OpenBSD CVS

CVS log for src/share/man/man7/securelevel.7


[BACK] Up to [local] / src / share / man / man7

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.31 / (download) - annotate - [select for diffs], Wed Aug 21 20:44:09 2019 UTC (4 years, 9 months ago) by cheloha
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE, OPENBSD_7_5, OPENBSD_7_4_BASE, OPENBSD_7_4, OPENBSD_7_3_BASE, OPENBSD_7_3, OPENBSD_7_2_BASE, OPENBSD_7_2, OPENBSD_7_1_BASE, OPENBSD_7_1, OPENBSD_7_0_BASE, OPENBSD_7_0, OPENBSD_6_9_BASE, OPENBSD_6_9, OPENBSD_6_8_BASE, OPENBSD_6_8, OPENBSD_6_7_BASE, OPENBSD_6_7, OPENBSD_6_6_BASE, OPENBSD_6_6, HEAD
Changes since 1.30: +3 -2 lines
Diff to previous 1.30 (colored)

sysctl(2): add kern.utc_offset: successor to the DST/TIMEZONE options(4)

The DST and TIMEZONE options(4) are incompatible with KARL, so we need
some other way to compensate for an RTC running with a known offset.

Enter kern.utc_offset, an offset in minutes East of UTC.  TIMEZONE has
always been minutes West, but this is inconsistent with how everyone
else talks about timezones, hence the flip.

TIMEZONE has the advantage of being compiled into the binary.  Our new
sysctl(2) has no such luck, so it needs to be set as early as possible
in boot, from sysctl.conf(5), so we can correct the kernel clock from
the RTC's local time to UTC before daemons like ntpd(8) and cron(8)
start.  To encourage this, kern.utc_offset is made immutable after the
securelevel(7) is raised to 1.

Prompted by yasuoka@.  Discussed with deraadt@, kettenis@, yasuoka@.
Additional testing by yasuoka@.

ok deraadt@, yasuoka@

Revision 1.30 / (download) - annotate - [select for diffs], Tue Sep 12 02:22:15 2017 UTC (6 years, 8 months ago) by schwarze
Branch: MAIN
CVS Tags: OPENBSD_6_5_BASE, OPENBSD_6_5, OPENBSD_6_4_BASE, OPENBSD_6_4, OPENBSD_6_3_BASE, OPENBSD_6_3, OPENBSD_6_2_BASE, OPENBSD_6_2
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 (colored)

Update the documentation regarding /dev/mem and /dev/kmem;
Theo already clamped down on these devices last year.
Triggered by a question from Nan Xiao <xiaonan830818 at gmail dot com>.
OK deraadt@

Revision 1.29 / (download) - annotate - [select for diffs], Wed Sep 28 17:58:17 2016 UTC (7 years, 8 months ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_6_1_BASE, OPENBSD_6_1
Changes since 1.28: +11 -30 lines
Diff to previous 1.28 (colored)

group the sysctls;

Revision 1.28 / (download) - annotate - [select for diffs], Wed Sep 28 17:54:01 2016 UTC (7 years, 8 months ago) by jmc
Branch: MAIN
Changes since 1.27: +6 -1 lines
Diff to previous 1.27 (colored)

document kern.allowkmem; reminded by deraadt

Revision 1.27 / (download) - annotate - [select for diffs], Sun Sep 18 15:05:02 2016 UTC (7 years, 8 months ago) by jmc
Branch: MAIN
Changes since 1.26: +2 -3 lines
Diff to previous 1.26 (colored)

there's no reason to point readers to options(4) now;

Revision 1.26 / (download) - annotate - [select for diffs], Sun Sep 18 14:28:05 2016 UTC (7 years, 8 months ago) by deraadt
Branch: MAIN
Changes since 1.25: +2 -5 lines
Diff to previous 1.25 (colored)

option INSECURE is obsolete

Revision 1.25 / (download) - annotate - [select for diffs], Thu Oct 9 04:23:04 2014 UTC (9 years, 8 months ago) by tedu
Branch: MAIN
CVS Tags: OPENBSD_6_0_BASE, OPENBSD_6_0, OPENBSD_5_9_BASE, OPENBSD_5_9, OPENBSD_5_8_BASE, OPENBSD_5_8, OPENBSD_5_7_BASE, OPENBSD_5_7
Changes since 1.24: +2 -4 lines
Diff to previous 1.24 (colored)

no modules

Revision 1.24 / (download) - annotate - [select for diffs], Mon Jul 14 09:21:04 2014 UTC (9 years, 10 months ago) by ajacoutot
Branch: MAIN
CVS Tags: OPENBSD_5_6_BASE, OPENBSD_5_6
Changes since 1.23: +5 -5 lines
Diff to previous 1.23 (colored)

No more "securelevel" variable.

Revision 1.23 / (download) - annotate - [select for diffs], Fri Jun 24 19:47:48 2011 UTC (12 years, 11 months ago) by naddy
Branch: MAIN
CVS Tags: OPENBSD_5_5_BASE, OPENBSD_5_5, OPENBSD_5_4_BASE, OPENBSD_5_4, OPENBSD_5_3_BASE, OPENBSD_5_3, OPENBSD_5_2_BASE, OPENBSD_5_2, OPENBSD_5_1_BASE, OPENBSD_5_1, OPENBSD_5_0_BASE, OPENBSD_5_0
Changes since 1.22: +7 -2 lines
Diff to previous 1.22 (colored)

machdep.kbdreset enables a shutdown by Ctrl-Alt-Del on amd64 and
i386.  Stop abusing it on other archs for controling a shutdown by
pressing the soft power button:

* Add a MI sysctl hw.allowpowerdown; if set to 1 (the default) it
  allows a power button shutdown.
* Make acpi(4)/acpibtn(4) honor hw.allowpowerdown.
* Switch the various power button intercepts on landisk, sgi, sparc64
  and zaurus over to hw.allowpowerdown.
* Garbage collect the machdep.kbdreset sysctl on all archs other than
  amd64 and i386.

ok miod@

Revision 1.22 / (download) - annotate - [select for diffs], Sat May 9 13:45:28 2009 UTC (15 years, 1 month ago) by sthen
Branch: MAIN
CVS Tags: OPENBSD_4_9_BASE, OPENBSD_4_9, OPENBSD_4_8_BASE, OPENBSD_4_8, OPENBSD_4_7_BASE, OPENBSD_4_7, OPENBSD_4_6_BASE, OPENBSD_4_6
Changes since 1.21: +7 -6 lines
Diff to previous 1.21 (colored)

- mention that configuring new GPIO pins is locked out with securelevel>0,
discussed with jmc@ and Marc Balmer
- clear out some .Xr from SEE ALSO that are also in the main text and not
really necessary to repeat, req by jmc@.

ok jmc.

Revision 1.21 / (download) - annotate - [select for diffs], Fri Jun 1 16:56:26 2007 UTC (17 years ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_4_5_BASE, OPENBSD_4_5, OPENBSD_4_4_BASE, OPENBSD_4_4, OPENBSD_4_3_BASE, OPENBSD_4_3, OPENBSD_4_2_BASE, OPENBSD_4_2
Changes since 1.20: +4 -4 lines
Diff to previous 1.20 (colored)

enforce DESCRIPTION-after-SYNOPSIS order, to appease man -h;

Revision 1.20 / (download) - annotate - [select for diffs], Thu May 31 19:19:58 2007 UTC (17 years ago) by jmc
Branch: MAIN
Changes since 1.19: +2 -2 lines
Diff to previous 1.19 (colored)

convert to new .Dd format;

Revision 1.19 / (download) - annotate - [select for diffs], Sat Aug 19 07:51:25 2006 UTC (17 years, 9 months ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_4_1_BASE, OPENBSD_4_1, OPENBSD_4_0_BASE, OPENBSD_4_0
Changes since 1.18: +6 -1 lines
Diff to previous 1.18 (colored)

document machdep.aperture; pointed out by andrew smith
ok deraadt

Revision 1.18 / (download) - annotate - [select for diffs], Sat Mar 25 08:28:45 2006 UTC (18 years, 2 months ago) by jmc
Branch: MAIN
Changes since 1.17: +9 -9 lines
Diff to previous 1.17 (colored)

ddb.{console,panic} cannot be raised at securelevel 1 either;

from nicholas marriott;
ok miod ray

Revision 1.17 / (download) - annotate - [select for diffs], Thu May 12 08:16:06 2005 UTC (19 years, 1 month ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_3_9_BASE, OPENBSD_3_9, OPENBSD_3_8_BASE, OPENBSD_3_8
Changes since 1.16: +3 -3 lines
Diff to previous 1.16 (colored)

change pfctl reference to pf, since programs like authpf also attempt to
alter rulesets, not just pfctl interface;

from tamas tevesz;

Revision 1.16 / (download) - annotate - [select for diffs], Tue Apr 19 07:28:34 2005 UTC (19 years, 1 month ago) by jmc
Branch: MAIN
Changes since 1.15: +8 -3 lines
Diff to previous 1.15 (colored)

- some sysctls may not be lowered either
- document machdep.kbdreset

diff from fgsch@
ok deraadt@

Revision 1.15 / (download) - annotate - [select for diffs], Thu Jan 8 10:56:07 2004 UTC (20 years, 5 months ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_3_7_BASE, OPENBSD_3_7, OPENBSD_3_6_BASE, OPENBSD_3_6, OPENBSD_3_5_BASE, OPENBSD_3_5
Changes since 1.14: +11 -1 lines
Diff to previous 1.14 (colored)

document that sysctls fs.posix.setuid and net.inet.ip.sourceroute may not
be set when securelevel > 0;

the latter from Ryan Leslie (PR 3631);

Revision 1.14 / (download) - annotate - [select for diffs], Tue Jul 30 00:11:36 2002 UTC (21 years, 10 months ago) by nordin
Branch: MAIN
CVS Tags: OPENBSD_3_4_BASE, OPENBSD_3_4, OPENBSD_3_3_BASE, OPENBSD_3_3, OPENBSD_3_2_BASE, OPENBSD_3_2
Changes since 1.13: +4 -2 lines
Diff to previous 1.13 (colored)

Clarify time handling at securelevel 2. Idea from mpech@ ok millert@

Revision 1.13 / (download) - annotate - [select for diffs], Thu Jun 28 10:09:49 2001 UTC (22 years, 11 months ago) by hugh
Branch: MAIN
CVS Tags: OPENBSD_3_1_BASE, OPENBSD_3_1, OPENBSD_3_0_BASE, OPENBSD_3_0
Changes since 1.12: +4 -7 lines
Diff to previous 1.12 (colored)

Restore reference to packet filter.

Revision 1.12 / (download) - annotate - [select for diffs], Wed May 30 03:24:16 2001 UTC (23 years ago) by millert
Branch: MAIN
Changes since 1.11: +7 -6 lines
Diff to previous 1.11 (colored)

comment out references to ipf to be replaced in the future with whatever packet filter we end up using

Revision 1.11 / (download) - annotate - [select for diffs], Tue May 1 18:31:43 2001 UTC (23 years, 1 month ago) by aaron
Branch: MAIN
Changes since 1.10: +2 -2 lines
Diff to previous 1.10 (colored)

Sort SEE ALSO entries; mpech@prosoft.org.lv

Revision 1.10 / (download) - annotate - [select for diffs], Sun Mar 11 05:48:26 2001 UTC (23 years, 3 months ago) by aaron
Branch: MAIN
CVS Tags: OPENBSD_2_9_BASE, OPENBSD_2_9
Changes since 1.9: +3 -2 lines
Diff to previous 1.9 (colored)

Give /etc/rc.securelevel the same FILES-style description as in init(8).

Revision 1.9 / (download) - annotate - [select for diffs], Thu Jun 29 18:12:42 2000 UTC (23 years, 11 months ago) by hugh
Branch: MAIN
CVS Tags: OPENBSD_2_8_BASE, OPENBSD_2_8
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored)

escape -1 with \& as per mdoc.samples

Revision 1.8 / (download) - annotate - [select for diffs], Thu Apr 27 00:36:01 2000 UTC (24 years, 1 month ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_2_7_BASE, OPENBSD_2_7
Changes since 1.7: +2 -1 lines
Diff to previous 1.7 (colored)

have mem(4) talk about securelevel(7)

Revision 1.7 / (download) - annotate - [select for diffs], Sun Mar 19 19:25:37 2000 UTC (24 years, 2 months ago) by aaron
Branch: MAIN
Changes since 1.6: +20 -15 lines
Diff to previous 1.6 (colored)

Various cleanups.

Revision 1.6 / (download) - annotate - [select for diffs], Sun Feb 27 04:59:10 2000 UTC (24 years, 3 months ago) by hugh
Branch: MAIN
Changes since 1.5: +21 -3 lines
Diff to previous 1.5 (colored)

document ddb securelevel semantics

Revision 1.5 / (download) - annotate - [select for diffs], Sun Feb 27 04:29:44 2000 UTC (24 years, 3 months ago) by hugh
Branch: MAIN
Changes since 1.4: +5 -3 lines
Diff to previous 1.4 (colored)

be clear about raw disk devs

Revision 1.4 / (download) - annotate - [select for diffs], Mon Feb 14 15:36:04 2000 UTC (24 years, 3 months ago) by aaron
Branch: MAIN
Changes since 1.3: +2 -2 lines
Diff to previous 1.3 (colored)

Kill trailing whitespace.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Feb 14 15:25:57 2000 UTC (24 years, 3 months ago) by aaron
Branch: MAIN
Changes since 1.2: +5 -5 lines
Diff to previous 1.2 (colored)

Re-order SEE ALSO section.

Revision 1.2 / (download) - annotate - [select for diffs], Mon Jan 10 07:18:50 2000 UTC (24 years, 5 months ago) by hugh
Branch: MAIN
Changes since 1.1: +37 -24 lines
Diff to previous 1.1 (colored)

nits & style

Revision 1.1 / (download) - annotate - [select for diffs], Sat Jan 8 01:55:33 2000 UTC (24 years, 5 months ago) by hugh
Branch: MAIN

Give securelevel its own manpage and enable.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.