en Copyright 2015 Java http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#f99f0ee14e3af81c23150a6a340259ca8a33d01a rc.d: add a service jails config to all base system servicesThis gives more permissions to services (e.g. network access toservices which require this) when they are started as an automaticservice jail.The sshd patch is important for the sshd-related functionality asdescribed in the man-page in the service jails part.The location of the added env vars is supposed to allow overriding themin rc.conf, and to hard-disable the use of svcj for some parts where itdoesn't make sense or will not work.Only a subset of all of the services are fully tested (I'm running thissince more than a year with various services started as service jails).The untested parts should be most of the time ok, in some edge-casesmore permissions are needed inside the service jail.Differential Revision: https://reviews.freebsd.org/D40371 List of files: /freebsd/libexec/rc/rc.d/accounting Wed, 22 May 2024 15:31:47 +0200 Alexander Leidinger <netchild@FreeBSD.org> http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd/libexec/rc/rc.d/accounting Wed, 16 Aug 2023 19:55:03 +0200 Warner Losh <imp@FreeBSD.org> http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#a63915c2d7ff177ce364488f86eff99949402051 MFHead @r350386Sponsored by: The FreeBSD Foundation List of files: /freebsd/libexec/rc/rc.d/accounting Sun, 28 Jul 2019 06:02:22 +0200 Alan Somers <asomers@FreeBSD.org> http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#1e121c3ef151e74d455f699ac172c9a1cfac20d8 Limit access to system accounting files.In 2013 the security chapter of the Handbook was updated in r42501 tosuggest limiting access to the system accounting file [*1] by creating theinitial file with a mode of 0600. This was in part based on a discussion inthe forums [*2]. Unfortunately, this advice is overridden by the fact that anew file is created as part of periodic daily processing, and the file modeis set by the rc.d/accounting script.These changes update the accounting script to create the directory with mode0750 if it doesn't already exist, and to create the daily file with mode0640. This limits write access to root only, read access to root and membersof wheel, and eliminates world access completely. For admins who want toprevent even members of wheel from accessing the files, the mode of the/var/account directory can be manually changed to 0700, because the scriptnever creates or changes that directory if it already exists.The accounting_rotate_log() function now also handles the error cases of noexisting log file to rotate, and attempting to rotate the file multipletimes (.0 file already exists).Another small change here eliminates the complexity of the mktemp/chmod/mvsequence for creating a new acct file by using install(1) with the flagsneeded to directly create the file with the desired ownership andmodes. That allows coalescing two separate if checkyesno accounting_enableblocks into one.These changes were inspired by my investigation of PR 202203.[1] https://www.freebsd.org/doc/handbook/security-accounting.html[2] http://forums.freebsd.org/showthread.php?t=41059PR: 202203Differential Revision: https://reviews.freebsd.org/D20876 List of files: /freebsd/libexec/rc/rc.d/accounting Sat, 13 Jul 2019 18:07:38 +0200 Ian Lepore <ian@FreeBSD.org> http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#c6879c6c14eedbd060ba588a3129a6c60ebbe783 Merge ^/head r339015 through r339669. List of files: /freebsd/libexec/rc/rc.d/accounting Tue, 23 Oct 2018 23:09:37 +0200 Dimitry Andric <dim@FreeBSD.org> http://kernelsources.org:8080/source/history/freebsd/libexec/rc/rc.d/accounting#0696600c41600d80bcd993bfd8e675d0ae6951fe Move the rc framework out of sbin/init into libexec/rc.The reasons for this are forward looking to pkgbase: * /sbin/init is a special binary; try not to replace it with every package update because an rc script was touched. (a follow-up commit will make init its own package) * having rc in its own place will allow more easy replacement of the rc framework with alternatives, such as openrc.Discussed with: brd (during BSDCam), kmooreRequested by: cem, bzPR: 231522Approved by: re (gjb) List of files: /freebsd/libexec/rc/rc.d/accounting Wed, 17 Oct 2018 18:49:11 +0200 Bjoern A. Zeeb <bz@FreeBSD.org>