HardenedBSD/etc/rc

#!/bin/sh
# $FreeBSD$
#	From: @(#)rc	5.27 (Berkeley) 6/5/91

# System startup script run by init on autoboot
# or after single-user.
# Output and error are redirected to console by init,
# and the console is the controlling terminal.

# Note that almost all of the user-configurable behavior is no longer in
# this file, but rather in /etc/defaults/rc.conf.  Please check that file
# first before contemplating any changes here.  If you do need to change
# this file for some reason, we would like to know about it.

stty status '^T'

# Set shell to ignore SIGINT (2), but not children;
# shell catches SIGQUIT (3) and returns to single user after fsck.
#
trap : 2
trap : 3	# shouldn't be needed

HOME=/
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
export HOME PATH

# BOOTP diskless boot.  We have to run the rc file early in order to
# retarget various config files.
#
if [ -r /etc/rc.diskless1 ]; then
	dlv=`/sbin/sysctl -n vfs.nfs.diskless_valid 2> /dev/null`
	if [ ${dlv:=0} != 0 ]; then
		. /etc/rc.diskless1
	fi
fi

# If there is a global system configuration file, suck it in.
#
if [ -r /etc/defaults/rc.conf ]; then
	. /etc/defaults/rc.conf
elif [ -r /etc/rc.conf ]; then
	. /etc/rc.conf
fi

# Configure ccd devices.
#
if [ -r /etc/ccd.conf ]; then
	ccdconfig -C
fi

case ${start_vinum} in
[Yy][Ee][Ss])
	vinum start
	;;
esac

swapon -a

case $1 in
autoboot)
	echo Automatic reboot in progress...
	fsck -p
	case $? in
	0)
		;;
	2)
		exit 1
		;;
	4)
		reboot
		echo "reboot failed... help!"
		exit 1
		;;
	8)
		echo "Automatic file system check failed... help!"
		exit 1
		;;
	12)
		echo "Reboot interrupted"
		exit 1
		;;
	130)
		# interrupt before catcher installed
		exit 1
		;;
	*)
		echo "Unknown error in reboot"
		exit 1
		;;
	esac
	;;
*)
	echo Skipping disk checks ...
	;;
esac

set -T
trap "echo 'Reboot interrupted'; exit 1" 3

# root normally must be read/write, but if this is a BOOTP NFS
# diskless boot it does not have to be.
#
case ${root_rw_mount} in
[Nn][Oo] | '')
	;;
*)
	if ! mount -u -o rw / ; then
		echo "Mounting root filesystem rw failed, startup aborted"
		exit 1
	fi
	;;
esac

umount -a >/dev/null 2>&1

# Early NFS mounts and clean up of /var/db/mounttab.
#
case ${early_nfs_mounts} in
[Yy][Ee][Ss])
	case $1 in
	autoboot)
		if [ -f /var/db/mounttab ]; then
			rpc.umntall -k
		fi
		;;
	esac
	mount -a
	;;
*)
	mount -a -t nonfs
	;;
esac

case $? in
0)
	;;
*)
	echo "Mounting /etc/fstab filesystems failed, startup aborted"
	exit 1
	;;
esac

# Run custom disk mounting function here
#
if [ -n "${diskless_mount}" -a -r "${diskless_mount}" ]; then
		sh ${diskless_mount}
fi

adjkerntz -i

clean_var() {
	if [ ! -f /var/run/clean_var ]; then
		rm -rf /var/run/*
		rm -f /var/spool/lock/*
		rm -rf /var/spool/uucp/.Temp/*
		# Keep a copy of the boot messages around
		dmesg >/var/run/dmesg.boot
		# And an initial utmp file
		(cd /var/run && cp /dev/null utmp && chmod 644 utmp;)
		>/var/run/clean_var
	fi
}

if [ -d /var/run -a -d /var/spool/lock -a -d /var/spool/uucp/.Temp ]; then
	# network_pass1() *may* end up writing stuff to /var - we don't want to
	# remove it immediately afterwards - *nor* to we want to fail to clean
	# an nfs-mounted /var.
	clean_var
fi

# Add additional swapfile, if configured.
#
case ${swapfile} in
[Nn][Oo] | '')
	;;
*)
	if [ -w "${swapfile}" -a -b /dev/vn0b ]; then
		echo "Adding ${swapfile} as additional swap."
		vnconfig /dev/vn0b ${swapfile} && swapon /dev/vn0b
	fi
	;;
esac

# Set sysctl variables as early as we can
#
if [ -r /etc/rc.sysctl ]; then
	. /etc/rc.sysctl
fi

# Configure serial devices
#
if [ -r /etc/rc.serial ]; then
	. /etc/rc.serial
fi

# Start up PC-card configuration
#
if [ -r /etc/rc.pccard ]; then
	. /etc/rc.pccard
fi

# Start up the initial network configuration.
#
if [ -r /etc/rc.network ]; then
	. /etc/rc.network	# We only need to do this once.
	network_pass1
fi

# Only mount NFS file systems if $early_nfs_mounts is false.
# If there is a /var/db/mounttab, clean it up with rpc.umntall.
#
echo -n "Mounting NFS file systems"
case ${early_nfs_mounts} in
[Yy][Ee][Ss])
	;;
*)
	case $1 in
	autoboot)
		if [ -f /var/db/mounttab ]; then
			rpc.umntall -k
		fi
		;;
	esac
	mount -a -t nfs
	;;
esac
echo .

# Whack the pty perms back into shape.
#
chflags 0 /dev/tty[pqrsPQRS]*
chmod 666 /dev/tty[pqrsPQRS]*
chown root:wheel /dev/tty[pqrsPQRS]*

# Clean up left-over files
#
clean_var			# If it hasn't already been done
rm /var/run/clean_var

# Clearing /tmp at boot-time seems to have a long tradition.  It doesn't
# help in any way for long-living systems, and it might accidentally
# clobber files you would rather like to have preserved after a crash
# (if not using mfs /tmp anyway).
#
# See also the example of another cleanup policy in /etc/periodic/daily.
#
case ${clear_tmp_enable} in
[Yy][Ee][Ss])
	echo clearing /tmp
	# prune quickly with one rm, then use find to clean up /tmp/[lq]*
	# (not needed with mfs /tmp, but doesn't hurt there...)
	(cd /tmp && rm -rf [a-km-pr-zA-Z]* &&
		find -d . ! -name . ! -name lost+found ! -name quota.user \
		! -name quota.group -exec rm -rf -- {} \;)
	;;
esac

# Remove X lock files, since they will prevent you from restarting X11
# after a system crash.
#
rm -f /tmp/.X*-lock /tmp/.X11-unix/*

# Snapshot any kernel -c changes back to disk here <someday>.
# This has changed with ELF and /kernel.config.

echo -n 'additional daemons:'

# Start system logging and name service.  Named needs to start before syslogd
# if you don't have a /etc/resolv.conf.
#
case ${syslogd_enable} in
[Yy][Ee][Ss])
	# Transitional symlink (for the next couple of years :) until all
	# binaries have had a chance to move towards /var/run/log.
	if [ ! -h /dev/log ]; then
		# might complain for r/o root f/s
		ln -sf /var/run/log /dev/log
	fi

	rm -f /var/run/log
	echo -n ' syslogd';	syslogd ${syslogd_flags}
	;;
esac

echo '.'

# Enable dumpdev so that savecore can see it.
# /var/crash should be a directory or a symbolic link
# to the crash directory if core dumps are to be saved.
#
case ${dumpdev} in
[Nn][Oo] | '')
	;;
*)
	if [ -e "${dumpdev}" -a -d /var/crash ]; then
		dumpon ${dumpdev}
		echo -n checking for core dump...
		savecore /var/crash
	fi
	;;
esac

if [ -n "${network_pass1_done}" ]; then
	network_pass2
fi

# Enable/Check the quotas (must be after ypbind if using NIS)
#
case ${enable_quotas} in
[Yy][Ee][Ss])
	case ${check_quotas} in
	[Yy][Ee][Ss])
		echo -n 'checking quotas:'
		quotacheck -a
		echo ' done.'
		;;
	esac

	echo -n 'enabling quotas:'
	quotaon -a
	echo ' done.'
	;;
esac

if [ -n "${network_pass2_done}" ]; then
	network_pass3
fi

# Build ps databases
#
kvm_mkdb
dev_mkdb

# Check the password temp/lock file
#
if [ -e /etc/ptmp ]; then
	logger -s -p auth.err \
	"password file may be incorrect -- /etc/ptmp exists"
fi

case ${accounting_enable} in
[Yy][Ee][Ss])
	if [ -d /var/account ]; then
		echo 'turning on accounting'
		if [ ! -e /var/account/acct ]; then
			touch /var/account/acct
		fi
		accton /var/account/acct
	fi
	;;
esac

# Make shared lib searching a little faster.  Leave /usr/lib first if you
# add your own entries or you may come to grief.
#
if [ -x /sbin/ldconfig ]; then
	case `/usr/bin/objformat` in
	elf)
		_LDC=/usr/lib
		for i in ${ldconfig_paths}; do
			if [ -d "${i}" ]; then
				_LDC="${_LDC} ${i}"
			fi
		done
		echo 'setting ELF ldconfig path:' ${_LDC}
		ldconfig -elf ${_LDC}
		;;
	esac

	# Legacy aout support for i386 only
	case `sysctl -n hw.machine` in
	i386)
		# Default the a.out ldconfig path.
		: ${ldconfig_paths_aout=${ldconfig_paths}}
		_LDC=/usr/lib/aout
		for i in ${ldconfig_paths_aout}; do
			if [ -d "${i}" ]; then
				_LDC="${_LDC} ${i}"
			fi
		done
		echo 'setting a.out ldconfig path:' ${_LDC}
		ldconfig -aout ${_LDC}
		;;
	esac
fi

# Now start up miscellaneous daemons that don't belong anywhere else
#
echo -n starting standard daemons:
case ${inetd_enable} in
[Nn][Oo])
	;;
*)
	echo -n ' inetd';	inetd ${inetd_flags}
	;;
esac

case ${cron_enable} in
[Nn][Oo])
	;;
*)
	echo -n ' cron';	cron
	;;
esac

case ${lpd_enable} in
[Yy][Ee][Ss])
	echo -n ' printer';	${lpd_program:-/usr/sbin/lpd} ${lpd_flags}
	;;
esac

case ${sendmail_enable} in
[Yy][Ee][Ss])
	if [ -r /etc/sendmail.cf ]; then
		echo -n ' sendmail';	/usr/sbin/sendmail ${sendmail_flags}
	fi
	;;
esac

case ${usbd_enable} in
[Yy][Ee][Ss])
	echo -n ' usbd';	/usr/sbin/usbd ${usbd_flags}
	;;
esac

echo '.'

# Recover vi editor files.
find /var/tmp/vi.recover ! -type f -a ! -type d -delete
vibackup=`echo /var/tmp/vi.recover/vi.*`
if [ "${vibackup}" != '/var/tmp/vi.recover/vi.*' ]; then
	echo 'Recovering vi editor sessions'
	for i in ${vibackup}; do
		# Only test files that are readable.
		if [ ! -r "${i}" ]; then
			continue
		fi

		# Unmodified nvi editor backup files either have the
		# execute bit set or are zero length.  Delete them.
		if [ -x "${i}" -o ! -s "${i}" ]; then
			rm -f ${i}
		fi
	done

	# It is possible to get incomplete recovery files, if the editor
	# crashes at the right time.
	virecovery=`echo /var/tmp/vi.recover/recover.*`
	if [ "${virecovery}" != "/var/tmp/vi.recover/recover.*" ]; then
		for i in ${virecovery}; do
			# Only test files that are readable.
			if [ ! -r "${i}" ]; then
				continue
			fi

			# Delete any recovery files that are zero length,
			# corrupted, or that have no corresponding backup file.
			# Else send mail to the user.
			recfile=`awk '/^X-vi-recover-path:/{print $2}' < ${i}`
			if [ -n "${recfile}" -a -s "${recfile}" ]; then
				sendmail -t < ${i}
			else
				rm -f ${i}
			fi
		done
	fi
fi

# Make a bounds file for msgs(1) if there isn't one already
# "Delete important files with symlink" security hole?
#
if [ -d /var/msgs -a ! -f /var/msgs/bounds ]; then
	echo 0 > /var/msgs/bounds
fi

case ${update_motd} in
[Nn][Oo] | '')
	;;
*)
	if T=`mktemp /tmp/_motd.XXXXXX`; then
		uname -v | sed -e 's,^\([^#]*\) #\(.* [1-2][0-9][0-9][0-9]\).*/\([^\]*\) $,\1 (\3) #\2,' > ${T}
		awk '{if (NR == 1) {if ($1 == "FreeBSD") {next} else {print "\n"$0}} else {print}}' < /etc/motd >> ${T}
		cmp -s ${T} /etc/motd || {
			cp ${T} /etc/motd
			chmod 644 /etc/motd
		}
		rm -f ${T}
	fi
	;;
esac

# Configure implementation specific stuff
#
arch=`uname -m`
if [ -r /etc/rc.${arch} ]; then
	. /etc/rc.${arch}
fi

# Run rc.devfs if readable to customize devfs
#
if [ -r /etc/rc.devfs ]; then
	sh /etc/rc.devfs
fi

# Do traditional (but rather obsolete) rc.local file if it exists.  If you
# use this file and want to make it programmatic, source /etc/defaults/rc.conf
# in /etc/rc.local and add your custom variables to /etc/rc.conf, as
# shown below.  Please do not put local extensions into /etc/rc itself.
# Use /etc/rc.local
#
# ---- rc.local ----
#	if [ -r /etc/defaults/rc.conf ]; then
#		. /etc/defaults/rc.conf
#	fi
#
#	... additional startup conditionals ...
# ---- rc.local ----
#
if [ -r /etc/rc.local ]; then
	echo -n 'starting local daemons:'
	sh /etc/rc.local
	echo '.'
fi

# For each valid dir in $local_startup, search for init scripts matching *.sh
#
case ${local_startup} in
[Nn][Oo] | '')
	;;
*)
	echo -n 'Local package initialization:'
	for dir in ${local_startup}; do
		if [ -d "${dir}" ]; then
			for script in ${dir}/*.sh; do
				if [ -x "${script}" ]; then
					(set -T
					 trap 'exit 1' 2
					 ${script} start)
				fi
			done
		fi
	done
	echo .
	;;
esac

if [ -n "${network_pass3_done}" ]; then
	network_pass4
fi

# Raise kernel security level.  This should be done only after `fsck' has
# repaired local file systems if you want the securelevel to be greater than 1.
#
case ${kern_securelevel_enable} in
[Yy][Ee][Ss])
	if [ "${kern_securelevel}" -ge 0 ]; then
		echo 'Raising kernel security level'
		sysctl -w kern.securelevel=${kern_securelevel}
	fi
	;;
esac

date
exit 0