sysctl: Teach sysctl to attach and run itself in a jail

This allows the parent jail to retrieve or set kernel state when child
does not have sysctl(8) installed (e.g. light weighted OCI containers
o

sysctl: Teach sysctl to attach and run itself in a jail

This allows the parent jail to retrieve or set kernel state when child
does not have sysctl(8) installed (e.g. light weighted OCI containers
or slim jails).

This is especially useful when manipulating jail prison or vnet sysctls.
For example, `sysctl -j foo -Ja` or `sysctl -j foo net.fibs=2`.

Reviewed by: dfr (previous version), markj
MFC after: 1 week
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D48618

show more ...

sysctl: Refactor function parsefile()

Let the caller open the file and pass in the file handler. This can
benefit an upcoming change so that we will have cleaner logic.

No functional change intende

sysctl: Refactor function parsefile()

Let the caller open the file and pass in the file handler. This can
benefit an upcoming change so that we will have cleaner logic.

No functional change intended.

Suggested by: markj
MFC after: 1 week

show more ...

sysctl: Sort options

No functional change intended.

MFC after: 1 day

sysctl: Fix usage() and SYNOPSIS section of man page

I forgot to update the usage() and SYNOPSIS section of man page when
adding the two options -J and -V.

While here, fix the options sort order in

sysctl: Fix usage() and SYNOPSIS section of man page

I forgot to update the usage() and SYNOPSIS section of man page when
adding the two options -J and -V.

While here, fix the options sort order in SYNOPSIS section.

Fixes: 5ec83c660aca sysctl: Add flags to filter jail prison and vnet variables
MFC after: 1 day

show more ...

sysctl: Add flags to filter jail prison and vnet variables

So users do not have to contact the source code to tell whether a
variable is a jail prison / vnet one or not.

Reviewed by: cy (previous v

sysctl: Add flags to filter jail prison and vnet variables

So users do not have to contact the source code to tell whether a
variable is a jail prison / vnet one or not.

Reviewed by: cy (previous version), markj, jamie (for #jails)
MFC after: 2 weeks
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D47107

show more ...

sysctl(8): Fix typo in comment

Line214: combind -> combine

Reviewed by: zlai
Event: Advanced UNIX Programming Course (Fall’23) at NTHU
Request: https://github.com/freebsd/freebsd-src/pull/966

sbin: Automated cleanup of cdefs and other formatting

Apply the following automated changes to try to eliminate
no-longer-needed sys/cdefs.h includes as well as now-empty
blank lines in a row.

Remo

sbin: Automated cleanup of cdefs and other formatting

Apply the following automated changes to try to eliminate
no-longer-needed sys/cdefs.h includes as well as now-empty
blank lines in a row.

Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/
Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/
Remove /\n+#if.*\n#endif.*\n+/
Remove /^#if.*\n#endif.*\n/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/

Sponsored by: Netflix

show more ...

sysctl: emit a newline after NULL node descriptions

Previously when printing the sysctl description (via the -d flag) we
omitted the newline if the node provided no description (i.e., NULL).
This co

sysctl: emit a newline after NULL node descriptions

Previously when printing the sysctl description (via the -d flag) we
omitted the newline if the node provided no description (i.e., NULL).
This could be observed via e.g. `sysctl -d dev`.

PR: 44034
Reviewed by: zlei
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D42112

show more ...

Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

Add -F option to sysctl(8) to display sysctl format.

Also add a test to ensure that it is working correctly.

Submitted by: ota_j.email.ne.jp
Reviewed by: mckusick
Differential Revision: https://re

Add -F option to sysctl(8) to display sysctl format.

Also add a test to ensure that it is working correctly.

Submitted by: ota_j.email.ne.jp
Reviewed by: mckusick
Differential Revision: https://reviews.freebsd.org/D34012

show more ...

sysctl: Small style fix

Slightly reorder to make this look better. No functional change.

Sponsored by: Netflix

Fix building sysctl(8) after c78ad20

In sysctl we parse an efi header on amd64. Fix this after changing the
virtual memory type from a void * to a uint64_t in c78ad20.

sbin/sysctl: Fix CTLFLAG_SKIP for adjacent nodes

The OID is saved when we encounter CTLFLAG_SKIP so that descendants can
be skipped as well. We then must not update the skip OID until we are
out of

sbin/sysctl: Fix CTLFLAG_SKIP for adjacent nodes

The OID is saved when we encounter CTLFLAG_SKIP so that descendants can
be skipped as well. We then must not update the skip OID until we are
out of the node. This was achieved by resetting the skip OID once the
prefix no longer matches, but the case where the OID we reset on has
CTLFLAG_SKIP was not accounted for.

Reported by: mav
Reviewed by: mav
MFC after: 2 days
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D28364

show more ...

sbin/sysctl: Style fix

Remove parameter names from function prototype to match other
prototypes in the file.

Sponsored by: iXsystems, Inc.

sbin/sysctl: Always honor skip in sysctl_all

Fix broken CTLFLAG_SKIP when present on the first child of the requested
node.

We don't need to ignore skip for the first node because in sysctl_all()
w

sbin/sysctl: Always honor skip in sysctl_all

Fix broken CTLFLAG_SKIP when present on the first child of the requested
node.

We don't need to ignore skip for the first node because in sysctl_all()
we've implicitly visited the first node already when oid is specified.
The first call to show_var() in here is after we have iterated to the
next node. When the command line specifically requests a non-node sysctl
we go straight into show_var() without calling sysctl_all().

Reported by: jhb
Reviewed by: jhb
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D27674

show more ...

Use a dynamic buffer for the copy of a node's new value.

This permits setting a node's value to a string longer than BUFSIZ.

Reported by: Sony Arpita Das @ Chelsio
Reviewed by: freqlabs
MFC after:

Use a dynamic buffer for the copy of a node's new value.

This permits setting a node's value to a string longer than BUFSIZ.

Reported by: Sony Arpita Das @ Chelsio
Reviewed by: freqlabs
MFC after: 1 week
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D27027

show more ...

sysctl+kern_sysctl: Honor SKIP for descendant nodes

Ensure we also skip descendants of SKIP nodes when iterating through children
of an explicitly specified node.

Reported by: np
Reviewed by: np
MF

sysctl+kern_sysctl: Honor SKIP for descendant nodes

Ensure we also skip descendants of SKIP nodes when iterating through children
of an explicitly specified node.

Reported by: np
Reviewed by: np
MFC after: 1 week
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D26833

show more ...

sysctl: Misc code cleanup

* Use defined SYS_SYSCTL names
* Use memcmp instead of explicit loop
* Use NULL instead of 0 for pointer value
* Use __FBSDID
* Reformat, improve comments in parse()

No fu

sysctl: Misc code cleanup

* Use defined SYS_SYSCTL names
* Use memcmp instead of explicit loop
* Use NULL instead of 0 for pointer value
* Use __FBSDID
* Reformat, improve comments in parse()

No functional changes.

Reviewed by: imp
MFC after: 1 week
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D26832

show more ...

Enable iterating all sysctls, even ones with CTLFLAG_SKIP

Add an "nextnoskip" sysctl that allows for listing of sysctls intended to be
normally skipped for cost reasons.

This makes it so the names/

Enable iterating all sysctls, even ones with CTLFLAG_SKIP

Add an "nextnoskip" sysctl that allows for listing of sysctls intended to be
normally skipped for cost reasons.

This makes it so the names/descriptions of those sysctls can be discovered with
sysctl -aN/sysctl -ad/sysctl -at.

It also makes it so children are visited when a node flagged with CTLFLAG_SKIP
is explicitly requested.

The intended use case is to mark the root "kstat" node with CTLFLAG_SKIP so that
the extensive and expensive stats are skipped by default but may still be easily
obtained without having to know them all (which may not even be possible) and
request each one-by-one.

Reviewed by: jhb
MFC after: 2 weeks
Relnotes: yes
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D26560

show more ...

Add sysctl(8) formatting for hw.pagesizes.

- Change the type of hw.pagesizes to OPAQUE, since it returns an array.
- Modify the handler to only truncate the returned length if the caller
supplied

Add sysctl(8) formatting for hw.pagesizes.

- Change the type of hw.pagesizes to OPAQUE, since it returns an array.
- Modify the handler to only truncate the returned length if the caller
supplied an output buffer. This allows use of the trick of passing a
NULL output buffer to fetch the output size, while preserving
compatibility if MAXPAGESIZES is increased.
- Add a "S,pagesize" formatter to sysctl(8).

Reviewed by: alc, kib
MFC after: 2 weeks
Sponsored by: Juniper Networks, Inc.
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D26239

show more ...

MFhead@r344527

Merge ^/head r344178 through r344512.

evdev: export event device properties through sysctl interface

A big security advantage of Wayland is not allowing applications to read
input devices all the time. Having /dev/input/* accessible to

evdev: export event device properties through sysctl interface

A big security advantage of Wayland is not allowing applications to read
input devices all the time. Having /dev/input/* accessible to the user
account subverts this advantage.

libudev-devd was opening the evdev devices to detect their types (mouse,
keyboard, touchpad, etc). This don't work if /dev/input/* is inaccessible.
With the kernel exposing this information as sysctls (kern.evdev.input.*),
we can work w/o /dev/input/* access, preserving the Wayland security model.

Submitted by: Greg V <greg@unrelenting.technology>
Reviewed by: wulf, imp
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D18694

show more ...

Merge ^/head r338392 through r338594.

Improve handling of the EFI map types[] array.

Use nitems(), do not assume EFI_MD_TYPE_ contiguous allocation, in
particular, switch to use designated array initializers.

Reviewed by: jhb (previous

Improve handling of the EFI map types[] array.

Use nitems(), do not assume EFI_MD_TYPE_ contiguous allocation, in
particular, switch to use designated array initializers.

Reviewed by: jhb (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Approved by: re (gjb)

show more ...