From owner-freebsd-arch@FreeBSD.ORG Sun Jan 5 21:04:07 2014 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id CDA3996C; Sun, 5 Jan 2014 21:04:07 +0000 (UTC) Received: from smtpauth4.wiscmail.wisc.edu (wmauth4.doit.wisc.edu [144.92.197.145]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 8DBFE1391; Sun, 5 Jan 2014 21:04:07 +0000 (UTC) MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_O69mP3h7Oe9DLHDkdwR32w)" Received: from avs-daemon.smtpauth4.wiscmail.wisc.edu by smtpauth4.wiscmail.wisc.edu (Oracle Communications Messaging Server 7u4-27.01(7.0.4.27.0) 64bit (built Aug 30 2012)) id <0MYY001004TUXX00@smtpauth4.wiscmail.wisc.edu>; Sun, 05 Jan 2014 15:04:05 -0600 (CST) X-Spam-PmxInfo: Server=avs-4, Version=6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.1.5.205415, SenderIP=0.0.0.0 X-Spam-Report: AuthenticatedSender=yes, SenderIP=0.0.0.0 Received: from wanderer.tachypleus.net (pool-72-66-107-173.washdc.fios.verizon.net [72.66.107.173]) by smtpauth4.wiscmail.wisc.edu (Oracle Communications Messaging Server 7u4-27.01(7.0.4.27.0) 64bit (built Aug 30 2012)) with ESMTPSA id <0MYY00KQM56RGD00@smtpauth4.wiscmail.wisc.edu>; Sun, 05 Jan 2014 15:04:05 -0600 (CST) Date: Sun, 05 Jan 2014 16:04:03 -0500 From: Nathan Whitehorn Subject: Re: [CFT] bsdinstall and zfsboot enhancements In-reply-to: <20131201123442.GA6818@stack.nl> To: Jilles Tjoelker Message-id: <52C9C8C3.7050108@freebsd.org> X-Enigmail-Version: 1.6 References: <5275C597.6070702@freebsd.org> <97944047-D575-4E2E-B687-9871DFE058E3@fisglobal.com> <52769CFE.5080707@freebsd.org> <5281340E.8080009@callfortesting.org> <52813E53.20403@freebsd.org> <5281441E.7060806@freebsd.org> <529A6862.7060308@freebsd.org> <20131201123442.GA6818@stack.nl> User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 Cc: "Teske, Devin" , Current Current , "freebsd-arch@freebsd.org" , Devin Teske , Peter Grehan , Michael Dexter X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jan 2014 21:04:07 -0000 This is a multi-part message in MIME format. --Boundary_(ID_O69mP3h7Oe9DLHDkdwR32w) Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT On 12/01/13 07:34, Jilles Tjoelker wrote: > On Sat, Nov 30, 2013 at 04:36:18PM -0600, Nathan Whitehorn wrote: >> This took much longer than I'd anticipated, but the patch to init is >> attached. I chose not to make the changes to init rather than >> getttyent() and friends in libc, which I am open to revisiting. > lib/libpam/modules/pam_securetty/pam_securetty.c calls getttynam(3) and > will not allow root login on a "fake" TTY that getttynam() does not > know. This module is enabled by default for the "login" service. > > So it is probably better to patch libc rather than init. OK, here's a revised patch. This one is shorter and works by introducing an "auto" flag (ideas for names appreciated) that means "on" if the line is an active console and "off" otherwise. Note that the behavior is now: - ttys marked "off" stay off - ttys marked "on" stay on - ttys marked "auto" are enabled iff they are console devices - ttys not present in /etc/ttys stay off This behavior change is much easier to implement when doing it in libc for various structural reasons and allows the terminal type, etc. to be specified in the usual way. >> The behavior changes are as follows: >> If the "console" device in /etc/ttys in marked "on", instead of opening >> /dev/console, init will loop through the active kernel console devices, >> and for each will: >> 1. If the kernel console device is in /etc/ttys and marked "on", it >> already has a terminal and will be ignored. >> 2. If marked "off", that is an explicit statement that a console is not >> wanted and so it will be ignored. >> 3. If not present in /etc/ttys, init will run getty with whatever >> parameters "console" has. > This seems to make sense. > >> (3) is the main behavioral change. No changes in behavior will occur if >> /etc/ttys is not modified. If we turn on "console" by default, it will >> usually have no effect instead of trying to run multiple gettys, which >> is new. If we then also comment out the ttyu0 line, instead of marking >> it "off", the result will be the conditional presence of a login prompt >> on the first serial port depending on whether it is an active console >> device for the kernel. I believe this is the behavior we are going for. > The terminal type for the console entry should probably be changed to > something other than "unknown" to reduce annoyance. > >> Comments and test results would be appreciated. > As a preparatory patch, you could remove se_index and session_index from > init. They are only used to warn about a changed slot number in utmp(5) > which is irrelevant with utmpx. This noise warning would also appear > in most cases when changing from a "fake" console entry to a real line > in /etc/ttys. Also, if you do decide to fake ttys entries in init rather > than libc, the patch to init will be simpler. > With the new patch, this is indeed the case: no changes to init are necessary at all. This does not change any behavior unless explicitly requested in /etc/ttys, so unless there are any objections in the next couple days, I will commit it. -Nathan --Boundary_(ID_O69mP3h7Oe9DLHDkdwR32w) Content-type: text/plain; CHARSET=US-ASCII; name=init-tty.diff Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=init-tty.diff Index: include/ttyent.h =================================================================== --- include/ttyent.h (revision 260331) +++ include/ttyent.h (working copy) @@ -37,6 +37,7 @@ #define _TTYS_OFF "off" #define _TTYS_ON "on" +#define _TTYS_AUTO "auto" #define _TTYS_SECURE "secure" #define _TTYS_INSECURE "insecure" #define _TTYS_WINDOW "window" Index: lib/libc/gen/getttyent.c =================================================================== --- lib/libc/gen/getttyent.c (revision 260331) +++ lib/libc/gen/getttyent.c (working copy) @@ -39,6 +39,9 @@ #include #include +#include +#include + static char zapchar; static FILE *tf; static size_t lbsize; @@ -64,6 +67,32 @@ return (t); } +static int +auto_tty_status(const char *ty_name) +{ + size_t len; + char *buf, *cons, *nextcons; + + /* Check if this is an enabled kernel console line */ + buf = NULL; + if (sysctlbyname("kern.console", NULL, &len, NULL, 0) == -1) + return (0); /* Errors mean don't enable */ + buf = malloc(len); + if (sysctlbyname("kern.console", buf, &len, NULL, 0) == -1) + return (0); + + if ((cons = strchr(buf, '/')) == NULL) + return (0); + *cons = '\0'; + nextcons = buf; + while ((cons = strsep(&nextcons, ",")) != NULL && strlen(cons) != 0) { + if (strcmp(cons, ty_name) == 0) + return (TTY_ON); + } + + return (0); +} + struct ttyent * getttyent(void) { @@ -126,6 +155,8 @@ tty.ty_status &= ~TTY_ON; else if (scmp(_TTYS_ON)) tty.ty_status |= TTY_ON; + else if (scmp(_TTYS_AUTO)) + tty.ty_status |= auto_tty_status(tty.ty_name); else if (scmp(_TTYS_SECURE)) tty.ty_status |= TTY_SECURE; else if (scmp(_TTYS_INSECURE)) Index: libexec/getty/ttys.5 =================================================================== --- libexec/getty/ttys.5 (revision 260331) +++ libexec/getty/ttys.5 (working copy) @@ -102,8 +102,11 @@ .Pp As flag values, the strings ``on'' and ``off'' specify that .Xr init 8 -should (should not) execute the command given in the second field, -while ``secure'' (if ``on'' is also specified) allows users with a +should (should not) execute the command given in the second field. +``auto'' will cause this line to be enabled if and only if it is +an active kernel console device (it is equivalent to ``on'' in this +case). +The flag ``secure'' (if ``on'' is also specified) allows users with a uid of 0 to login on this line. The flag ``dialin'' indicates that a tty entry describes a dialin --Boundary_(ID_O69mP3h7Oe9DLHDkdwR32w)-- From owner-freebsd-arch@FreeBSD.ORG Mon Jan 6 23:36:42 2014 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4948BA27 for ; Mon, 6 Jan 2014 23:36:42 +0000 (UTC) Received: from mail-ob0-f177.google.com (mail-ob0-f177.google.com [209.85.214.177]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 0119C16F2 for ; Mon, 6 Jan 2014 23:36:41 +0000 (UTC) Received: by mail-ob0-f177.google.com with SMTP id vb8so19052961obc.36 for ; Mon, 06 Jan 2014 15:36:35 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=tdqQkpVFSzc1wB2aLb31I/0cyTGWwceKWW2x8ZPSFRo=; b=Qc5fhgTlxWUmVEO/R8EMLXHXlBRMbC5Q48LKJ45/YnfOzaQ5GBaVV6JXSYA1kI+SqL uU5HpSBOao/c44Y/lINGoVz5AV2Adgy2MCNHDLj9KgDqz2+WKObij3eZf4dV5Nx+/gwx /yC80zeoNpWMj77Iva/Cw1OaSYczwG02TZLXc00F7zFzvW1vv7ac0SvtC/+4OlcBBc3l Z1u90snhqWkwEw6CExsc/5nlHRlXu0mcS2Q8iz1kiHZxsGr8m00xEQ9IkDumCQNwuuPa wwQ74CDaDtDRGSImlk3Hy64S2gw90yY8spgtMhKucKIIZB7JEdtS5+GkJCKcIYJ8cliK KnFA== X-Gm-Message-State: ALoCoQkpMnCmNZJeFsIAsVC0vQhVawg20FjeaTv0Dyf+Fz20aWfdEacDCO9FkE1v6qLXO6kFXyTp X-Received: by 10.60.34.3 with SMTP id v3mr2805226oei.67.1389051395471; Mon, 06 Jan 2014 15:36:35 -0800 (PST) Received: from Michaels-MacBook-Pro.local (c-98-246-202-204.hsd1.or.comcast.net. [98.246.202.204]) by mx.google.com with ESMTPSA id ej7sm87153606obb.8.2014.01.06.15.36.34 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 06 Jan 2014 15:36:34 -0800 (PST) Message-ID: <52CB3E01.8040605@callfortesting.org> Date: Mon, 06 Jan 2014 15:36:33 -0800 From: Michael Dexter User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Nathan Whitehorn , Jilles Tjoelker Subject: Re: [CFT] bsdinstall and zfsboot enhancements References: <5275C597.6070702@freebsd.org> <97944047-D575-4E2E-B687-9871DFE058E3@fisglobal.com> <52769CFE.5080707@freebsd.org> <5281340E.8080009@callfortesting.org> <52813E53.20403@freebsd.org> <5281441E.7060806@freebsd.org> <529A6862.7060308@freebsd.org> <20131201123442.GA6818@stack.nl> <52C9C8C3.7050108@freebsd.org> In-Reply-To: <52C9C8C3.7050108@freebsd.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Devin Teske , Current Current , "Teske, Devin" , Peter Grehan , "freebsd-arch@freebsd.org" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jan 2014 23:36:42 -0000 On 1/5/14 1:04 PM, Nathan Whitehorn wrote: > On 12/01/13 07:34, Jilles Tjoelker wrote: >> On Sat, Nov 30, 2013 at 04:36:18PM -0600, Nathan Whitehorn wrote: >>> This took much longer than I'd anticipated, but the patch to init is >>> attached. I chose not to make the changes to init rather than >>> getttyent() and friends in libc, which I am open to revisiting. >> lib/libpam/modules/pam_securetty/pam_securetty.c calls getttynam(3) and >> will not allow root login on a "fake" TTY that getttynam() does not >> know. This module is enabled by default for the "login" service. >> >> So it is probably better to patch libc rather than init. > > OK, here's a revised patch. This one is shorter and works by introducing > an "auto" flag (ideas for names appreciated) that means "on" if the line > is an active console and "off" otherwise. Note that the behavior is now: > - ttys marked "off" stay off > - ttys marked "on" stay on > - ttys marked "auto" are enabled iff they are console devices > - ttys not present in /etc/ttys stay off > > This behavior change is much easier to implement when doing it in libc > for various structural reasons and allows the terminal type, etc. to be > specified in the usual way. > >>> The behavior changes are as follows: >>> If the "console" device in /etc/ttys in marked "on", instead of opening >>> /dev/console, init will loop through the active kernel console devices, >>> and for each will: >>> 1. If the kernel console device is in /etc/ttys and marked "on", it >>> already has a terminal and will be ignored. >>> 2. If marked "off", that is an explicit statement that a console is not >>> wanted and so it will be ignored. >>> 3. If not present in /etc/ttys, init will run getty with whatever >>> parameters "console" has. >> This seems to make sense. >> >>> (3) is the main behavioral change. No changes in behavior will occur if >>> /etc/ttys is not modified. If we turn on "console" by default, it will >>> usually have no effect instead of trying to run multiple gettys, which >>> is new. If we then also comment out the ttyu0 line, instead of marking >>> it "off", the result will be the conditional presence of a login prompt >>> on the first serial port depending on whether it is an active console >>> device for the kernel. I believe this is the behavior we are going for. >> The terminal type for the console entry should probably be changed to >> something other than "unknown" to reduce annoyance. >> >>> Comments and test results would be appreciated. >> As a preparatory patch, you could remove se_index and session_index from >> init. They are only used to warn about a changed slot number in utmp(5) >> which is irrelevant with utmpx. This noise warning would also appear >> in most cases when changing from a "fake" console entry to a real line >> in /etc/ttys. Also, if you do decide to fake ttys entries in init rather >> than libc, the patch to init will be simpler. >> > > With the new patch, this is indeed the case: no changes to init are > necessary at all. This does not change any behavior unless explicitly > requested in /etc/ttys, so unless there are any objections in the next > couple days, I will commit it. > -Nathan Hello all, Not sure if everyone knows that Nathan posted a patched 11-current ISO: http://people.freebsd.org/~nwhitehorn/auto-console.iso I have fetched and booted to this with my "iso" mode in my scripts and IT WORKS. Install from ISO and boot as normal. Only glitch which I haven't seen for some time: The resulting guest console is shortened by one line with this persistent string at the bottom: /boot/kernel/kernel text=0xf45a98 data= .... syms= ... This persists after VM reboot, goes away with bhyveload and returns for the next VM boot. Okay, a second glitch upon second boot. The root prompt reads: login: Jan 6