Annotation of src/share/man/man7/sysctl.7, Revision 1.94
1.94 ! wiz 1: .\" $NetBSD: sysctl.7,v 1.93 2015/09/24 14:56:41 christos Exp $
1.1 pavel 2: .\"
3: .\" Copyright (c) 1993
4: .\" The Regents of the University of California. All rights reserved.
5: .\"
6: .\" Redistribution and use in source and binary forms, with or without
7: .\" modification, are permitted provided that the following conditions
8: .\" are met:
9: .\" 1. Redistributions of source code must retain the above copyright
10: .\" notice, this list of conditions and the following disclaimer.
11: .\" 2. Redistributions in binary form must reproduce the above copyright
12: .\" notice, this list of conditions and the following disclaimer in the
13: .\" documentation and/or other materials provided with the distribution.
14: .\" 3. Neither the name of the University nor the names of its contributors
15: .\" may be used to endorse or promote products derived from this software
16: .\" without specific prior written permission.
17: .\"
18: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28: .\" SUCH DAMAGE.
29: .\"
30: .\" @(#)sysctl.3 8.4 (Berkeley) 5/9/95
31: .\"
1.93 christos 32: .Dd September 24, 2015
1.1 pavel 33: .Dt SYSCTL 7
34: .Os
35: .Sh NAME
36: .Nm sysctl
37: .Nd system information variables
38: .Sh DESCRIPTION
39: The
40: .Xr sysctl 3
41: library function and the
42: .Xr sysctl 8
43: utility are used to get and set values of system variables, maintained
44: by the kernel.
45: The variables are organized in a tree and identified by a sequence of
46: numbers, conventionally separated by dots with the topmost identifier
47: at the left side.
48: The numbers have corresponding text names.
49: The
50: .Xr sysctlnametomib 3
51: function or the
52: .Fl M
53: argument to the
54: .Xr sysctl 8
55: utility can be used to convert the text representation to the
56: numeric one.
57: .Pp
58: The individual sysctl variables are described below, both the textual
59: and numeric form where applicable.
60: The textual names can be used as argument to the
61: .Xr sysctl 8
62: utility and in the file
63: .Pa /etc/sysctl.conf .
64: The numeric names are usually defined as preprocessor constants and
65: are intended for use by programs.
66: Every such constant expands to one integer, which identifies the
67: sysctl variable relative to the upper level of the tree.
68: See the
69: .Xr sysctl 3
70: manual page for programming examples.
1.50 jruoho 71: .Ss Top level names
1.56 uwe 72: The top level names are defined with a
73: .Va CTL_
74: prefix in
1.33 joerg 75: .In sys/sysctl.h ,
1.1 pavel 76: and are as follows.
77: The next and subsequent levels down are found in the include files
78: listed here, and described in separate sections below.
1.56 uwe 79: .Bl -column "security" ".Dv CTL_SECURITY" ".In uvm/uvm_param.h" "High kernel limits"
80: .It Sy Name Ta Sy Constant Ta Sy Next level names Ta Sy Description
81: .It kern Ta Dv CTL_KERN Ta In sys/sysctl.h Ta High kernel limits
82: .It vm Ta Dv CTL_VM Ta In uvm/uvm_param.h Ta Virtual memory
83: .It vfs Ta Dv CTL_VFS Ta In sys/mount.h Ta Filesystem
84: .It net Ta Dv CTL_NET Ta In sys/socket.h Ta Networking
85: .It debug Ta Dv CTL_DEBUG Ta In sys/sysctl.h Ta Debugging
86: .It hw Ta Dv CTL_HW Ta In sys/sysctl.h Ta Generic CPU, I/O
87: .It machdep Ta Dv CTL_MACHDEP Ta In sys/sysctl.h Ta Machine dependent
88: .It user Ta Dv CTL_USER Ta In sys/sysctl.h Ta User-level
89: .It ddb Ta Dv CTL_DDB Ta In sys/sysctl.h Ta In-kernel debugger
90: .It proc Ta Dv CTL_PROC Ta In sys/sysctl.h Ta Per-process
91: .It vendor Ta Dv CTL_VENDOR Ta ? Ta Vendor specific
92: .It emul Ta Dv CTL_EMUL Ta In sys/sysctl.h Ta Emulation settings
93: .It security Ta Dv CTL_SECURITY Ta In sys/sysctl.h Ta Security settings
1.1 pavel 94: .El
1.50 jruoho 95: .Ss The debug.* subtree
1.1 pavel 96: The debugging variables vary from system to system.
97: A debugging variable may be added or deleted without need to recompile
98: .Nm
99: to know about it.
100: Each time it runs,
101: .Nm
102: gets the list of debugging variables from the kernel and
103: displays their current values.
104: The system defines twenty
1.56 uwe 105: .Vt ( struct ctldebug )
1.1 pavel 106: variables named
107: .Dv debug0
108: through
109: .Dv debug19 .
110: They are declared as separate variables so that they can be
111: individually initialized at the location of their associated variable.
112: The loader prevents multiple use of the same variable by issuing errors
113: if a variable is initialized in more than one place.
114: For example, to export the variable
1.56 uwe 115: .Va dospecialcheck
1.1 pavel 116: as a debugging variable, the following declaration would be used:
1.43 jruoho 117: .Pp
1.1 pavel 118: .Bd -literal -offset indent -compact
119: int dospecialcheck = 1;
120: struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck };
121: .Ed
122: .Pp
123: Note that the dynamic implementation of
124: .Nm
125: currently in use largely makes this particular
126: .Nm
127: interface obsolete.
128: See
129: .Xr sysctl 8
130: .\" and
131: .\" .Xr sysctl 9
132: for more information.
1.50 jruoho 133: .Ss The vfs.* subtree
1.1 pavel 134: A distinguished second level name,
1.91 kamil 135: .Li vfs.generic ( Dv VFS_GENERIC ) ,
1.57 wiz 136: is used to get general information about all file systems.
1.26 elad 137: It has the following third level identifiers:
1.56 uwe 138: .Bl -tag -width "123456"
1.91 kamil 139: .It Li vfs.generic.maxtypenum ( Dv VFS_MAXTYPENUM )
1.57 wiz 140: The highest valid file system type number.
1.91 kamil 141: .It Li vfs.generic.conf ( Dv VFS_CONF )
1.57 wiz 142: Returns configuration information about the file system type given as a fourth
1.26 elad 143: level identifier.
1.91 kamil 144: .It Li vfs.generic.usermount ( Dv VFS_USERMOUNT )
1.68 jym 145: Determines if non superuser mounts are allowed, defaults to
1.59 christos 146: .Dv 0 .
1.91 kamil 147: .It Li vfs.generic.magiclinks ( Dv VFS_MAGICLINKS )
1.59 christos 148: Controls if expansion of variables is going to be performed on pathnames
149: or not.
150: Defaults to no variable expansion,
151: .Dv 0 .
152: Variables are of the form
153: .Li @name
1.60 christos 154: and the variables supported are described in
155: .Xr symlink 7
156: under
157: .Dq "MAGIC SYMLINKS" .
1.26 elad 158: .El
159: .Pp
1.54 christos 160: A second level name for controlling the
161: .Xr wapbl 4
162: (Write Ahead Physical Block Logging file system journalling)
163: capabilities with the following third level identifiers:
1.56 uwe 164: .Bl -tag -width "123456"
165: .It Li vfs.wapbl.flush_disk_cache
1.55 wiz 166: Controls whether to attempt to flush the disk cache on each commit.
1.77 apb 167: It defaults to 1 and it should always be on to ensure integrity
168: of file system metadata in the event of a power loss.
1.54 christos 169: For slow disks, turning it off can improve performance.
1.56 uwe 170: .It Li vfs.wapbl.verbose_commit
1.55 wiz 171: For each transaction log commit, print the number of bytes written
172: and the time it took to commit as seconds.nanoseconds.
1.54 christos 173: .El
174: .Pp
1.57 wiz 175: The remaining second level identifiers are the file system names, identified
1.26 elad 176: by the type number returned by a
1.1 pavel 177: .Xr statvfs 2
178: call or from
1.27 wiz 179: .Li vfs.generic.conf .
1.56 uwe 180: .Pp
1.57 wiz 181: The third level identifiers available for each file system
1.1 pavel 182: are given in the header file that defines the mount
1.57 wiz 183: argument structure for that file system.
1.50 jruoho 184: .Ss The hw.* subtree
1.1 pavel 185: The string and integer information available for the
186: .Li hw
187: level is detailed below.
188: The changeable column shows whether a process with appropriate
189: privilege may change the value.
1.37 jruoho 190: .Bl -column "hw.machine_arch" "integer" "Changeable" -offset indent
1.92 wiz 191: .It Sy Second level name Sy Type Sy Changeable
1.1 pavel 192: .It hw.alignbytes integer no
193: .It hw.byteorder integer no
194: .It hw.cnmagic string yes
195: .It hw.disknames string no
196: .It hw.diskstats struct no
197: .It hw.machine string no
198: .It hw.machine_arch string no
199: .It hw.model string no
200: .It hw.ncpu integer no
1.84 njoly 201: .It hw.ncpuonline integer no
1.1 pavel 202: .It hw.pagesize integer no
203: .It hw.physmem integer no
204: .It hw.physmem64 quad no
205: .It hw.usermem integer no
206: .It hw.usermem64 quad no
207: .El
208: .Bl -tag -width "123456"
1.91 kamil 209: .It Li hw.alignbytes ( Dv HW_ALIGNBYTES )
1.1 pavel 210: Alignment constraint for all possible data types.
211: This shows the value
212: .Dv ALIGNBYTES
213: in
1.56 uwe 214: .In machine/param.h ,
1.1 pavel 215: at the kernel compilation time.
1.91 kamil 216: .It Li hw.byteorder ( Dv HW_BYTEORDER )
1.56 uwe 217: The byteorder (4321, or 1234).
1.91 kamil 218: .It Li hw.cnmagic ( Dv HW_CNMAGIC )
1.1 pavel 219: The console magic key sequence.
1.91 kamil 220: .It Li hw.disknames ( Dv HW_DISKNAMES )
1.1 pavel 221: The list of (space separated) disk device names on the system.
1.91 kamil 222: .It Li hw.iostatnames ( Dv HW_IOSTATNAMES )
1.1 pavel 223: A space separated list of devices that will have I/O statistics
224: collected on them.
1.91 kamil 225: .It Li hw.iostats ( Dv HW_IOSTATS )
1.1 pavel 226: Return statistical information on the NFS mounts, disk and tape
227: devices on the system.
228: An array of
1.56 uwe 229: .Vt struct io_sysctl
1.1 pavel 230: structures is returned,
231: whose size depends on the current number of such objects in the system.
232: The third level name is the size of the
1.56 uwe 233: .Vt struct io_sysctl .
1.1 pavel 234: The type of object can be determined by examining the
235: .Va type
236: element of
1.56 uwe 237: .Vt struct io_sysctl .
1.1 pavel 238: Which can be
239: .Dv IOSTAT_DISK
240: (disk drive),
241: .Dv IOSTAT_TAPE
242: (tape drive), or
243: .Dv IOSTAT_NFS
244: (NFS mount).
1.91 kamil 245: .It Li hw.machine ( Dv HW_MACHINE )
1.1 pavel 246: The machine class.
1.91 kamil 247: .It Li hw.machine_arch ( Dv HW_MACHINE_ARCH )
1.1 pavel 248: The machine CPU class.
1.91 kamil 249: .It Li hw.model ( Dv HW_MODEL )
1.1 pavel 250: The machine model.
1.91 kamil 251: .It Li hw.ncpu ( Dv HW_NCPU )
1.84 njoly 252: The number of CPUs configured.
1.91 kamil 253: .It Li hw.ncpuonline ( Dv HW_NCPUONLINE )
1.84 njoly 254: The number of CPUs online.
1.91 kamil 255: .It Li hw.pagesize ( Dv HW_PAGESIZE )
1.1 pavel 256: The software page size.
1.91 kamil 257: .It Li hw.physmem ( Dv HW_PHYSMEM )
1.1 pavel 258: The bytes of physical memory as a 32-bit integer.
1.91 kamil 259: .It Li hw.physmem64 ( Dv HW_PHYSMEM64 )
1.1 pavel 260: The bytes of physical memory as a 64-bit integer.
1.91 kamil 261: .It Li hw.usermem ( Dv HW_USERMEM )
1.1 pavel 262: The bytes of non-kernel memory as a 32-bit integer.
1.91 kamil 263: .It Li hw.usermem64 ( Dv HW_USERMEM64 )
1.1 pavel 264: The bytes of non-kernel memory as a 64-bit integer.
265: .El
1.50 jruoho 266: .Ss The kern.* subtree
1.43 jruoho 267: This subtree includes data generally related to the kernel.
1.1 pavel 268: The string and integer information available for the
269: .Li kern
270: level is detailed below.
271: The changeable column shows whether a process with appropriate
272: privilege may change the value.
1.43 jruoho 273: .Bl -column "kern.posix_reader_writer_locks" \
274: "struct kinfo_drivers" "not applicable"
1.92 wiz 275: .It Sy Second level name Sy Type Sy Changeable
1.51 jruoho 276: .It kern.aio_listio_max integer yes
277: .It kern.aio_max integer yes
1.44 jruoho 278: .It kern.arandom integer no
1.1 pavel 279: .It kern.argmax integer no
1.39 jruoho 280: .It kern.boothowto integer no
1.1 pavel 281: .It kern.boottime struct timeval no
1.85 apb 282: .It kern.buildinfo string no
1.39 jruoho 283: .\".It kern.bufq node not applicable
1.1 pavel 284: .It kern.ccpu integer no
285: .It kern.clockrate struct clockinfo no
286: .It kern.consdev integer no
1.39 jruoho 287: .It kern.coredump node not applicable
1.21 joerg 288: .It kern.cp_id struct no
289: .It kern.cp_time uint64_t[\|] no
1.46 jruoho 290: .It kern.cryptodevallowsoft integer yes
1.1 pavel 291: .It kern.defcorename string yes
1.38 jruoho 292: .It kern.detachall integer yes
1.1 pavel 293: .It kern.domainname string yes
294: .It kern.drivers struct kinfo_drivers no
1.39 jruoho 295: .It kern.dump_on_panic integer yes
1.1 pavel 296: .It kern.file struct file no
297: .It kern.forkfsleep integer yes
298: .It kern.fscale integer no
299: .It kern.fsync integer no
1.21 joerg 300: .It kern.hardclock_ticks integer no
1.1 pavel 301: .It kern.hostid integer yes
302: .It kern.hostname string yes
1.21 joerg 303: .It kern.iov_max integer no
1.39 jruoho 304: .It kern.ipc node not applicable
1.21 joerg 305: .It kern.job_control integer no
1.1 pavel 306: .It kern.labeloffset integer no
307: .It kern.labelsector integer no
1.21 joerg 308: .It kern.login_name_max integer no
1.1 pavel 309: .It kern.logsigexit integer yes
1.21 joerg 310: .It kern.mapped_files integer no
1.1 pavel 311: .It kern.maxfiles integer yes
1.70 christos 312: .It kern.maxlwp integer yes
1.1 pavel 313: .It kern.maxpartitions integer no
314: .It kern.maxphys integer no
315: .It kern.maxproc integer yes
316: .It kern.maxptys integer yes
317: .It kern.maxvnodes integer yes
318: .It kern.mbuf node not applicable
319: .It kern.memlock integer no
1.21 joerg 320: .It kern.memlock_range integer no
321: .It kern.memory_protection integer no
1.42 jruoho 322: .It kern.module node not applicable
1.21 joerg 323: .It kern.monotonic_clock integer no
1.49 jruoho 324: .It kern.mqueue node not applicable
1.1 pavel 325: .It kern.msgbuf integer no
326: .It kern.msgbufsize integer no
327: .It kern.ngroups integer no
1.41 jruoho 328: .\".It kern.no_sa_support integer yes
1.1 pavel 329: .It kern.ntptime struct ntptimeval no
330: .It kern.osrelease string no
1.39 jruoho 331: .It kern.osrevision integer no
1.1 pavel 332: .It kern.ostype string no
1.41 jruoho 333: .\".It kern.panic_now integer yes
1.1 pavel 334: .It kern.pipe node not applicable
1.82 joerg 335: .It kern.pool struct pool_sysctl no
1.39 jruoho 336: .\" .It kern.posix node not applicable
337: .It kern.posix1version integer no
1.51 jruoho 338: .It kern.posix_aio integer no
1.21 joerg 339: .It kern.posix_barriers integer no
340: .It kern.posix_reader_writer_locks integer no
1.39 jruoho 341: .\".It kern.posix_sched integer yes
1.21 joerg 342: .It kern.posix_semaphores integer no
343: .It kern.posix_spin_locks integer no
344: .It kern.posix_threads integer no
345: .It kern.posix_timers integer no
1.1 pavel 346: .It kern.proc struct kinfo_proc no
347: .It kern.proc2 struct kinfo_proc2 no
1.21 joerg 348: .It kern.proc_args string no
1.39 jruoho 349: .It kern.profiling node not applicable
1.41 jruoho 350: .\".It kern.pset node not applicable
1.1 pavel 351: .It kern.rawpartition integer no
1.21 joerg 352: .It kern.root_device string no
353: .It kern.root_partition integer no
354: .It kern.rtc_offset integer yes
355: .It kern.saved_ids integer no
1.39 jruoho 356: .It kern.sbmax integer yes
1.41 jruoho 357: .\".It kern.sched node not applicable
1.1 pavel 358: .It kern.securelevel integer raise only
1.39 jruoho 359: .It kern.somaxkva integer yes
1.21 joerg 360: .It kern.synchronized_io integer no
1.19 christos 361: .It kern.timecounter node not applicable
1.1 pavel 362: .It kern.timex struct no
363: .It kern.tkstat node not applicable
1.66 christos 364: .It kern.tty node not applicable
1.1 pavel 365: .It kern.urandom integer no
1.45 jruoho 366: .It kern.usercrypto integer yes
367: .It kern.userasymcrypto integer yes
1.39 jruoho 368: .It kern.veriexec node not applicable
1.1 pavel 369: .It kern.version string no
370: .It kern.vnode struct vnode no
371: .El
372: .Bl -tag -width "123456"
1.51 jruoho 373: .It Li kern.aio_listio_max
374: The maximum number of asynchronous
375: .Tn I/O
376: operations in a single list I/O call.
377: Like with all variables related to
378: .Xr aio 3 ,
379: the variable may be created and removed dynamically
380: upon loading or unloading the corresponding kernel module.
381: .It Li kern.aio_max
382: The maximum number of asynchronous I/O operations.
1.44 jruoho 383: .It Li kern.arandom
384: This variable picks a random number each time it is queried.
385: The used random number generator
1.56 uwe 386: .Pf ( Tn RNG )
1.44 jruoho 387: is based on
388: .Xr arc4random 3 .
1.91 kamil 389: .It Li kern.argmax ( Dv KERN_ARGMAX )
1.1 pavel 390: The maximum bytes of argument to
391: .Xr execve 2 .
1.23 apb 392: .It Li kern.boothowto
393: Flags passed from the boot loader; see
394: .Xr reboot 2
395: for the meanings of the flags.
1.91 kamil 396: .It Li kern.boottime ( Dv KERN_BOOTTIME )
1.1 pavel 397: A
1.56 uwe 398: .Vt struct timeval
1.1 pavel 399: structure is returned.
400: This structure contains the time that the system was booted.
1.85 apb 401: .It Li kern.buildinfo
402: When the kernel is built, the build environment may optionally provide
403: arbitrary information to be stored in this variable.
1.41 jruoho 404: .\" .It Li kern.bufq
405: .\" XXX: Undocumented.
1.91 kamil 406: .It Li kern.ccpu ( Dv KERN_CCPU )
1.1 pavel 407: The scheduler exponential decay value.
1.91 kamil 408: .It Li kern.clockrate ( Dv KERN_CLOCKRATE )
1.1 pavel 409: A
1.56 uwe 410: .Vt struct clockinfo
1.1 pavel 411: structure is returned.
412: This structure contains the clock, statistics clock and profiling clock
413: frequencies, the number of micro-seconds per hz tick, and the clock
414: skew rate.
1.36 jruoho 415: Refer to
416: .Xr hz 9
417: for additional details.
1.91 kamil 418: .It Li kern.consdev ( Dv KERN_CONSDEV )
1.1 pavel 419: Console device.
1.39 jruoho 420: .It Li kern.coredump
421: Settings related to set-id processes coredumps.
422: By default, set-id processes do not dump core in situations where
423: other processes would.
424: The settings in this node allows an administrator to change this
425: behavior.
426: .Pp
427: The third level name is
428: .Dv kern.coredump.setid
1.40 jruoho 429: and fourth level variables are described below.
430: .Bl -column "kern.coredump.setid.group" "integer" "Changeable" -offset indent
1.92 wiz 431: .It Sy Fourth level name Sy Type Sy Changeable
1.40 jruoho 432: .It kern.coredump.setid.dump integer yes
433: .It kern.coredump.setid.group integer yes
434: .It kern.coredump.setid.mode integer yes
435: .It kern.coredump.setid.owner integer yes
436: .It kern.coredump.setid.path string yes
437: .El
1.39 jruoho 438: .Bl -tag -width "123456"
439: .It Li kern.coredump.setid.dump
440: If non-zero, set-id processes will dump core.
441: .It Li kern.coredump.setid.group
442: The group-id for the set-id processes' coredump.
443: .It Li kern.coredump.setid.mode
444: The mode for the set-id processes' coredump.
445: See
446: .Xr chmod 1 .
447: .It Li kern.coredump.setid.owner
448: The user-id that will be used as the owner of the set-id processes'
449: coredump.
450: .It Li kern.coredump.setid.path
451: The path to which set-id processes' coredumps will be saved to.
452: Same syntax as kern.defcorename.
453: .El
1.91 kamil 454: .It Li kern.cp_id ( Dv KERN_CP_ID )
1.1 pavel 455: Mapping of CPU number to CPU id.
1.91 kamil 456: .It Li kern.cp_time ( Dv KERN_CP_TIME )
1.56 uwe 457: Returns an array of
458: .Dv CPUSTATES
459: .Vt uint64_t Ns s.
1.1 pavel 460: This array contains the
461: number of clock ticks spent in different CPU states.
462: On multi-processor systems, the sum across all CPUs is returned unless
463: appropriate space is given for one data set for each CPU.
464: Data for a specific CPU can also be obtained by adding the number of the
465: CPU at the end of the MIB, enlarging it by one.
1.46 jruoho 466: .It Li kern.cryptodevallowsoft
467: This variable controls userland access to hardware versus software transforms
468: in the
469: .Xr crypto 4
470: system.
471: The available values are as follows:
1.47 wiz 472: .Bl -tag -width XX0 -offset indent
473: .It Dv \*[Lt] 0
1.46 jruoho 474: Always force userlevel requests to use software transforms.
475: .It Dv = 0
476: If present, use hardware and grant userlevel requests for
477: non-accelerated transforms (handling the latter in software).
1.47 wiz 478: .It Dv \*[Gt] 0
1.46 jruoho 479: Allow user requests only for transforms which are hardware-accelerated.
480: .El
1.91 kamil 481: .It Li kern.defcorename ( Dv KERN_DEFCORENAME )
1.1 pavel 482: Default template for the name of core dump files (see also
483: .Li proc.pid.corename
484: in the per-process variables
485: .Li proc.* ,
486: and
487: .Xr core 5
488: for format of this template).
489: The default value is
1.56 uwe 490: .Pa %n.core
1.1 pavel 491: and can be changed with the kernel configuration option
492: .Cd options DEFCORENAME
493: (see
494: .Xr options 4
495: ).
1.38 jruoho 496: .It Li kern.detachall
497: Detach all devices at shutdown.
1.91 kamil 498: .It Li kern.domainname ( Dv KERN_DOMAINNAME )
1.1 pavel 499: Get or set the YP domain name.
1.91 kamil 500: .It Li kern.drivers ( Dv KERN_DRIVERS )
1.1 pavel 501: Return an array of
1.56 uwe 502: .Vt struct kinfo_drivers
1.1 pavel 503: that contains the name and major device numbers of all the device drivers
504: in the current kernel.
505: The
506: .Va d_name
507: field is always a NUL terminated string.
508: The
509: .Va d_bmajor
510: field will be set to \-1 if the driver doesn't have a block device.
1.91 kamil 511: .It Li kern.dump_on_panic ( Dv KERN_DUMP_ON_PANIC )
1.41 jruoho 512: Perform a crash dump on system
513: .Xr panic 9 .
1.91 kamil 514: .It Li kern.file ( Dv KERN_FILE )
1.1 pavel 515: Return the entire file table.
516: The returned data consists of a single
1.56 uwe 517: .Vt struct filelist
1.1 pavel 518: followed by an array of
1.56 uwe 519: .Vt struct file ,
1.1 pavel 520: whose size depends on the current number of such objects in the system.
1.91 kamil 521: .It Li kern.forkfsleep ( Dv KERN_FORKFSLEEP )
1.1 pavel 522: If
523: .Xr fork 2
524: system call fails due to limit on number of processes (either
525: the global maxproc limit or user's one), wait for this many
526: milliseconds before returning
527: .Er EAGAIN
528: error to process.
529: Useful to keep heavily forking runaway processes in bay.
530: Default zero (no sleep).
531: Maximum is 20 seconds.
1.91 kamil 532: .It Li kern.fscale ( Dv KERN_FSCALE )
1.1 pavel 533: The kernel fixed-point scale factor.
1.91 kamil 534: .It Li kern.fsync ( Dv KERN_FSYNC )
1.58 wiz 535: Return 1 if the
536: .St -p1003.1b-93
537: File Synchronization Option is available
1.1 pavel 538: on this system,
1.56 uwe 539: otherwise\ 0.
1.91 kamil 540: .It Li kern.hardclock_ticks ( Dv KERN_HARDCLOCK_TICKS )
1.1 pavel 541: Returns the number of
542: .Xr hardclock 9
543: ticks.
1.91 kamil 544: .It Li kern.hostid ( Dv KERN_HOSTID )
1.39 jruoho 545: Get or set the host identifier.
546: This is aimed to replace the legacy
547: .Xr gethostid 3
548: and
549: .Xr sethostid 3
550: system calls.
1.91 kamil 551: .It Li kern.hostname ( Dv KERN_HOSTNAME )
1.39 jruoho 552: Get or set the
553: .Xr hostname 1 .
1.91 kamil 554: .It Li kern.iov_max ( Dv KERN_IOV_MAX )
1.1 pavel 555: Return the maximum number of
1.56 uwe 556: .Vt iovec
1.1 pavel 557: structures that a process has available for use with
558: .Xr preadv 2 ,
559: .Xr pwritev 2 ,
560: .Xr readv 2 ,
561: .Xr recvmsg 2 ,
562: .Xr sendmsg 2
563: and
564: .Xr writev 2 .
1.91 kamil 565: .It Li kern.ipc ( Dv KERN_SYSVIPC )
1.39 jruoho 566: Return information about the SysV IPC parameters.
567: The third level names for the ipc variables are detailed below.
568: .Bl -column "kern.ipc.shm_use_phys" "integer" "Changeable" -offset indent
1.92 wiz 569: .It Sy Third level name Sy Type Sy Changeable
1.39 jruoho 570: .It kern.ipc.sysvmsg integer no
571: .It kern.ipc.sysvsem integer no
572: .It kern.ipc.sysvshm integer no
573: .It kern.ipc.sysvipc_info struct no
574: .It kern.ipc.shmmax integer yes
575: .It kern.ipc.shmmni integer yes
576: .It kern.ipc.shmseg integer yes
577: .It kern.ipc.shmmaxpgs integer yes
578: .It kern.ipc.shm_use_phys integer yes
579: .It kern.ipc.msgmni integer yes
580: .It kern.ipc.msgseg integer yes
581: .It kern.ipc.semmni integer yes
582: .It kern.ipc.semmns integer yes
583: .It kern.ipc.semmnu integer yes
584: .El
585: .Bl -tag -width "123456"
1.91 kamil 586: .It Li kern.ipc.sysvmsg ( Dv KERN_SYSVIPC_MSG )
1.39 jruoho 587: Returns 1 if System V style message queue functionality is available
588: on this system,
1.56 uwe 589: otherwise\ 0.
1.91 kamil 590: .It Li kern.ipc.sysvsem ( Dv KERN_SYSVIPC_SEM )
1.39 jruoho 591: Returns 1 if System V style semaphore functionality is available
592: on this system,
1.56 uwe 593: otherwise\ 0.
1.91 kamil 594: .It Li kern.ipc.sysvshm ( Dv KERN_SYSVIPC_SHM )
1.39 jruoho 595: Returns 1 if System V style share memory functionality is available
596: on this system,
1.56 uwe 597: otherwise\ 0.
1.91 kamil 598: .It Li kern.ipc.sysvipc_info ( Dv KERN_SYSVIPC_INFO )
1.39 jruoho 599: Return System V style IPC configuration and run-time information.
600: The fourth level name selects the System V style IPC facility.
601: .Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent
1.92 wiz 602: .It Sy Fourth level name Sy Type
1.39 jruoho 603: .It KERN_SYSVIPC_MSG_INFO struct msg_sysctl_info
604: .It KERN_SYSVIPC_SEM_INFO struct sem_sysctl_info
605: .It KERN_SYSVIPC_SHM_INFO struct shm_sysctl_info
606: .El
607: .Bl -tag -width "123456"
608: .It Li KERN_SYSVIPC_MSG_INFO
609: Return information on the System V style message facility.
610: The
611: .Sy msg_sysctl_info
612: structure is defined in
613: .In sys/msg.h .
614: .It Li KERN_SYSVIPC_SEM_INFO
615: Return information on the System V style semaphore facility.
616: The
617: .Sy sem_sysctl_info
618: structure is defined in
619: .In sys/sem.h .
620: .It Li KERN_SYSVIPC_SHM_INFO
621: Return information on the System V style shared memory facility.
622: The
623: .Sy shm_sysctl_info
624: structure is defined in
625: .In sys/shm.h .
626: .El
1.91 kamil 627: .It Li kern.ipc.shmmax ( Dv KERN_SYSVIPC_SHMMAX )
1.39 jruoho 628: Max shared memory segment size in bytes.
1.91 kamil 629: .It Li kern.ipc.shmmni ( Dv KERN_SYSVIPC_SHMMNI )
1.39 jruoho 630: Max number of shared memory identifiers.
1.91 kamil 631: .It Li kern.ipc.shmseg ( Dv KERN_SYSVIPC_SHMSEG )
1.39 jruoho 632: Max shared memory segments per process.
1.91 kamil 633: .It Li kern.ipc.shmmaxpgs ( Dv KERN_SYSVIPC_SHMMAXPGS )
1.39 jruoho 634: Max amount of shared memory in pages.
1.91 kamil 635: .It Li kern.ipc.shm_use_phys ( Dv KERN_SYSVIPC_SHMUSEPHYS )
1.39 jruoho 636: Locking of shared memory in physical memory.
637: If 0, memory can be swapped
638: out, otherwise it will be locked in physical memory.
639: .It Li kern.ipc.msgmni
640: Max number of message queue identifiers.
641: .It Li kern.ipc.msgseg
642: Max number of number of message segments.
643: .It Li kern.ipc.semmni
644: Max number of number of semaphore identifiers.
645: .It Li kern.ipc.semmns
646: Max number of number of semaphores in system.
647: .It Li kern.ipc.semmnu
648: Max number of undo structures in system.
649: .El
1.91 kamil 650: .It Li kern.job_control ( Dv KERN_JOB_CONTROL )
1.56 uwe 651: Return 1 if job control is available on this system, otherwise\ 0.
1.91 kamil 652: .It Li kern.labeloffset ( Dv KERN_LABELOFFSET )
1.56 uwe 653: The offset within the sector specified by
654: .Dv KERN_LABELSECTOR
655: of the
1.1 pavel 656: .Xr disklabel 5 .
1.91 kamil 657: .It Li kern.labelsector ( Dv KERN_LABELSECTOR )
1.1 pavel 658: The sector number containing the
659: .Xr disklabel 5 .
1.91 kamil 660: .It Li kern.login_name_max ( Dv KERN_LOGIN_NAME_MAX )
1.1 pavel 661: The size of the storage required for a login name, in bytes,
662: including the terminating NUL.
1.91 kamil 663: .It Li kern.logsigexit ( Dv KERN_LOGSIGEXIT )
1.1 pavel 664: If this flag is non-zero, the kernel will
665: .Xr log 9
666: all process exits due to signals which create a
667: .Xr core 5
668: file, and whether the coredump was created.
1.91 kamil 669: .It Li kern.mapped_files ( Dv KERN_MAPPED_FILES )
1.58 wiz 670: Returns 1 if the
671: .St -p1003.1b-93
672: Memory Mapped Files Option is available on this system,
1.56 uwe 673: otherwise\ 0.
1.91 kamil 674: .It Li kern.maxfiles ( Dv KERN_MAXFILES )
1.1 pavel 675: The maximum number of open files that may be open in the system.
1.91 kamil 676: .It Li kern.maxpartitions ( Dv KERN_MAXPARTITIONS )
1.1 pavel 677: The maximum number of partitions allowed per disk.
1.71 wiz 678: .It Li kern.maxlwp
1.70 christos 679: The maximum number of Lightweight Processes (threads) the system allows
680: per uid.
1.91 kamil 681: .It Li kern.maxphys ( Dv KERN_MAXPHYS )
1.1 pavel 682: Maximum raw I/O transfer size.
1.91 kamil 683: .It Li kern.maxproc ( Dv KERN_MAXPROC )
1.1 pavel 684: The maximum number of simultaneous processes the system will allow.
1.91 kamil 685: .It Li kern.maxptys ( Dv KERN_MAXPTYS )
1.1 pavel 686: The maximum number of pseudo terminals.
687: This value can be both raised and lowered, though it cannot
688: be set lower than number of currently used ptys.
689: See also
690: .Xr pty 4 .
1.91 kamil 691: .It Li kern.maxvnodes ( Dv KERN_MAXVNODES )
1.1 pavel 692: The maximum number of vnodes available on the system.
693: This can only be raised.
1.91 kamil 694: .It Li kern.mbuf ( Dv KERN_MBUF )
1.1 pavel 695: Return information about the mbuf control variables.
696: Mbufs are data structures which store network packets and other data
697: structures in the networking code, see
698: .Xr mbuf 9 .
699: The third level names for the mbuf variables are detailed below.
700: The changeable column shows whether a process with appropriate
701: privilege may change the value.
1.21 joerg 702: .Bl -column "kern.mbuf.nmbclusters" "integer" "Changeable" -offset indent
1.92 wiz 703: .It Sy Third level name Sy Type Sy Changeable
1.1 pavel 704: .\" XXX Changeable? really?
705: .It kern.mbuf.mblowat integer yes
706: .It kern.mbuf.mclbytes integer yes
707: .It kern.mbuf.mcllowat integer yes
708: .It kern.mbuf.msize integer yes
709: .It kern.mbuf.nmbclusters integer yes
710: .El
711: .Pp
712: The variables are as follows:
713: .Bl -tag -width "123456"
1.91 kamil 714: .It Li kern.mbuf.mblowat ( Dv MBUF_MBLOWAT )
1.1 pavel 715: The mbuf low water mark.
1.91 kamil 716: .It Li kern.mbuf.mclbytes ( Dv MBUF_MCLBYTES )
1.1 pavel 717: The mbuf cluster size.
1.91 kamil 718: .It Li kern.mbuf.mcllowat ( Dv MBUF_MCLLOWAT )
1.1 pavel 719: The mbuf cluster low water mark.
1.91 kamil 720: .It Li kern.mbuf.msize ( Dv MBUF_MSIZE )
1.1 pavel 721: The mbuf base size.
1.91 kamil 722: .It Li kern.mbuf.nmbclusters ( Dv MBUF_NMBCLUSTERS )
1.1 pavel 723: The limit on the number of mbuf clusters.
724: The variable can only be increased, and only increased on machines with
725: direct-mapped pool pages.
726: .El
1.91 kamil 727: .It Li kern.memlock ( Dv KERN_MEMLOCK )
1.58 wiz 728: Returns 1 if the
729: .St -p1003.1b-93
730: Process Memory Locking Option is available on this system,
1.56 uwe 731: otherwise\ 0.
1.91 kamil 732: .It Li kern.memlock_range ( Dv KERN_MEMLOCK_RANGE )
1.58 wiz 733: Returns 1 if the
734: .St -p1003.1b-93
735: Range Memory Locking Option is available on this system,
1.56 uwe 736: otherwise\ 0.
1.91 kamil 737: .It Li kern.memory_protection ( Dv KERN_MEMORY_PROTECTION )
1.58 wiz 738: Returns 1 if the
739: .St -p1003.1b-93
740: Memory Protection Option is available on this system,
1.56 uwe 741: otherwise\ 0.
1.42 jruoho 742: .It Li kern.module
743: Settings related to kernel modules.
744: The third level names for the settings are described below.
745: .Bl -column "kern.module.autoload" "integer" "Changeable" -offset indent
1.92 wiz 746: .It Sy Third level name Sy Type Sy Changeable
1.42 jruoho 747: .It kern.module.autoload integer yes
1.78 pgoyette 748: .It kern.module.autotime integer yes
1.42 jruoho 749: .It kern.module.verbose integer yes
750: .El
751: .Pp
752: The variables are as follows:
753: .Bl -tag -width "123456"
754: .It Li kern.module.autoload
755: A boolean that controls whether kernel modules are loaded automatically.
1.52 jruoho 756: See
1.53 jruoho 757: .Xr module 7
1.42 jruoho 758: for additional details.
1.78 pgoyette 759: .It Li kern.module.autotime
760: An integer that controls the delay before an attempt is made to
1.79 wiz 761: automatically unload a module that was auto-loaded.
762: Setting this value to zero disables the auto-unload function.
1.42 jruoho 763: .It Li kern.module.verbose
764: A boolean that enables or disables verbose
765: debug messages related to kernel modules.
766: .El
1.91 kamil 767: .It Li kern.monotonic_clock ( Dv KERN_MONOTONIC_CLOCK )
1.58 wiz 768: Returns the standard version the implementation of the
769: .St -p1003.1b-93
1.49 jruoho 770: Monotonic Clock Option conforms to,
1.56 uwe 771: otherwise\ 0.
1.48 jruoho 772: .It Li kern.mqueue
773: Settings related to
774: .Tn POSIX
775: message queues; see
776: .Xr mqueue 3 .
777: This node is created dynamically when
778: the corresponding kernel module is loaded.
779: The third level names for the settings are described below.
780: .Bl -column "kern.mqueue.mq_max_msgsize" "integer" "Changeable" -offset indent
1.92 wiz 781: .It Sy Third level name Sy Type Sy Changeable
1.48 jruoho 782: .It kern.mqueue.mq_open_max integer yes
783: .It kern.mqueue.mq_prio_max integer yes
784: .It kern.mqueue.mq_max_msgsize integer yes
785: .It kern.mqueue.mq_def_maxmsg integer yes
786: .It kern.mqueue.mq_max_maxmsg integer yes
787: .El
788: .Pp
789: The variables are:
790: .Bl -tag -width "123456"
791: .It Li kern.mqueue.mq_open_max
792: The maximum number of message queue descriptors any single process can open.
793: .It Li kern.mqueue.mq_prio_max
794: The maximum priority of a message.
795: .It Li kern.mqueue.mq_max_msgsize
796: The maximum size of a message in a message queue.
797: .It Li kern.mqueue.mq_def_maxmsg
798: The default maximum message count.
799: .It Li kern.mqueue.mq_max_maxmsg
800: The maximum number of messages in a message queue.
801: .El
1.91 kamil 802: .It Li kern.msgbuf ( Dv KERN_MSGBUF )
1.1 pavel 803: The kernel message buffer, rotated so that the head of the circular kernel
804: message buffer is at the start of the returned data.
805: The returned data may contain NUL bytes.
1.91 kamil 806: .It Li kern.msgbufsize ( Dv KERN_MSGBUFSIZE )
1.1 pavel 807: The maximum number of characters that the kernel message buffer can hold.
1.91 kamil 808: .It Li kern.ngroups ( Dv KERN_NGROUPS )
1.1 pavel 809: The maximum number of supplemental groups.
1.41 jruoho 810: .\" .It Li kern.no_sa_support
811: .\" XXX: Undocumented.
1.91 kamil 812: .It Li kern.ntptime ( Dv KERN_NTPTIME )
1.1 pavel 813: A
1.56 uwe 814: .Vt struct ntptimeval
1.1 pavel 815: structure is returned.
816: This structure contains data used by the
817: .Xr ntpd 8
818: program.
1.91 kamil 819: .It Li kern.osrelease ( Dv KERN_OSRELEASE )
1.1 pavel 820: The system release string.
1.91 kamil 821: .It Li kern.osrevision ( Dv KERN_OSREV )
1.1 pavel 822: The system revision string.
1.91 kamil 823: .It Li kern.ostype ( Dv KERN_OSTYPE )
1.1 pavel 824: The system type string.
1.41 jruoho 825: .\".It Li kern.panic_now
826: .\" XXX: Undocumented.
1.91 kamil 827: .It Li kern.pipe ( Dv KERN_PIPE )
1.1 pavel 828: Pipe settings.
829: The third level names for the integer pipe settings is detailed below.
830: The changeable column shows whether a process with appropriate
831: privilege may change the value.
1.21 joerg 832: .Bl -column "kern.pipe.maxbigpipes" "integer" "Changeable" -offset indent
1.92 wiz 833: .It Sy Third level name Sy Type Sy Changeable
1.1 pavel 834: .It kern.pipe.kvasiz integer yes
835: .It kern.pipe.maxbigpipes integer yes
836: .It kern.pipe.maxkvasz integer yes
837: .It kern.pipe.limitkva integer yes
838: .It kern.pipe.nbigpipes integer yes
839: .El
840: .Pp
841: The variables are as follows:
842: .Bl -tag -width "123456"
1.91 kamil 843: .It Li kern.pipe.kvasiz ( Dv KERN_PIPE_KVASIZ )
1.1 pavel 844: Amount of kernel memory consumed by pipe buffers.
1.91 kamil 845: .It Li kern.pipe.maxbigpipes ( Dv KERN_PIPE_MAXBIGPIPES )
1.56 uwe 846: Maximum number of
847: .Dq big
848: pipes.
1.91 kamil 849: .It Li kern.pipe.maxkvasz ( Dv KERN_PIPE_MAXKVASZ )
1.1 pavel 850: Maximum amount of kernel memory to be used for pipes.
1.91 kamil 851: .It Li kern.pipe.limitkva ( Dv KERN_PIPE_LIMITKVA )
1.1 pavel 852: Limit for direct transfers via page loan.
1.91 kamil 853: .It Li kern.pipe.nbigpipes ( Dv KERN_PIPE_NBIGPIPES )
1.56 uwe 854: Number of
855: .Dq big
856: pipes.
1.1 pavel 857: .El
1.82 joerg 858: .It Li kern.pool
859: Provides statistics about the
1.83 wiz 860: .Xr pool 9
1.82 joerg 861: and
862: .Xr pool_cache 9
863: subsystems.
1.39 jruoho 864: .\" XXX: Undocumented .It Li kern.posix ( ? )
865: .\" This is a node in which the only variable is semmax.
1.91 kamil 866: .It Li kern.posix1version ( Dv KERN_POSIX1 )
1.58 wiz 867: The version of ISO/IEC 9945
868: .Pq St -p1003.1
869: with which the system attempts to comply.
1.51 jruoho 870: .It Li kern.posix_aio
871: The version of
872: .St -p1003.1
873: and its Asynchronous I/O option to which the system attempts to conform.
1.91 kamil 874: .It Li kern.posix_barriers ( Dv KERN_POSIX_BARRIERS )
1.1 pavel 875: The version of
876: .St -p1003.1
877: and its
878: Barriers
879: option to which the system attempts to conform,
1.56 uwe 880: otherwise\ 0.
1.91 kamil 881: .It Li kern.posix_reader_writer_locks ( Dv KERN_POSIX_READER_WRITER_LOCKS )
1.1 pavel 882: The version of
883: .St -p1003.1
884: and its
885: Read-Write Locks
886: option to which the system attempts to conform,
1.56 uwe 887: otherwise\ 0.
1.41 jruoho 888: .\".It Li kern.posix_sched
889: .\" XXX: Undocumented.
1.91 kamil 890: .It Li kern.posix_semaphores ( Dv KERN_POSIX_SEMAPHORES )
1.1 pavel 891: The version of
892: .St -p1003.1
893: and its
894: Semaphores
895: option to which the system attempts to conform,
1.56 uwe 896: otherwise\ 0.
1.91 kamil 897: .It Li kern.posix_spin_locks ( Dv KERN_POSIX_SPIN_LOCKS )
1.1 pavel 898: The version of
899: .St -p1003.1
900: and its
901: Spin Locks
902: option to which the system attempts to conform,
1.56 uwe 903: otherwise\ 0.
1.91 kamil 904: .It Li kern.posix_threads ( Dv KERN_POSIX_THREADS )
1.1 pavel 905: The version of
906: .St -p1003.1
907: and its
908: Threads
909: option to which the system attempts to conform,
1.56 uwe 910: otherwise\ 0.
1.91 kamil 911: .It Li kern.posix_timers ( Dv KERN_POSIX_TIMERS )
1.1 pavel 912: The version of
913: .St -p1003.1
914: and its
915: Timers
916: option to which the system attempts to conform,
1.56 uwe 917: otherwise\ 0.
1.91 kamil 918: .It Li kern.proc ( Dv KERN_PROC )
1.1 pavel 919: Return the entire process table, or a subset of it.
920: An array of
1.56 uwe 921: .Vt struct kinfo_proc
1.1 pavel 922: structures is returned,
923: whose size depends on the current number of such objects in the system.
924: The third and fourth level numeric names are as follows:
1.21 joerg 925: .Bl -column "KERN_PROC_SESSION" "Fourth level is:" -offset indent
1.92 wiz 926: .It Sy Third level name Sy Fourth level is:
1.21 joerg 927: .It KERN_PROC_ALL None
928: .It KERN_PROC_GID A group ID
929: .It KERN_PROC_PID A process ID
930: .It KERN_PROC_PGRP A process group
931: .It KERN_PROC_RGID A real group ID
932: .It KERN_PROC_RUID A real user ID
933: .It KERN_PROC_SESSION A session ID
934: .It KERN_PROC_TTY A tty device
935: .It KERN_PROC_UID A user ID
1.1 pavel 936: .El
1.91 kamil 937: .It Li kern.proc2 ( Dv KERN_PROC2 )
1.56 uwe 938: As for
939: .Dv KERN_PROC ,
940: but an array of
941: .Vt struct kinfo_proc2
1.1 pavel 942: structures are returned.
943: The fifth level name is the size of the
1.56 uwe 944: .Vt struct kinfo_proc2
1.1 pavel 945: and the sixth level name is the number of structures to return.
1.91 kamil 946: .It Li kern.proc_args ( Dv KERN_PROC_ARGS )
1.1 pavel 947: Return the argv or environment strings (or the number thereof)
948: of a process.
949: Multiple strings are returned separated by NUL characters.
950: The third level name is the process ID.
951: The fourth level name is as follows:
1.93 christos 952: .Bl -column "KERN_PROG_PATHNAME" "The full pathname of the executable" -offset indent
1.92 wiz 953: .It Dv KERN_PROC_ARGV The argv strings
954: .It Dv KERN_PROC_ENV The environ strings
955: .It Dv KERN_PROC_NARGV The number of argv strings
956: .It Dv KERN_PROC_NENV The number of environ strings
1.93 christos 957: .It Dv KERN_PROC_PATHNAME The full pathname of the executable
1.1 pavel 958: .El
1.91 kamil 959: .It Li kern.profiling ( Dv KERN_PROF )
1.1 pavel 960: Return profiling information about the kernel.
961: If the kernel is not compiled for profiling,
1.56 uwe 962: attempts to retrieve any of the
963: .Dv KERN_PROF
964: values will fail with
1.1 pavel 965: .Er EOPNOTSUPP .
966: The third level names for the string and integer profiling information
967: is detailed below.
968: The changeable column shows whether a process with appropriate
969: privilege may change the value.
1.21 joerg 970: .Bl -column "kern.profiling.gmonparam" "struct gmonparam" "Changeable" -offset indent
1.92 wiz 971: .It Sy Third level name Sy Type Sy Changeable
1.1 pavel 972: .It kern.profiling.count u_short[\|] yes
973: .It kern.profiling.froms u_short[\|] yes
974: .It kern.profiling.gmonparam struct gmonparam no
975: .It kern.profiling.state integer yes
976: .It kern.profiling.tos struct tostruct yes
977: .El
978: .Pp
979: The variables are as follows:
980: .Bl -tag -width "123456"
1.91 kamil 981: .It Li kern.profiling.count ( Dv GPROF_COUNT )
1.1 pavel 982: Array of statistical program counter counts.
1.91 kamil 983: .It Li kern.profiling.froms ( Dv GPROF_FROMS )
1.1 pavel 984: Array indexed by program counter of call-from points.
1.91 kamil 985: .It Li kern.profiling.gmonparams ( Dv GPROF_GMONPARAM )
1.1 pavel 986: Structure giving the sizes of the above arrays.
1.91 kamil 987: .It Li kern.profiling.state ( Dv GPROF_STATE )
1.1 pavel 988: Profiling state.
1.56 uwe 989: If set to
990: .Dv GMON_PROF_ON ,
991: starts profiling.
992: If set to
993: .Dv GMON_PROF_OFF ,
994: stops profiling.
1.91 kamil 995: .It Li kern.profiling.tos ( Dv GPROF_TOS )
1.1 pavel 996: Array of
1.56 uwe 997: .Vt struct tostruct
1.1 pavel 998: describing destination of calls and their counts.
999: .El
1.41 jruoho 1000: .\" .It Li kern.pset
1001: .\" XXX: Undocumented.
1.91 kamil 1002: .It Li kern.rawpartition ( Dv KERN_RAWPARTITION )
1.1 pavel 1003: The raw partition of a disk (a == 0).
1.91 kamil 1004: .It Li kern.root_device ( Dv KERN_ROOT_DEVICE )
1.1 pavel 1005: The name of the root device (e.g.,
1006: .Dq wd0 ) .
1.91 kamil 1007: .It Li kern.root_partition ( Dv KERN_ROOT_PARTITION )
1.1 pavel 1008: The root partition on the root device (a == 0).
1.91 kamil 1009: .It Li kern.rtc_offset ( Dv KERN_RTC_OFFSET )
1.1 pavel 1010: Return the offset of real time clock from UTC in minutes.
1.91 kamil 1011: .It Li kern.saved_ids ( Dv KERN_SAVED_IDS )
1.1 pavel 1012: Returns 1 if saved set-group and saved set-user ID is available.
1.91 kamil 1013: .It Li kern.sbmax ( Dv KERN_SBMAX )
1.1 pavel 1014: Maximum socket buffer size.
1015: .\" XXX units?
1.91 kamil 1016: .It Li kern.securelevel ( Dv KERN_SECURELVL )
1.25 elad 1017: See
1018: .Xr secmodel_securelevel 9 .
1.41 jruoho 1019: .\" .It Li kern.sched
1020: .\" XXX: Undocumented.
1.91 kamil 1021: .It Li kern.somaxkva ( Dv KERN_SOMAXKVA )
1.1 pavel 1022: Maximum amount of kernel memory to be used for socket buffers.
1023: .\" XXX units?
1.91 kamil 1024: .It Li kern.synchronized_io ( Dv KERN_SYNCHRONIZED_IO )
1.58 wiz 1025: Returns 1 if the
1026: .St -p1003.1b-93
1027: Synchronized I/O Option is available on this system,
1.56 uwe 1028: otherwise\ 0.
1.19 christos 1029: .It Li kern.timecounter ( dynamic )
1030: Display and control the timecounter source of the system.
1.21 joerg 1031: .Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent
1.92 wiz 1032: .It Sy Third level name Sy Type Sy Changeable
1.19 christos 1033: .It kern.timecounter.choice string no
1034: .It kern.timecounter.hardware string yes
1035: .It kern.timecounter.timestepwarnings integer yes
1036: .El
1037: .Pp
1038: The variables are as follows:
1039: .Bl -tag -width "123456"
1040: .It Li kern.timecounter.choice ( dynamic )
1041: The list of available timecounters with their quality and frequency.
1042: .It Li kern.timecounter.hardware ( dynamic )
1043: The currently selected timecounter source.
1044: .It Li kern.timecounter.timestepwarnings ( dynamic )
1045: If non-zero display a message each time the time is stepped.
1046: .El
1.91 kamil 1047: .It Li kern.timex ( Dv KERN_TIMEX )
1.1 pavel 1048: Not available.
1.91 kamil 1049: .It Li kern.tkstat ( Dv KERN_TKSTAT )
1.1 pavel 1050: Return information about the number of characters sent and received
1051: on ttys.
1052: The third level names for the tty statistic variables are detailed below.
1053: The changeable column shows whether a process
1054: with appropriate privilege may change the value.
1.21 joerg 1055: .Bl -column "kern.tkstat.cancc" "quad" "Changeable" -offset indent
1.92 wiz 1056: .It Sy Third level name Sy Type Sy Changeable
1.1 pavel 1057: .It kern.tkstat.cancc quad no
1058: .It kern.tkstat.nin quad no
1059: .It kern.tkstat.nout quad no
1060: .It kern.tkstat.rawcc quad no
1061: .El
1062: .Pp
1063: The variables are as follows:
1064: .Bl -tag -width "123456"
1.91 kamil 1065: .It Li kern.tkstat.cancc ( Dv KERN_TKSTAT_CANCC )
1.1 pavel 1066: The number of canonical input characters.
1.91 kamil 1067: .It Li kern.tkstat.nin ( Dv KERN_TKSTAT_NIN )
1.1 pavel 1068: The total number of input characters.
1.91 kamil 1069: .It Li kern.tkstat.nout ( Dv KERN_TKSTAT_NOUT )
1.1 pavel 1070: The total number of output characters.
1.91 kamil 1071: .It Li kern.tkstat.rawcc ( Dv KERN_TKSTAT_RAWCC )
1.1 pavel 1072: The number of raw input characters.
1073: .El
1.66 christos 1074: .It Li kern.tty
1075: The third level names for the tty setup variables are detailed below.
1076: The changeable column shows whether a process
1077: with appropriate privilege may change the value.
1078: .Bl -column "kern.tty.qsize" "int" "Changeable" -offset indent
1.92 wiz 1079: .It Sy Third level name Sy Type Sy Changeable
1.66 christos 1080: .It kern.tty.qsize int yes
1081: .El
1082: .Pp
1083: The variables are as follows:
1084: .Bl -tag -width "123456"
1085: .It Li kern.tty.qsize
1086: Control/display the size of the default input and output queues selected
1087: during tty creation.
1088: Is converted to a power of two and its range is between
1089: .Dv 1024
1090: and
1091: .Dv 65536 .
1092: .El
1.70 christos 1093: .It Li kern.uidinfo
1094: Resource usage for the current user.
1095: .Bl -column "kern.uidinfo.proccnt" "integer" "Changeable" -offset indent
1.92 wiz 1096: .It Sy Third level name Sy Type Sy Changeable
1.70 christos 1097: .It kern.uidinfo.proccnt integer no
1098: .It kern.uidinfo.lwpcnt integer no
1099: .It kern.uidinfo.lockcnt integer no
1100: .It kern.uidinfo.sbsize integer no
1101: .El
1102: .Bl -tag -width "123456"
1103: .It Li kern.uidinfo.proccnt
1104: Returns the number of active processes for the current user.
1105: .It Li kern.uidinfo.lwpcnt
1106: Returns the number of active threads for the current user; the first thread
1107: of each process is not counted.
1108: .It Li kern.uidinfo.lockcnt
1109: Number of locks held by the current user.
1110: .It Li kern.uidinfo.sbsize
1111: Number of bytes in socket buffers allocated to the current user.
1112: .El
1.91 kamil 1113: .It Li kern.urandom ( Dv KERN_URND )
1.1 pavel 1114: Random integer value.
1.45 jruoho 1115: .It Li kern.usercrypto
1116: When enabled, allows userland to
1117: .Xr open 2
1118: the
1119: .Pa /dev/crypto
1120: special device, used by the
1121: .Xr crypto 4
1122: system.
1123: .It Li kern.userasymcrypto
1124: Enables or disables the use of software asymmetric crypto support in the
1125: .Xr crypto 4
1126: system.
1.1 pavel 1127: .It Li kern.veriexec
1.40 jruoho 1128: Runtime information for
1129: .Xr veriexec 8 .
1130: .Bl -column "kern.veriexec.algorithms" "integer" "Changeable" -offset indent
1.92 wiz 1131: .It Sy Third level name Sy Type Sy Changeable
1.40 jruoho 1132: .It kern.veriexec.algorithms string no
1133: .It kern.veriexec.count node not applicable
1134: .It kern.veriexec.strict integer yes
1135: .It kern.veriexec.verbose integer yes
1136: .El
1.1 pavel 1137: .Bl -tag -width "123456"
1138: .It Li kern.veriexec.algorithms
1139: Returns a string with the supported algorithms in Veriexec.
1140: .It Li kern.veriexec.count
1141: Sub-nodes are added to this node as new mounts are monitored by Veriexec.
1142: Each mount will be under its own
1143: .No tableN
1144: node.
1145: Under each node there will be three variables, indicating the mount
1.57 wiz 1146: point, the file system type, and the number of entries.
1.1 pavel 1147: .It Li kern.veriexec.strict
1148: Controls the strict level of Veriexec.
1149: See
1.62 jruoho 1150: .Xr security 7
1.1 pavel 1151: for more information on each level's implications.
1152: .It Li kern.veriexec.verbose
1153: Controls the verbosity level of Veriexec.
1154: If 0, only the minimal
1155: indication required will be given about what's happening - fingerprint
1156: mismatches, removal of entries from the tables, modification of a
1157: fingerprinted file.
1158: If 1, more messages will be printed (ie., when a file with a valid
1159: fingerprint is accessed).
1160: Verbose level 2 is debug mode.
1161: .El
1.91 kamil 1162: .It Li kern.version ( Dv KERN_VERSION )
1.1 pavel 1163: The system version string.
1.91 kamil 1164: .It Li kern.vnode ( Dv KERN_VNODE )
1.1 pavel 1165: Return the entire vnode table.
1166: Note, the vnode table is not necessarily a consistent snapshot of
1167: the system.
1168: The returned data consists of an array whose size depends on the
1169: current number of such objects in the system.
1170: Each element of the array contains the kernel address of a vnode
1.56 uwe 1171: .Vt struct vnode *
1.1 pavel 1172: followed by the vnode itself
1.56 uwe 1173: .Vt struct vnode .
1.43 jruoho 1174: .\" XXX: Undocumented: kern.lwp: no children?
1.1 pavel 1175: .El
1.50 jruoho 1176: .Ss The machdep.* subtree
1.1 pavel 1177: The set of variables defined is architecture dependent.
1178: Most architectures define at least the following variables.
1.43 jruoho 1179: .Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent
1.92 wiz 1180: .It Sy Second level name Sy Type Sy Changeable
1.43 jruoho 1181: .It Li machdep.booted_kernel string no
1.1 pavel 1182: .El
1.43 jruoho 1183: .\" XXX: Document the above.
1.50 jruoho 1184: .Ss The net.* subtree
1.1 pavel 1185: The string and integer information available for the
1186: .Li net
1187: level is detailed below.
1188: The changeable column shows whether a process with appropriate
1189: privilege may change the value.
1190: The second and third levels are typically the protocol family and
1191: protocol number, though this is not always the case.
1.21 joerg 1192: .Bl -column "Second level name" "IPsec key management values" "Changeable" -offset indent
1.92 wiz 1193: .It Sy Second level name Sy Type Sy Changeable
1.1 pavel 1194: .It net.route routing messages no
1195: .It net.inet IPv4 values yes
1196: .It net.inet6 IPv6 values yes
1197: .It net.key IPsec key management values yes
1198: .El
1199: .Bl -tag -width "123456"
1.91 kamil 1200: .It Li net.route ( Dv PF_ROUTE )
1.1 pavel 1201: .\" XXX really?
1202: Return the entire routing table or a subset of it.
1203: The data is returned as a sequence of routing messages (see
1204: .Xr route 4
1205: for the header file, format and meaning).
1206: The length of each message is contained in the message header.
1207: .Pp
1.56 uwe 1208: The third level name is a protocol number, which is currently always\ 0.
1.1 pavel 1209: The fourth level name is an address family, which may be set to 0 to
1210: select all address families.
1211: The fifth and sixth level names are as follows:
1.21 joerg 1212: .Bl -column "Fifth level name" "Sixth level is:" -offset indent
1.92 wiz 1213: .It Sy Fifth level name Sy Sixth level is:
1.21 joerg 1214: .It NET_RT_FLAGS rtflags
1215: .It NET_RT_DUMP None
1216: .It NET_RT_IFLIST None
1.1 pavel 1217: .El
1.91 kamil 1218: .It Li net.inet ( Dv PF_INET )
1.1 pavel 1219: Get or set various global information about the IPv4
1220: .Pq Internet Protocol version 4 .
1221: The third level name is the protocol.
1222: The fourth level name is the variable name.
1223: The currently defined protocols and names are:
1.92 wiz 1224: .Bl -column "Protocol" "anonportalgo.available" "integer" "Changeable" -offset indent
1225: .It Sy Protocol Variable Sy Type Sy Changeable
1.1 pavel 1226: .It arp down integer yes
1227: .It arp keep integer yes
1.65 christos 1228: .It arp log_movements integer yes
1229: .It arp log_permanent_modify integer yes
1.86 christos 1230: .It arp log_unknown_network integer yes
1.65 christos 1231: .It arp log_wrong_iface integer yes
1.1 pavel 1232: .It arp prune integer yes
1233: .It arp refresh integer yes
1234: .It carp allow integer yes
1235: .It carp preempt integer yes
1236: .It carp log integer yes
1237: .It carp arpbalance integer yes
1238: .It icmp errppslimit integer yes
1239: .It icmp maskrepl integer yes
1240: .It icmp rediraccept integer yes
1241: .It icmp redirtimeout integer yes
1.28 christos 1242: .It icmp bmcastecho integer yes
1.1 pavel 1243: .It ip allowsrcrt integer yes
1.72 christos 1244: .It ip anonportalgo.selected string yes
1245: .It ip anonportalgo.available string yes
1.74 christos 1246: .It ip anonportalgo.reserve struct yes
1.1 pavel 1247: .It ip anonportmax integer yes
1248: .It ip anonportmin integer yes
1249: .It ip checkinterface integer yes
1250: .It ip directed-broadcast integer yes
1251: .It ip do_loopback_cksum integer yes
1252: .It ip forwarding integer yes
1253: .It ip forwsrcrt integer yes
1254: .It ip gifttl integer yes
1255: .It ip grettl integer yes
1.8 liamjfoy 1256: .It ip hashsize integer yes
1.1 pavel 1257: .It ip hostzerobroadcast integer yes
1258: .It ip lowportmin integer yes
1259: .It ip lowportmax integer yes
1260: .It ip maxflows integer yes
1261: .It ip maxfragpackets integer yes
1262: .It ip mtudisc integer yes
1263: .It ip mtudisctimeout integer yes
1264: .It ip random_id integer yes
1265: .It ip redirect integer yes
1266: .It ip subnetsarelocal integer yes
1267: .It ip ttl integer yes
1268: .It tcp rfc1323 integer yes
1269: .It tcp sendspace integer yes
1270: .It tcp recvspace integer yes
1271: .It tcp mssdflt integer yes
1272: .It tcp syn_cache_limit integer yes
1273: .It tcp syn_bucket_limit integer yes
1274: .It tcp syn_cache_interval integer yes
1275: .It tcp init_win integer yes
1276: .It tcp init_win_local integer yes
1277: .It tcp mss_ifmtu integer yes
1278: .It tcp win_scale integer yes
1279: .It tcp timestamps integer yes
1280: .It tcp compat_42 integer yes
1281: .It tcp cwm integer yes
1282: .It tcp cwm_burstsize integer yes
1283: .It tcp ack_on_push integer yes
1284: .It tcp keepidle integer yes
1285: .It tcp keepintvl integer yes
1286: .It tcp keepcnt integer yes
1287: .It tcp slowhz integer no
1.12 christos 1288: .It tcp keepinit integer yes
1.1 pavel 1289: .It tcp log_refused integer yes
1290: .It tcp rstppslimit integer yes
1291: .It tcp ident struct no
1.13 christos 1292: .It tcp drop struct no
1.1 pavel 1293: .It tcp sack.enable integer yes
1294: .It tcp sack.globalholes integer no
1295: .It tcp sack.globalmaxholes integer yes
1296: .It tcp sack.maxholes integer yes
1297: .It tcp ecn.enable integer yes
1298: .It tcp ecn.maxretries integer yes
1299: .It tcp congctl.selected string yes
1300: .It tcp congctl.available string yes
1301: .It tcp abc.enable integer yes
1302: .It tcp abc.aggressive integer yes
1303: .It udp checksum integer yes
1304: .It udp do_loopback_cksum integer yes
1305: .It udp recvspace integer yes
1306: .It udp sendspace integer yes
1307: .El
1308: .Pp
1309: The variables are as follows:
1310: .Bl -tag -width "123456"
1311: .It Li arp.down
1312: Failed ARP entry lifetime.
1313: .It Li arp.keep
1314: Valid ARP entry lifetime.
1315: .It Li arp.prune
1316: ARP cache pruning interval.
1317: .It Li arp.refresh
1318: ARP entry refresh interval.
1319: .It Li carp.allow
1320: If set to 0, incoming
1321: .Xr carp 4
1322: packets will not be processed.
1323: If set to any other value, processing will occur.
1324: Enabled by default.
1325: .It Li carp.arpbalance
1326: If set to any value other than 0, the ARP balancing functionality of
1327: .Xr carp 4
1328: is enabled.
1329: When ARP requests are received for an IP address which is part of any virtual
1330: host, carp will hash the source IP in the ARP request to select one of the
1331: virtual hosts from the set of all the virtual hosts which have that IP address.
1332: The master of that host will respond with the correct virtual MAC address.
1333: Disabled by default.
1334: .It Li carp.log
1335: If set to any value other than 0,
1336: .Xr carp 4
1337: will log errors.
1338: Disabled by default.
1339: .It Li carp.preempt
1340: If set to 0,
1341: .Xr carp 4
1342: will not attempt to become master if it is receiving advertisements from
1343: another active master.
1344: If set to any other value, carp will become master of the virtual host if it
1345: believes it can send advertisements more frequently than the current master.
1346: Disabled by default.
1347: .It Li ip.allowsrcrt
1348: If set to 1, the host accepts source routed packets.
1.72 christos 1349: .It Li ip.anonportalgo.available
1350: The available RFC 6056 port randomization algorithms.
1.74 christos 1351: .It Li ip.anonportalgo.reserve
1352: A bitmask of ports that will not be used during anonymous or privileged
1353: port selection.
1.72 christos 1354: .It Li ip.anonportalgo.selected
1355: The currently selected RFC 6056 port randomization algorithm.
1.1 pavel 1356: .It Li ip.anonportmax
1357: The highest port number to use for TCP and UDP ephemeral port allocation.
1358: This cannot be set to less than 1024 or greater than 65535, and must
1359: be greater than
1360: .Li ip.anonportmin .
1361: .It Li ip.anonportmin
1362: The lowest port number to use for TCP and UDP ephemeral port allocation.
1363: This cannot be set to less than 1024 or greater than 65535.
1364: .It Li ip.checkinterface
1365: If set to non-zero, the host will reject packets addressed to it
1366: that arrive on an interface not bound to that address.
1367: Currently, this must be disabled if ipnat is used to translate the
1368: destination address to another local interface, or if addresses
1369: are added to the loopback interface instead of the interface where
1370: the packets for those packets are received.
1371: .It Li ip.directed-broadcast
1372: If set to 1, enables directed broadcast behavior for the host.
1373: .It Li ip.do_loopback_cksum
1374: Perform IP checksum on loopback.
1375: .It Li ip.forwarding
1376: If set to 1, enables IP forwarding for the host,
1377: meaning that the host is acting as a router.
1378: .It Li ip.forwsrcrt
1379: If set to 1, enables forwarding of source-routed packets for the host.
1380: This value may only be changed if the kernel security level is less than 1.
1381: .It Li ip.gifttl
1382: The maximum time-to-live (hop count) value for an IPv4 packet generated by
1383: .Xr gif 4
1384: tunnel interface.
1385: .It Li ip.grettl
1386: The maximum time-to-live (hop count) value for an IPv4 packet generated by
1387: .Xr gre 4
1388: tunnel interface.
1.8 liamjfoy 1389: .It Li ip.hashsize
1390: The size of IPv4 Fast Forward hash table.
1391: This value must be a power of 2 (64, 256...).
1392: A larger hash table size results in fewer collisions.
1393: Also see
1394: .Li ip.maxflows .
1.1 pavel 1395: .It Li ip.hostzerobroadcast
1396: All zeroes address is broadcast address.
1397: .It Li ip.lowportmax
1398: The highest port number to use for TCP and UDP reserved port allocation.
1399: This cannot be set to less than 0 or greater than 1024, and must
1400: be greater than
1401: .Li ip.lowportmin .
1402: .It Li ip.lowportmin
1403: The lowest port number to use for TCP and UDP reserved port allocation.
1404: This cannot be set to less than 0 or greater than 1024, and must
1405: be smaller than
1406: .Li ip.lowportmax .
1407: .It Li ip.maxflows
1.5 liamjfoy 1408: IPv4 Fast Forwarding is enabled by default.
1409: If set to 0, IPv4 Fast Forwarding is disabled.
1.1 pavel 1410: .Li ip.maxflows
1411: controls the maximum amount of flows which can be created.
1412: The default value is 256.
1413: .It Li ip.maxfragpackets
1414: The maximum number of fragmented packets the node will accept.
1415: 0 means that the node will not accept any fragmented packets.
1416: \-1 means that the node will accept as many fragmented packets as it receives.
1417: The flag is provided basically for avoiding possible DoS attacks.
1418: .It Li ip.mtudisc
1419: If set to 1, enables Path MTU Discovery (RFC 1191).
1420: When Path MTU Discovery is enabled, the transmitted TCP segment
1421: size will be determined by the advertised maximum segment size
1422: (MSS) from the remote end, as constrained by the path MTU.
1423: If MTU Discovery is disabled, the transmitted segment size will
1424: never be greater than
1425: .Li tcp.mssdflt
1426: (the local maximum segment size).
1427: .It Li ip.mtudisctimeout
1428: The number of seconds in which a route added by the Path MTU
1429: Discovery engine will time out.
1430: When the route times out, the Path
1431: MTU Discovery engine will attempt to probe a larger path MTU.
1432: .It Li ip.random_id
1433: Assign random ip_id values.
1434: .It Li ip.redirect
1435: If set to 1, ICMP redirects may be sent by the host.
1436: This option is ignored unless the host is routing IP packets,
1437: and should normally be enabled on all systems.
1438: .It Li ip.subnetsarelocal
1439: If set to 1, subnets are to be considered local addresses.
1440: .It Li ip.ttl
1441: The maximum time-to-live (hop count) value for an IP packet sourced by
1442: the system.
1443: This value applies to normal transport protocols, not to ICMP.
1444: .It Li icmp.errppslimit
1445: The variable specifies the maximum number of outgoing ICMP error messages,
1446: per second.
1447: ICMP error messages that exceeded the value are subject to rate limitation
1448: and will not go out from the node.
1449: Negative value disables rate limitation.
1450: .It Li icmp.maskrepl
1451: If set to 1, ICMP network mask requests are to be answered.
1452: .It Li icmp.rediraccept
1453: If set to non-zero, the host will accept ICMP redirect packets.
1454: Note that routers will never accept ICMP redirect packets,
1455: and the variable is meaningful on IP hosts only.
1456: .It Li icmp.redirtimeout
1457: The variable specifies lifetime of routing entries generated by incoming
1458: ICMP redirect.
1459: This defaults to 600 seconds.
1460: .It Li icmp.returndatabytes
1461: Number of bytes to return in an ICMP error message.
1.28 christos 1462: .It Li icmp.bmcastecho
1463: If set to 1, enables responding to ICMP echo or timestamp request to the
1464: broadcast address.
1.1 pavel 1465: .It Li tcp.ack_on_push
1466: If set to 1, TCP is to immediately transmit an ACK upon reception of
1467: a packet with PUSH set.
1468: This can avoid losing a round trip time in some rare situations,
1469: but has the caveat of potentially defeating TCP's delayed ACK algorithm.
1470: Use of this option is generally not recommended, but
1471: the variable exists in case your configuration really needs it.
1472: .It Li tcp.compat_42
1473: If set to 1, enables work-arounds for bugs in the 4.2BSD TCP implementation.
1474: Use of this option is not recommended, although it may be
1475: required in order to communicate with extremely old TCP implementations.
1476: .It Li tcp.cwm
1477: If set to 1, enables use of the Hughes/Touch/Heidemann Congestion Window
1478: Monitoring algorithm.
1479: This algorithm prevents line-rate bursts of packets that could
1480: otherwise occur when data begins flowing on an idle TCP connection.
1481: These line-rate bursts can contribute to network and router congestion.
1482: This can be particularly useful on World Wide Web servers
1483: which support HTTP/1.1, which has lingering connections.
1484: .It Li tcp.cwm_burstsize
1485: The Congestion Window Monitoring allowed burst size, in terms
1486: of packet count.
1487: .It Li tcp.delack_ticks
1488: Number of ticks to delay sending an ACK.
1489: .It Li tcp.do_loopback_cksum
1490: Perform TCP checksum on loopback.
1491: .It Li tcp.init_win
1.76 wiz 1492: A value indicating the TCP initial congestion window.
1493: The valid range
1.87 matt 1494: is 0 to 10 (maximum specified by RFC6928),
1.75 christos 1495: with a default of 4 (approximately 4K per RFC3390).
1.1 pavel 1496: .It Li tcp.init_win_local
1497: Like
1498: .Li tcp.init_win ,
1499: but used when communicating with hosts on a local network.
1500: .It Li tcp.keepcnt
1501: Number of keepalive probes sent before declaring a connection dead.
1502: If set to zero, there is no limit;
1503: keepalives will be sent until some kind of
1504: response is received from the peer.
1505: .It Li tcp.keepidle
1506: Time a connection must be idle before keepalives are sent (if keepalives
1507: are enabled for the connection).
1508: See also tcp.slowhz.
1509: .It Li tcp.keepintvl
1510: Time after a keepalive probe is sent until, in the absence of any response,
1511: another probe is sent.
1512: See also tcp.slowhz.
1513: .It Li tcp.log_refused
1514: If set to 1, refused TCP connections to the host will be logged.
1.12 christos 1515: .It Li tcp.keepinit
1516: Timeout in seconds during connection establishment.
1.1 pavel 1517: .It Li tcp.mss_ifmtu
1518: If set to 1, TCP calculates the outgoing maximum segment size based on
1519: the MTU of the appropriate interface.
1520: If set to 0, it is calculated based on the greater of the MTU of the
1521: interface, and the largest (non-loopback) interface MTU on the system.
1522: .It Li tcp.mssdflt
1523: The default maximum segment size both advertised to the peer
1524: and to use when either the peer does not advertise a maximum segment size to
1525: us during connection setup or Path MTU Discovery
1526: .Li ( ip.mtudisc )
1527: is disabled.
1528: Do not change this value unless you really know what you are doing.
1529: .It Li tcp.recvspace
1530: The default TCP receive buffer size.
1531: .It Li tcp.rfc1323
1532: If set to 1, enables RFC 1323 extensions to TCP.
1533: .It Li tcp.rstppslimit
1534: The variable specifies the maximum number of outgoing TCP RST packets,
1535: per second.
1536: TCP RST packet that exceeded the value are subject to rate limitation
1537: and will not go out from the node.
1538: Negative value disables rate limitation.
1.13 christos 1539: .It Li tcp.ident
1540: Return the user ID of a connected socket pair.
1541: (RFC1413 Identification Protocol lookups.)
1542: .It Li tcp.drop
1543: Drop a TCP socket pair connection.
1.1 pavel 1544: .It Li tcp.sack.enable
1545: If set to 1, enables RFC 2018 Selective ACKnowledgement.
1546: .It Li tcp.sack.globalholes
1547: Global number of TCP SACK holes.
1548: .It Li tcp.sack.globalmaxholes
1549: Global maximum number of TCP SACK holes.
1550: .It Li tcp.sack.maxholes
1551: Maximum number of TCP SACK holes allowed per connection.
1552: .It Li tcp.ecn.enable
1553: If set to 1, enables RFC 3168 Explicit Congestion Notification.
1554: .It Li tcp.ecn.maxretries
1555: Number of times to retry sending the ECN-setup packet.
1556: .It Li tcp.sendspace
1557: The default TCP send buffer size.
1558: .It Li tcp.slowhz
1559: The units for tcp.keepidle and tcp.keepintvl; those variables are in ticks
1560: of a clock that ticks tcp.slowhz times per second.
1561: (That is, their values
1562: must be divided by the tcp.slowhz value to get times in seconds.)
1563: .It Li tcp.syn_bucket_limit
1564: The maximum number of entries allowed per hash bucket in the TCP
1565: compressed state engine.
1566: .It Li tcp.syn_cache_limit
1567: The maximum number of entries allowed in the TCP compressed state
1568: engine.
1569: .It Li tcp.timestamps
1570: If rfc1323 is enabled, a value of 1 indicates RFC 1323 time stamp options,
1571: used for measuring TCP round trip times, are enabled.
1572: .It Li tcp.win_scale
1573: If rfc1323 is enabled, a value of 1 indicates RFC 1323 window scale options,
1574: for increasing the TCP window size, are enabled.
1575: .It Li tcp.congctl.available
1576: The available TCP congestion control algorithms.
1577: .It Li tcp.congctl.selected
1578: The currently selected TCP congestion control algorithm.
1579: .It Li tcp.abc.enable
1580: If set to 1, use RFC 3465 Appropriate Byte Counting (ABC).
1581: If set to 0, use traditional Packet Counting.
1582: .It Li tcp.abc.aggressive
1583: Choose the L parameter found in RFC 3465.
1584: L is the maximum cwnd increase for an ack during slow start.
1585: If set to 1, use L=2*SMSS.
1586: If set to 0, use L=1*SMSS.
1587: It has no effect unless tcp.abc.enable is set to 1.
1588: .It Li udp.checksum
1589: If set to 1, UDP checksums are being computed.
1590: Received non-zero UDP checksums are always checked.
1591: Disabling UDP checksums is strongly discouraged.
1.67 christos 1592: .It Li udp.recvspace
1593: The default UDP receive buffer size.
1.1 pavel 1594: .It Li udp.sendspace
1595: The default UDP send buffer size.
1596: .El
1597: .Pp
1598: For variables net.*.ipsec, please refer to
1599: .Xr ipsec 4 .
1.91 kamil 1600: .It Li net.inet6 ( Dv PF_INET6 )
1.1 pavel 1601: Get or set various global information about the IPv6
1602: .Pq Internet Protocol version 6 .
1603: The third level name is the protocol.
1604: The fourth level name is the variable name.
1605: The currently defined protocols and names are:
1.92 wiz 1606: .Bl -column "Protocol" "anonportalgo.available" "integer" "Changeable" -offset indent
1607: .It Sy Protocol Variable Sy Type Sy Changeable
1.1 pavel 1608: .It icmp6 errppslimit integer yes
1609: .It icmp6 mtudisc_hiwat integer yes
1610: .It icmp6 mtudisc_lowat integer yes
1611: .It icmp6 nd6_debug integer yes
1612: .It icmp6 nd6_delay integer yes
1613: .It icmp6 nd6_maxnudhint integer yes
1614: .It icmp6 nd6_mmaxtries integer yes
1615: .It icmp6 nd6_prune integer yes
1616: .It icmp6 nd6_umaxtries integer yes
1617: .It icmp6 nd6_useloopback integer yes
1618: .It icmp6 nodeinfo integer yes
1619: .It icmp6 rediraccept integer yes
1620: .It icmp6 redirtimeout integer yes
1621: .It ip6 accept_rtadv integer yes
1.72 christos 1622: .It ip6 anonportalgo.selected string yes
1623: .It ip6 anonportalgo.available string yes
1.90 kamil 1624: .It ip6 anonportalgo.reserve struct yes
1.1 pavel 1625: .It ip6 anonportmax integer yes
1626: .It ip6 anonportmin integer yes
1627: .It ip6 auto_flowlabel integer yes
1628: .It ip6 dad_count integer yes
1629: .It ip6 defmcasthlim integer yes
1630: .It ip6 forwarding integer yes
1631: .It ip6 gifhlim integer yes
1.7 liamjfoy 1632: .It ip6 hashsize integer yes
1.1 pavel 1633: .It ip6 hlim integer yes
1634: .It ip6 hdrnestlimit integer yes
1635: .It ip6 kame_version string no
1636: .It ip6 keepfaith integer yes
1637: .It ip6 log_interval integer yes
1638: .It ip6 lowportmax integer yes
1639: .It ip6 lowportmin integer yes
1.73 christos 1640: .It ip6 maxdynroutes integer yes
1641: .It ip6 maxifprefixes integer yes
1642: .It ip6 maxifdefrouters integer yes
1.5 liamjfoy 1643: .It ip6 maxflows integer yes
1.1 pavel 1644: .It ip6 maxfragpackets integer yes
1645: .It ip6 maxfrags integer yes
1.73 christos 1646: .It ip6 neighborgcthresh integer yes
1.1 pavel 1647: .It ip6 redirect integer yes
1648: .It ip6 rr_prune integer yes
1649: .It ip6 use_deprecated integer yes
1650: .It ip6 v6only integer yes
1651: .It udp6 do_loopback_cksum integer yes
1652: .It udp6 recvspace integer yes
1653: .It udp6 sendspace integer yes
1654: .El
1655: .Pp
1656: The variables are as follows:
1657: .Bl -tag -width "123456"
1658: .It Li ip6.accept_rtadv
1659: If set to non-zero, the node will accept ICMPv6 router advertisement packets
1660: and autoconfigures address prefixes and default routers.
1661: The node must be a host
1662: .Pq not a router
1663: for the option to be meaningful.
1.72 christos 1664: .It Li ip6.anonportalgo.available
1665: The available RFC 6056 port randomization algorithms.
1.74 christos 1666: .It Li ip6.anonportalgo.reserve
1667: A bitmask of ports that will not be used during anonymous or privileged
1668: port selection.
1.72 christos 1669: .It Li ip6.anonportalgo.selected
1670: The currently selected RFC 6056 port randomization algorithm.
1.1 pavel 1671: .It Li ip6.anonportmax
1672: The highest port number to use for TCP and UDP ephemeral port allocation.
1673: This cannot be set to less than 1024 or greater than 65535, and must
1674: be greater than
1675: .Li ip6.anonportmin .
1676: .It Li ip6.anonportmin
1677: The lowest port number to use for TCP and UDP ephemeral port allocation.
1678: This cannot be set to less than 1024 or greater than 65535.
1679: .It Li ip6.auto_flowlabel
1680: On connected transport protocol packets,
1681: fill IPv6 flowlabel field to help intermediate routers to identify packet flows.
1682: .It Li ip6.dad_count
1683: The variable configures number of IPv6 DAD
1684: .Pq duplicated address detection
1685: probe packets.
1686: The packets will be generated when IPv6 interface addresses are configured.
1687: .It Li ip6.defmcasthlim
1688: The default hop limit value for an IPv6 multicast packet sourced by the node.
1689: This value applies to all the transport protocols on top of IPv6.
1690: There are APIs to override the value, as documented in
1691: .Xr ip6 4 .
1692: .It Li ip6.forwarding
1693: If set to 1, enables IPv6 forwarding for the node,
1694: meaning that the node is acting as a router.
1695: If set to 0, disables IPv6 forwarding for the node,
1696: meaning that the node is acting as a host.
1697: IPv6 specification defines node behavior for
1698: .Dq router
1699: case and
1700: .Dq host
1701: case quite differently, and changing this variable during operation
1702: may cause serious trouble.
1703: It is recommended to configure the variable at bootstrap time,
1704: and bootstrap time only.
1705: .It Li ip6.gifhlim
1706: The maximum hop limit value for an IPv6 packet generated by
1707: .Xr gif 4
1708: tunnel interface.
1709: .It Li ip6.hdrnestlimit
1710: The number of IPv6 extension headers permitted on incoming IPv6 packets.
1711: If set to 0, the node will accept as many extension headers as possible.
1.7 liamjfoy 1712: .It Li ip6.hashsize
1713: The size of IPv6 Fast Forward hash table.
1.56 uwe 1714: This value must be a power of 2 (64, 256, ...).
1.7 liamjfoy 1715: A larger hash table size results in fewer collisions.
1716: Also see
1717: .Li ip6.maxflows .
1.1 pavel 1718: .It Li ip6.hlim
1719: The default hop limit value for an IPv6 unicast packet sourced by the node.
1720: This value applies to all the transport protocols on top of IPv6.
1721: There are APIs to override the value, as documented in
1722: .Xr ip6 4 .
1723: .It Li ip6.kame_version
1724: The string identifies the version of KAME IPv6 stack implemented in the kernel.
1725: .It Li ip6.keepfaith
1726: If set to non-zero, it enables
1727: .Dq FAITH
1728: TCP relay IPv6-to-IPv4 translator code in the kernel.
1729: Refer
1730: .Xr faith 4
1731: and
1732: .Xr faithd 8
1733: for detail.
1734: .It Li ip6.log_interval
1735: The variable controls amount of logs generated by IPv6 packet
1736: forwarding engine, by setting interval between log output
1737: .Pq in seconds .
1738: .It Li ip6.lowportmax
1739: The highest port number to use for TCP and UDP reserved port allocation.
1740: This cannot be set to less than 0 or greater than 1024, and must
1741: be greater than
1742: .Li ip6.lowportmin .
1743: .It Li ip6.lowportmin
1744: The lowest port number to use for TCP and UDP reserved port allocation.
1745: This cannot be set to less than 0 or greater than 1024, and must
1746: be smaller than
1747: .Li ip6.lowportmax .
1.73 christos 1748: .It Li ip6.maxdynroutes
1749: Maximum number of routes created by redirect.
1750: Set it to negative to disable.
1751: The default value is 4096.
1752: .It Li ip6.maxifprefixes
1753: Maximum number of prefixes created by route advertisements per interface.
1754: Set it to negative to disable.
1755: The default value is 16.
1756: .It Li ip6.maxifdefrouters 16
1757: Maximum number of default routers created by route advertisements per interface.
1758: Set it to negative to disable.
1759: The default value is 16.
1.5 liamjfoy 1760: .It Li ip6.maxflows
1761: IPv6 Fast Forwarding is enabled by default.
1762: If set to 0, IPv6 Fast Forwarding is disabled.
1763: .Li ip6.maxflows
1764: controls the maximum amount of flows which can be created.
1.6 liamjfoy 1765: The default value is 256.
1.1 pavel 1766: .It Li ip6.maxfragpackets
1767: The maximum number of fragmented packets the node will accept.
1768: 0 means that the node will not accept any fragmented packets.
1769: \-1 means that the node will accept as many fragmented packets as it receives.
1770: The flag is provided basically for avoiding possible DoS attacks.
1771: .It Li ip6.maxfrags
1772: The maximum number of fragments the node will accept.
1773: 0 means that the node will not accept any fragments.
1774: \-1 means that the node will accept as many fragments as it receives.
1775: The flag is provided basically for avoiding possible DoS attacks.
1.73 christos 1776: .It Li ip6.neighborgcthresh
1777: Maximum number of entries in neighbor cache.
1778: Set to negative to disable.
1779: The default value is 2048.
1.1 pavel 1780: .It Li ip6.redirect
1781: If set to 1, ICMPv6 redirects may be sent by the node.
1782: This option is ignored unless the node is routing IP packets,
1783: and should normally be enabled on all systems.
1784: .It Li ip6.rr_prune
1785: The variable specifies interval between IPv6 router renumbering prefix
1786: babysitting, in seconds.
1787: .It Li ip6.use_deprecated
1788: The variable controls use of deprecated address, specified in RFC 2462 5.5.4.
1789: .It Li ip6.v6only
1790: The variable specifies initial value for
1791: .Dv IPV6_V6ONLY
1792: socket option for
1793: .Dv AF_INET6
1794: socket.
1795: Please refer to
1796: .Xr ip6 4
1797: for detail.
1798: .It Li icmp6.errppslimit
1799: The variable specifies the maximum number of outgoing ICMPv6 error messages,
1800: per second.
1801: ICMPv6 error messages that exceeded the value are subject to rate limitation
1802: and will not go out from the node.
1803: Negative value disables rate limitation.
1804: .It Li icmp6.mtudisc_hiwat
1805: .It Li icmp6.mtudisc_lowat
1806: The variables define the maximum number of routing table entries,
1807: created due to path MTU discovery
1808: .Pq prevents denial-of-service attacks with ICMPv6 too big messages .
1809: When IPv6 path MTU discovery happens, we keep path MTU information into
1810: the routing table.
1811: If the number of routing table entries exceed the value,
1812: the kernel will not attempt to keep the path MTU information.
1813: .Li icmp6.mtudisc_hiwat
1814: is used when we have verified ICMPv6 too big messages.
1815: .Li icmp6.mtudisc_lowat
1816: is used when we have unverified ICMPv6 too big messages.
1817: Verification is performed by using address/port pairs kept in connected pcbs.
1818: Negative value disables the upper limit.
1819: .It Li icmp6.nd6_debug
1820: If set to non-zero, kernel IPv6 neighbor discovery code will generate
1821: debugging messages.
1822: The debug outputs are useful to diagnose IPv6 interoperability issues.
1823: The flag must be set to 0 for normal operation.
1824: .It Li icmp6.nd6_delay
1825: The variable specifies
1826: .Dv DELAY_FIRST_PROBE_TIME
1827: timing constant in IPv6 neighbor discovery specification
1828: .Pq RFC 2461 ,
1829: in seconds.
1830: .It Li icmp6.nd6_maxnudhint
1831: IPv6 neighbor discovery permits upper layer protocols to supply reachability
1832: hints, to avoid unnecessary neighbor discovery exchanges.
1833: The variable defines the number of consecutive hints the neighbor discovery
1834: layer will take.
1835: For example, by setting the variable to 3, neighbor discovery layer
1836: will take 3 consecutive hints in maximum.
1837: After receiving 3 hints, neighbor discovery layer will perform
1838: normal neighbor discovery process.
1839: .It Li icmp6.nd6_mmaxtries
1840: The variable specifies
1841: .Dv MAX_MULTICAST_SOLICIT
1842: constant in IPv6 neighbor discovery specification
1843: .Pq RFC 2461 .
1844: .It Li icmp6.nd6_prune
1845: The variable specifies interval between IPv6 neighbor cache babysitting,
1846: in seconds.
1847: .It Li icmp6.nd6_umaxtries
1848: The variable specifies
1849: .Dv MAX_UNICAST_SOLICIT
1850: constant in IPv6 neighbor discovery specification
1851: .Pq RFC 2461 .
1852: .It Li icmp6.nd6_useloopback
1853: If set to non-zero, kernel IPv6 stack will use loopback interface for
1854: local traffic.
1855: .It Li icmp6.nodeinfo
1856: The variable enables responses to ICMPv6 node information queries.
1857: If you set the variable to 0, responses will not be generated for
1858: ICMPv6 node information queries.
1859: Since node information queries can have a security impact, it is
1860: possible to fine tune which responses should be answered.
1861: Two separate bits can be set.
1862: .Bl -tag -width "12345"
1863: .It 1
1864: Respond to ICMPv6 FQDN queries, e.g.
1865: .Li ping6 -w .
1866: .It 2
1867: Respond to ICMPv6 node addresses queries, e.g.
1868: .Li ping6 -a .
1869: .El
1870: .It Li icmp6.rediraccept
1871: If set to non-zero, the host will accept ICMPv6 redirect packets.
1872: Note that IPv6 routers will never accept ICMPv6 redirect packets,
1873: and the variable is meaningful on IPv6 hosts
1874: .Pq non-router
1875: only.
1876: .It Li icmp6.redirtimeout
1877: The variable specifies lifetime of routing entries generated by incoming
1878: ICMPv6 redirect.
1879: .It Li udp6.do_loopback_cksum
1880: Perform UDP checksum on loopback.
1881: .It Li udp6.recvspace
1882: Default UDP receive buffer size.
1883: .It Li udp6.sendspace
1884: Default UDP send buffer size.
1885: .El
1886: .Pp
1887: We reuse net.*.tcp for
1888: .Tn TCP
1889: over
1890: .Tn IPv6 ,
1891: and therefore we do not have variables net.*.tcp6.
1892: Variables net.inet6.udp6 have identical meaning to net.inet.udp.
1893: Please refer to
1894: .Li PF_INET
1895: section above.
1896: For variables net.*.ipsec6, please refer to
1897: .Xr ipsec 4 .
1.91 kamil 1898: .It Li net.key ( Dv PF_KEY )
1.1 pavel 1899: Get or set various global information about the IPsec key management.
1900: The third level name is the variable name.
1901: The currently defined variable and names are:
1.21 joerg 1902: .Bl -column "blockacq_lifetime" "integer" "Changeable" -offset indent
1.92 wiz 1903: .It Sy Variable Type Sy Changeable
1.1 pavel 1904: .It debug integer yes
1.80 christos 1905: .It enabled integer yes
1906: .It used integer no
1.1 pavel 1907: .It spi_try integer yes
1908: .It spi_min_value integer yes
1909: .It spi_max_value integer yes
1910: .It larval_lifetime integer yes
1911: .It blockacq_count integer yes
1912: .It blockacq_lifetime integer yes
1913: .It esp_keymin integer yes
1914: .It esp_auth integer yes
1915: .It ah_keymin integer yes
1916: .El
1.21 joerg 1917: .Pp
1.1 pavel 1918: The variables are as follows:
1919: .Bl -tag -width "123456"
1920: .It Li debug
1921: Turn on debugging message from within the kernel.
1922: The value is a bitmap, as defined in
1.56 uwe 1923: .In netkey/key_debug.h .
1.80 christos 1924: .It Li enabled
1.81 christos 1925: Control processing of IPsec control messages.
1926: .Bl -tag -width indent
1927: .It 0
1928: Never allow IPsec processing
1929: .It 1
1930: Allow IPsec processing when SPD policies are present.
1931: .It 2
1932: Force IPsec processing even when SPD policies are not present.
1933: .El
1.80 christos 1934: .It Li used
1935: Based on if IPsec is enabled, and SPD rule existance, show if
1936: IPsec is being used.
1937: Note that currenly once IPsec is being used, it cannot be disabled.
1.1 pavel 1938: .It Li spi_try
1939: The number of times the kernel will try to obtain an unique SPI
1940: when it generates it from random number generator.
1941: .It Li spi_min_value
1942: Minimum SPI value when generating it within the kernel.
1943: .It Li spi_max_value
1944: Maximum SPI value when generating it within the kernel.
1945: .It Li larval_lifetime
1946: Lifetime for LARVAL SAD entries, in seconds.
1947: .It Li blockacq_count
1948: Number of ACQUIRE PF_KEY messages to be blocked after an ACQUIRE message.
1949: It avoids flood of ACQUIRE PF_KEY from being sent from the kernel to the
1950: key management daemon.
1951: .It Li blockacq_lifetime
1952: Lifetime of ACQUIRE PF_KEY message.
1953: .It Li esp_keymin
1954: Minimum ESP key length, in bits.
1955: The value is used when the kernel creates proposal payload
1956: on ACQUIRE PF_KEY message.
1957: .It Li esp_auth
1958: Whether ESP authentication should be used or not.
1959: Non-zero value indicates that ESP authentication should be used.
1960: The value is used when the kernel creates proposal payload
1961: on ACQUIRE PF_KEY message.
1962: .It Li ah_keymin
1963: Minimum AH key length, in bits,
1964: The value is used when the kernel creates proposal payload
1965: on ACQUIRE PF_KEY message.
1966: .El
1967: .El
1.50 jruoho 1968: .Ss The proc.* subtree
1.1 pavel 1969: The string and integer information available for the
1970: .Li proc
1971: level is detailed below.
1972: The changeable column shows whether a process with appropriate
1973: privilege may change the value.
1974: These values are per-process,
1975: and as such may change from one process to another.
1976: When a process is created,
1977: the default values are inherited from its parent.
1978: When a set-user-ID or set-group-ID binary is executed, the
1979: value of PROC_PID_CORENAME is reset to the system default value.
1980: The second level name is either the magic value PROC_CURPROC, which
1981: points to the current process, or the PID of the target process.
1.21 joerg 1982: .Bl -column "proc.pid.corename" "string" "not applicable" -offset indent
1.92 wiz 1983: .It Sy Third level name Sy Type Sy Changeable
1.1 pavel 1984: .It proc.pid.corename string yes
1985: .It proc.pid.rlimit node not applicable
1986: .It proc.pid.stopfork int yes
1987: .It proc.pid.stopexec int yes
1988: .It proc.pid.stopexit int yes
1989: .El
1990: .Bl -tag -width "123456"
1.91 kamil 1991: .It Li proc.pid.corename ( Dv PROC_PID_CORENAME )
1.1 pavel 1992: The template used for the core dump file name (see
1993: .Xr core 5
1994: for details).
1995: The base name must either be
1.56 uwe 1996: .Pa core
1997: or end with the suffix
1998: .Pa .core
1999: (the super-user may set arbitrary names).
2000: By default it points to
2001: .Dv KERN_DEFCORENAME .
1.91 kamil 2002: .It Li proc.pid.rlimit ( Dv PROC_PID_LIMIT )
1.1 pavel 2003: Return resources limits, as defined for the
2004: .Xr getrlimit 2
2005: and
2006: .Xr setrlimit 2
2007: system calls.
2008: The fourth level name is one of:
1.56 uwe 2009: .Bl -tag -width "123456"
1.91 kamil 2010: .It Li proc.pid.rlimit.cputime ( Dv PROC_PID_LIMIT_CPU )
1.1 pavel 2011: The maximum amount of CPU time (in seconds) to be used by each process.
1.91 kamil 2012: .It Li proc.pid.rlimit.filesize ( Dv PROC_PID_LIMIT_FSIZE )
1.1 pavel 2013: The largest size (in bytes) file that may be created.
1.91 kamil 2014: .It Li proc.pid.rlimit.datasize ( Dv PROC_PID_LIMIT_DATA )
1.1 pavel 2015: The maximum size (in bytes) of the data segment for a process;
2016: this defines how far a program may extend its break with the
2017: .Xr sbrk 2
2018: system call.
1.91 kamil 2019: .It Li proc.pid.rlimit.stacksize ( Dv PROC_PID_LIMIT_STACK )
1.1 pavel 2020: The maximum size (in bytes) of the stack segment for a process;
2021: this defines how far a program's stack segment may be extended.
2022: Stack extension is performed automatically by the system.
1.91 kamil 2023: .It Li proc.pid.rlimit.coredumpsize ( Dv PROC_PID_LIMIT_CORE )
1.1 pavel 2024: The largest size (in bytes)
2025: .Pa core
2026: file that may be created.
1.91 kamil 2027: .It Li proc.pid.rlimit.memoryuse ( Dv PROC_PID_LIMIT_RSS )
1.1 pavel 2028: The maximum size (in bytes) to which a process's resident set size may
2029: grow.
2030: This imposes a limit on the amount of physical memory to be given to
2031: a process; if memory is tight, the system will prefer to take memory
2032: from processes that are exceeding their declared resident set size.
1.91 kamil 2033: .It Li proc.pid.rlimit.memorylocked ( Dv PROC_PID_LIMIT_MEMLOCK )
1.1 pavel 2034: The maximum size (in bytes) which a process may lock into memory
2035: using the
2036: .Xr mlock 2
2037: function.
1.91 kamil 2038: .It Li proc.pid.rlimit.maxproc ( Dv PROC_PID_LIMIT_NPROC )
1.1 pavel 2039: The maximum number of simultaneous processes for this user id.
1.91 kamil 2040: .It Li proc.pid.rlimit.descriptors ( Dv PROC_PID_LIMIT_NOFILE )
1.1 pavel 2041: The maximum number of open files for this process.
1.91 kamil 2042: .It Li proc.pid.rlimit.sbsize ( Dv PROC_PID_LIMIT_SBSIZE )
1.22 snj 2043: The maximum size (in bytes) of the socket buffers
2044: set by the
2045: .Xr setsockopt 2
2046: .Dv SO_RCVBUF
2047: and
2048: .Dv SO_SNDBUF
2049: options.
1.91 kamil 2050: .It Li proc.pid.rlimit.vmemoryuse ( Dv PROC_PID_LIMIT_AS )
1.88 kamil 2051: The maximum size (in bytes) which a process can obtain.
1.91 kamil 2052: .It Li proc.pid.rlimit.maxlwp ( Dv PROC_PID_LIMIT_NTHR )
1.88 kamil 2053: The maximum number of threads that cen be created and running at one time in
2054: the process.
2055: The first thread of each process is not counted against this.
1.1 pavel 2056: .El
2057: .Pp
2058: The fifth level name is one of
1.91 kamil 2059: .Li soft ( Dv PROC_PID_LIMIT_TYPE_SOFT )
1.56 uwe 2060: or
1.91 kamil 2061: .Li hard ( Dv PROC_PID_LIMIT_TYPE_HARD ) ,
1.1 pavel 2062: to select respectively the soft or hard limit.
2063: Both are of type integer.
1.91 kamil 2064: .It Li proc.pid.stopfork ( Dv PROC_PID_STOPFORK )
1.1 pavel 2065: If non zero, the process' children will be stopped after
2066: .Xr fork 2
2067: calls.
2068: The children is created in the SSTOP state and is never scheduled
2069: for running before being stopped.
2070: This feature helps attaching a process with a debugger such as
2071: .Xr gdb 1
2072: before it had the opportunity to actually do anything.
2073: .Pp
2074: This value is inherited by the process's children, and it also
2075: apply to emulation specific system calls that fork a new process, such as
2076: .Fn sproc
2077: or
2078: .Fn clone .
1.91 kamil 2079: .It Li proc.pid.stopexec ( Dv PROC_PID_STOPEXEC )
1.1 pavel 2080: If non zero, the process will be stopped on next
2081: .Xr exec 3
2082: call.
2083: The process created by
2084: .Xr exec 3
2085: is created in the SSTOP state and is never scheduled for running
2086: before being stopped.
2087: This feature helps attaching a process with a debugger such as
2088: .Xr gdb 1
2089: before it had the opportunity to actually do anything.
2090: .Pp
2091: This value is inherited by the process's children.
1.91 kamil 2092: .It Li proc.pid.stopexit ( Dv PROC_PID_STOPEXIT )
1.1 pavel 2093: If non zero, the process will be stopped on when it has cause to exit,
2094: either by way of calling
2095: .Xr exit 3 ,
2096: .Xr _exit 2 ,
2097: or by the receipt of a specific signal.
2098: The process is stopped before any of its resources or vm space is
2099: released allowing examination of the termination state of a process
2100: before it disappears.
2101: This feature can be used to examine the final conditions of the
2102: process's vmspace via
2103: .Xr pmap 1
2104: or its resource settings with
2105: .Xr sysctl 8
2106: before it disappears.
2107: .Pp
2108: This value is also inherited by the process's children.
2109: .El
1.91 kamil 2110: .Ss The user.* subtree ( Dv CTL_USER )
1.1 pavel 2111: The string and integer information available for the
2112: .Li user
2113: level is detailed below.
2114: The changeable column shows whether a process with appropriate
2115: privilege may change the value.
1.21 joerg 2116: .Bl -column "user.coll_weights_max" "integer" "Changeable" -offset indent
1.92 wiz 2117: .It Sy Second level name Sy Type Sy Changeable
1.1 pavel 2118: .It user.atexit_max integer no
2119: .It user.bc_base_max integer no
2120: .It user.bc_dim_max integer no
2121: .It user.bc_scale_max integer no
2122: .It user.bc_string_max integer no
2123: .It user.coll_weights_max integer no
2124: .It user.cs_path string no
2125: .It user.expr_nest_max integer no
2126: .It user.line_max integer no
2127: .It user.posix2_c_bind integer no
2128: .It user.posix2_c_dev integer no
2129: .It user.posix2_char_term integer no
2130: .It user.posix2_fort_dev integer no
2131: .It user.posix2_fort_run integer no
2132: .It user.posix2_localedef integer no
2133: .It user.posix2_sw_dev integer no
2134: .It user.posix2_upe integer no
2135: .It user.posix2_version integer no
2136: .It user.re_dup_max integer no
2137: .It user.stream_max integer no
2138: .It user.stream_max integer no
2139: .It user.tzname_max integer no
2140: .El
2141: .Bl -tag -width "123456"
1.91 kamil 2142: .It Li user.atexit_max ( Dv USER_ATEXIT_MAX )
1.1 pavel 2143: The maximum number of functions that may be registered with
2144: .Xr atexit 3 .
1.91 kamil 2145: .It Li user.bc_base_max ( Dv USER_BC_BASE_MAX )
1.1 pavel 2146: The maximum ibase/obase values in the
2147: .Xr bc 1
2148: utility.
1.91 kamil 2149: .It Li user.bc_dim_max ( Dv USER_BC_DIM_MAX )
1.1 pavel 2150: The maximum array size in the
2151: .Xr bc 1
2152: utility.
1.91 kamil 2153: .It Li user.bc_scale_max ( Dv USER_BC_SCALE_MAX )
1.1 pavel 2154: The maximum scale value in the
2155: .Xr bc 1
2156: utility.
1.91 kamil 2157: .It Li user.bc_string_max ( Dv USER_BC_STRING_MAX )
1.1 pavel 2158: The maximum string length in the
2159: .Xr bc 1
2160: utility.
1.91 kamil 2161: .It Li user.coll_weights_max ( Dv USER_COLL_WEIGHTS_MAX )
1.1 pavel 2162: The maximum number of weights that can be assigned to any entry of
2163: the LC_COLLATE order keyword in the locale definition file.
2164: .It Li user.cs_path ( USER_CS_PATH )
2165: Return a value for the
2166: .Ev PATH
2167: environment variable that finds all the standard utilities.
1.91 kamil 2168: .It Li user.expr_nest_max ( Dv USER_EXPR_NEST_MAX )
1.1 pavel 2169: The maximum number of expressions that can be nested within
2170: parenthesis by the
2171: .Xr expr 1
2172: utility.
1.91 kamil 2173: .It Li user.line_max ( Dv USER_LINE_MAX )
1.1 pavel 2174: The maximum length in bytes of a text-processing utility's input
2175: line.
1.91 kamil 2176: .It Li user.posix2_char_term ( Dv USER_POSIX2_CHAR_TERM )
1.1 pavel 2177: Return 1 if the system supports at least one terminal type capable of
1.58 wiz 2178: all operations described in
2179: .St -p1003.2 ,
2180: otherwise\ 0.
1.91 kamil 2181: .It Li user.posix2_c_bind ( Dv USER_POSIX2_C_BIND )
1.1 pavel 2182: Return 1 if the system's C-language development facilities support the
1.56 uwe 2183: C-Language Bindings Option, otherwise\ 0.
1.91 kamil 2184: .It Li user.posix2_c_dev ( Dv USER_POSIX2_C_DEV )
1.1 pavel 2185: Return 1 if the system supports the C-Language Development Utilities Option,
1.56 uwe 2186: otherwise\ 0.
1.91 kamil 2187: .It Li user.posix2_fort_dev ( Dv USER_POSIX2_FORT_DEV )
1.1 pavel 2188: Return 1 if the system supports the FORTRAN Development Utilities Option,
1.56 uwe 2189: otherwise\ 0.
1.91 kamil 2190: .It Li user.posix2_fort_run ( Dv USER_POSIX2_FORT_RUN )
1.1 pavel 2191: Return 1 if the system supports the FORTRAN Runtime Utilities Option,
1.56 uwe 2192: otherwise\ 0.
1.91 kamil 2193: .It Li user.posix2_localedef ( Dv USER_POSIX2_LOCALEDEF )
1.56 uwe 2194: Return 1 if the system supports the creation of locales, otherwise\ 0.
1.91 kamil 2195: .It Li user.posix2_sw_dev ( Dv USER_POSIX2_SW_DEV )
1.1 pavel 2196: Return 1 if the system supports the Software Development Utilities Option,
1.56 uwe 2197: otherwise\ 0.
1.91 kamil 2198: .It Li user.posix2_upe ( Dv USER_POSIX2_UPE )
1.1 pavel 2199: Return 1 if the system supports the User Portability Utilities Option,
1.56 uwe 2200: otherwise\ 0.
1.91 kamil 2201: .It Li user.posix2_version ( Dv USER_POSIX2_VERSION )
1.58 wiz 2202: The version of
2203: .St -p1003.2
2204: with which the system attempts to comply.
1.91 kamil 2205: .It Li user.re_dup_max ( Dv USER_RE_DUP_MAX )
1.1 pavel 2206: The maximum number of repeated occurrences of a regular expression
2207: permitted when using interval notation.
1.91 kamil 2208: .It Li user.stream_max ( Dv USER_STREAM_MAX )
1.1 pavel 2209: The minimum maximum number of streams that a process may have open
2210: at any one time.
1.91 kamil 2211: .It Li user.tzname_max ( Dv USER_TZNAME_MAX )
1.1 pavel 2212: The minimum maximum number of types supported for the name of a
2213: timezone.
2214: .El
1.91 kamil 2215: .Ss The vm.* subtree ( Dv CTL_VM )
1.1 pavel 2216: The string and integer information available for the
2217: .Li vm
2218: level is detailed below.
2219: The changeable column shows whether a process with appropriate
2220: privilege may change the value.
1.21 joerg 2221: .Bl -column "Second level name" "struct uvmexp_sysctl" "Changeable" -offset indent
1.92 wiz 2222: .It Sy Second level name Sy Type Sy Changeable
1.1 pavel 2223: .It vm.anonmax int yes
2224: .It vm.anonmin int yes
2225: .It vm.bufcache int yes
2226: .It vm.bufmem int no
2227: .It vm.bufmem_hiwater int yes
2228: .It vm.bufmem_lowater int yes
2229: .It vm.execmax int yes
2230: .It vm.execmin int yes
2231: .It vm.filemax int yes
2232: .It vm.filemin int yes
2233: .It vm.loadavg struct loadavg no
2234: .It vm.maxslp int no
2235: .It vm.nkmempages int no
2236: .It vm.uspace int no
2237: .It vm.uvmexp struct uvmexp no
2238: .It vm.uvmexp2 struct uvmexp_sysctl no
2239: .It vm.vmmeter struct vmtotal no
1.93 christos 2240: .It vm.proc.map struct kinfo_vmentry no
1.1 pavel 2241: .El
2242: .Bl -tag -width "123456"
1.91 kamil 2243: .It Li vm.anonmax ( Dv VM_ANONMAX )
1.1 pavel 2244: The percentage of physical memory which will be reclaimed
2245: from other types of memory usage to store anonymous application data.
1.91 kamil 2246: .It Li vm.anonmin ( Dv VM_ANONMIN )
1.1 pavel 2247: The percentage of physical memory which will be always be available for
2248: anonymous application data.
1.91 kamil 2249: .It Li vm.bufcache ( Dv VM_BUFCACHE )
1.1 pavel 2250: The percentage of physical memory which will be available
2251: for the buffer cache.
1.91 kamil 2252: .It Li vm.bufmem ( Dv VM_BUFMEM )
1.1 pavel 2253: The amount of kernel memory that is being used by the buffer cache.
1.91 kamil 2254: .It Li vm.bufmem_lowater ( Dv VM_BUFMEM_LOWATER )
1.1 pavel 2255: The minimum amount of kernel memory to reserve for the
2256: buffer cache.
1.91 kamil 2257: .It Li vm.bufmem_hiwater ( Dv VM_BUFMEM_HIWATER )
1.1 pavel 2258: The maximum amount of kernel memory to be used for the
2259: buffer cache.
1.91 kamil 2260: .It Li vm.execmax ( Dv VM_EXECMAX )
1.1 pavel 2261: The percentage of physical memory which will be reclaimed
2262: from other types of memory usage to store cached executable data.
1.91 kamil 2263: .It Li vm.execmin ( Dv VM_EXECMIN )
1.1 pavel 2264: The percentage of physical memory which will be always be available for
2265: cached executable data.
1.91 kamil 2266: .It Li vm.filemax ( Dv VM_FILEMAX )
1.1 pavel 2267: The percentage of physical memory which will be reclaimed
2268: from other types of memory usage to store cached file data.
1.91 kamil 2269: .It Li vm.filemin ( Dv VM_FILEMIN )
1.1 pavel 2270: The percentage of physical memory which will be always be available for
2271: cached file data.
1.91 kamil 2272: .It Li vm.loadavg ( Dv VM_LOADAVG )
1.1 pavel 2273: Return the load average history.
2274: The returned data consists of a
1.56 uwe 2275: .Vt struct loadavg .
1.91 kamil 2276: .It Li vm.maxslp ( Dv VM_MAXSLP )
1.1 pavel 2277: The value of the maxslp kernel global variable.
1.91 kamil 2278: .It Li vm.vmmeter ( Dv VM_METER )
1.1 pavel 2279: Return system wide virtual memory statistics.
2280: The returned data consists of a
1.56 uwe 2281: .Vt struct vmtotal .
1.31 drochner 2282: .It vm.user_va0_disable
1.56 uwe 2283: A flag which controls whether user processes can map virtual address\ 0.
1.93 christos 2284: .It Li vm.proc.map ( Dv VM_PROC )
1.94 ! wiz 2285: The third level is
1.93 christos 2286: .dv VM_PROC_MAP ,
2287: the fourth is the pid of the process to display the vm object entries for, and
2288: the fifth is the size of
2289: .Vt struct kinfo_vmentry .
2290: Returns an array of
2291: .Vt struct kinfo_vmentry
2292: objects.
1.91 kamil 2293: .It Li vm.uspace ( Dv VM_USPACE )
1.1 pavel 2294: The number of bytes allocated for each kernel stack.
1.91 kamil 2295: .It Li vm.uvmexp ( Dv VM_UVMEXP )
1.1 pavel 2296: Return system wide virtual memory statistics.
2297: The returned data consists of a
1.56 uwe 2298: .Vt struct uvmexp .
1.91 kamil 2299: .It Li vm.uvmexp2 ( Dv VM_UVMEXP2 )
1.1 pavel 2300: Return system wide virtual memory statistics.
2301: The returned data consists of a
1.56 uwe 2302: .Vt struct uvmexp_sysctl .
1.1 pavel 2303: .\" XXX vm.idlezero
2304: .El
1.91 kamil 2305: .Ss The ddb.* subtree ( Dv CTL_DDB )
1.34 jruoho 2306: The information available for the
1.1 pavel 2307: .Li ddb
2308: level is detailed below.
2309: The changeable column shows whether a process with appropriate
2310: privilege may change the value.
2311: .\" XXX sort
1.21 joerg 2312: .Bl -column "Second level name" "integer" "Changeable" -offset indent
1.92 wiz 2313: .It Sy Second level name Sy Type Sy Changeable
1.1 pavel 2314: .It ddb.radix integer yes
2315: .It ddb.maxoff integer yes
1.34 jruoho 2316: .It ddb.maxwidth integer yes
1.1 pavel 2317: .It ddb.lines integer yes
2318: .It ddb.tabstops integer yes
2319: .It ddb.onpanic integer yes
2320: .It ddb.fromconsole integer yes
1.34 jruoho 2321: .It ddb.tee_msgbuf integer yes
2322: .It ddb.commandonenter string yes
1.1 pavel 2323: .El
2324: .Bl -tag -width "123456"
1.91 kamil 2325: .It Li ddb.radix ( Dv DDBCTL_RADIX )
1.1 pavel 2326: The input and output radix.
1.91 kamil 2327: .It Li ddb.maxoff ( Dv DDBCTL_MAXOFF )
1.1 pavel 2328: The maximum symbol offset.
1.91 kamil 2329: .It Li ddb.maxwidth ( Dv DDBCTL_MAXWIDTH )
1.34 jruoho 2330: The maximum output line width.
1.91 kamil 2331: .It Li ddb.lines ( Dv DDBCTL_LINES )
1.1 pavel 2332: Number of display lines.
1.91 kamil 2333: .It Li ddb.tabstops ( Dv DDBCTL_TABSTOPS )
1.1 pavel 2334: Tab width.
1.91 kamil 2335: .It Li ddb.onpanic ( Dv DDBCTL_ONPANIC )
1.63 riz 2336: If greater than zero, DDB will be entered if the kernel panics.
2337: A value of 1 causes the system to enter DDB on panic, while a value of 2
2338: causes the kernel to attempt to print out a stack trace before entering DDB.
2339: A value of 0 causes the kernel to attempt to print a stack trace, then
1.64 wiz 2340: reboot, while a value of \-1 means neither a stack trace will be printed
1.63 riz 2341: nor DDB entered.
1.91 kamil 2342: .It Li ddb.fromconsole ( Dv DDBCTL_FROMCONSOLE )
1.1 pavel 2343: If not zero, DDB may be entered by sending a break on a serial
2344: console or by a special key sequence on a graphics console.
1.34 jruoho 2345: .It Li ddb.tee_msgbuf
2346: If not zero, DDB will output also to the kernel message buffer.
2347: .It Li ddb.commandonenter
2348: If not empty, a command to be executed on each enter to the
2349: .Tn DDB .
2350: .\"
2351: .\" XXX: (a) ddb.commandonenter is missing in ddb(4);
2352: .\" (b) No DDBCTL definitions for tee_msgbuf and commandonenter.
1.1 pavel 2353: .El
2354: .Pp
1.34 jruoho 2355: Some of these
2356: .Tn MIB
2357: nodes are also available as variables from within the debugger.
1.1 pavel 2358: See
2359: .Xr ddb 4
2360: for more details.
1.91 kamil 2361: .Ss The security.* subtree ( Dv CTL_SECURITY )
1.1 pavel 2362: The
2363: .Li security
2364: level contains various security-related settings for
1.2 wiz 2365: the system.
1.43 jruoho 2366: The available second level names are:
2367: .Bl -column "Second level name" "integer" "Changeable" -offset indent
1.92 wiz 2368: .It Sy Second level name Sy Type Sy Changeable
1.43 jruoho 2369: .It Li security.curtain integer yes
2370: .It Li security.models node not applicable
2371: .It Li security.pax node not applicable
2372: .El
2373: .Pp
1.2 wiz 2374: Available settings are detailed below.
1.1 pavel 2375: .Bl -tag -width "123456"
2376: .It Li security.curtain
1.43 jruoho 2377: If non-zero, will filter return objects according to the user
2378: .Tn ID
1.1 pavel 2379: requesting information about them, preventing from users any
1.43 jruoho 2380: access to objects they do not own.
1.1 pavel 2381: .Pp
2382: At the moment, it affects
2383: .Xr ps 1 ,
2384: .Xr netstat 1
2385: (for
2386: .Dv PF_INET ,
2387: .Dv PF_INET6 ,
2388: and
2389: .Dv PF_UNIX
2390: PCBs), and
2391: .Xr w 1 .
1.4 elad 2392: .It Li security.models
2393: .Nx
2394: supports pluggable security models.
1.17 ad 2395: Every security model used, whether if loaded as a module or built with the system,
1.4 elad 2396: is required to add an entry to this node with at least one element,
2397: .Dq name ,
2398: indicating the name of the security model.
2399: .Pp
2400: In addition to the name, any settings and other information private to the
2401: security model will be available under this node.
2402: See
2403: .Xr secmodel 9
2404: for more information.
1.1 pavel 2405: .It Li security.pax
2406: Settings for PaX -- exploit mitigation features.
1.4 elad 2407: For more information on any of the PaX features, please see
2408: .Xr paxctl 8
2409: and
1.62 jruoho 2410: .Xr security 7 .
1.43 jruoho 2411: The available third and fourth level names are:
2412: .Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \
2413: -offset 2n
2414: .It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable
2415: .It Li security.pax.aslr.enabled integer yes
2416: .\".It Li security.pax.aslr.exec_len integer yes
2417: .It Li security.pax.aslr.global integer yes
2418: .\".It Li security.pax.aslr.mmap_len integer yes
2419: .\".It Li security.pax.aslr.stack_len integer yes
2420: .It Li security.pax.mprotect.enabled integer yes
2421: .It Li security.pax.mprotect.global integer yes
2422: .It Li security.pax.segvguard.enabled integer yes
2423: .It Li security.pax.segvguard.expiry_timeout integer yes
2424: .It Li security.pax.segvguard.global integer yes
2425: .It Li security.pax.segvguard.max_crashes integer yes
2426: .It Li security.pax.segvguard.suspend_timeout integer yes
2427: .El
1.1 pavel 2428: .Bl -tag -width "123456"
1.43 jruoho 2429: .It Li security.pax.aslr.enabled
1.14 elad 2430: Enable PaX ASLR (Address Space Layout Randomization).
2431: .Pp
2432: The value of this
2433: knob must be non-zero for PaX ASLR to be enabled, even if a program is set to
2434: explicit enable.
1.43 jruoho 2435: .\".It Li security.pax.aslr.exec_len
2436: .\" XXX: Undocumented.
1.14 elad 2437: .It Li security.pax.aslr.global
2438: Specifies the default global policy for programs without an
2439: explicit enable/disable flag.
2440: .Pp
2441: When non-zero, all programs will get PaX ASLR, except those exempted with
1.69 wiz 2442: .Xr paxctl 8 .
1.14 elad 2443: Otherwise, all programs will not get PaX ASLR, except those specifically
2444: marked as such with
2445: .Xr paxctl 8 .
1.43 jruoho 2446: .\".It Li security.pax.aslr.mmap_len
2447: .\" XXX: Undocumented.
2448: .\" .It Li security.pax.aslr.stack_len
2449: .\" XXX: Undocumented.
2450: .It Li security.pax.mprotect.enabled
1.1 pavel 2451: Enable PaX MPROTECT restrictions.
2452: .Pp
2453: These are
2454: .Xr mprotect 2
1.2 wiz 2455: restrictions to better enforce a W^X policy.
2456: The value of this
1.1 pavel 2457: knob must be non-zero for PaX MPROTECT to be enabled, even if a
2458: program is set to explicit enable.
2459: .It Li security.pax.mprotect.global
2460: Specifies the default global policy for programs without an
2461: explicit enable/disable flag.
2462: .Pp
2463: When non-zero, all programs will get the PaX MPROTECT restrictions,
2464: except those exempted with
1.69 wiz 2465: .Xr paxctl 8 .
1.1 pavel 2466: Otherwise, all programs will not get the PaX MPROTECT restrictions,
2467: except those specifically marked as such with
1.4 elad 2468: .Xr paxctl 8 .
1.43 jruoho 2469: .It Li security.pax.segvguard.enabled
1.1 pavel 2470: Enable PaX Segvguard.
2471: .Pp
2472: PaX Segvguard can detect and prevent certain exploitation attempts, where
2473: an attacker may try for example to brute-force function return addresses
2474: of respawning daemons.
2475: .Pp
2476: .Em Note :
2477: The
2478: .Nx
2479: interface and implementation of the Segvguard is still experimental, and may
2480: change in future releases.
1.43 jruoho 2481: .It Li security.pax.segvguard.expiry_timeout
2482: If the max number was not reached within this timeout (in seconds), the entry
2483: will expire.
1.1 pavel 2484: .It Li security.pax.segvguard.global
2485: Specifies the default global policy for programs without an
2486: explicit enable/disable flag.
2487: .Pp
2488: When non-zero, all programs will get the PaX Segvguard,
2489: except those exempted with
1.69 wiz 2490: .Xr paxctl 8 .
1.2 wiz 2491: Otherwise, no program will get the PaX Segvguard restrictions,
1.1 pavel 2492: except those specifically marked as such with
1.4 elad 2493: .Xr paxctl 8 .
1.43 jruoho 2494: .It Li security.pax.segvguard.max_crashes
2495: The maximum number of segfaults a program can receive before suspension.
1.1 pavel 2496: .It Li security.pax.segvguard.suspend_timeout
2497: Number of seconds to suspend a user from running a faulting program when the
2498: limit was exceeded.
2499: .El
2500: .El
1.91 kamil 2501: .Ss The vendor.* subtree ( Dv CTL_VENDOR )
1.1 pavel 2502: The
2503: .Li vendor
2504: toplevel name is reserved to be used by vendors who wish to
2505: have their own private MIB tree.
2506: Intended use is to store values under
2507: .Dq vendor.\*[Lt]yourname\*[Gt].* .
2508: .Sh SEE ALSO
2509: .Xr sysctl 3 ,
2510: .Xr ipsec 4 ,
2511: .Xr tcp 4 ,
1.62 jruoho 2512: .Xr security 7 ,
1.1 pavel 2513: .Xr sysctl 8
2514: .Sh HISTORY
2515: The
2516: .Nm
2517: variables first appeared in
2518: .Bx 4.4 .
CVSweb <webmaster@jp.NetBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to sysctl.7 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / share / man / man7