xref: /dflybsd-src/sbin/init/init.c (revision 8bdbc095884336714d87f2877b79c17d22de5cd3)
1 /*-
2  * Copyright (c) 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Donn Seeley at Berkeley Software Design, Inc.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  * @(#) Copyright (c) 1991, 1993 The Regents of the University of California.  All rights reserved.
33  * @(#)init.c	8.1 (Berkeley) 7/15/93
34  * $FreeBSD: src/sbin/init/init.c,v 1.38.2.8 2001/10/22 11:27:32 des Exp $
35  */
36 
37 #include <sys/param.h>
38 #include <sys/ioctl.h>
39 #include <sys/mount.h>
40 #include <sys/sysctl.h>
41 #include <sys/wait.h>
42 #include <sys/stat.h>
43 
44 #include <db.h>
45 #include <errno.h>
46 #include <fcntl.h>
47 #include <libutil.h>
48 #include <utmpx.h>
49 #include <paths.h>
50 #include <signal.h>
51 #include <stdio.h>
52 #include <stdlib.h>
53 #include <string.h>
54 #include <syslog.h>
55 #include <time.h>
56 #include <ttyent.h>
57 #include <unistd.h>
58 #include <sys/reboot.h>
59 #include <err.h>
60 
61 #include <stdarg.h>
62 
63 #ifdef SECURE
64 #include <pwd.h>
65 #endif
66 
67 #ifdef LOGIN_CAP
68 #include <login_cap.h>
69 #endif
70 
71 #include "pathnames.h"
72 
73 /*
74  * Sleep times; used to prevent thrashing.
75  */
76 #define	GETTY_SPACING		 5	/* N secs minimum getty spacing */
77 #define	GETTY_SLEEP		30	/* sleep N secs after spacing problem */
78 #define	GETTY_NSPACE		 3	/* max. spacing count to bring reaction */
79 #define	WINDOW_WAIT		 3	/* wait N secs after starting window */
80 #define	STALL_TIMEOUT		30	/* wait N secs after warning */
81 #define	DEATH_WATCH		10	/* wait N secs for procs to die */
82 #define	DEATH_SCRIPT		120	/* wait for 2min for /etc/rc.shutdown */
83 
84 /*
85  * User-based resource limits.
86  */
87 #define RESOURCE_RC		"daemon"
88 #define RESOURCE_WINDOW		"default"
89 #define RESOURCE_GETTY		"default"
90 
91 #ifndef DEFAULT_STATE
92 #define DEFAULT_STATE		runcom
93 #endif
94 
95 typedef enum {
96 	invalid_state,
97 	single_user,
98 	runcom,
99 	read_ttys,
100 	multi_user,
101 	clean_ttys,
102 	catatonia,
103 	death
104 } state_t;
105 typedef state_t (*state_func_t)(void);
106 
107 static state_t f_single_user(void);
108 static state_t f_runcom(void);
109 static state_t f_read_ttys(void);
110 static state_t f_multi_user(void);
111 static state_t f_clean_ttys(void);
112 static state_t f_catatonia(void);
113 static state_t f_death(void);
114 
115 state_func_t state_funcs[] = {
116 	NULL,
117 	f_single_user,
118 	f_runcom,
119 	f_read_ttys,
120 	f_multi_user,
121 	f_clean_ttys,
122 	f_catatonia,
123 	f_death
124 };
125 
126 enum { AUTOBOOT, FASTBOOT } runcom_mode = AUTOBOOT;
127 #define FALSE	0
128 #define TRUE	1
129 
130 static void transition(state_t);
131 static volatile sig_atomic_t requested_transition = DEFAULT_STATE;
132 
133 static void	setctty(const char *);
134 
135 typedef struct init_session {
136 	int	se_index;		/* index of entry in ttys file */
137 	pid_t	se_process;		/* controlling process */
138 	struct timeval	se_started;		/* used to avoid thrashing */
139 	int	se_flags;		/* status of session */
140 #define	SE_SHUTDOWN	0x1		/* session won't be restarted */
141 #define	SE_PRESENT	0x2		/* session is in /etc/ttys */
142 	int     se_nspace;              /* spacing count */
143 	char	*se_device;		/* filename of port */
144 	char	*se_getty;		/* what to run on that port */
145 	char    *se_getty_argv_space;   /* pre-parsed argument array space */
146 	char	**se_getty_argv;	/* pre-parsed argument array */
147 	char	*se_window;		/* window system (started only once) */
148 	char    *se_window_argv_space;  /* pre-parsed argument array space */
149 	char	**se_window_argv;	/* pre-parsed argument array */
150 	char    *se_type;               /* default terminal type */
151 	struct	init_session *se_prev;
152 	struct	init_session *se_next;
153 } session_t;
154 
155 static void	 handle(sig_t, ...);
156 static void	 delset(sigset_t *, ...);
157 
158 static void	 stall(const char *, ...) __printflike(1, 2);
159 static void	 warning(const char *, ...) __printflike(1, 2);
160 static void	 emergency(const char *, ...) __printflike(1, 2);
161 static void	 disaster(int);
162 static void	 badsys(int);
163 static int	 runshutdown(void);
164 static char	*strk(char *);
165 
166 #define	DEATH		'd'
167 #define	SINGLE_USER	's'
168 #define	RUNCOM		'r'
169 #define	READ_TTYS	't'
170 #define	MULTI_USER	'm'
171 #define	CLEAN_TTYS	'T'
172 #define	CATATONIA	'c'
173 
174 static void	free_session(session_t *);
175 static session_t *new_session(session_t *, int, struct ttyent *);
176 static void	adjttyent(struct ttyent *typ);
177 
178 static char	**construct_argv(char *);
179 static void	start_window_system(session_t *);
180 static void	collect_child(pid_t, int);
181 static pid_t	start_getty(session_t *);
182 static void	transition_handler(int);
183 static void	alrm_handler(int);
184 static void	setsecuritylevel(int);
185 static int	getsecuritylevel(void);
186 static char	*get_chroot(void);
187 static int	setupargv(session_t *, struct ttyent *);
188 #ifdef LOGIN_CAP
189 static void	setprocresources(const char *);
190 #endif
191 
192 static void	clear_session_logs(session_t *, int);
193 
194 static int	start_session_db(void);
195 static void	add_session(session_t *);
196 static void	del_session(session_t *);
197 static session_t *find_session(pid_t);
198 
199 #ifdef SUPPORT_UTMPX
200 static struct timeval boot_time;
201 state_t current_state = death;
202 static void session_utmpx(const session_t *, int);
203 static void make_utmpx(const char *, const char *, int, pid_t,
204     const struct timeval *, int);
205 static char get_runlevel(const state_t);
206 static void utmpx_set_runlevel(char, char);
207 #endif
208 
209 static int Reboot = FALSE;
210 static int howto = RB_AUTOBOOT;
211 
212 static DB *session_db;
213 static volatile sig_atomic_t clang;
214 static session_t *sessions;
215 
216 /*
217  * The mother of all processes.
218  */
219 int
220 main(int argc, char *argv[])
221 {
222 	char *init_chroot;
223 	int c;
224 	struct sigaction sa;
225 	sigset_t mask;
226 	struct stat sts;
227 
228 #ifdef SUPPORT_UTMPX
229 	(void)gettimeofday(&boot_time, NULL);
230 #endif /* SUPPORT_UTMPX */
231 
232 	/* Dispose of random users. */
233 	if (getuid() != 0)
234 		errx(1, "%s", strerror(EPERM));
235 
236 	/* System V users like to reexec init. */
237 	if (getpid() != 1) {
238 #ifdef COMPAT_SYSV_INIT
239 		/* So give them what they want */
240 		if (argc > 1) {
241 			if (strlen(argv[1]) == 1) {
242 				char runlevel = *argv[1];
243 				int sig;
244 
245 				switch (runlevel) {
246 					case '0': /* halt + poweroff */
247 						sig = SIGUSR2;
248 						break;
249 					case '1': /* single-user */
250 						sig = SIGTERM;
251 						break;
252 					case '6': /* reboot */
253 						sig = SIGINT;
254 						break;
255 					case 'c': /* block further logins */
256 						sig = SIGTSTP;
257 						break;
258 					case 'q': /* rescan /etc/ttys */
259 						sig = SIGHUP;
260 						break;
261 					default:
262 						goto invalid;
263 				}
264 				kill(1, sig);
265 				_exit(0);
266 			} else
267 invalid:
268 				errx(1, "invalid run-level ``%s''", argv[1]);
269 		} else
270 #endif
271 			errx(1, "already running");
272 	}
273 	/*
274 	 * Note that this does NOT open a file...
275 	 * Does 'init' deserve its own facility number?
276 	 */
277 	openlog("init", LOG_CONS, LOG_AUTH);
278 
279 	/*
280 	 * If chroot has been requested by the boot loader,
281 	 * do it now.  Try to be robust:  If the directory
282 	 * doesn't exist, continue anyway.
283 	 */
284 	init_chroot = get_chroot();
285 	if (init_chroot != NULL) {
286 		if (chdir(init_chroot) == -1 || chroot(".") == -1)
287 			warning("can't chroot to %s: %m", init_chroot);
288 		free(init_chroot);
289 	}
290 
291 	/*
292 	 * Create an initial session.
293 	 */
294 	if (setsid() < 0)
295 		warning("initial setsid() failed: %m");
296 
297 	/*
298 	 * Establish an initial user so that programs running
299 	 * single user do not freak out and die (like passwd).
300 	 */
301 	if (setlogin("root") < 0)
302 		warning("setlogin() failed: %m");
303 
304 	if (stat("/dev/null", &sts) < 0) {
305 		warning("/dev MAY BE CORRUPT! /dev/null is missing!\n");
306 		sleep(5);
307 	}
308 
309 	/*
310 	 * This code assumes that we always get arguments through flags,
311 	 * never through bits set in some random machine register.
312 	 */
313 	while ((c = getopt(argc, argv, "dsf")) != -1)
314 		switch (c) {
315 		case 'd':
316 			/* We don't support DEVFS. */
317 			break;
318 		case 's':
319 			requested_transition = single_user;
320 			break;
321 		case 'f':
322 			runcom_mode = FASTBOOT;
323 			break;
324 		default:
325 			warning("unrecognized flag '-%c'", c);
326 			break;
327 		}
328 
329 	if (optind != argc)
330 		warning("ignoring excess arguments");
331 
332 	/*
333 	 * We catch or block signals rather than ignore them,
334 	 * so that they get reset on exec.
335 	 */
336 	handle(badsys, SIGSYS, 0);
337 	handle(disaster, SIGABRT, SIGFPE, SIGILL, SIGSEGV,
338 	       SIGBUS, SIGXCPU, SIGXFSZ, 0);
339 	handle(transition_handler, SIGHUP, SIGINT, SIGTERM, SIGTSTP,
340 		SIGUSR1, SIGUSR2, 0);
341 	handle(alrm_handler, SIGALRM, 0);
342 	sigfillset(&mask);
343 	delset(&mask, SIGABRT, SIGFPE, SIGILL, SIGSEGV, SIGBUS, SIGSYS,
344 		SIGXCPU, SIGXFSZ, SIGHUP, SIGINT, SIGTERM, SIGTSTP, SIGALRM,
345 		SIGUSR1, SIGUSR2, 0);
346 	sigprocmask(SIG_SETMASK, &mask, NULL);
347 	sigemptyset(&sa.sa_mask);
348 	sa.sa_flags = 0;
349 	sa.sa_handler = SIG_IGN;
350 	sigaction(SIGTTIN, &sa, NULL);
351 	sigaction(SIGTTOU, &sa, NULL);
352 
353 	/*
354 	 * Paranoia.
355 	 */
356 	close(0);
357 	close(1);
358 	close(2);
359 
360 	/*
361 	 * Start the state machine.
362 	 */
363 	transition(requested_transition);
364 
365 	/*
366 	 * Should never reach here.
367 	 */
368 	return 1;
369 }
370 
371 /*
372  * Associate a function with a signal handler.
373  */
374 static void
375 handle(sig_t handler, ...)
376 {
377 	int sig;
378 	struct sigaction sa;
379 	sigset_t mask_everything;
380 	va_list ap;
381 
382 	va_start(ap, handler);
383 
384 	sa.sa_handler = handler;
385 	sigfillset(&mask_everything);
386 
387 	while ((sig = va_arg(ap, int)) != 0) {
388 		sa.sa_mask = mask_everything;
389 		/* XXX SA_RESTART? */
390 		sa.sa_flags = sig == SIGCHLD ? SA_NOCLDSTOP : 0;
391 		sigaction(sig, &sa, NULL);
392 	}
393 	va_end(ap);
394 }
395 
396 /*
397  * Delete a set of signals from a mask.
398  */
399 static void
400 delset(sigset_t *maskp, ...)
401 {
402 	int sig;
403 	va_list ap;
404 
405 	va_start(ap, maskp);
406 
407 	while ((sig = va_arg(ap, int)) != 0)
408 		sigdelset(maskp, sig);
409 	va_end(ap);
410 }
411 
412 /*
413  * Log a message and sleep for a while (to give someone an opportunity
414  * to read it and to save log or hardcopy output if the problem is chronic).
415  */
416 static void
417 stall(const char *message, ...)
418 {
419 	va_list ap;
420 
421 	va_start(ap, message);
422 
423 	vsyslog(LOG_ALERT, message, ap);
424 	va_end(ap);
425 	sleep(STALL_TIMEOUT);
426 }
427 
428 /*
429  * Like stall(), but doesn't sleep.
430  * If cpp had variadic macros, the two functions could be #defines for another.
431  */
432 static void
433 warning(const char *message, ...)
434 {
435 	va_list ap;
436 
437 	va_start(ap, message);
438 
439 	vsyslog(LOG_ALERT, message, ap);
440 	va_end(ap);
441 }
442 
443 /*
444  * Log an emergency message.
445  */
446 static void
447 emergency(const char *message, ...)
448 {
449 	va_list ap;
450 
451 	va_start(ap, message);
452 
453 	vsyslog(LOG_EMERG, message, ap);
454 	va_end(ap);
455 }
456 
457 /*
458  * Catch a SIGSYS signal.
459  *
460  * These may arise if a system does not support sysctl.
461  * We tolerate up to 25 of these, then throw in the towel.
462  */
463 static void
464 badsys(int sig)
465 {
466 	static int badcount = 0;
467 
468 	if (badcount++ < 25)
469 		return;
470 	disaster(sig);
471 }
472 
473 /*
474  * Catch an unexpected signal.
475  */
476 static void
477 disaster(int sig)
478 {
479 	emergency("fatal signal: %s",
480 		(unsigned)sig < NSIG ? sys_siglist[sig] : "unknown signal");
481 
482 	sleep(STALL_TIMEOUT);
483 	_exit(sig);		/* reboot */
484 }
485 
486 /*
487  * Get the security level of the kernel.
488  */
489 static int
490 getsecuritylevel(void)
491 {
492 #ifdef KERN_SECURELVL
493 	int name[2], curlevel;
494 	size_t len;
495 
496 	name[0] = CTL_KERN;
497 	name[1] = KERN_SECURELVL;
498 	len = sizeof curlevel;
499 	if (sysctl(name, 2, &curlevel, &len, NULL, 0) == -1) {
500 		emergency("cannot get kernel security level: %s",
501 		    strerror(errno));
502 		return (-1);
503 	}
504 	return (curlevel);
505 #else
506 	return (-1);
507 #endif
508 }
509 
510 /*
511  * Get the value of the "init_chroot" variable from the
512  * kernel environment (or NULL if not set).
513  */
514 
515 static char *
516 get_chroot(void)
517 {
518 	static const char ichname[] = "init_chroot=";	/* includes '=' */
519 	const int ichlen = strlen(ichname);
520 	int real_oid[CTL_MAXNAME];
521 	char sbuf[1024];
522 	size_t oidlen, slen;
523 	char *res;
524 	int i;
525 
526 	oidlen = NELEM(real_oid);
527 	if (sysctlnametomib("kern.environment", real_oid, &oidlen)) {
528 		warning("cannot find kern.environment base sysctl OID");
529 		return NULL;
530 	}
531 	if (oidlen + 1 >= NELEM(real_oid)) {
532 		warning("kern.environment OID is too large!");
533 		return NULL;
534 	}
535 	res = NULL;
536 	real_oid[oidlen] = 0;
537 
538 	for (i = 0; ; i++) {
539 		real_oid[oidlen + 1] = i;
540 		slen = sizeof(sbuf);
541 		if (sysctl(real_oid, oidlen + 2, sbuf, &slen, NULL, 0) < 0) {
542 			if (errno != ENOENT)
543 				warning("sysctl kern.environment.%d: %m", i);
544 			break;
545 		}
546 
547 		/*
548 		 * slen includes the terminating \0, but do a few sanity
549 		 * checks anyway.
550 		 */
551 		if (slen == 0)
552 			continue;
553 		sbuf[slen - 1] = 0;
554 		if (strncmp(sbuf, ichname, ichlen) != 0)
555 			continue;
556 		if (sbuf[ichlen])
557 			res = strdup(sbuf + ichlen);
558 		break;
559 	}
560 	return (res);
561 }
562 
563 /*
564  * Set the security level of the kernel.
565  */
566 static void
567 setsecuritylevel(int newlevel)
568 {
569 #ifdef KERN_SECURELVL
570 	int name[2], curlevel;
571 
572 	curlevel = getsecuritylevel();
573 	if (newlevel == curlevel)
574 		return;
575 	name[0] = CTL_KERN;
576 	name[1] = KERN_SECURELVL;
577 	if (sysctl(name, 2, NULL, NULL, &newlevel, sizeof newlevel) == -1) {
578 		emergency(
579 		    "cannot change kernel security level from %d to %d: %s",
580 		    curlevel, newlevel, strerror(errno));
581 		return;
582 	}
583 #ifdef SECURE
584 	warning("kernel security level changed from %d to %d",
585 	    curlevel, newlevel);
586 #endif
587 #endif
588 }
589 
590 /*
591  * Change states in the finite state machine.
592  * The initial state is passed as an argument.
593  */
594 static void
595 transition(state_t s)
596 {
597 	for (;;) {
598 #ifdef SUPPORT_UTMPX
599 		utmpx_set_runlevel(get_runlevel(current_state),
600 		    get_runlevel(s));
601 		current_state = s;
602 #endif
603 		s = (*state_funcs[s])();
604 	}
605 }
606 
607 /*
608  * Close out the accounting files for a login session.
609  */
610 static void
611 clear_session_logs(session_t *sp, int status)
612 {
613 	char *line = sp->se_device + sizeof(_PATH_DEV) - 1;
614 
615 #ifdef SUPPORT_UTMPX
616 	if (logoutx(line, status, DEAD_PROCESS))
617 		 logwtmpx(line, "", "", status, DEAD_PROCESS);
618 #endif
619 #ifdef SUPPORT_UTMP
620 	if (logout(line))
621 		logwtmp(line, "", "");
622 #endif
623 }
624 
625 /*
626  * Start a session and allocate a controlling terminal.
627  * Only called by children of init after forking.
628  */
629 static void
630 setctty(const char *name)
631 {
632 	int fd;
633 
634 	revoke(name);
635 	if ((fd = open(name, O_RDWR)) == -1) {
636 		stall("can't open %s: %m", name);
637 		_exit(1);
638 	}
639 	if (login_tty(fd) == -1) {
640 		stall("can't get %s for controlling terminal: %m", name);
641 		_exit(1);
642 	}
643 }
644 
645 /*
646  * Bring the system up single user.
647  */
648 static state_t
649 f_single_user(void)
650 {
651 	pid_t pid, wpid;
652 	int status;
653 	sigset_t mask;
654 	const char *shell = _PATH_BSHELL;
655 	const char *argv[2];
656 #ifdef SECURE
657 	struct ttyent *typ;
658 	struct passwd *pp;
659 	static const char banner[] =
660 		"Enter root password, or ^D to go multi-user\n";
661 	char *clear, *password;
662 #endif
663 #ifdef DEBUGSHELL
664 	char altshell[128];
665 #endif
666 
667 	if (Reboot) {
668 		/* Instead of going single user, let's reboot the machine */
669 		sync();
670 		alarm(2);
671 		pause();
672 		reboot(howto);
673 		_exit(0);
674 	}
675 
676 	if ((pid = fork()) == 0) {
677 		/*
678 		 * Start the single user session.
679 		 */
680 		setctty(_PATH_CONSOLE);
681 
682 #ifdef SECURE
683 		/*
684 		 * Check the root password.
685 		 * We don't care if the console is 'on' by default;
686 		 * it's the only tty that can be 'off' and 'secure'.
687 		 */
688 		typ = getttynam("console");
689 		pp = getpwnam("root");
690 		if (typ && (typ->ty_status & TTY_SECURE) == 0 &&
691 		    pp && *pp->pw_passwd) {
692 			write(2, banner, sizeof banner - 1);
693 			for (;;) {
694 				clear = getpass("Password:");
695 				if (clear == NULL || *clear == '\0')
696 					_exit(0);
697 				password = crypt(clear, pp->pw_passwd);
698 				bzero(clear, _PASSWORD_LEN);
699 				if (password != NULL && strcmp(password, pp->pw_passwd) == 0)
700 					break;
701 				warning("single-user login failed\n");
702 			}
703 		}
704 		endttyent();
705 		endpwent();
706 #endif /* SECURE */
707 
708 #ifdef DEBUGSHELL
709 		{
710 			char *cp = altshell;
711 			int num;
712 
713 #define	SHREQUEST \
714 	"Enter full pathname of shell or RETURN for " _PATH_BSHELL ": "
715 			write(STDERR_FILENO, SHREQUEST, sizeof(SHREQUEST) - 1);
716 			while ((num = read(STDIN_FILENO, cp, 1)) != -1 &&
717 			    num != 0 && *cp != '\n' && cp < &altshell[127])
718 					cp++;
719 			*cp = '\0';
720 			if (altshell[0] != '\0')
721 				shell = altshell;
722 		}
723 #endif /* DEBUGSHELL */
724 
725 		/*
726 		 * Unblock signals.
727 		 * We catch all the interesting ones,
728 		 * and those are reset to SIG_DFL on exec.
729 		 */
730 		sigemptyset(&mask);
731 		sigprocmask(SIG_SETMASK, &mask, NULL);
732 
733 		/*
734 		 * Fire off a shell.
735 		 * If the default one doesn't work, try the Bourne shell.
736 		 */
737 		argv[0] = "-sh";
738 		argv[1] = NULL;
739 		execv(shell, __DECONST(char **, argv));
740 		emergency("can't exec %s for single user: %m", shell);
741 		execv(_PATH_BSHELL, __DECONST(char **, argv));
742 		emergency("can't exec %s for single user: %m", _PATH_BSHELL);
743 		sleep(STALL_TIMEOUT);
744 		_exit(1);
745 	}
746 
747 	if (pid == -1) {
748 		/*
749 		 * We are seriously hosed.  Do our best.
750 		 */
751 		emergency("can't fork single-user shell, trying again");
752 		while (waitpid(-1, NULL, WNOHANG) > 0)
753 			continue;
754 		return single_user;
755 	}
756 
757 	requested_transition = 0;
758 	do {
759 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
760 			collect_child(wpid, status);
761 		if (wpid == -1) {
762 			if (errno == EINTR)
763 				continue;
764 			warning("wait for single-user shell failed: %m; restarting");
765 			return single_user;
766 		}
767 		if (wpid == pid && WIFSTOPPED(status)) {
768 			warning("init: shell stopped, restarting\n");
769 			kill(pid, SIGCONT);
770 			wpid = -1;
771 		}
772 	} while (wpid != pid && !requested_transition);
773 
774 	if (requested_transition)
775 		return requested_transition;
776 
777 	if (!WIFEXITED(status)) {
778 		if (WTERMSIG(status) == SIGKILL) {
779 			/*
780 			 *  reboot(8) killed shell?
781 			 */
782 			warning("single user shell terminated.");
783 			sleep(STALL_TIMEOUT);
784 			_exit(0);
785 		} else {
786 			warning("single user shell terminated, restarting");
787 			return single_user;
788 		}
789 	}
790 
791 	runcom_mode = FASTBOOT;
792 	return runcom;
793 }
794 
795 /*
796  * Run the system startup script.
797  */
798 static state_t
799 f_runcom(void)
800 {
801 	pid_t pid, wpid;
802 	int status;
803 	const char *argv[4];
804 	struct sigaction sa;
805 
806 	if ((pid = fork()) == 0) {
807 		sigemptyset(&sa.sa_mask);
808 		sa.sa_flags = 0;
809 		sa.sa_handler = SIG_IGN;
810 		sigaction(SIGTSTP, &sa, NULL);
811 		sigaction(SIGHUP, &sa, NULL);
812 
813 		setctty(_PATH_CONSOLE);
814 
815 		argv[0] = "sh";
816 		argv[1] = _PATH_RUNCOM;
817 		argv[2] = runcom_mode == AUTOBOOT ? "autoboot" : 0;
818 		argv[3] = NULL;
819 
820 		sigprocmask(SIG_SETMASK, &sa.sa_mask, NULL);
821 
822 #ifdef LOGIN_CAP
823 		setprocresources(RESOURCE_RC);
824 #endif
825 		execv(_PATH_BSHELL, __DECONST(char **, argv));
826 		stall("can't exec %s for %s: %m", _PATH_BSHELL, _PATH_RUNCOM);
827 		_exit(1);	/* force single user mode */
828 	}
829 
830 	if (pid == -1) {
831 		emergency("can't fork for %s on %s: %m",
832 			_PATH_BSHELL, _PATH_RUNCOM);
833 		while (waitpid(-1, NULL, WNOHANG) > 0)
834 			continue;
835 		sleep(STALL_TIMEOUT);
836 		return single_user;
837 	}
838 
839 	/*
840 	 * Copied from single_user().  This is a bit paranoid.
841 	 */
842 	requested_transition = 0;
843 	do {
844 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
845 			collect_child(wpid, status);
846 		if (wpid == -1) {
847 			if (requested_transition == death)
848 				return death;
849 			if (errno == EINTR)
850 				continue;
851 			warning("wait for %s on %s failed: %m; going to single user mode",
852 				_PATH_BSHELL, _PATH_RUNCOM);
853 			return single_user;
854 		}
855 		if (wpid == pid && WIFSTOPPED(status)) {
856 			warning("init: %s on %s stopped, restarting\n",
857 				_PATH_BSHELL, _PATH_RUNCOM);
858 			kill(pid, SIGCONT);
859 			wpid = -1;
860 		}
861 	} while (wpid != pid);
862 
863 	if (WIFSIGNALED(status) && WTERMSIG(status) == SIGTERM &&
864 	    requested_transition == catatonia) {
865 		/* /etc/rc executed /sbin/reboot; wait for the end quietly */
866 		sigset_t s;
867 
868 		sigfillset(&s);
869 		for (;;)
870 			sigsuspend(&s);
871 	}
872 
873 	if (!WIFEXITED(status)) {
874 		warning("%s on %s terminated abnormally, going to single user mode",
875 			_PATH_BSHELL, _PATH_RUNCOM);
876 		return single_user;
877 	}
878 
879 	if (WEXITSTATUS(status))
880 		return single_user;
881 
882 	runcom_mode = AUTOBOOT;		/* the default */
883 #ifdef SUPPORT_UTMPX
884 	logwtmpx("~", "reboot", "", 0, INIT_PROCESS);
885 #endif
886 #ifdef SUPPORT_UTMP
887 	logwtmp("~", "reboot", "");
888 #endif
889 	return read_ttys;
890 }
891 
892 /*
893  * Open the session database.
894  *
895  * NB: We could pass in the size here; is it necessary?
896  */
897 static int
898 start_session_db(void)
899 {
900 	if (session_db && (*session_db->close)(session_db))
901 		emergency("session database close: %s", strerror(errno));
902 	if ((session_db = dbopen(NULL, O_RDWR, 0, DB_HASH, NULL)) == NULL) {
903 		emergency("session database open: %s", strerror(errno));
904 		return (1);
905 	}
906 	return (0);
907 
908 }
909 
910 /*
911  * Add a new login session.
912  */
913 static void
914 add_session(session_t *sp)
915 {
916 	DBT key;
917 	DBT data;
918 
919 	key.data = &sp->se_process;
920 	key.size = sizeof sp->se_process;
921 	data.data = &sp;
922 	data.size = sizeof sp;
923 
924 	if ((*session_db->put)(session_db, &key, &data, 0))
925 		emergency("insert %d: %s", sp->se_process, strerror(errno));
926 #ifdef SUPPORT_UTMPX
927 	session_utmpx(sp, 1);
928 #endif
929 }
930 
931 /*
932  * Delete an old login session.
933  */
934 static void
935 del_session(session_t *sp)
936 {
937 	DBT key;
938 
939 	key.data = &sp->se_process;
940 	key.size = sizeof sp->se_process;
941 
942 	if ((*session_db->del)(session_db, &key, 0))
943 		emergency("delete %d: %s", sp->se_process, strerror(errno));
944 #ifdef SUPPORT_UTMPX
945 	session_utmpx(sp, 0);
946 #endif
947 }
948 
949 /*
950  * Look up a login session by pid.
951  */
952 static session_t *
953 find_session(pid_t pid)
954 {
955 	DBT key;
956 	DBT data;
957 	session_t *ret;
958 
959 	key.data = &pid;
960 	key.size = sizeof pid;
961 	if ((*session_db->get)(session_db, &key, &data, 0) != 0)
962 		return 0;
963 	bcopy(data.data, (char *)&ret, sizeof(ret));
964 	return ret;
965 }
966 
967 /*
968  * Construct an argument vector from a command line.
969  */
970 static char **
971 construct_argv(char *command)
972 {
973 	int argc = 0;
974 	char **argv = malloc(((strlen(command) + 1) / 2 + 1)
975 						* sizeof (char *));
976 
977 	if ((argv[argc++] = strk(command)) == NULL) {
978 		free(argv);
979 		return (NULL);
980 	}
981 	while ((argv[argc++] = strk(NULL)) != NULL)
982 		continue;
983 	return argv;
984 }
985 
986 /*
987  * Deallocate a session descriptor.
988  */
989 static void
990 free_session(session_t *sp)
991 {
992 	free(sp->se_device);
993 	if (sp->se_getty) {
994 		free(sp->se_getty);
995 		free(sp->se_getty_argv_space);
996 		free(sp->se_getty_argv);
997 	}
998 	if (sp->se_window) {
999 		free(sp->se_window);
1000 		free(sp->se_window_argv_space);
1001 		free(sp->se_window_argv);
1002 	}
1003 	if (sp->se_type)
1004 		free(sp->se_type);
1005 	free(sp);
1006 }
1007 
1008 static
1009 void
1010 adjttyent(struct ttyent *typ)
1011 {
1012 	struct stat st;
1013 	uint32_t rdev;
1014 	char *devpath;
1015 	size_t rdev_size = sizeof(rdev);
1016 
1017 	if (typ->ty_name == NULL)
1018 		return;
1019 
1020 	/*
1021 	 * IFCONSOLE option forces tty off if not the console.
1022 	 */
1023 	if (typ->ty_status & TTY_IFCONSOLE) {
1024 		asprintf(&devpath, "%s%s", _PATH_DEV, typ->ty_name);
1025 		if (stat(devpath, &st) < 0 ||
1026 		    sysctlbyname("kern.console_rdev",
1027 				 &rdev, &rdev_size,
1028 				 NULL, 0) < 0) {
1029 			/* device does not exist or no sysctl, disable */
1030 			typ->ty_status &= ~TTY_ON;
1031 		} else if (rdev != st.st_rdev) {
1032 			typ->ty_status &= ~TTY_ON;
1033 		}
1034 		free(devpath);
1035 	}
1036 }
1037 
1038 /*
1039  * Allocate a new session descriptor.
1040  * Mark it SE_PRESENT.
1041  */
1042 static session_t *
1043 new_session(session_t *sprev, int session_index, struct ttyent *typ)
1044 {
1045 	session_t *sp;
1046 	int fd;
1047 
1048 	if (typ->ty_name == NULL || typ->ty_getty == NULL)
1049 		return 0;
1050 
1051 	if ((typ->ty_status & TTY_ON) == 0)
1052 		return 0;
1053 
1054 	sp = (session_t *) calloc(1, sizeof (session_t));
1055 
1056 	asprintf(&sp->se_device, "%s%s", _PATH_DEV, typ->ty_name);
1057 	sp->se_index = session_index;
1058 	sp->se_flags |= SE_PRESENT;
1059 
1060 	/*
1061 	 * Attempt to open the device, if we get "device not configured"
1062 	 * then don't add the device to the session list.
1063 	 */
1064 	if ((fd = open(sp->se_device, O_RDONLY | O_NONBLOCK, 0)) < 0) {
1065 		if (errno == ENXIO) {
1066 			free_session(sp);
1067 			return (0);
1068 		}
1069 	} else
1070 		close(fd);
1071 
1072 	if (setupargv(sp, typ) == 0) {
1073 		free_session(sp);
1074 		return (0);
1075 	}
1076 
1077 	sp->se_next = NULL;
1078 	if (sprev == NULL) {
1079 		sessions = sp;
1080 		sp->se_prev = NULL;
1081 	} else {
1082 		sprev->se_next = sp;
1083 		sp->se_prev = sprev;
1084 	}
1085 
1086 	return sp;
1087 }
1088 
1089 /*
1090  * Calculate getty and if useful window argv vectors.
1091  */
1092 static int
1093 setupargv(session_t *sp, struct ttyent *typ)
1094 {
1095 
1096 	if (sp->se_getty) {
1097 		free(sp->se_getty);
1098 		free(sp->se_getty_argv_space);
1099 		free(sp->se_getty_argv);
1100 	}
1101 	sp->se_getty = malloc(strlen(typ->ty_getty) + strlen(typ->ty_name) + 2);
1102 	sprintf(sp->se_getty, "%s %s", typ->ty_getty, typ->ty_name);
1103 	sp->se_getty_argv_space = strdup(sp->se_getty);
1104 	sp->se_getty_argv = construct_argv(sp->se_getty_argv_space);
1105 	if (sp->se_getty_argv == NULL) {
1106 		warning("can't parse getty for port %s", sp->se_device);
1107 		free(sp->se_getty);
1108 		free(sp->se_getty_argv_space);
1109 		sp->se_getty = sp->se_getty_argv_space = NULL;
1110 		return (0);
1111 	}
1112 	if (sp->se_window) {
1113 		free(sp->se_window);
1114 		free(sp->se_window_argv_space);
1115 		free(sp->se_window_argv);
1116 	}
1117 	sp->se_window = sp->se_window_argv_space = NULL;
1118 	sp->se_window_argv = NULL;
1119 	if (typ->ty_window) {
1120 		sp->se_window = strdup(typ->ty_window);
1121 		sp->se_window_argv_space = strdup(sp->se_window);
1122 		sp->se_window_argv = construct_argv(sp->se_window_argv_space);
1123 		if (sp->se_window_argv == NULL) {
1124 			warning("can't parse window for port %s",
1125 				sp->se_device);
1126 			free(sp->se_window_argv_space);
1127 			free(sp->se_window);
1128 			sp->se_window = sp->se_window_argv_space = NULL;
1129 			return (0);
1130 		}
1131 	}
1132 	if (sp->se_type)
1133 		free(sp->se_type);
1134 	sp->se_type = typ->ty_type ? strdup(typ->ty_type) : 0;
1135 	return (1);
1136 }
1137 
1138 /*
1139  * Walk the list of ttys and create sessions for each active line.
1140  */
1141 static state_t
1142 f_read_ttys(void)
1143 {
1144 	int session_index = 0;
1145 	session_t *sp, *snext;
1146 	struct ttyent *typ;
1147 
1148 #ifdef SUPPORT_UTMPX
1149 	if (sessions == NULL) {
1150 		struct stat st;
1151 
1152 		make_utmpx("", BOOT_MSG, BOOT_TIME, 0, &boot_time, 0);
1153 
1154 		/*
1155 		 * If wtmpx is not empty, pick the down time from there
1156 		 */
1157 		if (stat(_PATH_WTMPX, &st) != -1 && st.st_size != 0) {
1158 			struct timeval down_time;
1159 
1160 			TIMESPEC_TO_TIMEVAL(&down_time,
1161 			    st.st_atime > st.st_mtime ?
1162 			    &st.st_atimespec : &st.st_mtimespec);
1163 			make_utmpx("", DOWN_MSG, DOWN_TIME, 0, &down_time, 0);
1164 		}
1165 	}
1166 #endif
1167 	/*
1168 	 * Destroy any previous session state.
1169 	 * There shouldn't be any, but just in case...
1170 	 */
1171 	for (sp = sessions; sp; sp = snext) {
1172 		if (sp->se_process)
1173 			clear_session_logs(sp, 0);
1174 		snext = sp->se_next;
1175 		free_session(sp);
1176 	}
1177 	sessions = NULL;
1178 	if (start_session_db())
1179 		return single_user;
1180 
1181 	/*
1182 	 * Allocate a session entry for each active port.
1183 	 * Note that sp starts at 0.
1184 	 */
1185 	while ((typ = getttyent()) != NULL) {
1186 		adjttyent(typ);
1187 		if ((snext = new_session(sp, ++session_index, typ)) != NULL)
1188 			sp = snext;
1189 	}
1190 
1191 	endttyent();
1192 
1193 	return multi_user;
1194 }
1195 
1196 /*
1197  * Start a window system running.
1198  */
1199 static void
1200 start_window_system(session_t *sp)
1201 {
1202 	pid_t pid;
1203 	sigset_t mask;
1204 	char term[64], *env[2];
1205 
1206 	if ((pid = fork()) == -1) {
1207 		emergency("can't fork for window system on port %s: %m",
1208 			sp->se_device);
1209 		/* hope that getty fails and we can try again */
1210 		return;
1211 	}
1212 
1213 	if (pid)
1214 		return;
1215 
1216 	sigemptyset(&mask);
1217 	sigprocmask(SIG_SETMASK, &mask, NULL);
1218 
1219 	if (setsid() < 0)
1220 		emergency("setsid failed (window) %m");
1221 
1222 #ifdef LOGIN_CAP
1223 	setprocresources(RESOURCE_WINDOW);
1224 #endif
1225 	if (sp->se_type) {
1226 		/* Don't use malloc after fork */
1227 		strcpy(term, "TERM=");
1228 		strncat(term, sp->se_type, sizeof(term) - 6);
1229 		env[0] = term;
1230 		env[1] = NULL;
1231 	}
1232 	else
1233 		env[0] = NULL;
1234 	execve(sp->se_window_argv[0], sp->se_window_argv, env);
1235 	stall("can't exec window system '%s' for port %s: %m",
1236 		sp->se_window_argv[0], sp->se_device);
1237 	_exit(1);
1238 }
1239 
1240 /*
1241  * Start a login session running.
1242  */
1243 static pid_t
1244 start_getty(session_t *sp)
1245 {
1246 	pid_t pid;
1247 	sigset_t mask;
1248 	time_t current_time = time(NULL);
1249 	int too_quick = 0;
1250 	char term[64], *env[2];
1251 
1252 	if (current_time >= sp->se_started.tv_sec &&
1253 	    current_time - sp->se_started.tv_sec < GETTY_SPACING) {
1254 		if (++sp->se_nspace > GETTY_NSPACE) {
1255 			sp->se_nspace = 0;
1256 			too_quick = 1;
1257 		}
1258 	} else
1259 		sp->se_nspace = 0;
1260 
1261 	/*
1262 	 * fork(), not vfork() -- we can't afford to block.
1263 	 */
1264 	if ((pid = fork()) == -1) {
1265 		emergency("can't fork for getty on port %s: %m", sp->se_device);
1266 		return -1;
1267 	}
1268 
1269 	if (pid)
1270 		return pid;
1271 
1272 	if (too_quick) {
1273 		warning("getty repeating too quickly on port %s, sleeping %d secs",
1274 			sp->se_device, GETTY_SLEEP);
1275 		sleep((unsigned) GETTY_SLEEP);
1276 	}
1277 
1278 	if (sp->se_window) {
1279 		start_window_system(sp);
1280 		sleep(WINDOW_WAIT);
1281 	}
1282 
1283 	sigemptyset(&mask);
1284 	sigprocmask(SIG_SETMASK, &mask, NULL);
1285 
1286 #ifdef LOGIN_CAP
1287 	setprocresources(RESOURCE_GETTY);
1288 #endif
1289 	if (sp->se_type) {
1290 		/* Don't use malloc after fork */
1291 		strcpy(term, "TERM=");
1292 		strncat(term, sp->se_type, sizeof(term) - 6);
1293 		env[0] = term;
1294 		env[1] = NULL;
1295 	}
1296 	else
1297 		env[0] = NULL;
1298 	execve(sp->se_getty_argv[0], sp->se_getty_argv, env);
1299 	stall("can't exec getty '%s' for port %s: %m",
1300 		sp->se_getty_argv[0], sp->se_device);
1301 	_exit(1);
1302 }
1303 
1304 /*
1305  * Collect exit status for a child.
1306  * If an exiting login, start a new login running.
1307  */
1308 static void
1309 collect_child(pid_t pid, int status)
1310 {
1311 	session_t *sp, *sprev, *snext;
1312 
1313 	if (! sessions)
1314 		return;
1315 
1316 	if (! (sp = find_session(pid)))
1317 		return;
1318 
1319 	clear_session_logs(sp, status);
1320 	del_session(sp);
1321 	sp->se_process = 0;
1322 
1323 	if (sp->se_flags & SE_SHUTDOWN) {
1324 		if ((sprev = sp->se_prev) != NULL)
1325 			sprev->se_next = sp->se_next;
1326 		else
1327 			sessions = sp->se_next;
1328 		if ((snext = sp->se_next) != NULL)
1329 			snext->se_prev = sp->se_prev;
1330 		free_session(sp);
1331 		return;
1332 	}
1333 
1334 	if ((pid = start_getty(sp)) == -1) {
1335 		/* serious trouble */
1336 		requested_transition = clean_ttys;
1337 		return;
1338 	}
1339 
1340 	sp->se_process = pid;
1341 	gettimeofday(&sp->se_started, NULL);
1342 	add_session(sp);
1343 }
1344 
1345 /*
1346  * Catch a signal and request a state transition.
1347  */
1348 static void
1349 transition_handler(int sig)
1350 {
1351 
1352 	switch (sig) {
1353 	case SIGHUP:
1354 		requested_transition = clean_ttys;
1355 		break;
1356 	case SIGUSR2:
1357 		howto = RB_POWEROFF;
1358 		/* FALLTHROUGH */
1359 	case SIGUSR1:
1360 		howto |= RB_HALT;
1361 		/* FALLTHROUGH */
1362 	case SIGINT:
1363 		Reboot = TRUE;
1364 		/* FALLTHROUGH */
1365 	case SIGTERM:
1366 		requested_transition = death;
1367 		break;
1368 	case SIGTSTP:
1369 		requested_transition = catatonia;
1370 		break;
1371 	default:
1372 		requested_transition = 0;
1373 		break;
1374 	}
1375 }
1376 
1377 /*
1378  * Take the system multiuser.
1379  */
1380 static state_t
1381 f_multi_user(void)
1382 {
1383 	pid_t pid;
1384 	int status;
1385 	session_t *sp;
1386 
1387 	requested_transition = 0;
1388 
1389 	/*
1390 	 * If the administrator has not set the security level to -1
1391 	 * to indicate that the kernel should not run multiuser in secure
1392 	 * mode, and the run script has not set a higher level of security
1393 	 * than level 1, then put the kernel into secure mode.
1394 	 */
1395 	if (getsecuritylevel() == 0)
1396 		setsecuritylevel(1);
1397 
1398 	for (sp = sessions; sp; sp = sp->se_next) {
1399 		if (sp->se_process)
1400 			continue;
1401 		if ((pid = start_getty(sp)) == -1) {
1402 			/* serious trouble */
1403 			requested_transition = clean_ttys;
1404 			break;
1405 		}
1406 		sp->se_process = pid;
1407 		gettimeofday(&sp->se_started, NULL);
1408 		add_session(sp);
1409 	}
1410 
1411 	while (!requested_transition)
1412 		if ((pid = waitpid(-1, &status, 0)) != -1)
1413 			collect_child(pid, status);
1414 
1415 	return requested_transition;
1416 }
1417 
1418 /*
1419  * This is an (n*2)+(n^2) algorithm.  We hope it isn't run often...
1420  */
1421 static state_t
1422 f_clean_ttys(void)
1423 {
1424 	session_t *sp, *sprev;
1425 	struct ttyent *typ;
1426 	int session_index = 0;
1427 	int devlen;
1428 	char *old_getty, *old_window, *old_type;
1429 
1430 	if (! sessions)
1431 		return multi_user;
1432 
1433 	/*
1434 	 * mark all sessions for death, (!SE_PRESENT)
1435 	 * as we find or create new ones they'll be marked as keepers,
1436 	 * we'll later nuke all the ones not found in /etc/ttys
1437 	 */
1438 	for (sp = sessions; sp != NULL; sp = sp->se_next)
1439 		sp->se_flags &= ~SE_PRESENT;
1440 
1441 	devlen = sizeof(_PATH_DEV) - 1;
1442 	while ((typ = getttyent()) != NULL) {
1443 		++session_index;
1444 
1445 		adjttyent(typ);
1446 		for (sprev = NULL, sp = sessions; sp; sprev = sp, sp = sp->se_next)
1447 			if (strcmp(typ->ty_name, sp->se_device + devlen) == 0)
1448 				break;
1449 
1450 		if (sp) {
1451 			/* we want this one to live */
1452 			sp->se_flags |= SE_PRESENT;
1453 			if (sp->se_index != session_index) {
1454 				warning("port %s changed utmp index from %d to %d",
1455 				       sp->se_device, sp->se_index,
1456 				       session_index);
1457 				sp->se_index = session_index;
1458 			}
1459 			if ((typ->ty_status & TTY_ON) == 0 ||
1460 			    typ->ty_getty == 0) {
1461 				sp->se_flags |= SE_SHUTDOWN;
1462 				kill(sp->se_process, SIGHUP);
1463 				continue;
1464 			}
1465 			sp->se_flags &= ~SE_SHUTDOWN;
1466 			old_getty = sp->se_getty ? strdup(sp->se_getty) : 0;
1467 			old_window = sp->se_window ? strdup(sp->se_window) : 0;
1468 			old_type = sp->se_type ? strdup(sp->se_type) : 0;
1469 			if (setupargv(sp, typ) == 0) {
1470 				warning("can't parse getty for port %s",
1471 					sp->se_device);
1472 				sp->se_flags |= SE_SHUTDOWN;
1473 				kill(sp->se_process, SIGHUP);
1474 			}
1475 			else if (   !old_getty
1476 				 || (!old_type && sp->se_type)
1477 				 || (old_type && !sp->se_type)
1478 				 || (!old_window && sp->se_window)
1479 				 || (old_window && !sp->se_window)
1480 				 || (strcmp(old_getty, sp->se_getty) != 0)
1481 				 || (old_window && strcmp(old_window, sp->se_window) != 0)
1482 				 || (old_type && strcmp(old_type, sp->se_type) != 0)
1483 				) {
1484 				/* Don't set SE_SHUTDOWN here */
1485 				sp->se_nspace = 0;
1486 				sp->se_started.tv_sec = sp->se_started.tv_usec = 0;
1487 				kill(sp->se_process, SIGHUP);
1488 			}
1489 			if (old_getty)
1490 				free(old_getty);
1491 			if (old_window)
1492 				free(old_window);
1493 			if (old_type)
1494 				free(old_type);
1495 			continue;
1496 		}
1497 
1498 		new_session(sprev, session_index, typ);
1499 	}
1500 
1501 	endttyent();
1502 
1503 	/*
1504 	 * sweep through and kill all deleted sessions
1505 	 * ones who's /etc/ttys line was deleted (SE_PRESENT unset)
1506 	 */
1507 	for (sp = sessions; sp != NULL; sp = sp->se_next) {
1508 		if ((sp->se_flags & SE_PRESENT) == 0) {
1509 			sp->se_flags |= SE_SHUTDOWN;
1510 			kill(sp->se_process, SIGHUP);
1511 		}
1512 	}
1513 
1514 	return multi_user;
1515 }
1516 
1517 /*
1518  * Block further logins.
1519  */
1520 static state_t
1521 f_catatonia(void)
1522 {
1523 	session_t *sp;
1524 
1525 	for (sp = sessions; sp; sp = sp->se_next)
1526 		sp->se_flags |= SE_SHUTDOWN;
1527 
1528 	return multi_user;
1529 }
1530 
1531 /*
1532  * Note SIGALRM.
1533  */
1534 static void
1535 alrm_handler(int sig __unused)
1536 {
1537 	clang = 1;
1538 }
1539 
1540 /*
1541  * Bring the system down to single user.
1542  */
1543 static state_t
1544 f_death(void)
1545 {
1546 	session_t *sp;
1547 	int i;
1548 	pid_t pid;
1549 	int status;
1550 	static const int death_sigs[2] = { SIGTERM, SIGKILL };
1551 
1552 #ifdef SUPPORT_UTMPX
1553 	logwtmpx("~", "shutdown", "", 0, INIT_PROCESS);
1554 #endif
1555 #ifdef SUPPORT_UTMP
1556 	logwtmp("~", "shutdown", "");
1557 #endif
1558 
1559 	for (sp = sessions; sp; sp = sp->se_next) {
1560 		sp->se_flags |= SE_SHUTDOWN;
1561 		kill(sp->se_process, SIGHUP);
1562 	}
1563 
1564 	/* Try to run the rc.shutdown script within a period of time */
1565 	runshutdown();
1566 
1567 	for (i = 0; i < 2; ++i) {
1568 		if (kill(-1, death_sigs[i]) == -1 && errno == ESRCH)
1569 			return single_user;
1570 
1571 		clang = 0;
1572 		alarm(DEATH_WATCH);
1573 		do
1574 			if ((pid = waitpid(-1, &status, 0)) != -1)
1575 				collect_child(pid, status);
1576 		while (clang == 0 && errno != ECHILD);
1577 
1578 		if (errno == ECHILD)
1579 			return single_user;
1580 	}
1581 
1582 	warning("some processes would not die; ps axl advised");
1583 
1584 	return single_user;
1585 }
1586 
1587 /*
1588  * Run the system shutdown script.
1589  *
1590  * Exit codes:      XXX I should document more
1591  * -2       shutdown script terminated abnormally
1592  * -1       fatal error - can't run script
1593  * 0        good.
1594  * >0       some error (exit code)
1595  */
1596 static int
1597 runshutdown(void)
1598 {
1599 	pid_t pid, wpid;
1600 	int status;
1601 	int shutdowntimeout;
1602 	size_t len;
1603 	const char *argv[4];
1604 	struct sigaction sa;
1605 	struct stat sb;
1606 
1607 	/*
1608 	 * rc.shutdown is optional, so to prevent any unnecessary
1609 	 * complaints from the shell we simply don't run it if the
1610 	 * file does not exist. If the stat() here fails for other
1611 	 * reasons, we'll let the shell complain.
1612 	 */
1613 	if (stat(_PATH_RUNDOWN, &sb) == -1 && errno == ENOENT)
1614 		return 0;
1615 
1616 	if ((pid = fork()) == 0) {
1617 		int	fd;
1618 
1619 		/* Assume that init already grab console as ctty before */
1620 
1621 		sigemptyset(&sa.sa_mask);
1622 		sa.sa_flags = 0;
1623 		sa.sa_handler = SIG_IGN;
1624 		sigaction(SIGTSTP, &sa, NULL);
1625 		sigaction(SIGHUP, &sa, NULL);
1626 
1627 		if ((fd = open(_PATH_CONSOLE, O_RDWR)) == -1)
1628 		    warning("can't open %s: %m", _PATH_CONSOLE);
1629 		else {
1630 		    dup2(fd, 0);
1631 		    dup2(fd, 1);
1632 		    dup2(fd, 2);
1633 		    if (fd > 2)
1634 			close(fd);
1635 		}
1636 
1637 		/*
1638 		 * Run the shutdown script.
1639 		 */
1640 		argv[0] = "sh";
1641 		argv[1] = _PATH_RUNDOWN;
1642 		if (Reboot)
1643 			argv[2] = "reboot";
1644 		else
1645 			argv[2] = "single";
1646 		argv[3] = NULL;
1647 
1648 		sigprocmask(SIG_SETMASK, &sa.sa_mask, NULL);
1649 
1650 #ifdef LOGIN_CAP
1651 		setprocresources(RESOURCE_RC);
1652 #endif
1653 		execv(_PATH_BSHELL, __DECONST(char **, argv));
1654 		warning("can't exec %s for %s: %m", _PATH_BSHELL, _PATH_RUNDOWN);
1655 		_exit(1);	/* force single user mode */
1656 	}
1657 
1658 	if (pid == -1) {
1659 		emergency("can't fork for %s on %s: %m",
1660 			_PATH_BSHELL, _PATH_RUNDOWN);
1661 		while (waitpid(-1, NULL, WNOHANG) > 0)
1662 			continue;
1663 		sleep(STALL_TIMEOUT);
1664 		return -1;
1665 	}
1666 
1667 	len = sizeof(shutdowntimeout);
1668 	if (sysctlbyname("kern.init_shutdown_timeout",
1669 			 &shutdowntimeout,
1670 			 &len, NULL, 0) == -1 || shutdowntimeout < 2)
1671 	    shutdowntimeout = DEATH_SCRIPT;
1672 	alarm(shutdowntimeout);
1673 	clang = 0;
1674 	/*
1675 	 * Copied from single_user().  This is a bit paranoid.
1676 	 * Use the same ALRM handler.
1677 	 */
1678 	do {
1679 		if ((wpid = waitpid(-1, &status, WUNTRACED)) != -1)
1680 			collect_child(wpid, status);
1681 		if (clang == 1) {
1682 			/* we were waiting for the sub-shell */
1683 			kill(wpid, SIGTERM);
1684 			warning("timeout expired for %s on %s: %m; going to single user mode",
1685 				_PATH_BSHELL, _PATH_RUNDOWN);
1686 			return -1;
1687 		}
1688 		if (wpid == -1) {
1689 			if (errno == EINTR)
1690 				continue;
1691 			warning("wait for %s on %s failed: %m; going to single user mode",
1692 				_PATH_BSHELL, _PATH_RUNDOWN);
1693 			return -1;
1694 		}
1695 		if (wpid == pid && WIFSTOPPED(status)) {
1696 			warning("init: %s on %s stopped, restarting\n",
1697 				_PATH_BSHELL, _PATH_RUNDOWN);
1698 			kill(pid, SIGCONT);
1699 			wpid = -1;
1700 		}
1701 	} while (wpid != pid && !clang);
1702 
1703 	/* Turn off the alarm */
1704 	alarm(0);
1705 
1706 	if (WIFSIGNALED(status) && WTERMSIG(status) == SIGTERM &&
1707 	    requested_transition == catatonia) {
1708 		/*
1709 		 * /etc/rc.shutdown executed /sbin/reboot;
1710 		 * wait for the end quietly
1711 		 */
1712 		sigset_t s;
1713 
1714 		sigfillset(&s);
1715 		for (;;)
1716 			sigsuspend(&s);
1717 	}
1718 
1719 	if (!WIFEXITED(status)) {
1720 		warning("%s on %s terminated abnormally, going to single user mode",
1721 			_PATH_BSHELL, _PATH_RUNDOWN);
1722 		return -2;
1723 	}
1724 
1725 	if ((status = WEXITSTATUS(status)) != 0)
1726 		warning("%s returned status %d", _PATH_RUNDOWN, status);
1727 
1728 	return status;
1729 }
1730 
1731 static char *
1732 strk(char *p)
1733 {
1734     static char *t;
1735     char *q;
1736     int c;
1737 
1738     if (p)
1739 	t = p;
1740     if (!t)
1741 	return 0;
1742 
1743     c = *t;
1744     while (c == ' ' || c == '\t' )
1745 	c = *++t;
1746     if (!c) {
1747 	t = NULL;
1748 	return 0;
1749     }
1750     q = t;
1751     if (c == '\'') {
1752 	c = *++t;
1753 	q = t;
1754 	while (c && c != '\'')
1755 	    c = *++t;
1756 	if (!c)  /* unterminated string */
1757 	    q = t = NULL;
1758 	else
1759 	    *t++ = 0;
1760     } else {
1761 	while (c && c != ' ' && c != '\t' )
1762 	    c = *++t;
1763 	*t++ = 0;
1764 	if (!c)
1765 	    t = NULL;
1766     }
1767     return q;
1768 }
1769 
1770 #ifdef LOGIN_CAP
1771 static void
1772 setprocresources(const char *cname)
1773 {
1774 	login_cap_t *lc;
1775 	if ((lc = login_getclassbyname(cname, NULL)) != NULL) {
1776 		setusercontext(lc, NULL, 0, LOGIN_SETPRIORITY|LOGIN_SETRESOURCES);
1777 		login_close(lc);
1778 	}
1779 }
1780 #endif
1781 
1782 #ifdef SUPPORT_UTMPX
1783 static void
1784 session_utmpx(const session_t *sp, int add)
1785 {
1786 	const char *name = sp->se_getty ? sp->se_getty :
1787 	    (sp->se_window ? sp->se_window : "");
1788 	const char *line = sp->se_device + sizeof(_PATH_DEV) - 1;
1789 
1790 	make_utmpx(name, line, add ? LOGIN_PROCESS : DEAD_PROCESS,
1791 	    sp->se_process, &sp->se_started, sp->se_index);
1792 }
1793 
1794 static void
1795 make_utmpx(const char *name, const char *line, int type, pid_t pid,
1796     const struct timeval *tv, int session)
1797 {
1798 	struct utmpx ut;
1799 	const char *eline;
1800 
1801 	(void)memset(&ut, 0, sizeof(ut));
1802 	(void)strlcpy(ut.ut_name, name, sizeof(ut.ut_name));
1803 	ut.ut_type = type;
1804 	(void)strlcpy(ut.ut_line, line, sizeof(ut.ut_line));
1805 	ut.ut_pid = pid;
1806 	if (tv)
1807 		ut.ut_tv = *tv;
1808 	else
1809 		(void)gettimeofday(&ut.ut_tv, NULL);
1810 	ut.ut_session = session;
1811 
1812 	eline = line + strlen(line);
1813 	if ((size_t)(eline - line) >= sizeof(ut.ut_id))
1814 		line = eline - sizeof(ut.ut_id);
1815 	(void)strncpy(ut.ut_id, line, sizeof(ut.ut_id));
1816 
1817 	if (pututxline(&ut) == NULL)
1818 		warning("can't add utmpx record for `%s': %m", ut.ut_line);
1819 	endutxent();
1820 }
1821 
1822 static char
1823 get_runlevel(const state_t s)
1824 {
1825 	if (s == single_user)
1826 		return SINGLE_USER;
1827 	if (s == runcom)
1828 		return RUNCOM;
1829 	if (s == read_ttys)
1830 		return READ_TTYS;
1831 	if (s == multi_user)
1832 		return MULTI_USER;
1833 	if (s == clean_ttys)
1834 		return CLEAN_TTYS;
1835 	if (s == catatonia)
1836 		return CATATONIA;
1837 	return DEATH;
1838 }
1839 
1840 static void
1841 utmpx_set_runlevel(char old, char new)
1842 {
1843 	struct utmpx ut;
1844 
1845 	/*
1846 	 * Don't record any transitions until we did the first transition
1847 	 * to read ttys, which is when we are guaranteed to have a read-write
1848 	 * /var. Perhaps use a different variable for this?
1849 	 */
1850 	if (sessions == NULL)
1851 		return;
1852 
1853 	(void)memset(&ut, 0, sizeof(ut));
1854 	(void)snprintf(ut.ut_line, sizeof(ut.ut_line), RUNLVL_MSG, new);
1855 	ut.ut_type = RUN_LVL;
1856 	(void)gettimeofday(&ut.ut_tv, NULL);
1857 	ut.ut_exit.e_exit = old;
1858 	ut.ut_exit.e_termination = new;
1859 	if (pututxline(&ut) == NULL)
1860 		warning("can't add utmpx record for `runlevel': %m");
1861 	endutxent();
1862 }
1863 #endif
1864