NetBSD/etc/rc.d/Makefile

# $NetBSD: Makefile,v 1.52 2005/08/23 12:12:56 peter Exp $

.include <bsd.own.mk>

# if you're adding new scripts, don't forget to update followings.
#	src/distrib/sets/lists/etc/mi
#	src/etc/mtree/special
#	src/usr.sbin/postinstall/postinstall

CONFIGFILES=\
	DAEMON LOGIN NETWORKING SERVERS \
	accounting altqd amd apmd \
	bootparams bootconf.sh ccd cgd cleartmp cron \
	dhclient dhcpd dhcrelay dmesg downinterfaces fixsb fsck ftpd \
	identd ifwatchd inetd ipfilter ipfs ipmon ipnat ipsec isdnd \
	kdc ldconfig lkm1 lkm2 lkm3 local lpd \
	mixerctl mopd motd mountall mountcritlocal mountcritremote mountd \
	moused mrouted \
	named ndbootd network newsyslog nfsd nfslocking ntpd ntpdate \
	pf pf_boot pflogd poffd postfix powerd ppp pwcheck quota \
	racoon rpcbind raidframe raidframeparity rarpd rbootd root \
	route6d routed rtadvd rtclocaltime rtsold rwho \
	savecore screenblank sendmail securelevel smmsp sshd \
	staticroute swap1 swap2 sysdb sysctl syslogd \
	timed tpctl ttys veriexec virecover wdogctl wscons wsmoused xdm xfs \
	ypbind yppasswdd ypserv
FILESDIR=	/etc/rc.d
FILESMODE=	${BINMODE}

.include <bsd.prog.mk>
pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security 2005-08-23 16:12:56 +04:00			`# $NetBSD: Makefile,v 1.52 2005/08/23 12:12:56 peter Exp $`
Need bsd.own.mk 2000-08-11 02:02:07 +04:00
			`.include <bsd.own.mk>`
rc.d scripts derived from /etc/rc 2000-03-10 14:53:23 +03:00
in comment, metion about src/distrib/sets/lists/etc/mi as well. 2003-01-10 08:07:45 +03:00			`# if you're adding new scripts, don't forget to update followings.`
			`# src/distrib/sets/lists/etc/mi`
Tweaks for the move of postinstall from /etc to /usr/sbin 2005-04-18 03:12:40 +04:00			`# src/etc/mtree/special`
			`# src/usr.sbin/postinstall/postinstall`
add comment: "if you're adding new scripts, don't forget to update src/etc/postinstall and src/etc/mtree/special." 2002-07-04 03:31:25 +04:00
Consistently use CONFIGFILES & CONFIGLINKS (which enable the 'configinstall' target) instead of using home-grown 'distribution' targets or using FILES with the 'install' target. Add some etc/ subdir Makefiles where appropriate. XXX: some of etc/Makefile install-etc-files could be converted to CONFIGFILES. 2004-05-16 13:53:09 +04:00			`CONFIGFILES=\`
			`DAEMON LOGIN NETWORKING SERVERS \`
- set NOPROG before .include <bsd.own.mk> - reformat FILES= lines for easier future additions 2001-12-12 15:19:09 +03:00			`accounting altqd amd apmd \`
Added cgd rc.d script and put it in the appropriate postinstall and mtree files. 2002-10-09 18:55:53 +04:00			`bootparams bootconf.sh ccd cgd cleartmp cron \`
Add the new ftpd rc.d script. 2005-08-05 02:32:44 +04:00			`dhclient dhcpd dhcrelay dmesg downinterfaces fixsb fsck ftpd \`
add identd 2004-02-01 05:32:58 +03:00			`identd ifwatchd inetd ipfilter ipfs ipmon ipnat ipsec isdnd \`
Revert part of previous; etc/rc.d/kdc must be installed even if Kerberos isn't enabled. This is how the rc.d system works in conjunction with our current build and install system; all the rc.d scripts are installed even if the subsystems they control are not. 2003-12-26 15:04:35 +03:00			`kdc ldconfig lkm1 lkm2 lkm3 local lpd \`
Add mixerctl script. 2002-06-02 22:37:45 +04:00			`mixerctl mopd motd mountall mountcritlocal mountcritremote mountd \`
- set NOPROG before .include <bsd.own.mk> - reformat FILES= lines for easier future additions 2001-12-12 15:19:09 +03:00			`moused mrouted \`
			`named ndbootd network newsyslog nfsd nfslocking ntpd ntpdate \`
pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security 2005-08-23 16:12:56 +04:00			`pf pf_boot pflogd poffd postfix powerd ppp pwcheck quota \`
Split raidframe parity checking/rebuild out into raidframeparity, which is called after quota so we don't end up with fsck and raidframe parity rebuild taking forever after a crash/reboot. While we are here check for raid[0-9].conf & raid[1-9][0-9].conf not raid[0-9].conf & raid[0-9][0-9].conf 2002-09-03 19:35:51 +04:00			`racoon rpcbind raidframe raidframeparity rarpd rbootd root \`
Add rtclocaltime. 2003-12-27 03:29:21 +03:00			`route6d routed rtadvd rtclocaltime rtsold rwho \`
Tweak postinstall to check for (and help out on) the upgrade to sendmail 8.12.8. Some of the same machinery (in shorter form) is in the additions to rc.d/sendmail. Also, add a smmsp startup script for the sendmail client queue runner. 2003-03-24 18:19:27 +03:00			`savecore screenblank sendmail securelevel smmsp sshd \`
add staticroute 2003-01-09 18:58:23 +03:00			`staticroute swap1 swap2 sysdb sysctl syslogd \`
Add the veriexec rc.d script. 2004-01-14 13:51:54 +03:00			`timed tpctl ttys veriexec virecover wdogctl wscons wsmoused xdm xfs \`
Back out previous (as discussed with releng). The correct way to set this is: # echo "myserver" > /var/yp/binding/`domainname`.ypservers 2003-01-16 14:55:28 +03:00			`ypbind yppasswdd ypserv`
rc.d scripts derived from /etc/rc 2000-03-10 14:53:23 +03:00			`FILESDIR= /etc/rc.d`
			`FILESMODE= ${BINMODE}`

			`.include <bsd.prog.mk>`