		echo "reboot failed... help!"
		exit 1
		;;
	8)
		echo "Automatic file system check failed... help!"
		exit 1
		;;
	12)
		echo "Reboot interrupted"
		exit 1
		;;
	130)
		# interrupt before catcher installed
		exit 1
		;;
	*)
		echo "Unknown error in reboot"
		exit 1
		;;
	esac
else
	echo Skipping disk checks ...
fi

trap "echo 'Reboot interrupted'; exit 1" 3

# root must be read/write both for NFS diskless and for VFS LKMs before
# proceeding any further.
mount -u -o rw /
if [ $? != 0 ]; then
	echo "Filesystem mount failed, startup aborted"
	exit 1
fi

umount -a >/dev/null 2>&1

mount -a -t nonfs
if [ $? != 0 ]; then
	echo "Filesystem mount failed, startup aborted"
	exit 1
fi

adjkerntz -i

# Keep a copy of the boot messages around
/sbin/dmesg > /var/run/dmesg.boot

# If there is a global system configuration file, suck it in.
if [ -f /etc/sysconfig ]; then
	. /etc/sysconfig
fi

# Add additional swapfile, if configured.
if [ "x$swapfile" != "xNO" -a -w "$swapfile" -a -b /dev/vn0b ]; then
	echo "Adding $swapfile as additional swap."
	/usr/sbin/vnconfig /dev/vn0b $swapfile && swapon /dev/vn0b
fi

# configure serial devices
if [ -f /etc/rc.serial ]; then
	. /etc/rc.serial
fi

# start up PC-card configuration
if [ -f /etc/rc.pccard ]; then
	. /etc/rc.pccard
fi

# start up the network
if [ -f /etc/netstart ]; then
	sh /etc/netstart
fi

mount -a -t nfs >/dev/null 2>&1

# Whack the pty perms back into shape.
chmod 666 /dev/tty[pqrsPQRS]*

# clean up left-over files
rm -f /etc/nologin
rm -f /var/spool/lock/*
rm -rf /var/spool/uucp/.Temp/*
(cd /var/run && { cp /dev/null utmp; chmod 644 utmp; })

#
# Clearing /tmp at boot-time is essentially stupid, but seems to have
# a long tradition.  It doesn't help in any way for long-living systems,
# and it might accidentally clobber files you would rather like to have
# preserved after a crash (if not using mfs /tmp anyway).
#
# See also the commented out example of another cleanup policy in
# /etc/daily.
#
echo clearing /tmp

# prune quickly with one rm, then use find to clean up /tmp/[lq]*
# (not needed with mfs /tmp, but doesn't hurt there...)
(cd /tmp && rm -rf [a-km-pr-zA-Z]* &&
    find -d . ! -name . ! -name lost+found ! -name quotas -exec rm -rf -- {} \;)

# The above is even more stupid since it prevents you from restarting
# X11 after a system crash.  If you disable the above, make sure to
# uncomment the line below.
#
# clean up leftover X lock files and local connection sockets
#rm -f /tmp/.X*-lock /tmp/.X11-unix/*


# enable dumpdev so that savecore can see it
if [ "X${dumpdev}" != X"NO" ]; then
	dumpon ${dumpdev}
fi

# /var/crash should be a directory or a symbolic link
# to the crash directory if core dumps are to be saved.
if [ "X${savecore}" = X"YES" -a -d /var/crash ]; then
	echo -n checking for core dump...
	savecore /var/crash
fi

# snapshot any kernel -c changes back to disk
echo 'recording kernel -c changes'
/sbin/dset -q

# start system logging and name service (named needs to start before syslogd
# if you don't have a /etc/resolv.conf)
#
echo -n starting system daemons:

# Transitional symlink (for the next couple of years :) until all
# binaries had a chance to move towards /var/run/log.
if [ ! -h /dev/log ] ; then
	# might complain for r/o root f/s
	ln -sf /var/run/log /dev/log
fi
rm -f /var/run/log
echo ' syslogd.';			syslogd

echo -n starting early network daemons:

# $namedflags is imported from /etc/sysconfig
if [ "X${namedflags}" != X"NO" ]; then
	echo -n ' named';		named $namedflags
fi

# $ntpdate and $xntpdflags are imported from /etc/sysconfig.
# If $ntpdate != NO, run ntpdate $ntpdate to set the date correctly.
# If $xntpdflags != NO, start xntpd.
if [ "X${ntpdate}" != X"NO" -o "X${xntpdflags}" != X"NO" ]; then
	if [ "X${tickadjflags}" != X"NO" ]; then
		echo -n ' tickadj';	tickadj ${tickadjflags--Aq}
	fi

	if [ "X${ntpdate}" != X"NO" ]; then
		echo -n ' ntpdate';	ntpdate ${ntpdate} >/dev/null 2>&1
	fi

	if [ "X${xntpdflags}" != X"NO" ]; then
		echo -n ' xntpd';	xntpd ${xntpdflags}
	fi
fi

# $timedflags is imported from /etc/sysconfig;
# if $timedflags == NO, timed isn't run.
if [ "X${timedflags}" != X"NO" ]; then
	echo -n ' timed'; timed $timedflags
fi

# Portmapper should always be run, to provide RPC services for inetd.
if [ -x /usr/sbin/portmap ]; then
	echo -n ' portmap';		portmap
fi

# Start ypserv if we're an NIS server.
# Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
if [ "X${nis_serverflags}" != X"NO" ]; then
	echo -n ' ypserv'; ypserv ${nis_serverflags}

	if [ "X${ypxfrdflags}" != X"NO" ]; then
		echo -n ' rpc.ypxfrd'; rpc.ypxfrd ${ypxfrdflags}
	fi

	if [ "X${yppasswddflags}" != X"NO" ]; then
		echo -n ' rpc.yppasswdd'; rpc.yppasswdd ${yppasswddflags}
	fi
fi

# Start ypbind if we're an NIS client
if [ "X${nis_clientflags}" != X"NO" ]; then
	echo -n ' ypbind'; ypbind ${nis_clientflags}
	if [ "X${nis_ypsetflags}" != X"NO" ]; then
		echo -n ' ypset'; ypset ${nis_ypsetflags}
	fi
fi

echo '.'

# Check the quotas (must be after ypbind if using NIS)
if [ "X${check_quotas}" = X"YES" ]; then
	echo -n 'checking quotas:'
	quotacheck -a
	echo ' done.'
	quotaon -a
fi

echo -n starting other network daemons:

if [ "X${nfs_server}" = X"YES" -a -r /etc/exports ]; then
	echo -n ' mountd'
	if [ "X${weak_mountd_authentication}" = X"YES" ]; then
		mountd -n
	else
		mountd
	fi
	echo -n ' nfsd';		nfsd -u -t 4
# Warning: rpc.lockd is broken.
# Only uncomment this line if the consequences are fully understood.
#	echo -n ' rpc.lockd';		rpc.lockd
	echo -n ' rpc.statd';		rpc.statd
fi

if [ "X${nfs_client}" = X"YES" ]; then
	echo -n ' nfsiod';		nfsiod -n 4
fi

if [ "X${amdflags}" != X"NO" ]; then
	echo -n ' amd'
	amd -p ${amdflags} > /var/run/amd.pid
fi

# $rwhod is imported from /etc/sysconfig;
# if $rwhod is set to YES, rwhod is run.
if [ "X${rwhod}" = X"YES" ]; then
	echo -n ' rwhod';	rwhod
fi

# Kerberos runs ONLY on the Kerberos server machine
if [ "X${kerberos_server}" = X"YES" ]; then
	echo -n ' kerberos';	kerberos >> /var/log/kerberos.log &
	echo -n ' kadmind'; \
		(sleep 20; kadmind -n >/dev/null 2>&1 &) &
fi

# IP multicast routing daemon
if [ "X${mrouted}" != X"NO" -a -x /usr/sbin/mrouted ]; then
	echo -n ' mrouted'; mrouted ${mrouted}
fi

echo '.'

# build ps databases
kvm_mkdb 
dev_mkdb

# check the password temp/lock file
if [ -f /etc/ptmp ]
then
	logger -s -p auth.err \
	"password file may be incorrect -- /etc/ptmp exists"
fi

if [ "X${accounting}" = X"YES" -a -d /var/account ]; then
	echo 'turning on accounting'
	if [ ! -e /var/account/acct ]; then
		touch /var/account/acct && chmod 600 /var/account/acct
	fi
	accton /var/account/acct
fi

# Make shared lib searching a little faster.  Leave /usr/lib first if you
# add your own entries or you may come to grief.
if [ -x /sbin/ldconfig ]; then
	_LDC=/usr/lib
	if [ -d /usr/lib/compat ]; then _LDC="${_LDC} /usr/lib/compat" ; fi
	if [ -d /usr/X11R6/lib ]; then _LDC="${_LDC} /usr/X11R6/lib" ; fi
	if [ -d /usr/X386/lib ]; then _LDC="${_LDC} /usr/X386/lib" ; fi
	if [ -d /usr/local/lib ]; then _LDC="${_LDC} /usr/local/lib" ; fi
	echo 'setting ldconfig path:' ${_LDC}
	ldconfig ${_LDC}
fi

# Now start up miscellaneous daemons that don't belong anywhere else
#
echo -n standard daemons:
echo -n ' inetd';		inetd
echo -n ' cron';		cron

if [ "X${lpd}" != X"NO" -a -x /usr/sbin/lpd ]; then
	echo -n ' printer';		lpd
fi

# $sendmail_flags is imported from /etc/sysconfig;
# if $sendmail_flags is something other than NO, sendmail is run.
if [ "X${sendmail_flags}" != X"NO" -a -r /etc/sendmail.cf ]; then
	echo -n ' sendmail';            /usr/sbin/sendmail ${sendmail_flags}
fi

echo '.'

# configure implementation specific stuff
arch=`uname -m`
if [ -f /etc/rc.${arch} ]; then
	. /etc/rc.${arch}
fi

# Recover vi editor files.
vibackup=`echo /var/tmp/vi.recover/vi.*`
if [ "$vibackup" != '/var/tmp/vi.recover/vi.*' ]; then
	echo 'Recovering vi editor sessions'
	for i in $vibackup; do
		# Only test files that are readable.
		if test ! -r $i; then
			continue
		fi

		# Unmodified nvi editor backup files either have the
		# execute bit set or are zero length.  Delete them.
		if test -x $i -o ! -s $i; then
			rm -f $i
		fi
	done

	# It is possible to get incomplete recovery files, if the editor
	# crashes at the right time.
	virecovery=`echo /var/tmp/vi.recover/recover.*`
	if [ "$virecovery" != "/var/tmp/vi.recover/recover.*" ]; then
		for i in $virecovery; do
			# Only test files that are readable.
			if test ! -r $i; then
				continue
			fi

			# Delete any recovery files that are zero length,
			# corrupted, or that have no corresponding backup file.
			# Else send mail to the user.
			recfile=`awk '/^X-vi-recover-path:/{print $2}' < $i`
			if test -n "$recfile" -a -s "$recfile"; then
				sendmail -t < $i
			else
				rm -f $i
			fi
		done
	fi
fi

# for each valid dir in $local_startup, search for init scripts matching *.sh
if [ "X${local_startup}" != X"NO" ]; then
	echo -n 'Local package startup:'
	for dir in ${local_startup}; do
		[ -d ${dir} ] && for script in ${dir}/*.sh; do
			[ -x ${script} ] && ${script} start
		done
	done
	echo .
fi

# Do traditional (but rather obsolete) rc.local file if it exists.
[ -f /etc/rc.local ] && sh /etc/rc.local

date
exit 0