etc: remove leftover leading empty comments, blank lines

Remove leftover empty leading comments/blank lines that had been
spacers between $FreeBSD$ and the following content in config files
in src/e

etc: remove leftover leading empty comments, blank lines

Remove leftover empty leading comments/blank lines that had been
spacers between $FreeBSD$ and the following content in config files
in src/etc.

Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D41548

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Reserve u2f group for FIDO/U2F key support (SSH, etc.)

We have FIDO/U2F support in the base system now, so reserve a group ID
for it (maching the security/u2f-devd port).

Sponsored by: The FreeBSD

Reserve u2f group for FIDO/U2F key support (SSH, etc.)

We have FIDO/U2F support in the base system now, so reserve a group ID
for it (maching the security/u2f-devd port).

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34341

show more ...

Add idle priority scheduling privilege group to MAC/priority

Add an idletime user group that allows non-root users to run processes
with idle scheduling priority. Privileges are granted by a MAC pol

Add idle priority scheduling privilege group to MAC/priority

Add an idletime user group that allows non-root users to run processes
with idle scheduling priority. Privileges are granted by a MAC policy in
the mac_priority module. For this purpose, the kernel privilege
PRIV_SCHED_IDPRIO was added to sys/priv.h (kernel module ABI change).

Deprecate the system wide sysctl(8) knob
security.bsd.unprivileged_idprio which lets any user run idle priority
processes, regardless of context. While the knob is still working, it is
marked as deprecated in the description and in the man pages.

MFC after: 2 weeks
Differential revision: https://reviews.freebsd.org/D33338

show more ...

MAC/priority module for realtime privilege group

This is a MAC policy module that grants scheduling privileges based on
group membership. Users or processes in the group realtime (gid 47) are
allow

MAC/priority module for realtime privilege group

This is a MAC policy module that grants scheduling privileges based on
group membership. Users or processes in the group realtime (gid 47) are
allowed to run threads and processes with realtime scheduling priority.
For timing-sensitive, low-latency software like audio/jack, running with
realtime priority helps to avoid stutter and gaps.

PR: 239125
MFC after: 2 weeks
Differential revision: https://reviews.freebsd.org/D33191

show more ...

Create and use a tests group for the tests user.

No user (except nobody) should be a member of the nobody group.

Reported by: rgrimes
Reviewed by: rgrimes
MFC after: 3 days
Sponsored by: DARPA
Diff

Create and use a tests group for the tests user.

No user (except nobody) should be a member of the nobody group.

Reported by: rgrimes
Reviewed by: rgrimes
MFC after: 3 days
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D24199

show more ...

Move back group, master.passwd and shells to etc directory

Use the .PATH mechanism instead so keep installing them from lib/libc/gen

While here revert 347961 and 347893 which are no longer needed

Move back group, master.passwd and shells to etc directory

Use the .PATH mechanism instead so keep installing them from lib/libc/gen

While here revert 347961 and 347893 which are no longer needed

Discussed with: manu
Tested by: manu
ok manu@

show more ...

Make it possible to run ntpd as a non-root user, add ntpd uid and gid.

Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting

Make it possible to run ntpd as a non-root user, add ntpd uid and gid.

Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting system time, and
(re-)binding to privileged UDP port 123. These changes add a new mac(4)
policy module, mac_ntpd(4), which grants just those privileges to any
process running with uid 123.

This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes
them the owner of the /var/db/ntp directory, so that it can be used as a
location where the non-privileged daemon can write files such as the
driftfile, and any optional logfile or stats files.

Because there are so many ways to configure ntpd, the question of how to
configure it to run without root privs can be a bit complex, so that will be
addressed in a separate commit. These changes are just what's required to
grant the limited subset of privs to ntpd, and the small change to ntpd to
prevent it from exiting with an error if running as non-root.

Differential Revision: https://reviews.freebsd.org/D16281

show more ...

MfH @r295202

Expect to see panics in routing code at least now.

Merge ^/head r294777 through r294960.

MFH

Sponsored by: The FreeBSD Foundation

Fix regression introduced on r293801.
The UID/GID 93 is in using by jaber on PORTS, we will use
UID/GID 160 for ypldap(8).

Reported by: antoine
Approved by: bapt (mentor)
Differential Revision: http

Fix regression introduced on r293801.
The UID/GID 93 is in using by jaber on PORTS, we will use
UID/GID 160 for ypldap(8).

Reported by: antoine
Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D5062

show more ...

Merge from head

Sponsored by: Gandi.net

Finish merging from head, messed up in previous attempt

Merge from HEAD

Catch up with head, primarily for the 1.14.4.0 firmware.

Merge ^/head r286422 through r286684.

Add a new group named 'video' with the id of 44. And make drm create
devices in /dev/dri/ with this new group.

This will allow ports and users to more easily access to these devices
for OpenGL and O

Add a new group named 'video' with the id of 44. And make drm create
devices in /dev/dri/ with this new group.

This will allow ports and users to more easily access to these devices
for OpenGL and OpenCL support.

Reviewed by: dumbbell@
Approved by: dumbbell@
Differential Revision: https://reviews.freebsd.org/D1260

show more ...

Merge head

IFC @264767

MFC @ r259205 in preparation for some SVM updates. (for real this time)

Merge head r233826 through r256722.

Merge head@256284

MFC - tracking commit

Remove most of the ATF tools and the _atf user.

This is necessary because ATF is deprecated and it will be replaced by Kyua.

Submitted by: jmmv@netbsd.org
Reviewed by: Garrett Cooper
Approved by: re