xref: /freebsd/sbin/init/init.c (revision 2282756519d9337dec783509a432fd6ddfd06683)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Donn Seeley at Berkeley Software Design, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #ifndef lint
36 static const char copyright[] =
37 "@(#) Copyright (c) 1991, 1993\n\
38 	The Regents of the University of California.  All rights reserved.\n";
39 #endif /* not lint */
40 
41 #ifndef lint
42 #if 0
43 static char sccsid[] = "@(#)init.c	8.1 (Berkeley) 7/15/93";
44 #endif
45 static const char rcsid[] =
46   "$FreeBSD$";
47 #endif /* not lint */
48 
49 #include <sys/param.h>
50 #include <sys/ioctl.h>
51 #include <sys/mman.h>
52 #include <sys/mount.h>
53 #include <sys/sysctl.h>
54 #include <sys/wait.h>
55 #include <sys/stat.h>
56 #include <sys/uio.h>
57 
58 #include <db.h>
59 #include <errno.h>
60 #include <fcntl.h>
61 #include <kenv.h>
62 #include <libutil.h>
63 #include <paths.h>
64 #include <signal.h>
65 #include <stdio.h>
66 #include <stdlib.h>
67 #include <string.h>
68 #include <syslog.h>
69 #include <time.h>
70 #include <ttyent.h>
71 #include <unistd.h>
72 #include <sys/reboot.h>
73 #include <err.h>
74 
75 #include <stdarg.h>
76 
77 #ifdef SECURE
78 #include <pwd.h>
79 #endif
80 
81 #ifdef LOGIN_CAP
82 #include <login_cap.h>
83 #endif
84 
85 #include "mntopts.h"
86 #include "pathnames.h"
87 
88 /*
89  * Sleep times; used to prevent thrashing.
90  */
91 #define	GETTY_SPACING		 5	/* N secs minimum getty spacing */
92 #define	GETTY_SLEEP		30	/* sleep N secs after spacing problem */
93 #define	GETTY_NSPACE		 3	/* max. spacing count to bring reaction */
94 #define	WINDOW_WAIT		 3	/* wait N secs after starting window */
95 #define	STALL_TIMEOUT		30	/* wait N secs after warning */
96 #define	DEATH_WATCH		10	/* wait N secs for procs to die */
97 #define	DEATH_SCRIPT		120	/* wait for 2min for /etc/rc.shutdown */
98 #define	RESOURCE_RC		"daemon"
99 #define	RESOURCE_WINDOW		"default"
100 #define	RESOURCE_GETTY		"default"
101 
102 static void handle(sig_t, ...);
103 static void delset(sigset_t *, ...);
104 
105 static void stall(const char *, ...) __printflike(1, 2);
106 static void warning(const char *, ...) __printflike(1, 2);
107 static void emergency(const char *, ...) __printflike(1, 2);
108 static void disaster(int);
109 static void badsys(int);
110 static void revoke_ttys(void);
111 static int  runshutdown(void);
112 static char *strk(char *);
113 
114 /*
115  * We really need a recursive typedef...
116  * The following at least guarantees that the return type of (*state_t)()
117  * is sufficiently wide to hold a function pointer.
118  */
119 typedef long (*state_func_t)(void);
120 typedef state_func_t (*state_t)(void);
121 
122 static state_func_t single_user(void);
123 static state_func_t runcom(void);
124 static state_func_t read_ttys(void);
125 static state_func_t multi_user(void);
126 static state_func_t clean_ttys(void);
127 static state_func_t catatonia(void);
128 static state_func_t death(void);
129 static state_func_t death_single(void);
130 static state_func_t reroot(void);
131 static state_func_t reroot_phase_two(void);
132 
133 static state_func_t run_script(const char *);
134 
135 static enum { AUTOBOOT, FASTBOOT } runcom_mode = AUTOBOOT;
136 #define FALSE	0
137 #define TRUE	1
138 
139 static int Reboot = FALSE;
140 static int howto = RB_AUTOBOOT;
141 
142 static int devfs;
143 static char *init_path_argv0;
144 
145 static void transition(state_t);
146 static state_t requested_transition;
147 static state_t current_state = death_single;
148 
149 static void execute_script(char *argv[]);
150 static void open_console(void);
151 static const char *get_shell(void);
152 static void write_stderr(const char *message);
153 
154 typedef struct init_session {
155 	pid_t	se_process;		/* controlling process */
156 	time_t	se_started;		/* used to avoid thrashing */
157 	int	se_flags;		/* status of session */
158 #define	SE_SHUTDOWN	0x1		/* session won't be restarted */
159 #define	SE_PRESENT	0x2		/* session is in /etc/ttys */
160 #define	SE_IFEXISTS	0x4		/* session defined as "onifexists" */
161 #define	SE_IFCONSOLE	0x8		/* session defined as "onifconsole" */
162 	int	se_nspace;		/* spacing count */
163 	char	*se_device;		/* filename of port */
164 	char	*se_getty;		/* what to run on that port */
165 	char	*se_getty_argv_space;   /* pre-parsed argument array space */
166 	char	**se_getty_argv;	/* pre-parsed argument array */
167 	char	*se_window;		/* window system (started only once) */
168 	char	*se_window_argv_space;  /* pre-parsed argument array space */
169 	char	**se_window_argv;	/* pre-parsed argument array */
170 	char	*se_type;		/* default terminal type */
171 	struct	init_session *se_prev;
172 	struct	init_session *se_next;
173 } session_t;
174 
175 static void free_session(session_t *);
176 static session_t *new_session(session_t *, struct ttyent *);
177 static session_t *sessions;
178 
179 static char **construct_argv(char *);
180 static void start_window_system(session_t *);
181 static void collect_child(pid_t);
182 static pid_t start_getty(session_t *);
183 static void transition_handler(int);
184 static void alrm_handler(int);
185 static void setsecuritylevel(int);
186 static int getsecuritylevel(void);
187 static int setupargv(session_t *, struct ttyent *);
188 #ifdef LOGIN_CAP
189 static void setprocresources(const char *);
190 #endif
191 static int clang;
192 
193 static int start_session_db(void);
194 static void add_session(session_t *);
195 static void del_session(session_t *);
196 static session_t *find_session(pid_t);
197 static DB *session_db;
198 
199 /*
200  * The mother of all processes.
201  */
202 int
203 main(int argc, char *argv[])
204 {
205 	state_t initial_transition = runcom;
206 	char kenv_value[PATH_MAX];
207 	int c, error;
208 	struct sigaction sa;
209 	sigset_t mask;
210 
211 	/* Dispose of random users. */
212 	if (getuid() != 0)
213 		errx(1, "%s", strerror(EPERM));
214 
215 	/* System V users like to reexec init. */
216 	if (getpid() != 1) {
217 #ifdef COMPAT_SYSV_INIT
218 		/* So give them what they want */
219 		if (argc > 1) {
220 			if (strlen(argv[1]) == 1) {
221 				char runlevel = *argv[1];
222 				int sig;
223 
224 				switch (runlevel) {
225 				case '0': /* halt + poweroff */
226 					sig = SIGUSR2;
227 					break;
228 				case '1': /* single-user */
229 					sig = SIGTERM;
230 					break;
231 				case '6': /* reboot */
232 					sig = SIGINT;
233 					break;
234 				case 'c': /* block further logins */
235 					sig = SIGTSTP;
236 					break;
237 				case 'q': /* rescan /etc/ttys */
238 					sig = SIGHUP;
239 					break;
240 				case 'r': /* remount root */
241 					sig = SIGEMT;
242 					break;
243 				default:
244 					goto invalid;
245 				}
246 				kill(1, sig);
247 				_exit(0);
248 			} else
249 invalid:
250 				errx(1, "invalid run-level ``%s''", argv[1]);
251 		} else
252 #endif
253 			errx(1, "already running");
254 	}
255 
256 	init_path_argv0 = strdup(argv[0]);
257 	if (init_path_argv0 == NULL)
258 		err(1, "strdup");
259 
260 	/*
261 	 * Note that this does NOT open a file...
262 	 * Does 'init' deserve its own facility number?
263 	 */
264 	openlog("init", LOG_CONS, LOG_AUTH);
265 
266 	/*
267 	 * Create an initial session.
268 	 */
269 	if (setsid() < 0 && (errno != EPERM || getsid(0) != 1))
270 		warning("initial setsid() failed: %m");
271 
272 	/*
273 	 * Establish an initial user so that programs running
274 	 * single user do not freak out and die (like passwd).
275 	 */
276 	if (setlogin("root") < 0)
277 		warning("setlogin() failed: %m");
278 
279 	/*
280 	 * This code assumes that we always get arguments through flags,
281 	 * never through bits set in some random machine register.
282 	 */
283 	while ((c = getopt(argc, argv, "dsfr")) != -1)
284 		switch (c) {
285 		case 'd':
286 			devfs = 1;
287 			break;
288 		case 's':
289 			initial_transition = single_user;
290 			break;
291 		case 'f':
292 			runcom_mode = FASTBOOT;
293 			break;
294 		case 'r':
295 			initial_transition = reroot_phase_two;
296 			break;
297 		default:
298 			warning("unrecognized flag '-%c'", c);
299 			break;
300 		}
301 
302 	if (optind != argc)
303 		warning("ignoring excess arguments");
304 
305 	/*
306 	 * We catch or block signals rather than ignore them,
307 	 * so that they get reset on exec.
308 	 */
309 	handle(badsys, SIGSYS, 0);
310 	handle(disaster, SIGABRT, SIGFPE, SIGILL, SIGSEGV, SIGBUS, SIGXCPU,
311 	    SIGXFSZ, 0);
312 	handle(transition_handler, SIGHUP, SIGINT, SIGEMT, SIGTERM, SIGTSTP,
313 	    SIGUSR1, SIGUSR2, SIGWINCH, 0);
314 	handle(alrm_handler, SIGALRM, 0);
315 	sigfillset(&mask);
316 	delset(&mask, SIGABRT, SIGFPE, SIGILL, SIGSEGV, SIGBUS, SIGSYS,
317 	    SIGXCPU, SIGXFSZ, SIGHUP, SIGINT, SIGEMT, SIGTERM, SIGTSTP,
318 	    SIGALRM, SIGUSR1, SIGUSR2, SIGWINCH, 0);
319 	sigprocmask(SIG_SETMASK, &mask, NULL);
320 	sigemptyset(&sa.sa_mask);
321 	sa.sa_flags = 0;
322 	sa.sa_handler = SIG_IGN;
323 	sigaction(SIGTTIN, &sa, NULL);
324 	sigaction(SIGTTOU, &sa, NULL);
325 
326 	/*
327 	 * Paranoia.
328 	 */
329 	close(0);
330 	close(1);
331 	close(2);
332 
333 	if (kenv(KENV_GET, "init_script", kenv_value, sizeof(kenv_value)) > 0) {
334 		state_func_t next_transition;
335 
336 		if ((next_transition = run_script(kenv_value)) != NULL)
337 			initial_transition = (state_t) next_transition;
338 	}
339 
340 	if (kenv(KENV_GET, "init_chroot", kenv_value, sizeof(kenv_value)) > 0) {
341 		if (chdir(kenv_value) != 0 || chroot(".") != 0)
342 			warning("Can't chroot to %s: %m", kenv_value);
343 	}
344 
345 	/*
346 	 * Additional check if devfs needs to be mounted:
347 	 * If "/" and "/dev" have the same device number,
348 	 * then it hasn't been mounted yet.
349 	 */
350 	if (!devfs) {
351 		struct stat stst;
352 		dev_t root_devno;
353 
354 		stat("/", &stst);
355 		root_devno = stst.st_dev;
356 		if (stat("/dev", &stst) != 0)
357 			warning("Can't stat /dev: %m");
358 		else if (stst.st_dev == root_devno)
359 			devfs++;
360 	}
361 
362 	if (devfs) {
363 		struct iovec iov[4];
364 		char *s;
365 		int i;
366 
367 		char _fstype[]	= "fstype";
368 		char _devfs[]	= "devfs";
369 		char _fspath[]	= "fspath";
370 		char _path_dev[]= _PATH_DEV;
371 
372 		iov[0].iov_base = _fstype;
373 		iov[0].iov_len = sizeof(_fstype);
374 		iov[1].iov_base = _devfs;
375 		iov[1].iov_len = sizeof(_devfs);
376 		iov[2].iov_base = _fspath;
377 		iov[2].iov_len = sizeof(_fspath);
378 		/*
379 		 * Try to avoid the trailing slash in _PATH_DEV.
380 		 * Be *very* defensive.
381 		 */
382 		s = strdup(_PATH_DEV);
383 		if (s != NULL) {
384 			i = strlen(s);
385 			if (i > 0 && s[i - 1] == '/')
386 				s[i - 1] = '\0';
387 			iov[3].iov_base = s;
388 			iov[3].iov_len = strlen(s) + 1;
389 		} else {
390 			iov[3].iov_base = _path_dev;
391 			iov[3].iov_len = sizeof(_path_dev);
392 		}
393 		nmount(iov, 4, 0);
394 		if (s != NULL)
395 			free(s);
396 	}
397 
398 	if (initial_transition != reroot_phase_two) {
399 		/*
400 		 * Unmount reroot leftovers.  This runs after init(8)
401 		 * gets reexecuted after reroot_phase_two() is done.
402 		 */
403 		error = unmount(_PATH_REROOT, MNT_FORCE);
404 		if (error != 0 && errno != EINVAL)
405 			warning("Cannot unmount %s: %m", _PATH_REROOT);
406 	}
407 
408 	/*
409 	 * Start the state machine.
410 	 */
411 	transition(initial_transition);
412 
413 	/*
414 	 * Should never reach here.
415 	 */
416 	return 1;
417 }
418 
419 /*
420  * Associate a function with a signal handler.
421  */
422 static void
423 handle(sig_t handler, ...)
424 {
425 	int sig;
426 	struct sigaction sa;
427 	sigset_t mask_everything;
428 	va_list ap;
429 	va_start(ap, handler);
430 
431 	sa.sa_handler = handler;
432 	sigfillset(&mask_everything);
433 
434 	while ((sig = va_arg(ap, int)) != 0) {
435 		sa.sa_mask = mask_everything;
436 		/* XXX SA_RESTART? */
437 		sa.sa_flags = sig == SIGCHLD ? SA_NOCLDSTOP : 0;
438 		sigaction(sig, &sa, NULL);
439 	}
440 	va_end(ap);
441 }
442 
443 /*
444  * Delete a set of signals from a mask.
445  */
446 static void
447 delset(sigset_t *maskp, ...)
448 {
449 	int sig;
450 	va_list ap;
451 	va_start(ap, maskp);
452 
453 	while ((sig = va_arg(ap, int)) != 0)
454 		sigdelset(maskp, sig);
455 	va_end(ap);
456 }
457 
458 /*
459  * Log a message and sleep for a while (to give someone an opportunity
460  * to read it and to save log or hardcopy output if the problem is chronic).
461  * NB: should send a message to the session logger to avoid blocking.
462  */
463 static void
464 stall(const char *message, ...)
465 {
466 	va_list ap;
467 	va_start(ap, message);
468 
469 	vsyslog(LOG_ALERT, message, ap);
470 	va_end(ap);
471 	sleep(STALL_TIMEOUT);
472 }
473 
474 /*
475  * Like stall(), but doesn't sleep.
476  * If cpp had variadic macros, the two functions could be #defines for another.
477  * NB: should send a message to the session logger to avoid blocking.
478  */
479 static void
480 warning(const char *message, ...)
481 {
482 	va_list ap;
483 	va_start(ap, message);
484 
485 	vsyslog(LOG_ALERT, message, ap);
486 	va_end(ap);
487 }
488 
489 /*
490  * Log an emergency message.
491  * NB: should send a message to the session logger to avoid blocking.
492  */
493 static void
494 emergency(const char *message, ...)
495 {
496 	va_list ap;
497 	va_start(ap, message);
498 
499 	vsyslog(LOG_EMERG, message, ap);
500 	va_end(ap);
501 }
502 
503 /*
504  * Catch a SIGSYS signal.
505  *
506  * These may arise if a system does not support sysctl.
507  * We tolerate up to 25 of these, then throw in the towel.
508  */
509 static void
510 badsys(int sig)
511 {
512 	static int badcount = 0;
513 
514 	if (badcount++ < 25)
515 		return;
516 	disaster(sig);
517 }
518 
519 /*
520  * Catch an unexpected signal.
521  */
522 static void
523 disaster(int sig)
524 {
525 
526 	emergency("fatal signal: %s",
527 	    (unsigned)sig < NSIG ? sys_siglist[sig] : "unknown signal");
528 
529 	sleep(STALL_TIMEOUT);
530 	_exit(sig);		/* reboot */
531 }
532 
533 /*
534  * Get the security level of the kernel.
535  */
536 static int
537 getsecuritylevel(void)
538 {
539 #ifdef KERN_SECURELVL
540 	int name[2], curlevel;
541 	size_t len;
542 
543 	name[0] = CTL_KERN;
544 	name[1] = KERN_SECURELVL;
545 	len = sizeof curlevel;
546 	if (sysctl(name, 2, &curlevel, &len, NULL, 0) == -1) {
547 		emergency("cannot get kernel security level: %s",
548 		    strerror(errno));
549 		return (-1);
550 	}
551 	return (curlevel);
552 #else
553 	return (-1);
554 #endif
555 }
556 
557 /*
558  * Set the security level of the kernel.
559  */
560 static void
561 setsecuritylevel(int newlevel)
562 {
563 #ifdef KERN_SECURELVL
564 	int name[2], curlevel;
565 
566 	curlevel = getsecuritylevel();
567 	if (newlevel == curlevel)
568 		return;
569 	name[0] = CTL_KERN;
570 	name[1] = KERN_SECURELVL;
571 	if (sysctl(name, 2, NULL, NULL, &newlevel, sizeof newlevel) == -1) {
572 		emergency(
573 		    "cannot change kernel security level from %d to %d: %s",
574 		    curlevel, newlevel, strerror(errno));
575 		return;
576 	}
577 #ifdef SECURE
578 	warning("kernel security level changed from %d to %d",
579 	    curlevel, newlevel);
580 #endif
581 #endif
582 }
583 
584 /*
585  * Change states in the finite state machine.
586  * The initial state is passed as an argument.
587  */
588 static void
589 transition(state_t s)
590 {
591 
592 	current_state = s;
593 	for (;;)
594 		current_state = (state_t) (*current_state)();
595 }
596 
597 /*
598  * Start a session and allocate a controlling terminal.
599  * Only called by children of init after forking.
600  */
601 static void
602 open_console(void)
603 {
604 	int fd;
605 
606 	/*
607 	 * Try to open /dev/console.  Open the device with O_NONBLOCK to
608 	 * prevent potential blocking on a carrier.
609 	 */
610 	revoke(_PATH_CONSOLE);
611 	if ((fd = open(_PATH_CONSOLE, O_RDWR | O_NONBLOCK)) != -1) {
612 		(void)fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) & ~O_NONBLOCK);
613 		if (login_tty(fd) == 0)
614 			return;
615 		close(fd);
616 	}
617 
618 	/* No luck.  Log output to file if possible. */
619 	if ((fd = open(_PATH_DEVNULL, O_RDWR)) == -1) {
620 		stall("cannot open null device.");
621 		_exit(1);
622 	}
623 	if (fd != STDIN_FILENO) {
624 		dup2(fd, STDIN_FILENO);
625 		close(fd);
626 	}
627 	fd = open(_PATH_INITLOG, O_WRONLY | O_APPEND | O_CREAT, 0644);
628 	if (fd == -1)
629 		dup2(STDIN_FILENO, STDOUT_FILENO);
630 	else if (fd != STDOUT_FILENO) {
631 		dup2(fd, STDOUT_FILENO);
632 		close(fd);
633 	}
634 	dup2(STDOUT_FILENO, STDERR_FILENO);
635 }
636 
637 static const char *
638 get_shell(void)
639 {
640 	static char kenv_value[PATH_MAX];
641 
642 	if (kenv(KENV_GET, "init_shell", kenv_value, sizeof(kenv_value)) > 0)
643 		return kenv_value;
644 	else
645 		return _PATH_BSHELL;
646 }
647 
648 static void
649 write_stderr(const char *message)
650 {
651 
652 	write(STDERR_FILENO, message, strlen(message));
653 }
654 
655 static int
656 read_file(const char *path, void **bufp, size_t *bufsizep)
657 {
658 	struct stat sb;
659 	size_t bufsize;
660 	void *buf;
661 	ssize_t nbytes;
662 	int error, fd;
663 
664 	fd = open(path, O_RDONLY);
665 	if (fd < 0) {
666 		emergency("%s: %s", path, strerror(errno));
667 		return (-1);
668 	}
669 
670 	error = fstat(fd, &sb);
671 	if (error != 0) {
672 		emergency("fstat: %s", strerror(errno));
673 		close(fd);
674 		return (error);
675 	}
676 
677 	bufsize = sb.st_size;
678 	buf = malloc(bufsize);
679 	if (buf == NULL) {
680 		emergency("malloc: %s", strerror(errno));
681 		close(fd);
682 		return (error);
683 	}
684 
685 	nbytes = read(fd, buf, bufsize);
686 	if (nbytes != (ssize_t)bufsize) {
687 		emergency("read: %s", strerror(errno));
688 		close(fd);
689 		free(buf);
690 		return (error);
691 	}
692 
693 	error = close(fd);
694 	if (error != 0) {
695 		emergency("close: %s", strerror(errno));
696 		free(buf);
697 		return (error);
698 	}
699 
700 	*bufp = buf;
701 	*bufsizep = bufsize;
702 
703 	return (0);
704 }
705 
706 static int
707 create_file(const char *path, const void *buf, size_t bufsize)
708 {
709 	ssize_t nbytes;
710 	int error, fd;
711 
712 	fd = open(path, O_WRONLY | O_CREAT | O_EXCL, 0700);
713 	if (fd < 0) {
714 		emergency("%s: %s", path, strerror(errno));
715 		return (-1);
716 	}
717 
718 	nbytes = write(fd, buf, bufsize);
719 	if (nbytes != (ssize_t)bufsize) {
720 		emergency("write: %s", strerror(errno));
721 		close(fd);
722 		return (-1);
723 	}
724 
725 	error = close(fd);
726 	if (error != 0) {
727 		emergency("close: %s", strerror(errno));
728 		return (-1);
729 	}
730 
731 	return (0);
732 }
733 
734 static int
735 mount_tmpfs(const char *fspath)
736 {
737 	struct iovec *iov;
738 	char errmsg[255];
739 	int error, iovlen;
740 
741 	iov = NULL;
742 	iovlen = 0;
743 	memset(errmsg, 0, sizeof(errmsg));
744 	build_iovec(&iov, &iovlen, "fstype",
745 	    __DECONST(void *, "tmpfs"), (size_t)-1);
746 	build_iovec(&iov, &iovlen, "fspath",
747 	    __DECONST(void *, fspath), (size_t)-1);
748 	build_iovec(&iov, &iovlen, "errmsg",
749 	    errmsg, sizeof(errmsg));
750 
751 	error = nmount(iov, iovlen, 0);
752 	if (error != 0) {
753 		if (*errmsg != '\0') {
754 			emergency("cannot mount tmpfs on %s: %s: %s",
755 			    fspath, errmsg, strerror(errno));
756 		} else {
757 			emergency("cannot mount tmpfs on %s: %s",
758 			    fspath, strerror(errno));
759 		}
760 		return (error);
761 	}
762 	return (0);
763 }
764 
765 static state_func_t
766 reroot(void)
767 {
768 	void *buf;
769 	size_t bufsize;
770 	int error;
771 
772 	buf = NULL;
773 	bufsize = 0;
774 
775 	revoke_ttys();
776 	runshutdown();
777 
778 	/*
779 	 * Make sure nobody can interfere with our scheme.
780 	 * Ignore ESRCH, which can apparently happen when
781 	 * there are no processes to kill.
782 	 */
783 	error = kill(-1, SIGKILL);
784 	if (error != 0 && errno != ESRCH) {
785 		emergency("kill(2) failed: %s", strerror(errno));
786 		goto out;
787 	}
788 
789 	/*
790 	 * Copy the init binary into tmpfs, so that we can unmount
791 	 * the old rootfs without committing suicide.
792 	 */
793 	error = read_file(init_path_argv0, &buf, &bufsize);
794 	if (error != 0)
795 		goto out;
796 	error = mount_tmpfs(_PATH_REROOT);
797 	if (error != 0)
798 		goto out;
799 	error = create_file(_PATH_REROOT_INIT, buf, bufsize);
800 	if (error != 0)
801 		goto out;
802 
803 	/*
804 	 * Execute the temporary init.
805 	 */
806 	execl(_PATH_REROOT_INIT, _PATH_REROOT_INIT, "-r", NULL);
807 	emergency("cannot exec %s: %s", _PATH_REROOT_INIT, strerror(errno));
808 
809 out:
810 	emergency("reroot failed; going to single user mode");
811 	free(buf);
812 	return (state_func_t) single_user;
813 }
814 
815 static state_func_t
816 reroot_phase_two(void)
817 {
818 	char init_path[PATH_MAX], *path, *path_component;
819 	size_t init_path_len;
820 	int nbytes, error;
821 
822 	/*
823 	 * Ask the kernel to mount the new rootfs.
824 	 */
825 	error = reboot(RB_REROOT);
826 	if (error != 0) {
827 		emergency("RB_REBOOT failed: %s", strerror(errno));
828 		goto out;
829 	}
830 
831 	/*
832 	 * Figure out where the destination init(8) binary is.  Note that
833 	 * the path could be different than what we've started with.  Use
834 	 * the value from kenv, if set, or the one from sysctl otherwise.
835 	 * The latter defaults to a hardcoded value, but can be overridden
836 	 * by a build time option.
837 	 */
838 	nbytes = kenv(KENV_GET, "init_path", init_path, sizeof(init_path));
839 	if (nbytes <= 0) {
840 		init_path_len = sizeof(init_path);
841 		error = sysctlbyname("kern.init_path",
842 		    init_path, &init_path_len, NULL, 0);
843 		if (error != 0) {
844 			emergency("failed to retrieve kern.init_path: %s",
845 			    strerror(errno));
846 			goto out;
847 		}
848 	}
849 
850 	/*
851 	 * Repeat the init search logic from sys/kern/init_path.c
852 	 */
853 	path_component = init_path;
854 	while ((path = strsep(&path_component, ":")) != NULL) {
855 		/*
856 		 * Execute init(8) from the new rootfs.
857 		 */
858 		execl(path, path, NULL);
859 	}
860 	emergency("cannot exec init from %s: %s", init_path, strerror(errno));
861 
862 out:
863 	emergency("reroot failed; going to single user mode");
864 	return (state_func_t) single_user;
865 }
866 
867 /*
868  * Bring the system up single user.
869  */
870 static state_func_t
871 single_user(void)
872 {
873 	pid_t pid, wpid;
874 	int status;
875 	sigset_t mask;
876 	const char *shell;
877 	char *argv[2];
878 	struct timeval tv, tn;
879 #ifdef SECURE
880 	struct ttyent *typ;
881 	struct passwd *pp;
882 	static const char banner[] =
883 		"Enter root password, or ^D to go multi-user\n";
884 	char *clear, *password;
885 #endif
886 #ifdef DEBUGSHELL
887 	char altshell[128];
888 #endif
889 
890 	if (Reboot) {
891 		/* Instead of going single user, let's reboot the machine */
892 		sync();
893 		if (reboot(howto) == -1) {
894 			emergency("reboot(%#x) failed, %s", howto,
895 			    strerror(errno));
896 			_exit(1); /* panic and reboot */
897 		}
898 		warning("reboot(%#x) returned", howto);
899 		_exit(0); /* panic as well */
900 	}
901 
902 	shell = get_shell();
903 
904 	if ((pid = fork()) == 0) {
905 		/*
906 		 * Start the single user session.
907 		 */
908 		open_console();
909 
910 #ifdef SECURE
911 		/*
912 		 * Check the root password.
913 		 * We don't care if the console is 'on' by default;
914 		 * it's the only tty that can be 'off' and 'secure'.
915 		 */
916 		typ = getttynam("console");
917 		pp = getpwnam("root");
918 		if (typ && (typ->ty_status & TTY_SECURE) == 0 &&
919 		    pp && *pp->pw_passwd) {
920 			write_stderr(banner);
921 			for (;;) {
922 				clear = getpass("Password:");
923 				if (clear == NULL || *clear == '\0')
924 					_exit(0);
925 				password = crypt(clear, pp->pw_passwd);
926 				bzero(clear, _PASSWORD_LEN);
927 				if (password != NULL &&
928 				    strcmp(password, pp->pw_passwd) == 0)
929 					break;
930 				warning("single-user login failed\n");
931 			}
932 		}
933 		endttyent();
934 		endpwent();
935 #endif /* SECURE */
936 
937 #ifdef DEBUGSHELL
938 		{
939 			char *cp = altshell;
940 			int num;
941 
942 #define	SHREQUEST "Enter full pathname of shell or RETURN for "
943 			write_stderr(SHREQUEST);
944 			write_stderr(shell);
945 			write_stderr(": ");
946 			while ((num = read(STDIN_FILENO, cp, 1)) != -1 &&
947 			    num != 0 && *cp != '\n' && cp < &altshell[127])
948 				cp++;
949 			*cp = '\0';
950 			if (altshell[0] != '\0')
951 				shell = altshell;
952 		}
953 #endif /* DEBUGSHELL */
954 
955 		/*
956 		 * Unblock signals.
957 		 * We catch all the interesting ones,
958 		 * and those are reset to SIG_DFL on exec.
959 		 */
960 		sigemptyset(&mask);
961 		sigprocmask(SIG_SETMASK, &mask, NULL);
962 
963 		/*
964 		 * Fire off a shell.
965 		 * If the default one doesn't work, try the Bourne shell.
966 		 */
967 
968 		char name[] = "-sh";
969 
970 		argv[0] = name;
971 		argv[1] = 0;
972 		execv(shell, argv);
973 		emergency("can't exec %s for single user: %m", shell);
974 		execv(_PATH_BSHELL, argv);
975 		emergency("can't exec %s for single user: %m", _PATH_BSHELL);
976 		sleep(STALL_TIMEOUT);
977 		_exit(1);
978 	}
979 
980 	if (pid == -1) {
981 		/*
982 		 * We are seriously hosed.  Do our best.
983 		 */
984 		emergency("can't fork single-user shell, trying again");
985 		while (waitpid(-1, (int *) 0, WNOHANG) > 0)
986 			continue;
987 		return (state_func_t) single_user;
988 	}
989 
990 	requested_transition = 0;
991 	do {
992 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
993 			collect_child(wpid);
994 		if (wpid == -1) {
995 			if (errno == EINTR)
996 				continue;
997 			warning("wait for single-user shell failed: %m; restarting");
998 			return (state_func_t) single_user;
999 		}
1000 		if (wpid == pid && WIFSTOPPED(status)) {
1001 			warning("init: shell stopped, restarting\n");
1002 			kill(pid, SIGCONT);
1003 			wpid = -1;
1004 		}
1005 	} while (wpid != pid && !requested_transition);
1006 
1007 	if (requested_transition)
1008 		return (state_func_t) requested_transition;
1009 
1010 	if (!WIFEXITED(status)) {
1011 		if (WTERMSIG(status) == SIGKILL) {
1012 			/*
1013 			 *  reboot(8) killed shell?
1014 			 */
1015 			warning("single user shell terminated.");
1016 			gettimeofday(&tv, NULL);
1017 			tn = tv;
1018 			tv.tv_sec += STALL_TIMEOUT;
1019 			while (tv.tv_sec > tn.tv_sec || (tv.tv_sec ==
1020 			    tn.tv_sec && tv.tv_usec > tn.tv_usec)) {
1021 				sleep(1);
1022 				gettimeofday(&tn, NULL);
1023 			}
1024 			_exit(0);
1025 		} else {
1026 			warning("single user shell terminated, restarting");
1027 			return (state_func_t) single_user;
1028 		}
1029 	}
1030 
1031 	runcom_mode = FASTBOOT;
1032 	return (state_func_t) runcom;
1033 }
1034 
1035 /*
1036  * Run the system startup script.
1037  */
1038 static state_func_t
1039 runcom(void)
1040 {
1041 	state_func_t next_transition;
1042 
1043 	if ((next_transition = run_script(_PATH_RUNCOM)) != NULL)
1044 		return next_transition;
1045 
1046 	runcom_mode = AUTOBOOT;		/* the default */
1047 	return (state_func_t) read_ttys;
1048 }
1049 
1050 static void
1051 execute_script(char *argv[])
1052 {
1053 	struct sigaction sa;
1054 	const char *shell, *script;
1055 	int error;
1056 
1057 	bzero(&sa, sizeof(sa));
1058 	sigemptyset(&sa.sa_mask);
1059 	sa.sa_handler = SIG_IGN;
1060 	sigaction(SIGTSTP, &sa, NULL);
1061 	sigaction(SIGHUP, &sa, NULL);
1062 
1063 	open_console();
1064 
1065 	sigprocmask(SIG_SETMASK, &sa.sa_mask, NULL);
1066 #ifdef LOGIN_CAP
1067 	setprocresources(RESOURCE_RC);
1068 #endif
1069 
1070 	/*
1071 	 * Try to directly execute the script first.  If it
1072 	 * fails, try the old method of passing the script path
1073 	 * to sh(1).  Don't complain if it fails because of
1074 	 * the missing execute bit.
1075 	 */
1076 	script = argv[1];
1077 	error = access(script, X_OK);
1078 	if (error == 0) {
1079 		execv(script, argv + 1);
1080 		warning("can't exec %s: %m", script);
1081 	} else if (errno != EACCES) {
1082 		warning("can't access %s: %m", script);
1083 	}
1084 
1085 	shell = get_shell();
1086 	execv(shell, argv);
1087 	stall("can't exec %s for %s: %m", shell, script);
1088 }
1089 
1090 /*
1091  * Run a shell script.
1092  * Returns 0 on success, otherwise the next transition to enter:
1093  *  - single_user if fork/execv/waitpid failed, or if the script
1094  *    terminated with a signal or exit code != 0.
1095  *  - death_single if a SIGTERM was delivered to init(8).
1096  */
1097 static state_func_t
1098 run_script(const char *script)
1099 {
1100 	pid_t pid, wpid;
1101 	int status;
1102 	char *argv[4];
1103 	const char *shell;
1104 
1105 	shell = get_shell();
1106 
1107 	if ((pid = fork()) == 0) {
1108 
1109 		char _sh[]		= "sh";
1110 		char _autoboot[]	= "autoboot";
1111 
1112 		argv[0] = _sh;
1113 		argv[1] = __DECONST(char *, script);
1114 		argv[2] = runcom_mode == AUTOBOOT ? _autoboot : 0;
1115 		argv[3] = 0;
1116 
1117 		execute_script(argv);
1118 		sleep(STALL_TIMEOUT);
1119 		_exit(1);	/* force single user mode */
1120 	}
1121 
1122 	if (pid == -1) {
1123 		emergency("can't fork for %s on %s: %m", shell, script);
1124 		while (waitpid(-1, (int *) 0, WNOHANG) > 0)
1125 			continue;
1126 		sleep(STALL_TIMEOUT);
1127 		return (state_func_t) single_user;
1128 	}
1129 
1130 	/*
1131 	 * Copied from single_user().  This is a bit paranoid.
1132 	 */
1133 	requested_transition = 0;
1134 	do {
1135 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
1136 			collect_child(wpid);
1137 		if (wpid == -1) {
1138 			if (requested_transition == death_single ||
1139 			    requested_transition == reroot)
1140 				return (state_func_t) requested_transition;
1141 			if (errno == EINTR)
1142 				continue;
1143 			warning("wait for %s on %s failed: %m; going to "
1144 			    "single user mode", shell, script);
1145 			return (state_func_t) single_user;
1146 		}
1147 		if (wpid == pid && WIFSTOPPED(status)) {
1148 			warning("init: %s on %s stopped, restarting\n",
1149 			    shell, script);
1150 			kill(pid, SIGCONT);
1151 			wpid = -1;
1152 		}
1153 	} while (wpid != pid);
1154 
1155 	if (WIFSIGNALED(status) && WTERMSIG(status) == SIGTERM &&
1156 	    requested_transition == catatonia) {
1157 		/* /etc/rc executed /sbin/reboot; wait for the end quietly */
1158 		sigset_t s;
1159 
1160 		sigfillset(&s);
1161 		for (;;)
1162 			sigsuspend(&s);
1163 	}
1164 
1165 	if (!WIFEXITED(status)) {
1166 		warning("%s on %s terminated abnormally, going to single "
1167 		    "user mode", shell, script);
1168 		return (state_func_t) single_user;
1169 	}
1170 
1171 	if (WEXITSTATUS(status))
1172 		return (state_func_t) single_user;
1173 
1174 	return (state_func_t) 0;
1175 }
1176 
1177 /*
1178  * Open the session database.
1179  *
1180  * NB: We could pass in the size here; is it necessary?
1181  */
1182 static int
1183 start_session_db(void)
1184 {
1185 	if (session_db && (*session_db->close)(session_db))
1186 		emergency("session database close: %s", strerror(errno));
1187 	if ((session_db = dbopen(NULL, O_RDWR, 0, DB_HASH, NULL)) == NULL) {
1188 		emergency("session database open: %s", strerror(errno));
1189 		return (1);
1190 	}
1191 	return (0);
1192 
1193 }
1194 
1195 /*
1196  * Add a new login session.
1197  */
1198 static void
1199 add_session(session_t *sp)
1200 {
1201 	DBT key;
1202 	DBT data;
1203 
1204 	key.data = &sp->se_process;
1205 	key.size = sizeof sp->se_process;
1206 	data.data = &sp;
1207 	data.size = sizeof sp;
1208 
1209 	if ((*session_db->put)(session_db, &key, &data, 0))
1210 		emergency("insert %d: %s", sp->se_process, strerror(errno));
1211 }
1212 
1213 /*
1214  * Delete an old login session.
1215  */
1216 static void
1217 del_session(session_t *sp)
1218 {
1219 	DBT key;
1220 
1221 	key.data = &sp->se_process;
1222 	key.size = sizeof sp->se_process;
1223 
1224 	if ((*session_db->del)(session_db, &key, 0))
1225 		emergency("delete %d: %s", sp->se_process, strerror(errno));
1226 }
1227 
1228 /*
1229  * Look up a login session by pid.
1230  */
1231 static session_t *
1232 find_session(pid_t pid)
1233 {
1234 	DBT key;
1235 	DBT data;
1236 	session_t *ret;
1237 
1238 	key.data = &pid;
1239 	key.size = sizeof pid;
1240 	if ((*session_db->get)(session_db, &key, &data, 0) != 0)
1241 		return 0;
1242 	bcopy(data.data, (char *)&ret, sizeof(ret));
1243 	return ret;
1244 }
1245 
1246 /*
1247  * Construct an argument vector from a command line.
1248  */
1249 static char **
1250 construct_argv(char *command)
1251 {
1252 	int argc = 0;
1253 	char **argv = (char **) malloc(((strlen(command) + 1) / 2 + 1)
1254 						* sizeof (char *));
1255 
1256 	if ((argv[argc++] = strk(command)) == NULL) {
1257 		free(argv);
1258 		return (NULL);
1259 	}
1260 	while ((argv[argc++] = strk((char *) 0)) != NULL)
1261 		continue;
1262 	return argv;
1263 }
1264 
1265 /*
1266  * Deallocate a session descriptor.
1267  */
1268 static void
1269 free_session(session_t *sp)
1270 {
1271 	free(sp->se_device);
1272 	if (sp->se_getty) {
1273 		free(sp->se_getty);
1274 		free(sp->se_getty_argv_space);
1275 		free(sp->se_getty_argv);
1276 	}
1277 	if (sp->se_window) {
1278 		free(sp->se_window);
1279 		free(sp->se_window_argv_space);
1280 		free(sp->se_window_argv);
1281 	}
1282 	if (sp->se_type)
1283 		free(sp->se_type);
1284 	free(sp);
1285 }
1286 
1287 /*
1288  * Allocate a new session descriptor.
1289  * Mark it SE_PRESENT.
1290  */
1291 static session_t *
1292 new_session(session_t *sprev, struct ttyent *typ)
1293 {
1294 	session_t *sp;
1295 
1296 	if ((typ->ty_status & TTY_ON) == 0 ||
1297 	    typ->ty_name == 0 ||
1298 	    typ->ty_getty == 0)
1299 		return 0;
1300 
1301 	sp = (session_t *) calloc(1, sizeof (session_t));
1302 
1303 	sp->se_flags |= SE_PRESENT;
1304 
1305 	if ((typ->ty_status & TTY_IFEXISTS) != 0)
1306 		sp->se_flags |= SE_IFEXISTS;
1307 
1308 	if ((typ->ty_status & TTY_IFCONSOLE) != 0)
1309 		sp->se_flags |= SE_IFCONSOLE;
1310 
1311 	if (asprintf(&sp->se_device, "%s%s", _PATH_DEV, typ->ty_name) < 0)
1312 		err(1, "asprintf");
1313 
1314 	if (setupargv(sp, typ) == 0) {
1315 		free_session(sp);
1316 		return (0);
1317 	}
1318 
1319 	sp->se_next = 0;
1320 	if (sprev == NULL) {
1321 		sessions = sp;
1322 		sp->se_prev = 0;
1323 	} else {
1324 		sprev->se_next = sp;
1325 		sp->se_prev = sprev;
1326 	}
1327 
1328 	return sp;
1329 }
1330 
1331 /*
1332  * Calculate getty and if useful window argv vectors.
1333  */
1334 static int
1335 setupargv(session_t *sp, struct ttyent *typ)
1336 {
1337 
1338 	if (sp->se_getty) {
1339 		free(sp->se_getty);
1340 		free(sp->se_getty_argv_space);
1341 		free(sp->se_getty_argv);
1342 	}
1343 	if (asprintf(&sp->se_getty, "%s %s", typ->ty_getty, typ->ty_name) < 0)
1344 		err(1, "asprintf");
1345 	sp->se_getty_argv_space = strdup(sp->se_getty);
1346 	sp->se_getty_argv = construct_argv(sp->se_getty_argv_space);
1347 	if (sp->se_getty_argv == NULL) {
1348 		warning("can't parse getty for port %s", sp->se_device);
1349 		free(sp->se_getty);
1350 		free(sp->se_getty_argv_space);
1351 		sp->se_getty = sp->se_getty_argv_space = 0;
1352 		return (0);
1353 	}
1354 	if (sp->se_window) {
1355 		free(sp->se_window);
1356 		free(sp->se_window_argv_space);
1357 		free(sp->se_window_argv);
1358 	}
1359 	sp->se_window = sp->se_window_argv_space = 0;
1360 	sp->se_window_argv = 0;
1361 	if (typ->ty_window) {
1362 		sp->se_window = strdup(typ->ty_window);
1363 		sp->se_window_argv_space = strdup(sp->se_window);
1364 		sp->se_window_argv = construct_argv(sp->se_window_argv_space);
1365 		if (sp->se_window_argv == NULL) {
1366 			warning("can't parse window for port %s",
1367 			    sp->se_device);
1368 			free(sp->se_window_argv_space);
1369 			free(sp->se_window);
1370 			sp->se_window = sp->se_window_argv_space = 0;
1371 			return (0);
1372 		}
1373 	}
1374 	if (sp->se_type)
1375 		free(sp->se_type);
1376 	sp->se_type = typ->ty_type ? strdup(typ->ty_type) : 0;
1377 	return (1);
1378 }
1379 
1380 /*
1381  * Walk the list of ttys and create sessions for each active line.
1382  */
1383 static state_func_t
1384 read_ttys(void)
1385 {
1386 	session_t *sp, *snext;
1387 	struct ttyent *typ;
1388 
1389 	/*
1390 	 * Destroy any previous session state.
1391 	 * There shouldn't be any, but just in case...
1392 	 */
1393 	for (sp = sessions; sp; sp = snext) {
1394 		snext = sp->se_next;
1395 		free_session(sp);
1396 	}
1397 	sessions = 0;
1398 	if (start_session_db())
1399 		return (state_func_t) single_user;
1400 
1401 	/*
1402 	 * Allocate a session entry for each active port.
1403 	 * Note that sp starts at 0.
1404 	 */
1405 	while ((typ = getttyent()) != NULL)
1406 		if ((snext = new_session(sp, typ)) != NULL)
1407 			sp = snext;
1408 
1409 	endttyent();
1410 
1411 	return (state_func_t) multi_user;
1412 }
1413 
1414 /*
1415  * Start a window system running.
1416  */
1417 static void
1418 start_window_system(session_t *sp)
1419 {
1420 	pid_t pid;
1421 	sigset_t mask;
1422 	char term[64], *env[2];
1423 	int status;
1424 
1425 	if ((pid = fork()) == -1) {
1426 		emergency("can't fork for window system on port %s: %m",
1427 		    sp->se_device);
1428 		/* hope that getty fails and we can try again */
1429 		return;
1430 	}
1431 	if (pid) {
1432 		waitpid(-1, &status, 0);
1433 		return;
1434 	}
1435 
1436 	/* reparent window process to the init to not make a zombie on exit */
1437 	if ((pid = fork()) == -1) {
1438 		emergency("can't fork for window system on port %s: %m",
1439 		    sp->se_device);
1440 		_exit(1);
1441 	}
1442 	if (pid)
1443 		_exit(0);
1444 
1445 	sigemptyset(&mask);
1446 	sigprocmask(SIG_SETMASK, &mask, NULL);
1447 
1448 	if (setsid() < 0)
1449 		emergency("setsid failed (window) %m");
1450 
1451 #ifdef LOGIN_CAP
1452 	setprocresources(RESOURCE_WINDOW);
1453 #endif
1454 	if (sp->se_type) {
1455 		/* Don't use malloc after fork */
1456 		strcpy(term, "TERM=");
1457 		strlcat(term, sp->se_type, sizeof(term));
1458 		env[0] = term;
1459 		env[1] = 0;
1460 	}
1461 	else
1462 		env[0] = 0;
1463 	execve(sp->se_window_argv[0], sp->se_window_argv, env);
1464 	stall("can't exec window system '%s' for port %s: %m",
1465 		sp->se_window_argv[0], sp->se_device);
1466 	_exit(1);
1467 }
1468 
1469 /*
1470  * Start a login session running.
1471  */
1472 static pid_t
1473 start_getty(session_t *sp)
1474 {
1475 	pid_t pid;
1476 	sigset_t mask;
1477 	time_t current_time = time((time_t *) 0);
1478 	int too_quick = 0;
1479 	char term[64], *env[2];
1480 
1481 	if (current_time >= sp->se_started &&
1482 	    current_time - sp->se_started < GETTY_SPACING) {
1483 		if (++sp->se_nspace > GETTY_NSPACE) {
1484 			sp->se_nspace = 0;
1485 			too_quick = 1;
1486 		}
1487 	} else
1488 		sp->se_nspace = 0;
1489 
1490 	/*
1491 	 * fork(), not vfork() -- we can't afford to block.
1492 	 */
1493 	if ((pid = fork()) == -1) {
1494 		emergency("can't fork for getty on port %s: %m", sp->se_device);
1495 		return -1;
1496 	}
1497 
1498 	if (pid)
1499 		return pid;
1500 
1501 	if (too_quick) {
1502 		warning("getty repeating too quickly on port %s, sleeping %d secs",
1503 		    sp->se_device, GETTY_SLEEP);
1504 		sleep((unsigned) GETTY_SLEEP);
1505 	}
1506 
1507 	if (sp->se_window) {
1508 		start_window_system(sp);
1509 		sleep(WINDOW_WAIT);
1510 	}
1511 
1512 	sigemptyset(&mask);
1513 	sigprocmask(SIG_SETMASK, &mask, NULL);
1514 
1515 #ifdef LOGIN_CAP
1516 	setprocresources(RESOURCE_GETTY);
1517 #endif
1518 	if (sp->se_type) {
1519 		/* Don't use malloc after fork */
1520 		strcpy(term, "TERM=");
1521 		strlcat(term, sp->se_type, sizeof(term));
1522 		env[0] = term;
1523 		env[1] = 0;
1524 	} else
1525 		env[0] = 0;
1526 	execve(sp->se_getty_argv[0], sp->se_getty_argv, env);
1527 	stall("can't exec getty '%s' for port %s: %m",
1528 		sp->se_getty_argv[0], sp->se_device);
1529 	_exit(1);
1530 }
1531 
1532 /*
1533  * Return 1 if the session is defined as "onifexists"
1534  * or "onifconsole" and the device node does not exist.
1535  */
1536 static int
1537 session_has_no_tty(session_t *sp)
1538 {
1539 	int fd;
1540 
1541 	if ((sp->se_flags & SE_IFEXISTS) == 0 &&
1542 	    (sp->se_flags & SE_IFCONSOLE) == 0)
1543 		return (0);
1544 
1545 	fd = open(sp->se_device, O_RDONLY | O_NONBLOCK, 0);
1546 	if (fd < 0) {
1547 		if (errno == ENOENT)
1548 			return (1);
1549 		return (0);
1550 	}
1551 
1552 	close(fd);
1553 	return (0);
1554 }
1555 
1556 /*
1557  * Collect exit status for a child.
1558  * If an exiting login, start a new login running.
1559  */
1560 static void
1561 collect_child(pid_t pid)
1562 {
1563 	session_t *sp, *sprev, *snext;
1564 
1565 	if (! sessions)
1566 		return;
1567 
1568 	if (! (sp = find_session(pid)))
1569 		return;
1570 
1571 	del_session(sp);
1572 	sp->se_process = 0;
1573 
1574 	if (sp->se_flags & SE_SHUTDOWN ||
1575 	    session_has_no_tty(sp)) {
1576 		if ((sprev = sp->se_prev) != NULL)
1577 			sprev->se_next = sp->se_next;
1578 		else
1579 			sessions = sp->se_next;
1580 		if ((snext = sp->se_next) != NULL)
1581 			snext->se_prev = sp->se_prev;
1582 		free_session(sp);
1583 		return;
1584 	}
1585 
1586 	if ((pid = start_getty(sp)) == -1) {
1587 		/* serious trouble */
1588 		requested_transition = clean_ttys;
1589 		return;
1590 	}
1591 
1592 	sp->se_process = pid;
1593 	sp->se_started = time((time_t *) 0);
1594 	add_session(sp);
1595 }
1596 
1597 /*
1598  * Catch a signal and request a state transition.
1599  */
1600 static void
1601 transition_handler(int sig)
1602 {
1603 
1604 	switch (sig) {
1605 	case SIGHUP:
1606 		if (current_state == read_ttys || current_state == multi_user ||
1607 		    current_state == clean_ttys || current_state == catatonia)
1608 			requested_transition = clean_ttys;
1609 		break;
1610 	case SIGWINCH:
1611 	case SIGUSR2:
1612 		howto = sig == SIGUSR2 ? RB_POWEROFF : RB_POWERCYCLE;
1613 	case SIGUSR1:
1614 		howto |= RB_HALT;
1615 	case SIGINT:
1616 		Reboot = TRUE;
1617 	case SIGTERM:
1618 		if (current_state == read_ttys || current_state == multi_user ||
1619 		    current_state == clean_ttys || current_state == catatonia)
1620 			requested_transition = death;
1621 		else
1622 			requested_transition = death_single;
1623 		break;
1624 	case SIGTSTP:
1625 		if (current_state == runcom || current_state == read_ttys ||
1626 		    current_state == clean_ttys ||
1627 		    current_state == multi_user || current_state == catatonia)
1628 			requested_transition = catatonia;
1629 		break;
1630 	case SIGEMT:
1631 		requested_transition = reroot;
1632 		break;
1633 	default:
1634 		requested_transition = 0;
1635 		break;
1636 	}
1637 }
1638 
1639 /*
1640  * Take the system multiuser.
1641  */
1642 static state_func_t
1643 multi_user(void)
1644 {
1645 	pid_t pid;
1646 	session_t *sp;
1647 
1648 	requested_transition = 0;
1649 
1650 	/*
1651 	 * If the administrator has not set the security level to -1
1652 	 * to indicate that the kernel should not run multiuser in secure
1653 	 * mode, and the run script has not set a higher level of security
1654 	 * than level 1, then put the kernel into secure mode.
1655 	 */
1656 	if (getsecuritylevel() == 0)
1657 		setsecuritylevel(1);
1658 
1659 	for (sp = sessions; sp; sp = sp->se_next) {
1660 		if (sp->se_process)
1661 			continue;
1662 		if (session_has_no_tty(sp))
1663 			continue;
1664 		if ((pid = start_getty(sp)) == -1) {
1665 			/* serious trouble */
1666 			requested_transition = clean_ttys;
1667 			break;
1668 		}
1669 		sp->se_process = pid;
1670 		sp->se_started = time((time_t *) 0);
1671 		add_session(sp);
1672 	}
1673 
1674 	while (!requested_transition)
1675 		if ((pid = waitpid(-1, (int *) 0, 0)) != -1)
1676 			collect_child(pid);
1677 
1678 	return (state_func_t) requested_transition;
1679 }
1680 
1681 /*
1682  * This is an (n*2)+(n^2) algorithm.  We hope it isn't run often...
1683  */
1684 static state_func_t
1685 clean_ttys(void)
1686 {
1687 	session_t *sp, *sprev;
1688 	struct ttyent *typ;
1689 	int devlen;
1690 	char *old_getty, *old_window, *old_type;
1691 
1692 	/*
1693 	 * mark all sessions for death, (!SE_PRESENT)
1694 	 * as we find or create new ones they'll be marked as keepers,
1695 	 * we'll later nuke all the ones not found in /etc/ttys
1696 	 */
1697 	for (sp = sessions; sp != NULL; sp = sp->se_next)
1698 		sp->se_flags &= ~SE_PRESENT;
1699 
1700 	devlen = sizeof(_PATH_DEV) - 1;
1701 	while ((typ = getttyent()) != NULL) {
1702 		for (sprev = 0, sp = sessions; sp; sprev = sp, sp = sp->se_next)
1703 			if (strcmp(typ->ty_name, sp->se_device + devlen) == 0)
1704 				break;
1705 
1706 		if (sp) {
1707 			/* we want this one to live */
1708 			sp->se_flags |= SE_PRESENT;
1709 			if ((typ->ty_status & TTY_ON) == 0 ||
1710 			    typ->ty_getty == 0) {
1711 				sp->se_flags |= SE_SHUTDOWN;
1712 				kill(sp->se_process, SIGHUP);
1713 				continue;
1714 			}
1715 			sp->se_flags &= ~SE_SHUTDOWN;
1716 			old_getty = sp->se_getty ? strdup(sp->se_getty) : 0;
1717 			old_window = sp->se_window ? strdup(sp->se_window) : 0;
1718 			old_type = sp->se_type ? strdup(sp->se_type) : 0;
1719 			if (setupargv(sp, typ) == 0) {
1720 				warning("can't parse getty for port %s",
1721 					sp->se_device);
1722 				sp->se_flags |= SE_SHUTDOWN;
1723 				kill(sp->se_process, SIGHUP);
1724 			}
1725 			else if (   !old_getty
1726 				 || (!old_type && sp->se_type)
1727 				 || (old_type && !sp->se_type)
1728 				 || (!old_window && sp->se_window)
1729 				 || (old_window && !sp->se_window)
1730 				 || (strcmp(old_getty, sp->se_getty) != 0)
1731 				 || (old_window && strcmp(old_window, sp->se_window) != 0)
1732 				 || (old_type && strcmp(old_type, sp->se_type) != 0)
1733 				) {
1734 				/* Don't set SE_SHUTDOWN here */
1735 				sp->se_nspace = 0;
1736 				sp->se_started = 0;
1737 				kill(sp->se_process, SIGHUP);
1738 			}
1739 			if (old_getty)
1740 				free(old_getty);
1741 			if (old_window)
1742 				free(old_window);
1743 			if (old_type)
1744 				free(old_type);
1745 			continue;
1746 		}
1747 
1748 		new_session(sprev, typ);
1749 	}
1750 
1751 	endttyent();
1752 
1753 	/*
1754 	 * sweep through and kill all deleted sessions
1755 	 * ones who's /etc/ttys line was deleted (SE_PRESENT unset)
1756 	 */
1757 	for (sp = sessions; sp != NULL; sp = sp->se_next) {
1758 		if ((sp->se_flags & SE_PRESENT) == 0) {
1759 			sp->se_flags |= SE_SHUTDOWN;
1760 			kill(sp->se_process, SIGHUP);
1761 		}
1762 	}
1763 
1764 	return (state_func_t) multi_user;
1765 }
1766 
1767 /*
1768  * Block further logins.
1769  */
1770 static state_func_t
1771 catatonia(void)
1772 {
1773 	session_t *sp;
1774 
1775 	for (sp = sessions; sp; sp = sp->se_next)
1776 		sp->se_flags |= SE_SHUTDOWN;
1777 
1778 	return (state_func_t) multi_user;
1779 }
1780 
1781 /*
1782  * Note SIGALRM.
1783  */
1784 static void
1785 alrm_handler(int sig)
1786 {
1787 
1788 	(void)sig;
1789 	clang = 1;
1790 }
1791 
1792 /*
1793  * Bring the system down to single user.
1794  */
1795 static state_func_t
1796 death(void)
1797 {
1798 	int block, blocked;
1799 	size_t len;
1800 
1801 	/* Temporarily block suspend. */
1802 	len = sizeof(blocked);
1803 	block = 1;
1804 	if (sysctlbyname("kern.suspend_blocked", &blocked, &len,
1805 	    &block, sizeof(block)) == -1)
1806 		blocked = 0;
1807 
1808 	/*
1809 	 * Also revoke the TTY here.  Because runshutdown() may reopen
1810 	 * the TTY whose getty we're killing here, there is no guarantee
1811 	 * runshutdown() will perform the initial open() call, causing
1812 	 * the terminal attributes to be misconfigured.
1813 	 */
1814 	revoke_ttys();
1815 
1816 	/* Try to run the rc.shutdown script within a period of time */
1817 	runshutdown();
1818 
1819 	/* Unblock suspend if we blocked it. */
1820 	if (!blocked)
1821 		sysctlbyname("kern.suspend_blocked", NULL, NULL,
1822 		    &blocked, sizeof(blocked));
1823 
1824 	return (state_func_t) death_single;
1825 }
1826 
1827 /*
1828  * Do what is necessary to reinitialize single user mode or reboot
1829  * from an incomplete state.
1830  */
1831 static state_func_t
1832 death_single(void)
1833 {
1834 	int i;
1835 	pid_t pid;
1836 	static const int death_sigs[2] = { SIGTERM, SIGKILL };
1837 
1838 	revoke(_PATH_CONSOLE);
1839 
1840 	for (i = 0; i < 2; ++i) {
1841 		if (kill(-1, death_sigs[i]) == -1 && errno == ESRCH)
1842 			return (state_func_t) single_user;
1843 
1844 		clang = 0;
1845 		alarm(DEATH_WATCH);
1846 		do
1847 			if ((pid = waitpid(-1, (int *)0, 0)) != -1)
1848 				collect_child(pid);
1849 		while (clang == 0 && errno != ECHILD);
1850 
1851 		if (errno == ECHILD)
1852 			return (state_func_t) single_user;
1853 	}
1854 
1855 	warning("some processes would not die; ps axl advised");
1856 
1857 	return (state_func_t) single_user;
1858 }
1859 
1860 static void
1861 revoke_ttys(void)
1862 {
1863 	session_t *sp;
1864 
1865 	for (sp = sessions; sp; sp = sp->se_next) {
1866 		sp->se_flags |= SE_SHUTDOWN;
1867 		kill(sp->se_process, SIGHUP);
1868 		revoke(sp->se_device);
1869 	}
1870 }
1871 
1872 /*
1873  * Run the system shutdown script.
1874  *
1875  * Exit codes:      XXX I should document more
1876  * -2       shutdown script terminated abnormally
1877  * -1       fatal error - can't run script
1878  * 0        good.
1879  * >0       some error (exit code)
1880  */
1881 static int
1882 runshutdown(void)
1883 {
1884 	pid_t pid, wpid;
1885 	int status;
1886 	int shutdowntimeout;
1887 	size_t len;
1888 	char *argv[4];
1889 	struct stat sb;
1890 
1891 	/*
1892 	 * rc.shutdown is optional, so to prevent any unnecessary
1893 	 * complaints from the shell we simply don't run it if the
1894 	 * file does not exist. If the stat() here fails for other
1895 	 * reasons, we'll let the shell complain.
1896 	 */
1897 	if (stat(_PATH_RUNDOWN, &sb) == -1 && errno == ENOENT)
1898 		return 0;
1899 
1900 	if ((pid = fork()) == 0) {
1901 		char _sh[]	= "sh";
1902 		char _reboot[]	= "reboot";
1903 		char _single[]	= "single";
1904 		char _path_rundown[] = _PATH_RUNDOWN;
1905 
1906 		argv[0] = _sh;
1907 		argv[1] = _path_rundown;
1908 		argv[2] = Reboot ? _reboot : _single;
1909 		argv[3] = 0;
1910 
1911 		execute_script(argv);
1912 		_exit(1);	/* force single user mode */
1913 	}
1914 
1915 	if (pid == -1) {
1916 		emergency("can't fork for %s: %m", _PATH_RUNDOWN);
1917 		while (waitpid(-1, (int *) 0, WNOHANG) > 0)
1918 			continue;
1919 		sleep(STALL_TIMEOUT);
1920 		return -1;
1921 	}
1922 
1923 	len = sizeof(shutdowntimeout);
1924 	if (sysctlbyname("kern.init_shutdown_timeout", &shutdowntimeout, &len,
1925 	    NULL, 0) == -1 || shutdowntimeout < 2)
1926 		shutdowntimeout = DEATH_SCRIPT;
1927 	alarm(shutdowntimeout);
1928 	clang = 0;
1929 	/*
1930 	 * Copied from single_user().  This is a bit paranoid.
1931 	 * Use the same ALRM handler.
1932 	 */
1933 	do {
1934 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
1935 			collect_child(wpid);
1936 		if (clang == 1) {
1937 			/* we were waiting for the sub-shell */
1938 			kill(wpid, SIGTERM);
1939 			warning("timeout expired for %s: %m; going to "
1940 			    "single user mode", _PATH_RUNDOWN);
1941 			return -1;
1942 		}
1943 		if (wpid == -1) {
1944 			if (errno == EINTR)
1945 				continue;
1946 			warning("wait for %s failed: %m; going to "
1947 			    "single user mode", _PATH_RUNDOWN);
1948 			return -1;
1949 		}
1950 		if (wpid == pid && WIFSTOPPED(status)) {
1951 			warning("init: %s stopped, restarting\n",
1952 			    _PATH_RUNDOWN);
1953 			kill(pid, SIGCONT);
1954 			wpid = -1;
1955 		}
1956 	} while (wpid != pid && !clang);
1957 
1958 	/* Turn off the alarm */
1959 	alarm(0);
1960 
1961 	if (WIFSIGNALED(status) && WTERMSIG(status) == SIGTERM &&
1962 	    requested_transition == catatonia) {
1963 		/*
1964 		 * /etc/rc.shutdown executed /sbin/reboot;
1965 		 * wait for the end quietly
1966 		 */
1967 		sigset_t s;
1968 
1969 		sigfillset(&s);
1970 		for (;;)
1971 			sigsuspend(&s);
1972 	}
1973 
1974 	if (!WIFEXITED(status)) {
1975 		warning("%s terminated abnormally, going to "
1976 		    "single user mode", _PATH_RUNDOWN);
1977 		return -2;
1978 	}
1979 
1980 	if ((status = WEXITSTATUS(status)) != 0)
1981 		warning("%s returned status %d", _PATH_RUNDOWN, status);
1982 
1983 	return status;
1984 }
1985 
1986 static char *
1987 strk(char *p)
1988 {
1989 	static char *t;
1990 	char *q;
1991 	int c;
1992 
1993 	if (p)
1994 		t = p;
1995 	if (!t)
1996 		return 0;
1997 
1998 	c = *t;
1999 	while (c == ' ' || c == '\t' )
2000 		c = *++t;
2001 	if (!c) {
2002 		t = 0;
2003 		return 0;
2004 	}
2005 	q = t;
2006 	if (c == '\'') {
2007 		c = *++t;
2008 		q = t;
2009 		while (c && c != '\'')
2010 			c = *++t;
2011 		if (!c)  /* unterminated string */
2012 			q = t = 0;
2013 		else
2014 			*t++ = 0;
2015 	} else {
2016 		while (c && c != ' ' && c != '\t' )
2017 			c = *++t;
2018 		*t++ = 0;
2019 		if (!c)
2020 			t = 0;
2021 	}
2022 	return q;
2023 }
2024 
2025 #ifdef LOGIN_CAP
2026 static void
2027 setprocresources(const char *cname)
2028 {
2029 	login_cap_t *lc;
2030 	if ((lc = login_getclassbyname(cname, NULL)) != NULL) {
2031 		setusercontext(lc, (struct passwd*)NULL, 0,
2032 		    LOGIN_SETPRIORITY | LOGIN_SETRESOURCES |
2033 		    LOGIN_SETLOGINCLASS | LOGIN_SETCPUMASK);
2034 		login_close(lc);
2035 	}
2036 }
2037 #endif
2038