[BACK]Return to sysctl.7 CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / share / man / man7

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/share/man/man7/sysctl.7 between version 1.42 and 1.43

version 1.42, 2010/04/20 06:22:52 version 1.43, 2010/04/20 07:33:45
Line 112  if a variable is initialized in more tha
Line 112  if a variable is initialized in more tha
 For example, to export the variable  For example, to export the variable
 .Dv dospecialcheck  .Dv dospecialcheck
 as a debugging variable, the following declaration would be used:  as a debugging variable, the following declaration would be used:
   .Pp
 .Bd -literal -offset indent -compact  .Bd -literal -offset indent -compact
 int dospecialcheck = 1;  int dospecialcheck = 1;
 struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };  struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };
Line 229  The bytes of non-kernel memory as a 32-b
Line 230  The bytes of non-kernel memory as a 32-b
 The bytes of non-kernel memory as a 64-bit integer.  The bytes of non-kernel memory as a 64-bit integer.
 .El  .El
 .Sh The kern.* subtree  .Sh The kern.* subtree
   This subtree includes data generally related to the kernel.
 The string and integer information available for the  The string and integer information available for the
 .Li kern  .Li kern
 level is detailed below.  level is detailed below.
 The changeable column shows whether a process with appropriate  The changeable column shows whether a process with appropriate
 privilege may change the value.  privilege may change the value.
 The types of data currently available are process information,  .Bl -column "kern.posix_reader_writer_locks" \
 system vnodes, the open file entries, routing table entries,  "struct kinfo_drivers" "not applicable"
 virtual memory statistics, load average history, and clock rate  
 information.  
 .Bl -column "kern.posix_reader_writer_locks" "struct kinfo_drivers" "not applicable"  
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
 .\".It kern.arandom     integer no  .\".It kern.arandom     integer no
 .It kern.argmax integer no  .It kern.argmax integer no
Line 433  and can be changed with the kernel confi
Line 432  and can be changed with the kernel confi
 ).  ).
 .It Li kern.detachall  .It Li kern.detachall
 Detach all devices at shutdown.  Detach all devices at shutdown.
 .\" XXX: Lacks CTL_KERN identifier.  
 .It Li kern.domainname ( KERN_DOMAINNAME )  .It Li kern.domainname ( KERN_DOMAINNAME )
 Get or set the YP domain name.  Get or set the YP domain name.
 .It Li kern.drivers ( KERN_DRIVERS )  .It Li kern.drivers ( KERN_DRIVERS )
Line 993  Each element of the array contains the k
Line 991  Each element of the array contains the k
 .Va struct vnode *  .Va struct vnode *
 followed by the vnode itself  followed by the vnode itself
 .Va struct vnode .  .Va struct vnode .
 .\" XXX kern.lwp  .\" XXX: Undocumented: kern.lwp: no children?
 .El  .El
 .Sh The machdep.* subtree  .Sh The machdep.* subtree
 The set of variables defined is architecture dependent.  The set of variables defined is architecture dependent.
 Most architectures define at least the following variables.  Most architectures define at least the following variables.
 .Bl -column "Second level name" "Type" "Changeable" -offset indent  .Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent
 .It Sy Second level name        Type    Changeable  .It Sy Second level name        Type    Changeable
 .It Li CPU_CONSDEV      dev_t   no  .It Li machdep.booted_kernel    string  no
 .El  .El
   .\" XXX: Document the above.
 .Sh The net.* subtree  .Sh The net.* subtree
 The string and integer information available for the  The string and integer information available for the
 .Li net  .Li net
Line 2098  The
Line 2097  The
 .Li security  .Li security
 level contains various security-related settings for  level contains various security-related settings for
 the system.  the system.
   The available second level names are:
   .Bl -column "Second level name" "integer" "Changeable" -offset indent
   .It Sy Second level name        Type    Changeable
   .It Li security.curtain integer yes
   .It Li security.models  node    not applicable
   .It Li security.pax     node    not applicable
   .El
   .Pp
 Available settings are detailed below.  Available settings are detailed below.
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li security.curtain  .It Li security.curtain
 If non-zero, will filter return objects according to the user-id  If non-zero, will filter return objects according to the user
   .Tn ID
 requesting information about them, preventing from users any  requesting information about them, preventing from users any
 access to objects they don't own.  access to objects they do not own.
 .Pp  .Pp
 At the moment, it affects  At the moment, it affects
 .Xr ps 1 ,  .Xr ps 1 ,
Line 2135  For more information on any of the PaX f
Line 2143  For more information on any of the PaX f
 .Xr paxctl 8  .Xr paxctl 8
 and  and
 .Xr security 8 .  .Xr security 8 .
   The available third and fourth level names are:
   .Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \
   -offset 2n
   .It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable
   .It Li security.pax.aslr.enabled        integer yes
   .\".It Li security.pax.aslr.exec_len    integer yes
   .It Li security.pax.aslr.global integer yes
   .\".It Li security.pax.aslr.mmap_len    integer yes
   .\".It Li security.pax.aslr.stack_len   integer yes
   .It Li security.pax.mprotect.enabled    integer yes
   .It Li security.pax.mprotect.global     integer yes
   .It Li security.pax.segvguard.enabled   integer yes
   .It Li security.pax.segvguard.expiry_timeout    integer yes
   .It Li security.pax.segvguard.global    integer yes
   .It Li security.pax.segvguard.max_crashes       integer yes
   .It Li security.pax.segvguard.suspend_timeout   integer yes
   .El
 .Pp  .Pp
 .Bl -tag -width "123456"  .Bl -tag -width "123456"
 .It Li security.pax.aslr.enable  .It Li security.pax.aslr.enabled
 Enable PaX ASLR (Address Space Layout Randomization).  Enable PaX ASLR (Address Space Layout Randomization).
 .Pp  .Pp
 The value of this  The value of this
 knob must be non-zero for PaX ASLR to be enabled, even if a program is set to  knob must be non-zero for PaX ASLR to be enabled, even if a program is set to
 explicit enable.  explicit enable.
   .\".It Li security.pax.aslr.exec_len
   .\" XXX: Undocumented.
 .It Li security.pax.aslr.global  .It Li security.pax.aslr.global
 Specifies the default global policy for programs without an  Specifies the default global policy for programs without an
 explicit enable/disable flag.  explicit enable/disable flag.
Line 2152  When non-zero, all programs will get PaX
Line 2179  When non-zero, all programs will get PaX
 Otherwise, all programs will not get PaX ASLR, except those specifically  Otherwise, all programs will not get PaX ASLR, except those specifically
 marked as such with  marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.mprotect.enable  .\".It Li security.pax.aslr.mmap_len
   .\" XXX: Undocumented.
   .\" .It Li security.pax.aslr.stack_len
   .\" XXX: Undocumented.
   .It Li security.pax.mprotect.enabled
 Enable PaX MPROTECT restrictions.  Enable PaX MPROTECT restrictions.
 .Pp  .Pp
 These are  These are
Line 2171  except those exempted with
Line 2202  except those exempted with
 Otherwise, all programs will not get the PaX MPROTECT restrictions,  Otherwise, all programs will not get the PaX MPROTECT restrictions,
 except those specifically marked as such with  except those specifically marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.segvguard.enable  .It Li security.pax.segvguard.enabled
 Enable PaX Segvguard.  Enable PaX Segvguard.
 .Pp  .Pp
 PaX Segvguard can detect and prevent certain exploitation attempts, where  PaX Segvguard can detect and prevent certain exploitation attempts, where
Line 2183  The
Line 2214  The
 .Nx  .Nx
 interface and implementation of the Segvguard is still experimental, and may  interface and implementation of the Segvguard is still experimental, and may
 change in future releases.  change in future releases.
   .It Li security.pax.segvguard.expiry_timeout
   If the max number was not reached within this timeout (in seconds), the entry
   will expire.
 .It Li security.pax.segvguard.global  .It Li security.pax.segvguard.global
 Specifies the default global policy for programs without an  Specifies the default global policy for programs without an
 explicit enable/disable flag.  explicit enable/disable flag.
Line 2193  except those exempted with
Line 2227  except those exempted with
 Otherwise, no program will get the PaX Segvguard restrictions,  Otherwise, no program will get the PaX Segvguard restrictions,
 except those specifically marked as such with  except those specifically marked as such with
 .Xr paxctl 8 .  .Xr paxctl 8 .
 .It Li security.pax.segvguard.expiry_timeout  .It Li security.pax.segvguard.max_crashes
 If the max number was not reached within this timeout (in seconds), the entry  The maximum number of segfaults a program can receive before suspension.
 will expire.  
 .It Li security.pax.segvguard.suspend_timeout  .It Li security.pax.segvguard.suspend_timeout
 Number of seconds to suspend a user from running a faulting program when the  Number of seconds to suspend a user from running a faulting program when the
 limit was exceeded.  limit was exceeded.
 .It Li security.pax.segvguard.max_crashes  
 Max number of segfaults a program can receive before suspension.  
 .El  .El
 .El  .El
 .Sh The vendor.* subtree ( CTL_VENDOR )  .Sh The vendor.* subtree ( CTL_VENDOR )

Legend:
Removed from v.1.42  
changed lines
  Added in v.1.43

CVSweb <webmaster@jp.NetBSD.org>