src/share/man/man7/sysctl.7 - diff

Return to sysctl.7 CVS log

Up to [cvs.NetBSD.org] / src / share / man / man7

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/share/man/man7/sysctl.7 between version 1.42 and 1.56

version 1.42, 2010/04/20 06:22:52

version 1.56, 2011/01/19 02:25:17

Line 29

.\"

.\" @(#)sysctl.3 8.4 (Berkeley) 5/9/95

.\"

.Dd April 20, 2010

.Dd January 19, 2011

.Dt SYSCTL 7

.Os

.Sh NAME

Line 68 sysctl variable relative to the upper le

See the

.Xr sysctl 3

manual page for programming examples.

.Sh Top level names

.Ss Top level names

The top level names are defined with a CTL_ prefix in

The top level names are defined with a

.Va CTL_

prefix in

.In sys/sysctl.h ,

and are as follows.

The next and subsequent levels down are found in the include files

listed here, and described in separate sections below.

.Bl -column security CTL_SECURITY "Next level names" "High kernel limits"

.Bl -column "security" ".Dv CTL_SECURITY" ".In uvm/uvm_param.h" "High kernel limits"

.It Sy Name Constant Next level names Description

.It Sy Name Ta Sy Constant Ta Sy Next level names Ta Sy Description

.It kern CTL_KERN sys/sysctl.h High kernel limits

.It kern Ta Dv CTL_KERN Ta In sys/sysctl.h Ta High kernel limits

.It vm CTL_VM uvm/uvm_param.h Virtual memory

.It vm Ta Dv CTL_VM Ta In uvm/uvm_param.h Ta Virtual memory

.It vfs CTL_VFS sys/mount.h Filesystem

.It vfs Ta Dv CTL_VFS Ta In sys/mount.h Ta Filesystem

.It net CTL_NET sys/socket.h Networking

.It net Ta Dv CTL_NET Ta In sys/socket.h Ta Networking

.It debug CTL_DEBUG sys/sysctl.h Debugging

.It debug Ta Dv CTL_DEBUG Ta In sys/sysctl.h Ta Debugging

.It hw CTL_HW sys/sysctl.h Generic CPU, I/O

.It hw Ta Dv CTL_HW Ta In sys/sysctl.h Ta Generic CPU, I/O

.It machdep CTL_MACHDEP sys/sysctl.h Machine dependent

.It machdep Ta Dv CTL_MACHDEP Ta In sys/sysctl.h Ta Machine dependent

.It user CTL_USER sys/sysctl.h User-level

.It user Ta Dv CTL_USER Ta In sys/sysctl.h Ta User-level

.It ddb CTL_DDB sys/sysctl.h In-kernel debugger

.It ddb Ta Dv CTL_DDB Ta In sys/sysctl.h Ta In-kernel debugger

.It proc CTL_PROC sys/sysctl.h Per-process

.It proc Ta Dv CTL_PROC Ta In sys/sysctl.h Ta Per-process

.It vendor CTL_VENDOR ? Vendor specific

.It vendor Ta Dv CTL_VENDOR Ta ? Ta Vendor specific

.It emul CTL_EMUL sys/sysctl.h Emulation settings

.It emul Ta Dv CTL_EMUL Ta In sys/sysctl.h Ta Emulation settings

.It security CTL_SECURITY sys/sysctl.h Security settings

.It security Ta Dv CTL_SECURITY Ta In sys/sysctl.h Ta Security settings

.El

.Sh The debug.* subtree

.Ss The debug.* subtree

The debugging variables vary from system to system.

A debugging variable may be added or deleted without need to recompile

.Nm

Line 100 Each time it runs,

Line 102 Each time it runs,

gets the list of debugging variables from the kernel and

displays their current values.

The system defines twenty

.Va ( struct ctldebug )

.Vt ( struct ctldebug )

variables named

.Dv debug0

through

Line 110 individually initialized at the location

Line 112 individually initialized at the location

The loader prevents multiple use of the same variable by issuing errors

if a variable is initialized in more than one place.

For example, to export the variable

.Dv dospecialcheck

.Va dospecialcheck

as a debugging variable, the following declaration would be used:

.Pp

.Bd -literal -offset indent -compact

int dospecialcheck = 1;

struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };

Line 127 See

Line 130 See

.\" and

.\" .Xr sysctl 9

for more information.

.Sh The vfs.* subtree

.Ss The vfs.* subtree

A distinguished second level name,

.Li vfs.generic ( VFS_GENERIC ) ,

is used to get general information about all filesystems.

It has the following third level identifiers:

.Bl -tag -width compact

.Bl -tag -width "123456"

.It vfs.generic.maxtypenum ( VFS_MAXTYPENUM )

.It Li vfs.generic.maxtypenum ( VFS_MAXTYPENUM )

The highest valid filesystem type number.

.It vfs.generic.conf ( VFS_CONF )

.It Li vfs.generic.conf ( VFS_CONF )

Returns configuration information about the file-system type given as a fourth

level identifier.

.El

.Pp

A second level name for controlling the

.Xr wapbl 4

(Write Ahead Physical Block Logging file system journalling)

capabilities with the following third level identifiers:

.Bl -tag -width "123456"

.It Li vfs.wapbl.flush_disk_cache

Controls whether to attempt to flush the disk cache on each commit.

It defaults to 1 and it should always be on to ensure data integrity in

case of a crash.

For slow disks, turning it off can improve performance.

.It Li vfs.wapbl.verbose_commit

For each transaction log commit, print the number of bytes written

and the time it took to commit as seconds.nanoseconds.

.El

.Pp

The remaining second level identifiers are the file-system names, identified

by the type number returned by a

.Xr statvfs 2

call or from

.Li vfs.generic.conf .

.Pp

The third level identifiers available for each filesystem

are given in the header file that defines the mount

argument structure for that filesystem.

.Sh The hw.* subtree

.Ss The hw.* subtree

The string and integer information available for the

.Li hw

level is detailed below.

Line 178 Alignment constraint for all possible da

Line 197 Alignment constraint for all possible da

This shows the value

.Dv ALIGNBYTES

.Pa /usr/include/machine/param.h ,

.In machine/param.h ,

at the kernel compilation time.

.It Li hw.byteorder ( HW_BYTEORDER )

The byteorder (4,321, or 1,234).

The byteorder (4321, or 1234).

.It Li hw.cnmagic ( HW_CNMAGIC )

The console magic key sequence.

.It Li hw.disknames ( HW_DISKNAMES )

Line 193 collected on them.

Line 212 collected on them.

Return statistical information on the NFS mounts, disk and tape

devices on the system.

An array of

.Va struct io_sysctl

.Vt struct io_sysctl

structures is returned,

whose size depends on the current number of such objects in the system.

The third level name is the size of the

.Va struct io_sysctl .

.Vt struct io_sysctl .

The type of object can be determined by examining the

.Va type

element of

.Va struct io_sysctl .

.Vt struct io_sysctl .

Which can be

.Dv IOSTAT_DISK

(disk drive),

Line 228 The bytes of non-kernel memory as a 32-b

Line 247 The bytes of non-kernel memory as a 32-b

.It Li hw.usermem64 ( HW_USERMEM64 )

The bytes of non-kernel memory as a 64-bit integer.

.El

.Sh The kern.* subtree

.Ss The kern.* subtree

This subtree includes data generally related to the kernel.

The string and integer information available for the

.Li kern

level is detailed below.

The changeable column shows whether a process with appropriate

privilege may change the value.

The types of data currently available are process information,

.Bl -column "kern.posix_reader_writer_locks" \

system vnodes, the open file entries, routing table entries,

"struct kinfo_drivers" "not applicable"

virtual memory statistics, load average history, and clock rate

information.

.Bl -column "kern.posix_reader_writer_locks" "struct kinfo_drivers" "not applicable"

.It Sy Second level name Type Changeable

.\".It kern.arandom integer no

.It kern.aio_listio_max integer yes

.It kern.aio_max integer yes

.It kern.arandom integer no

.It kern.argmax integer no

.It kern.autonicetime integer yes

.It kern.autoniceval integer yes

.It kern.boothowto integer no

.It kern.boottime struct timeval no

.\".It kern.bufq node not applicable

Line 253 information.

Line 270 information.

.It kern.coredump node not applicable

.It kern.cp_id struct no

.It kern.cp_time uint64_t[\|] no

.\".It kern.cryptodevallowsoft integer yes

.It kern.cryptodevallowsoft integer yes

.It kern.defcorename string yes

.It kern.detachall integer yes

.It kern.domainname string yes

Line 286 information.

Line 303 information.

.It kern.memory_protection integer no

.It kern.module node not applicable

.It kern.monotonic_clock integer no

.It kern.mqueue node not applicable

.It kern.msgbuf integer no

.It kern.msgbufsize integer no

.It kern.ngroups integer no

Line 298 information.

Line 316 information.

.It kern.pipe node not applicable

.\" .It kern.posix node not applicable

.It kern.posix1version integer no

.It kern.posix_aio integer no

.It kern.posix_barriers integer no

.It kern.posix_reader_writer_locks integer no

.\".It kern.posix_sched integer yes

Line 324 information.

Line 343 information.

.It kern.timex struct no

.It kern.tkstat node not applicable

.It kern.urandom integer no

.\".It kern.usercrypto integer yes

.It kern.usercrypto integer yes

.\" It kern.userasymcrypto integer yes

.It kern.userasymcrypto integer yes

.It kern.veriexec node not applicable

.It kern.version string no

.It kern.vnode struct vnode no

.El

.Bl -tag -width "123456"

.\".It Li kern.arandom

.It Li kern.aio_listio_max

.\" XXX: Undocumented.

The maximum number of asynchronous

.Tn I/O

operations in a single list I/O call.

Like with all variables related to

.Xr aio 3 ,

the variable may be created and removed dynamically

upon loading or unloading the corresponding kernel module.

.It Li kern.aio_max

The maximum number of asynchronous I/O operations.

.It Li kern.arandom

This variable picks a random number each time it is queried.

The used random number generator

.Pf ( Tn RNG )

is based on

.Xr arc4random 3 .

.It Li kern.argmax ( KERN_ARGMAX )

The maximum bytes of argument to

.Xr execve 2 .

.\" XXX: Is kern.autonicetime still available?

.It Li kern.autonicetime ( KERN_AUTONICETIME )

The number of seconds of CPU-time a non-root process may accumulate before

having its priority lowered from the default to the value of KERN_AUTONICEVAL.

If set to 0, automatic lowering of priority is not performed, and if set to \-1

all non-root processes are immediately lowered.

.\" XXX: Is kern.autoniceval still available?

.It Li kern.autoniceval ( KERN_AUTONICEVAL )

The priority assigned for automatically niced processes.

.It Li kern.boothowto

Flags passed from the boot loader; see

.Xr reboot 2

for the meanings of the flags.

.It Li kern.boottime ( KERN_BOOTTIME )

.Va struct timeval

.Vt struct timeval

structure is returned.

This structure contains the time that the system was booted.

.\" .It Li kern.bufq

Line 360 This structure contains the time that th

Line 384 This structure contains the time that th

The scheduler exponential decay value.

.It Li kern.clockrate ( KERN_CLOCKRATE )

.Va struct clockinfo

.Vt struct clockinfo

structure is returned.

This structure contains the clock, statistics clock and profiling clock

frequencies, the number of micro-seconds per hz tick, and the clock

Line 407 Same syntax as kern.defcorename.

Line 431 Same syntax as kern.defcorename.

.It Li kern.cp_id ( KERN_CP_ID )

Mapping of CPU number to CPU id.

.It Li kern.cp_time ( KERN_CP_TIME )

Returns an array of CPUSTATES uint64_ts.

Returns an array of

.Dv CPUSTATES

.Vt uint64_t Ns s.

This array contains the

number of clock ticks spent in different CPU states.

On multi-processor systems, the sum across all CPUs is returned unless

appropriate space is given for one data set for each CPU.

Data for a specific CPU can also be obtained by adding the number of the

CPU at the end of the MIB, enlarging it by one.

.\".It Li kern.cryptodevallowsoft

.It Li kern.cryptodevallowsoft

.\" XXX: Undocumented.

This variable controls userland access to hardware versus software transforms

in the

.Xr crypto 4

system.

The available values are as follows:

.Bl -tag -width XX0 -offset indent

.It Dv \*[Lt] 0

Always force userlevel requests to use software transforms.

.It Dv = 0

If present, use hardware and grant userlevel requests for

non-accelerated transforms (handling the latter in software).

.It Dv \*[Gt] 0

Allow user requests only for transforms which are hardware-accelerated.

.El

.It Li kern.defcorename ( KERN_DEFCORENAME )

Default template for the name of core dump files (see also

.Li proc.pid.corename

Line 425 and

Line 464 and

.Xr core 5

for format of this template).

The default value is

.Nm %n.core

.Pa %n.core

and can be changed with the kernel configuration option

.Cd options DEFCORENAME

(see

Line 433 and can be changed with the kernel confi

Line 472 and can be changed with the kernel confi

.It Li kern.detachall

Detach all devices at shutdown.

.\" XXX: Lacks CTL_KERN identifier.

.It Li kern.domainname ( KERN_DOMAINNAME )

Get or set the YP domain name.

.It Li kern.drivers ( KERN_DRIVERS )

Return an array of

.Va struct kinfo_drivers

.Vt struct kinfo_drivers

that contains the name and major device numbers of all the device drivers

in the current kernel.

The

Line 453 Perform a crash dump on system

Line 491 Perform a crash dump on system

.It Li kern.file ( KERN_FILE )

Return the entire file table.

The returned data consists of a single

.Va struct filelist

.Vt struct filelist

followed by an array of

.Va struct file ,

.Vt struct file ,

whose size depends on the current number of such objects in the system.

.It Li kern.forkfsleep ( KERN_FORKFSLEEP )

Line 473 The kernel fixed-point scale factor.

Line 511 The kernel fixed-point scale factor.

.It Li kern.fsync ( KERN_FSYNC )

Return 1 if the POSIX 1003.1b File Synchronization Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.hardclock_ticks ( KERN_HARDCLOCK_TICKS )

Returns the number of

.Xr hardclock 9

Line 490 Get or set the

Line 528 Get or set the

.Xr hostname 1 .

.It Li kern.iov_max ( KERN_IOV_MAX )

Return the maximum number of

.Va iovec

.Vt iovec

structures that a process has available for use with

.Xr preadv 2 ,

.Xr pwritev 2 ,

Line 523 The third level names for the ipc variab

Line 561 The third level names for the ipc variab

.It Li kern.ipc.sysvmsg ( KERN_SYSVIPC_MSG )

Returns 1 if System V style message queue functionality is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.ipc.sysvsem ( KERN_SYSVIPC_SEM )

Returns 1 if System V style semaphore functionality is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.ipc.sysvshm ( KERN_SYSVIPC_SHM )

Returns 1 if System V style share memory functionality is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.ipc.sysvipc_info ( KERN_SYSVIPC_INFO )

Return System V style IPC configuration and run-time information.

The fourth level name selects the System V style IPC facility.

Line 586 Max number of number of semaphores in sy

Line 624 Max number of number of semaphores in sy

Max number of undo structures in system.

.El

.It Li kern.job_control ( KERN_JOB_CONTROL )

Return 1 if job control is available on this system, otherwise 0.

Return 1 if job control is available on this system, otherwise\ 0.

.It Li kern.labeloffset ( KERN_LABELOFFSET )

The offset within the sector specified by KERN_LABELSECTOR of the

The offset within the sector specified by

.Dv KERN_LABELSECTOR

of the

.Xr disklabel 5 .

.It Li kern.labelsector ( KERN_LABELSECTOR )

The sector number containing the

Line 605 file, and whether the coredump was creat

Line 645 file, and whether the coredump was creat

.It Li kern.mapped_files ( KERN_MAPPED_FILES )

Returns 1 if the POSIX 1003.1b Memory Mapped Files Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.maxfiles ( KERN_MAXFILES )

The maximum number of open files that may be open in the system.

.It Li kern.maxpartitions ( KERN_MAXPARTITIONS )

Line 659 direct-mapped pool pages.

Line 699 direct-mapped pool pages.

.It Li kern.memlock ( KERN_MEMLOCK )

Returns 1 if the POSIX 1003.1b Process Memory Locking Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.memlock_range ( KERN_MEMLOCK_RANGE )

Returns 1 if the POSIX 1003.1b Range Memory Locking Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.memory_protection ( KERN_MEMORY_PROTECTION )

Returns 1 if the POSIX 1003.1b Memory Protection Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.module

Settings related to kernel modules.

The third level names for the settings are described below.

Line 681 The variables are as follows:

Line 721 The variables are as follows:

.Bl -tag -width "123456"

.It Li kern.module.autoload

A boolean that controls whether kernel modules are loaded automatically.

See for example

See

.Xr modstat 8

.Xr module 7

for additional details.

.It Li kern.module.verbose

A boolean that enables or disables verbose

Line 691 debug messages related to kernel modules

Line 731 debug messages related to kernel modules

.It Li kern.monotonic_clock ( KERN_MONOTONIC_CLOCK )

Returns the standard version the implementation of the POSIX 1003.1b

Monotonic Clock Option conforms to,

otherwise 0.

otherwise\ 0.

.It Li kern.mqueue

Settings related to

.Tn POSIX

message queues; see

.Xr mqueue 3 .

This node is created dynamically when

the corresponding kernel module is loaded.

The third level names for the settings are described below.

.Bl -column "kern.mqueue.mq_max_msgsize" "integer" "Changeable" -offset indent

.It Sy Third level name Type Changeable

.It kern.mqueue.mq_open_max integer yes

.It kern.mqueue.mq_prio_max integer yes

.It kern.mqueue.mq_max_msgsize integer yes

.It kern.mqueue.mq_def_maxmsg integer yes

.It kern.mqueue.mq_max_maxmsg integer yes

.El

.Pp

The variables are:

.Bl -tag -width "123456"

.It Li kern.mqueue.mq_open_max

The maximum number of message queue descriptors any single process can open.

.It Li kern.mqueue.mq_prio_max

The maximum priority of a message.

.It Li kern.mqueue.mq_max_msgsize

The maximum size of a message in a message queue.

.It Li kern.mqueue.mq_def_maxmsg

The default maximum message count.

.It Li kern.mqueue.mq_max_maxmsg

The maximum number of messages in a message queue.

.El

.It Li kern.msgbuf ( KERN_MSGBUF )

The kernel message buffer, rotated so that the head of the circular kernel

message buffer is at the start of the returned data.

Line 704 The maximum number of supplemental group

Line 774 The maximum number of supplemental group

.\" XXX: Undocumented.

.It Li kern.ntptime ( KERN_NTPTIME )

.Va struct ntptimeval

.Vt struct ntptimeval

structure is returned.

This structure contains data used by the

.Xr ntpd 8

Line 736 The variables are as follows:

Line 806 The variables are as follows:

.It Li kern.pipe.kvasiz ( KERN_PIPE_KVASIZ )

Amount of kernel memory consumed by pipe buffers.

.It Li kern.pipe.maxbigpipes ( KERN_PIPE_MAXBIGPIPES )

Maximum number of "big" pipes.

Maximum number of

.Dq big

pipes.

.It Li kern.pipe.maxkvasz ( KERN_PIPE_MAXKVASZ )

Maximum amount of kernel memory to be used for pipes.

.It Li kern.pipe.limitkva ( KERN_PIPE_LIMITKVA )

Limit for direct transfers via page loan.

.It Li kern.pipe.nbigpipes ( KERN_PIPE_NBIGPIPES )

Number of "big" pipes.

Number of

.Dq big

pipes.

.El

.\" XXX: Undocumented .It Li kern.posix ( ? )

.\" This is a node in which the only variable is semmax.

.It Li kern.posix1version ( KERN_POSIX1 )

The version of ISO/IEC 9945 (POSIX 1003.1) with which the system

attempts to comply.

.It Li kern.posix_aio

The version of

.St -p1003.1

and its Asynchronous I/O option to which the system attempts to conform.

.It Li kern.posix_barriers ( KERN_POSIX_BARRIERS )

The version of

.St -p1003.1

and its

Barriers

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.It Li kern.posix_reader_writer_locks ( KERN_POSIX_READER_WRITER_LOCKS )

The version of

.St -p1003.1

and its

Read-Write Locks

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.\".It Li kern.posix_sched

.\" XXX: Undocumented.

.It Li kern.posix_semaphores ( KERN_POSIX_SEMAPHORES )

Line 771 The version of

Line 849 The version of

and its

Semaphores

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.It Li kern.posix_spin_locks ( KERN_POSIX_SPIN_LOCKS )

The version of

.St -p1003.1

and its

Spin Locks

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.It Li kern.posix_threads ( KERN_POSIX_THREADS )

The version of

.St -p1003.1

and its

Threads

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.It Li kern.posix_timers ( KERN_POSIX_TIMERS )

The version of

.St -p1003.1

and its

Timers

option to which the system attempts to conform,

otherwise 0.

otherwise\ 0.

.It Li kern.proc ( KERN_PROC )

Return the entire process table, or a subset of it.

An array of

.Va struct kinfo_proc

.Vt struct kinfo_proc

structures is returned,

whose size depends on the current number of such objects in the system.

The third and fourth level numeric names are as follows:

Line 813 The third and fourth level numeric names

Line 891 The third and fourth level numeric names

.It KERN_PROC_UID A user ID

.El

.It Li kern.proc2 ( KERN_PROC2 )

As for KERN_PROC, but an array of

As for

.Va struct kinfo_proc2

.Dv KERN_PROC ,

but an array of

.Vt struct kinfo_proc2

structures are returned.

The fifth level name is the size of the

.Va struct kinfo_proc2

.Vt struct kinfo_proc2

and the sixth level name is the number of structures to return.

.It Li kern.proc_args ( KERN_PROC_ARGS )

Return the argv or environment strings (or the number thereof)

Line 834 The fourth level name is as follows:

Line 914 The fourth level name is as follows:

.It Li kern.profiling ( KERN_PROF )

Return profiling information about the kernel.

If the kernel is not compiled for profiling,

attempts to retrieve any of the KERN_PROF values will

attempts to retrieve any of the

fail with

.Dv KERN_PROF

values will fail with

.Er EOPNOTSUPP .

The third level names for the string and integer profiling information

is detailed below.

Line 860 Array indexed by program counter of call

Line 941 Array indexed by program counter of call

Structure giving the sizes of the above arrays.

.It Li kern.profiling.state ( GPROF_STATE )

Profiling state.

If set to GMON_PROF_ON, starts profiling.

If set to

If set to GMON_PROF_OFF, stops profiling.

.Dv GMON_PROF_ON ,

starts profiling.

If set to

.Dv GMON_PROF_OFF ,

stops profiling.

.It Li kern.profiling.tos ( GPROF_TOS )

Array of

.Va struct tostruct

.Vt struct tostruct

describing destination of calls and their counts.

.El

.\" .It Li kern.pset

Line 894 Maximum amount of kernel memory to be us

Line 979 Maximum amount of kernel memory to be us

.It Li kern.synchronized_io ( KERN_SYNCHRONIZED_IO )

Returns 1 if the POSIX 1003.1b Synchronized I/O Option is available

on this system,

otherwise 0.

otherwise\ 0.

.It Li kern.timecounter ( dynamic )

Display and control the timecounter source of the system.

.Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent

Line 942 The number of raw input characters.

Line 1027 The number of raw input characters.

.El

.It Li kern.urandom ( KERN_URND )

Random integer value.

.\".It Li kern.usercrypto

.It Li kern.usercrypto

.\" XXX: Undocumented.

When enabled, allows userland to

.\".It Li kern.userasymcrypto

.Xr open 2

.\" XXX: Undocumented.

the

.Pa /dev/crypto

special device, used by the

.Xr crypto 4

system.

.It Li kern.userasymcrypto

Enables or disables the use of software asymmetric crypto support in the

.Xr crypto 4

system.

.It Li kern.veriexec

Runtime information for

.Xr veriexec 8 .

Line 990 the system.

Line 1083 the system.

The returned data consists of an array whose size depends on the

current number of such objects in the system.

Each element of the array contains the kernel address of a vnode

.Va struct vnode *

.Vt struct vnode *

followed by the vnode itself

.Va struct vnode .

.Vt struct vnode .

.\" XXX kern.lwp

.\" XXX: Undocumented: kern.lwp: no children?

.El

.Sh The machdep.* subtree

.Ss The machdep.* subtree

The set of variables defined is architecture dependent.

Most architectures define at least the following variables.

.Bl -column "Second level name" "Type" "Changeable" -offset indent

.Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent

.It Sy Second level name Type Changeable

.It Li CPU_CONSDEV dev_t no

.It Li machdep.booted_kernel string no

.El

.Sh The net.* subtree

.\" XXX: Document the above.

.Ss The net.* subtree

The string and integer information available for the

.Li net

level is detailed below.

Line 1027 The data is returned as a sequence of ro

Line 1121 The data is returned as a sequence of ro

for the header file, format and meaning).

The length of each message is contained in the message header.

.Pp

The third level name is a protocol number, which is currently always 0.

The third level name is a protocol number, which is currently always\ 0.

The fourth level name is an address family, which may be set to 0 to

select all address families.

The fifth and sixth level names are as follows:

Line 1505 The number of IPv6 extension headers per

Line 1599 The number of IPv6 extension headers per

If set to 0, the node will accept as many extension headers as possible.

.It Li ip6.hashsize

The size of IPv6 Fast Forward hash table.

This value must be a power of 2 (64, 256...).

This value must be a power of 2 (64, 256, ...).

A larger hash table size results in fewer collisions.

Also see

.Li ip6.maxflows .

Line 1696 The variables are as follows:

Line 1790 The variables are as follows:

.It Li debug

Turn on debugging message from within the kernel.

The value is a bitmap, as defined in

.Pa /usr/include/netkey/key_debug.h .

.In netkey/key_debug.h .

.It Li spi_try

The number of times the kernel will try to obtain an unique SPI

when it generates it from random number generator.

Line 1727 The value is used when the kernel create

Line 1821 The value is used when the kernel create

on ACQUIRE PF_KEY message.

.El

.Sh The proc.* subtree

.Ss The proc.* subtree

The string and integer information available for the

.Li proc

level is detailed below.

Line 1755 The template used for the core dump file

Line 1849 The template used for the core dump file

.Xr core 5

for details).

The base name must either be

.Nm core

.Pa core

or end with the suffix ``.core'' (the super-user may set arbitrary names).

or end with the suffix

By default it points to KERN_DEFCORENAME.

.Pa .core

(the super-user may set arbitrary names).

By default it points to

.Dv KERN_DEFCORENAME .

.It Li proc.pid.rlimit ( PROC_PID_LIMIT )

Return resources limits, as defined for the

.Xr getrlimit 2

Line 1765 and

Line 1862 and

.Xr setrlimit 2

system calls.

The fourth level name is one of:

.Bl -tag -width PROC_PID_LIMIT_MEMLOCKAA

.Bl -tag -width "123456"

.It Li proc.pid.rlimit.cputime ( PROC_PID_LIMIT_CPU )

The maximum amount of CPU time (in seconds) to be used by each process.

.It Li proc.pid.rlimit.filesize ( PROC_PID_LIMIT_FSIZE )

Line 1809 options.

Line 1906 options.

.El

.Pp

The fifth level name is one of

.Li soft ( PROC_PID_LIMIT_TYPE_SOFT ) or

.Li soft ( PROC_PID_LIMIT_TYPE_SOFT )

.Li hard ( PROC_PID_LIMIT_TYPE_HARD ) ,

to select respectively the soft or hard limit.

Both are of type integer.

Line 1859 before it disappears.

Line 1957 before it disappears.

.Pp

This value is also inherited by the process's children.

.El

.Sh The user.* subtree ( CTL_USER )

.Ss The user.* subtree ( CTL_USER )

The string and integer information available for the

.Li user

level is detailed below.

Line 1927 The maximum length in bytes of a text-pr

Line 2025 The maximum length in bytes of a text-pr

line.

.It Li user.posix2_char_term ( USER_POSIX2_CHAR_TERM )

Return 1 if the system supports at least one terminal type capable of

all operations described in POSIX 1003.2, otherwise 0.

all operations described in POSIX 1003.2, otherwise\ 0.

.It Li user.posix2_c_bind ( USER_POSIX2_C_BIND )

Return 1 if the system's C-language development facilities support the

C-Language Bindings Option, otherwise 0.

C-Language Bindings Option, otherwise\ 0.

.It Li user.posix2_c_dev ( USER_POSIX2_C_DEV )

Return 1 if the system supports the C-Language Development Utilities Option,

otherwise 0.

otherwise\ 0.

.It Li user.posix2_fort_dev ( USER_POSIX2_FORT_DEV )

Return 1 if the system supports the FORTRAN Development Utilities Option,

otherwise 0.

otherwise\ 0.

.It Li user.posix2_fort_run ( USER_POSIX2_FORT_RUN )

Return 1 if the system supports the FORTRAN Runtime Utilities Option,

otherwise 0.

otherwise\ 0.

.It Li user.posix2_localedef ( USER_POSIX2_LOCALEDEF )

Return 1 if the system supports the creation of locales, otherwise 0.

Return 1 if the system supports the creation of locales, otherwise\ 0.

.It Li user.posix2_sw_dev ( USER_POSIX2_SW_DEV )

Return 1 if the system supports the Software Development Utilities Option,

otherwise 0.

otherwise\ 0.

.It Li user.posix2_upe ( USER_POSIX2_UPE )

Return 1 if the system supports the User Portability Utilities Option,

otherwise 0.

otherwise\ 0.

.It Li user.posix2_version ( USER_POSIX2_VERSION )

The version of POSIX 1003.2 with which the system attempts to comply.

.It Li user.re_dup_max ( USER_RE_DUP_MAX )

Line 1960 at any one time.

Line 2058 at any one time.

The minimum maximum number of types supported for the name of a

timezone.

.El

.Sh The vm.* subtree ( CTL_VM )

.Ss The vm.* subtree ( CTL_VM )

The string and integer information available for the

.Li vm

level is detailed below.

Line 2020 cached file data.

Line 2118 cached file data.

.It Li vm.loadavg ( VM_LOADAVG )

Return the load average history.

The returned data consists of a

.Va struct loadavg .

.Vt struct loadavg .

.It Li vm.maxslp ( VM_MAXSLP )

The value of the maxslp kernel global variable.

.It Li vm.vmmeter ( VM_METER )

Return system wide virtual memory statistics.

The returned data consists of a

.Va struct vmtotal .

.Vt struct vmtotal .

.It vm.user_va0_disable

A flag which controls whether user processes can map virtual address 0.

A flag which controls whether user processes can map virtual address\ 0.

.It Li vm.uspace ( VM_USPACE )

The number of bytes allocated for each kernel stack.

.It Li vm.uvmexp ( VM_UVMEXP )

Return system wide virtual memory statistics.

The returned data consists of a

.Va struct uvmexp .

.Vt struct uvmexp .

.It Li vm.uvmexp2 ( VM_UVMEXP2 )

Return system wide virtual memory statistics.

The returned data consists of a

.Va struct uvmexp_sysctl .

.Vt struct uvmexp_sysctl .

.\" XXX vm.idlezero

.El

.Sh The ddb.* subtree ( CTL_DDB )

.Ss The ddb.* subtree ( CTL_DDB )

The information available for the

.Li ddb

level is detailed below.

Line 2093 nodes are also available as variables fr

Line 2191 nodes are also available as variables fr

See

.Xr ddb 4

for more details.

.Sh The security.* subtree ( CTL_SECURITY )

.Ss The security.* subtree ( CTL_SECURITY )

The

.Li security

level contains various security-related settings for

the system.

The available second level names are:

.Bl -column "Second level name" "integer" "Changeable" -offset indent

.It Sy Second level name Type Changeable

.It Li security.curtain integer yes

.It Li security.models node not applicable

.It Li security.pax node not applicable

.El

.Pp

Available settings are detailed below.

.Pp

.Bl -tag -width "123456"

.It Li security.curtain

If non-zero, will filter return objects according to the user-id

If non-zero, will filter return objects according to the user

.Tn ID

requesting information about them, preventing from users any

access to objects they don't own.

access to objects they do not own.

.Pp

At the moment, it affects

.Xr ps 1 ,

Line 2135 For more information on any of the PaX f

Line 2242 For more information on any of the PaX f

.Xr paxctl 8

and

.Xr security 8 .

The available third and fourth level names are:

.Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \

-offset 2n

.It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable

.It Li security.pax.aslr.enabled integer yes

.\".It Li security.pax.aslr.exec_len integer yes

.It Li security.pax.aslr.global integer yes

.\".It Li security.pax.aslr.mmap_len integer yes

.\".It Li security.pax.aslr.stack_len integer yes

.It Li security.pax.mprotect.enabled integer yes

.It Li security.pax.mprotect.global integer yes

.It Li security.pax.segvguard.enabled integer yes

.It Li security.pax.segvguard.expiry_timeout integer yes

.It Li security.pax.segvguard.global integer yes

.It Li security.pax.segvguard.max_crashes integer yes

.It Li security.pax.segvguard.suspend_timeout integer yes

.El

.Pp

.Bl -tag -width "123456"

.It Li security.pax.aslr.enable

.It Li security.pax.aslr.enabled

Enable PaX ASLR (Address Space Layout Randomization).

.Pp

The value of this

knob must be non-zero for PaX ASLR to be enabled, even if a program is set to

explicit enable.

.\".It Li security.pax.aslr.exec_len

.\" XXX: Undocumented.

.It Li security.pax.aslr.global

Specifies the default global policy for programs without an

explicit enable/disable flag.

Line 2152 When non-zero, all programs will get PaX

Line 2278 When non-zero, all programs will get PaX

Otherwise, all programs will not get PaX ASLR, except those specifically

marked as such with

.Xr paxctl 8 .

.It Li security.pax.mprotect.enable

.\".It Li security.pax.aslr.mmap_len

.\" XXX: Undocumented.

.\" .It Li security.pax.aslr.stack_len

.\" XXX: Undocumented.

.It Li security.pax.mprotect.enabled

Enable PaX MPROTECT restrictions.

.Pp

These are

Line 2171 except those exempted with

Line 2301 except those exempted with

Otherwise, all programs will not get the PaX MPROTECT restrictions,

except those specifically marked as such with

.Xr paxctl 8 .

.It Li security.pax.segvguard.enable

.It Li security.pax.segvguard.enabled

Enable PaX Segvguard.

.Pp

PaX Segvguard can detect and prevent certain exploitation attempts, where

Line 2183 The

Line 2313 The

.Nx

interface and implementation of the Segvguard is still experimental, and may

change in future releases.

.It Li security.pax.segvguard.expiry_timeout

If the max number was not reached within this timeout (in seconds), the entry

will expire.

.It Li security.pax.segvguard.global

Specifies the default global policy for programs without an

explicit enable/disable flag.

Line 2193 except those exempted with

Line 2326 except those exempted with

Otherwise, no program will get the PaX Segvguard restrictions,

except those specifically marked as such with

.Xr paxctl 8 .

.It Li security.pax.segvguard.expiry_timeout

.It Li security.pax.segvguard.max_crashes

If the max number was not reached within this timeout (in seconds), the entry

The maximum number of segfaults a program can receive before suspension.

will expire.

.It Li security.pax.segvguard.suspend_timeout

Number of seconds to suspend a user from running a faulting program when the

limit was exceeded.

.It Li security.pax.segvguard.max_crashes

Max number of segfaults a program can receive before suspension.

.El

.Sh The vendor.* subtree ( CTL_VENDOR )

.Ss The vendor.* subtree ( CTL_VENDOR )

The

.Li vendor

toplevel name is reserved to be used by vendors who wish to

CVSweb <webmaster@jp.NetBSD.org>