1.\" $NetBSD: sysctl.7,v 1.71 2012/06/09 08:22:14 wiz Exp $ 2.\" 3.\" Copyright (c) 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" @(#)sysctl.3 8.4 (Berkeley) 5/9/95 31.\" 32.Dd June 8, 2012 33.Dt SYSCTL 7 34.Os 35.Sh NAME 36.Nm sysctl 37.Nd system information variables 38.Sh DESCRIPTION 39The 40.Xr sysctl 3 41library function and the 42.Xr sysctl 8 43utility are used to get and set values of system variables, maintained 44by the kernel. 45The variables are organized in a tree and identified by a sequence of 46numbers, conventionally separated by dots with the topmost identifier 47at the left side. 48The numbers have corresponding text names. 49The 50.Xr sysctlnametomib 3 51function or the 52.Fl M 53argument to the 54.Xr sysctl 8 55utility can be used to convert the text representation to the 56numeric one. 57.Pp 58The individual sysctl variables are described below, both the textual 59and numeric form where applicable. 60The textual names can be used as argument to the 61.Xr sysctl 8 62utility and in the file 63.Pa /etc/sysctl.conf . 64The numeric names are usually defined as preprocessor constants and 65are intended for use by programs. 66Every such constant expands to one integer, which identifies the 67sysctl variable relative to the upper level of the tree. 68See the 69.Xr sysctl 3 70manual page for programming examples. 71.Ss Top level names 72The top level names are defined with a 73.Va CTL_ 74prefix in 75.In sys/sysctl.h , 76and are as follows. 77The next and subsequent levels down are found in the include files 78listed here, and described in separate sections below. 79.Bl -column "security" ".Dv CTL_SECURITY" ".In uvm/uvm_param.h" "High kernel limits" 80.It Sy Name Ta Sy Constant Ta Sy Next level names Ta Sy Description 81.It kern Ta Dv CTL_KERN Ta In sys/sysctl.h Ta High kernel limits 82.It vm Ta Dv CTL_VM Ta In uvm/uvm_param.h Ta Virtual memory 83.It vfs Ta Dv CTL_VFS Ta In sys/mount.h Ta Filesystem 84.It net Ta Dv CTL_NET Ta In sys/socket.h Ta Networking 85.It debug Ta Dv CTL_DEBUG Ta In sys/sysctl.h Ta Debugging 86.It hw Ta Dv CTL_HW Ta In sys/sysctl.h Ta Generic CPU, I/O 87.It machdep Ta Dv CTL_MACHDEP Ta In sys/sysctl.h Ta Machine dependent 88.It user Ta Dv CTL_USER Ta In sys/sysctl.h Ta User-level 89.It ddb Ta Dv CTL_DDB Ta In sys/sysctl.h Ta In-kernel debugger 90.It proc Ta Dv CTL_PROC Ta In sys/sysctl.h Ta Per-process 91.It vendor Ta Dv CTL_VENDOR Ta ? Ta Vendor specific 92.It emul Ta Dv CTL_EMUL Ta In sys/sysctl.h Ta Emulation settings 93.It security Ta Dv CTL_SECURITY Ta In sys/sysctl.h Ta Security settings 94.El 95.Ss The debug.* subtree 96The debugging variables vary from system to system. 97A debugging variable may be added or deleted without need to recompile 98.Nm 99to know about it. 100Each time it runs, 101.Nm 102gets the list of debugging variables from the kernel and 103displays their current values. 104The system defines twenty 105.Vt ( struct ctldebug ) 106variables named 107.Dv debug0 108through 109.Dv debug19 . 110They are declared as separate variables so that they can be 111individually initialized at the location of their associated variable. 112The loader prevents multiple use of the same variable by issuing errors 113if a variable is initialized in more than one place. 114For example, to export the variable 115.Va dospecialcheck 116as a debugging variable, the following declaration would be used: 117.Pp 118.Bd -literal -offset indent -compact 119int dospecialcheck = 1; 120struct ctldebug debug5 = { "dospecialcheck", \*[Am]dospecialcheck }; 121.Ed 122.Pp 123Note that the dynamic implementation of 124.Nm 125currently in use largely makes this particular 126.Nm 127interface obsolete. 128See 129.Xr sysctl 8 130.\" and 131.\" .Xr sysctl 9 132for more information. 133.Ss The vfs.* subtree 134A distinguished second level name, 135.Li vfs.generic ( VFS_GENERIC ) , 136is used to get general information about all file systems. 137It has the following third level identifiers: 138.Bl -tag -width "123456" 139.It Li vfs.generic.maxtypenum ( VFS_MAXTYPENUM ) 140The highest valid file system type number. 141.It Li vfs.generic.conf ( VFS_CONF ) 142Returns configuration information about the file system type given as a fourth 143level identifier. 144.It Li vfs.generic.usermount ( VFS_USERMOUNT ) 145Determines if non superuser mounts are allowed, defaults to 146.Dv 0 . 147.It Li vfs.generic.magiclinks ( VFS_MAGICLINKS ) 148Controls if expansion of variables is going to be performed on pathnames 149or not. 150Defaults to no variable expansion, 151.Dv 0 . 152Variables are of the form 153.Li @name 154and the variables supported are described in 155.Xr symlink 7 156under 157.Dq "MAGIC SYMLINKS" . 158.El 159.Pp 160A second level name for controlling the 161.Xr wapbl 4 162(Write Ahead Physical Block Logging file system journalling) 163capabilities with the following third level identifiers: 164.Bl -tag -width "123456" 165.It Li vfs.wapbl.flush_disk_cache 166Controls whether to attempt to flush the disk cache on each commit. 167It defaults to 1 and it should always be on to ensure data integrity in 168case of a crash. 169For slow disks, turning it off can improve performance. 170.It Li vfs.wapbl.verbose_commit 171For each transaction log commit, print the number of bytes written 172and the time it took to commit as seconds.nanoseconds. 173.El 174.Pp 175The remaining second level identifiers are the file system names, identified 176by the type number returned by a 177.Xr statvfs 2 178call or from 179.Li vfs.generic.conf . 180.Pp 181The third level identifiers available for each file system 182are given in the header file that defines the mount 183argument structure for that file system. 184.Ss The hw.* subtree 185The string and integer information available for the 186.Li hw 187level is detailed below. 188The changeable column shows whether a process with appropriate 189privilege may change the value. 190.Bl -column "hw.machine_arch" "integer" "Changeable" -offset indent 191.It Sy Second level name Type Changeable 192.It hw.alignbytes integer no 193.It hw.byteorder integer no 194.It hw.cnmagic string yes 195.It hw.disknames string no 196.It hw.diskstats struct no 197.It hw.machine string no 198.It hw.machine_arch string no 199.It hw.model string no 200.It hw.ncpu integer no 201.It hw.pagesize integer no 202.It hw.physmem integer no 203.It hw.physmem64 quad no 204.It hw.usermem integer no 205.It hw.usermem64 quad no 206.El 207.Pp 208.Bl -tag -width "123456" 209.It Li hw.alignbytes ( HW_ALIGNBYTES ) 210Alignment constraint for all possible data types. 211This shows the value 212.Dv ALIGNBYTES 213in 214.In machine/param.h , 215at the kernel compilation time. 216.It Li hw.byteorder ( HW_BYTEORDER ) 217The byteorder (4321, or 1234). 218.It Li hw.cnmagic ( HW_CNMAGIC ) 219The console magic key sequence. 220.It Li hw.disknames ( HW_DISKNAMES ) 221The list of (space separated) disk device names on the system. 222.It Li hw.iostatnames ( HW_IOSTATNAMES ) 223A space separated list of devices that will have I/O statistics 224collected on them. 225.It Li hw.iostats ( HW_IOSTATS ) 226Return statistical information on the NFS mounts, disk and tape 227devices on the system. 228An array of 229.Vt struct io_sysctl 230structures is returned, 231whose size depends on the current number of such objects in the system. 232The third level name is the size of the 233.Vt struct io_sysctl . 234The type of object can be determined by examining the 235.Va type 236element of 237.Vt struct io_sysctl . 238Which can be 239.Dv IOSTAT_DISK 240(disk drive), 241.Dv IOSTAT_TAPE 242(tape drive), or 243.Dv IOSTAT_NFS 244(NFS mount). 245.It Li hw.machine ( HW_MACHINE ) 246The machine class. 247.It Li hw.machine_arch ( HW_MACHINE_ARCH ) 248The machine CPU class. 249.It Li hw.model ( HW_MODEL ) 250The machine model. 251.It Li hw.ncpu ( HW_NCPU ) 252The number of CPUs. 253.It Li hw.pagesize ( HW_PAGESIZE ) 254The software page size. 255.It Li hw.physmem ( HW_PHYSMEM ) 256The bytes of physical memory as a 32-bit integer. 257.It Li hw.physmem64 ( HW_PHYSMEM64 ) 258The bytes of physical memory as a 64-bit integer. 259.It Li hw.usermem ( HW_USERMEM ) 260The bytes of non-kernel memory as a 32-bit integer. 261.It Li hw.usermem64 ( HW_USERMEM64 ) 262The bytes of non-kernel memory as a 64-bit integer. 263.El 264.Ss The kern.* subtree 265This subtree includes data generally related to the kernel. 266The string and integer information available for the 267.Li kern 268level is detailed below. 269The changeable column shows whether a process with appropriate 270privilege may change the value. 271.Bl -column "kern.posix_reader_writer_locks" \ 272"struct kinfo_drivers" "not applicable" 273.It Sy Second level name Type Changeable 274.It kern.aio_listio_max integer yes 275.It kern.aio_max integer yes 276.It kern.arandom integer no 277.It kern.argmax integer no 278.It kern.boothowto integer no 279.It kern.boottime struct timeval no 280.\".It kern.bufq node not applicable 281.It kern.ccpu integer no 282.It kern.clockrate struct clockinfo no 283.It kern.consdev integer no 284.It kern.coredump node not applicable 285.It kern.cp_id struct no 286.It kern.cp_time uint64_t[\|] no 287.It kern.cryptodevallowsoft integer yes 288.It kern.defcorename string yes 289.It kern.detachall integer yes 290.It kern.domainname string yes 291.It kern.drivers struct kinfo_drivers no 292.It kern.dump_on_panic integer yes 293.It kern.file struct file no 294.It kern.forkfsleep integer yes 295.It kern.fscale integer no 296.It kern.fsync integer no 297.It kern.hardclock_ticks integer no 298.It kern.hostid integer yes 299.It kern.hostname string yes 300.It kern.iov_max integer no 301.It kern.ipc node not applicable 302.It kern.job_control integer no 303.It kern.labeloffset integer no 304.It kern.labelsector integer no 305.It kern.login_name_max integer no 306.It kern.logsigexit integer yes 307.It kern.mapped_files integer no 308.It kern.maxfiles integer yes 309.It kern.maxlwp integer yes 310.It kern.maxpartitions integer no 311.It kern.maxphys integer no 312.It kern.maxproc integer yes 313.It kern.maxptys integer yes 314.It kern.maxvnodes integer yes 315.It kern.mbuf node not applicable 316.It kern.memlock integer no 317.It kern.memlock_range integer no 318.It kern.memory_protection integer no 319.It kern.module node not applicable 320.It kern.monotonic_clock integer no 321.It kern.mqueue node not applicable 322.It kern.msgbuf integer no 323.It kern.msgbufsize integer no 324.It kern.ngroups integer no 325.\".It kern.no_sa_support integer yes 326.It kern.ntptime struct ntptimeval no 327.It kern.osrelease string no 328.It kern.osrevision integer no 329.It kern.ostype string no 330.\".It kern.panic_now integer yes 331.It kern.pipe node not applicable 332.\" .It kern.posix node not applicable 333.It kern.posix1version integer no 334.It kern.posix_aio integer no 335.It kern.posix_barriers integer no 336.It kern.posix_reader_writer_locks integer no 337.\".It kern.posix_sched integer yes 338.It kern.posix_semaphores integer no 339.It kern.posix_spin_locks integer no 340.It kern.posix_threads integer no 341.It kern.posix_timers integer no 342.It kern.proc struct kinfo_proc no 343.It kern.proc2 struct kinfo_proc2 no 344.It kern.proc_args string no 345.It kern.profiling node not applicable 346.\".It kern.pset node not applicable 347.It kern.rawpartition integer no 348.It kern.root_device string no 349.It kern.root_partition integer no 350.It kern.rtc_offset integer yes 351.It kern.saved_ids integer no 352.It kern.sbmax integer yes 353.\".It kern.sched node not applicable 354.It kern.securelevel integer raise only 355.It kern.somaxkva integer yes 356.It kern.synchronized_io integer no 357.It kern.timecounter node not applicable 358.It kern.timex struct no 359.It kern.tkstat node not applicable 360.It kern.tty node not applicable 361.It kern.urandom integer no 362.It kern.usercrypto integer yes 363.It kern.userasymcrypto integer yes 364.It kern.veriexec node not applicable 365.It kern.version string no 366.It kern.vnode struct vnode no 367.El 368.Bl -tag -width "123456" 369.It Li kern.aio_listio_max 370The maximum number of asynchronous 371.Tn I/O 372operations in a single list I/O call. 373Like with all variables related to 374.Xr aio 3 , 375the variable may be created and removed dynamically 376upon loading or unloading the corresponding kernel module. 377.It Li kern.aio_max 378The maximum number of asynchronous I/O operations. 379.It Li kern.arandom 380This variable picks a random number each time it is queried. 381The used random number generator 382.Pf ( Tn RNG ) 383is based on 384.Xr arc4random 3 . 385.It Li kern.argmax ( KERN_ARGMAX ) 386The maximum bytes of argument to 387.Xr execve 2 . 388.It Li kern.boothowto 389Flags passed from the boot loader; see 390.Xr reboot 2 391for the meanings of the flags. 392.It Li kern.boottime ( KERN_BOOTTIME ) 393A 394.Vt struct timeval 395structure is returned. 396This structure contains the time that the system was booted. 397.\" .It Li kern.bufq 398.\" XXX: Undocumented. 399.It Li kern.ccpu ( KERN_CCPU ) 400The scheduler exponential decay value. 401.It Li kern.clockrate ( KERN_CLOCKRATE ) 402A 403.Vt struct clockinfo 404structure is returned. 405This structure contains the clock, statistics clock and profiling clock 406frequencies, the number of micro-seconds per hz tick, and the clock 407skew rate. 408Refer to 409.Xr hz 9 410for additional details. 411.It Li kern.consdev ( KERN_CONSDEV ) 412Console device. 413.It Li kern.coredump 414Settings related to set-id processes coredumps. 415By default, set-id processes do not dump core in situations where 416other processes would. 417The settings in this node allows an administrator to change this 418behavior. 419.Pp 420The third level name is 421.Dv kern.coredump.setid 422and fourth level variables are described below. 423.Bl -column "kern.coredump.setid.group" "integer" "Changeable" -offset indent 424.It Sy Fourth level name Type Changeable 425.It kern.coredump.setid.dump integer yes 426.It kern.coredump.setid.group integer yes 427.It kern.coredump.setid.mode integer yes 428.It kern.coredump.setid.owner integer yes 429.It kern.coredump.setid.path string yes 430.El 431.Bl -tag -width "123456" 432.It Li kern.coredump.setid.dump 433If non-zero, set-id processes will dump core. 434.It Li kern.coredump.setid.group 435The group-id for the set-id processes' coredump. 436.It Li kern.coredump.setid.mode 437The mode for the set-id processes' coredump. 438See 439.Xr chmod 1 . 440.It Li kern.coredump.setid.owner 441The user-id that will be used as the owner of the set-id processes' 442coredump. 443.It Li kern.coredump.setid.path 444The path to which set-id processes' coredumps will be saved to. 445Same syntax as kern.defcorename. 446.El 447.It Li kern.cp_id ( KERN_CP_ID ) 448Mapping of CPU number to CPU id. 449.It Li kern.cp_time ( KERN_CP_TIME ) 450Returns an array of 451.Dv CPUSTATES 452.Vt uint64_t Ns s. 453This array contains the 454number of clock ticks spent in different CPU states. 455On multi-processor systems, the sum across all CPUs is returned unless 456appropriate space is given for one data set for each CPU. 457Data for a specific CPU can also be obtained by adding the number of the 458CPU at the end of the MIB, enlarging it by one. 459.It Li kern.cryptodevallowsoft 460This variable controls userland access to hardware versus software transforms 461in the 462.Xr crypto 4 463system. 464The available values are as follows: 465.Bl -tag -width XX0 -offset indent 466.It Dv \*[Lt] 0 467Always force userlevel requests to use software transforms. 468.It Dv = 0 469If present, use hardware and grant userlevel requests for 470non-accelerated transforms (handling the latter in software). 471.It Dv \*[Gt] 0 472Allow user requests only for transforms which are hardware-accelerated. 473.El 474.It Li kern.defcorename ( KERN_DEFCORENAME ) 475Default template for the name of core dump files (see also 476.Li proc.pid.corename 477in the per-process variables 478.Li proc.* , 479and 480.Xr core 5 481for format of this template). 482The default value is 483.Pa %n.core 484and can be changed with the kernel configuration option 485.Cd options DEFCORENAME 486(see 487.Xr options 4 488). 489.It Li kern.detachall 490Detach all devices at shutdown. 491.It Li kern.domainname ( KERN_DOMAINNAME ) 492Get or set the YP domain name. 493.It Li kern.drivers ( KERN_DRIVERS ) 494Return an array of 495.Vt struct kinfo_drivers 496that contains the name and major device numbers of all the device drivers 497in the current kernel. 498The 499.Va d_name 500field is always a NUL terminated string. 501The 502.Va d_bmajor 503field will be set to \-1 if the driver doesn't have a block device. 504.It Li kern.dump_on_panic ( KERN_DUMP_ON_PANIC ) 505Perform a crash dump on system 506.Xr panic 9 . 507.It Li kern.file ( KERN_FILE ) 508Return the entire file table. 509The returned data consists of a single 510.Vt struct filelist 511followed by an array of 512.Vt struct file , 513whose size depends on the current number of such objects in the system. 514.It Li kern.forkfsleep ( KERN_FORKFSLEEP ) 515If 516.Xr fork 2 517system call fails due to limit on number of processes (either 518the global maxproc limit or user's one), wait for this many 519milliseconds before returning 520.Er EAGAIN 521error to process. 522Useful to keep heavily forking runaway processes in bay. 523Default zero (no sleep). 524Maximum is 20 seconds. 525.It Li kern.fscale ( KERN_FSCALE ) 526The kernel fixed-point scale factor. 527.It Li kern.fsync ( KERN_FSYNC ) 528Return 1 if the 529.St -p1003.1b-93 530File Synchronization Option is available 531on this system, 532otherwise\ 0. 533.It Li kern.hardclock_ticks ( KERN_HARDCLOCK_TICKS ) 534Returns the number of 535.Xr hardclock 9 536ticks. 537.It Li kern.hostid ( KERN_HOSTID ) 538Get or set the host identifier. 539This is aimed to replace the legacy 540.Xr gethostid 3 541and 542.Xr sethostid 3 543system calls. 544.It Li kern.hostname ( KERN_HOSTNAME ) 545Get or set the 546.Xr hostname 1 . 547.It Li kern.iov_max ( KERN_IOV_MAX ) 548Return the maximum number of 549.Vt iovec 550structures that a process has available for use with 551.Xr preadv 2 , 552.Xr pwritev 2 , 553.Xr readv 2 , 554.Xr recvmsg 2 , 555.Xr sendmsg 2 556and 557.Xr writev 2 . 558.It Li kern.ipc ( KERN_SYSVIPC ) 559Return information about the SysV IPC parameters. 560The third level names for the ipc variables are detailed below. 561.Bl -column "kern.ipc.shm_use_phys" "integer" "Changeable" -offset indent 562.It Sy Third level name Type Changeable 563.It kern.ipc.sysvmsg integer no 564.It kern.ipc.sysvsem integer no 565.It kern.ipc.sysvshm integer no 566.It kern.ipc.sysvipc_info struct no 567.It kern.ipc.shmmax integer yes 568.It kern.ipc.shmmni integer yes 569.It kern.ipc.shmseg integer yes 570.It kern.ipc.shmmaxpgs integer yes 571.It kern.ipc.shm_use_phys integer yes 572.It kern.ipc.msgmni integer yes 573.It kern.ipc.msgseg integer yes 574.It kern.ipc.semmni integer yes 575.It kern.ipc.semmns integer yes 576.It kern.ipc.semmnu integer yes 577.El 578.Bl -tag -width "123456" 579.It Li kern.ipc.sysvmsg ( KERN_SYSVIPC_MSG ) 580Returns 1 if System V style message queue functionality is available 581on this system, 582otherwise\ 0. 583.It Li kern.ipc.sysvsem ( KERN_SYSVIPC_SEM ) 584Returns 1 if System V style semaphore functionality is available 585on this system, 586otherwise\ 0. 587.It Li kern.ipc.sysvshm ( KERN_SYSVIPC_SHM ) 588Returns 1 if System V style share memory functionality is available 589on this system, 590otherwise\ 0. 591.It Li kern.ipc.sysvipc_info ( KERN_SYSVIPC_INFO ) 592Return System V style IPC configuration and run-time information. 593The fourth level name selects the System V style IPC facility. 594.Bl -column "KERN_SYSVIPC_MSG_INFO" "struct shm_sysctl_info" -offset indent 595.It Sy Fourth level name Type 596.It KERN_SYSVIPC_MSG_INFO struct msg_sysctl_info 597.It KERN_SYSVIPC_SEM_INFO struct sem_sysctl_info 598.It KERN_SYSVIPC_SHM_INFO struct shm_sysctl_info 599.El 600.Pp 601.Bl -tag -width "123456" 602.It Li KERN_SYSVIPC_MSG_INFO 603Return information on the System V style message facility. 604The 605.Sy msg_sysctl_info 606structure is defined in 607.In sys/msg.h . 608.It Li KERN_SYSVIPC_SEM_INFO 609Return information on the System V style semaphore facility. 610The 611.Sy sem_sysctl_info 612structure is defined in 613.In sys/sem.h . 614.It Li KERN_SYSVIPC_SHM_INFO 615Return information on the System V style shared memory facility. 616The 617.Sy shm_sysctl_info 618structure is defined in 619.In sys/shm.h . 620.El 621.It Li kern.ipc.shmmax ( KERN_SYSVIPC_SHMMAX ) 622Max shared memory segment size in bytes. 623.It Li kern.ipc.shmmni ( KERN_SYSVIPC_SHMMNI ) 624Max number of shared memory identifiers. 625.It Li kern.ipc.shmseg ( KERN_SYSVIPC_SHMSEG ) 626Max shared memory segments per process. 627.It Li kern.ipc.shmmaxpgs ( KERN_SYSVIPC_SHMMAXPGS ) 628Max amount of shared memory in pages. 629.It Li kern.ipc.shm_use_phys ( KERN_SYSVIPC_SHMUSEPHYS ) 630Locking of shared memory in physical memory. 631If 0, memory can be swapped 632out, otherwise it will be locked in physical memory. 633.It Li kern.ipc.msgmni 634Max number of message queue identifiers. 635.It Li kern.ipc.msgseg 636Max number of number of message segments. 637.It Li kern.ipc.semmni 638Max number of number of semaphore identifiers. 639.It Li kern.ipc.semmns 640Max number of number of semaphores in system. 641.It Li kern.ipc.semmnu 642Max number of undo structures in system. 643.El 644.It Li kern.job_control ( KERN_JOB_CONTROL ) 645Return 1 if job control is available on this system, otherwise\ 0. 646.It Li kern.labeloffset ( KERN_LABELOFFSET ) 647The offset within the sector specified by 648.Dv KERN_LABELSECTOR 649of the 650.Xr disklabel 5 . 651.It Li kern.labelsector ( KERN_LABELSECTOR ) 652The sector number containing the 653.Xr disklabel 5 . 654.It Li kern.login_name_max ( KERN_LOGIN_NAME_MAX ) 655The size of the storage required for a login name, in bytes, 656including the terminating NUL. 657.It Li kern.logsigexit ( KERN_LOGSIGEXIT ) 658If this flag is non-zero, the kernel will 659.Xr log 9 660all process exits due to signals which create a 661.Xr core 5 662file, and whether the coredump was created. 663.It Li kern.mapped_files ( KERN_MAPPED_FILES ) 664Returns 1 if the 665.St -p1003.1b-93 666Memory Mapped Files Option is available on this system, 667otherwise\ 0. 668.It Li kern.maxfiles ( KERN_MAXFILES ) 669The maximum number of open files that may be open in the system. 670.It Li kern.maxpartitions ( KERN_MAXPARTITIONS ) 671The maximum number of partitions allowed per disk. 672.It Li kern.maxlwp 673The maximum number of Lightweight Processes (threads) the system allows 674per uid. 675.It Li kern.maxphys ( KERN_MAXPHYS ) 676Maximum raw I/O transfer size. 677.It Li kern.maxproc ( KERN_MAXPROC ) 678The maximum number of simultaneous processes the system will allow. 679.It Li kern.maxptys ( KERN_MAXPTYS ) 680The maximum number of pseudo terminals. 681This value can be both raised and lowered, though it cannot 682be set lower than number of currently used ptys. 683See also 684.Xr pty 4 . 685.It Li kern.maxvnodes ( KERN_MAXVNODES ) 686The maximum number of vnodes available on the system. 687This can only be raised. 688.It Li kern.mbuf ( KERN_MBUF ) 689Return information about the mbuf control variables. 690Mbufs are data structures which store network packets and other data 691structures in the networking code, see 692.Xr mbuf 9 . 693The third level names for the mbuf variables are detailed below. 694The changeable column shows whether a process with appropriate 695privilege may change the value. 696.Bl -column "kern.mbuf.nmbclusters" "integer" "Changeable" -offset indent 697.It Sy Third level name Type Changeable 698.\" XXX Changeable? really? 699.It kern.mbuf.mblowat integer yes 700.It kern.mbuf.mclbytes integer yes 701.It kern.mbuf.mcllowat integer yes 702.It kern.mbuf.msize integer yes 703.It kern.mbuf.nmbclusters integer yes 704.El 705.Pp 706The variables are as follows: 707.Bl -tag -width "123456" 708.It Li kern.mbuf.mblowat ( MBUF_MBLOWAT ) 709The mbuf low water mark. 710.It Li kern.mbuf.mclbytes ( MBUF_MCLBYTES ) 711The mbuf cluster size. 712.It Li kern.mbuf.mcllowat ( MBUF_MCLLOWAT ) 713The mbuf cluster low water mark. 714.It Li kern.mbuf.msize ( MBUF_MSIZE ) 715The mbuf base size. 716.It Li kern.mbuf.nmbclusters ( MBUF_NMBCLUSTERS ) 717The limit on the number of mbuf clusters. 718The variable can only be increased, and only increased on machines with 719direct-mapped pool pages. 720.El 721.It Li kern.memlock ( KERN_MEMLOCK ) 722Returns 1 if the 723.St -p1003.1b-93 724Process Memory Locking Option is available on this system, 725otherwise\ 0. 726.It Li kern.memlock_range ( KERN_MEMLOCK_RANGE ) 727Returns 1 if the 728.St -p1003.1b-93 729Range Memory Locking Option is available on this system, 730otherwise\ 0. 731.It Li kern.memory_protection ( KERN_MEMORY_PROTECTION ) 732Returns 1 if the 733.St -p1003.1b-93 734Memory Protection Option is available on this system, 735otherwise\ 0. 736.It Li kern.module 737Settings related to kernel modules. 738The third level names for the settings are described below. 739.Bl -column "kern.module.autoload" "integer" "Changeable" -offset indent 740.It Sy Third level name Type Changeable 741.It kern.module.autoload integer yes 742.It kern.module.verbose integer yes 743.El 744.Pp 745The variables are as follows: 746.Bl -tag -width "123456" 747.It Li kern.module.autoload 748A boolean that controls whether kernel modules are loaded automatically. 749See 750.Xr module 7 751for additional details. 752.It Li kern.module.verbose 753A boolean that enables or disables verbose 754debug messages related to kernel modules. 755.El 756.It Li kern.monotonic_clock ( KERN_MONOTONIC_CLOCK ) 757Returns the standard version the implementation of the 758.St -p1003.1b-93 759Monotonic Clock Option conforms to, 760otherwise\ 0. 761.It Li kern.mqueue 762Settings related to 763.Tn POSIX 764message queues; see 765.Xr mqueue 3 . 766This node is created dynamically when 767the corresponding kernel module is loaded. 768The third level names for the settings are described below. 769.Bl -column "kern.mqueue.mq_max_msgsize" "integer" "Changeable" -offset indent 770.It Sy Third level name Type Changeable 771.It kern.mqueue.mq_open_max integer yes 772.It kern.mqueue.mq_prio_max integer yes 773.It kern.mqueue.mq_max_msgsize integer yes 774.It kern.mqueue.mq_def_maxmsg integer yes 775.It kern.mqueue.mq_max_maxmsg integer yes 776.El 777.Pp 778The variables are: 779.Bl -tag -width "123456" 780.It Li kern.mqueue.mq_open_max 781The maximum number of message queue descriptors any single process can open. 782.It Li kern.mqueue.mq_prio_max 783The maximum priority of a message. 784.It Li kern.mqueue.mq_max_msgsize 785The maximum size of a message in a message queue. 786.It Li kern.mqueue.mq_def_maxmsg 787The default maximum message count. 788.It Li kern.mqueue.mq_max_maxmsg 789The maximum number of messages in a message queue. 790.El 791.It Li kern.msgbuf ( KERN_MSGBUF ) 792The kernel message buffer, rotated so that the head of the circular kernel 793message buffer is at the start of the returned data. 794The returned data may contain NUL bytes. 795.It Li kern.msgbufsize ( KERN_MSGBUFSIZE ) 796The maximum number of characters that the kernel message buffer can hold. 797.It Li kern.ngroups ( KERN_NGROUPS ) 798The maximum number of supplemental groups. 799.\" .It Li kern.no_sa_support 800.\" XXX: Undocumented. 801.It Li kern.ntptime ( KERN_NTPTIME ) 802A 803.Vt struct ntptimeval 804structure is returned. 805This structure contains data used by the 806.Xr ntpd 8 807program. 808.It Li kern.osrelease ( KERN_OSRELEASE ) 809The system release string. 810.It Li kern.osrevision ( KERN_OSREV ) 811The system revision string. 812.It Li kern.ostype ( KERN_OSTYPE ) 813The system type string. 814.\".It Li kern.panic_now 815.\" XXX: Undocumented. 816.It Li kern.pipe ( KERN_PIPE ) 817Pipe settings. 818The third level names for the integer pipe settings is detailed below. 819The changeable column shows whether a process with appropriate 820privilege may change the value. 821.Bl -column "kern.pipe.maxbigpipes" "integer" "Changeable" -offset indent 822.It Sy Third level name Type Changeable 823.It kern.pipe.kvasiz integer yes 824.It kern.pipe.maxbigpipes integer yes 825.It kern.pipe.maxkvasz integer yes 826.It kern.pipe.limitkva integer yes 827.It kern.pipe.nbigpipes integer yes 828.El 829.Pp 830The variables are as follows: 831.Bl -tag -width "123456" 832.It Li kern.pipe.kvasiz ( KERN_PIPE_KVASIZ ) 833Amount of kernel memory consumed by pipe buffers. 834.It Li kern.pipe.maxbigpipes ( KERN_PIPE_MAXBIGPIPES ) 835Maximum number of 836.Dq big 837pipes. 838.It Li kern.pipe.maxkvasz ( KERN_PIPE_MAXKVASZ ) 839Maximum amount of kernel memory to be used for pipes. 840.It Li kern.pipe.limitkva ( KERN_PIPE_LIMITKVA ) 841Limit for direct transfers via page loan. 842.It Li kern.pipe.nbigpipes ( KERN_PIPE_NBIGPIPES ) 843Number of 844.Dq big 845pipes. 846.El 847.\" XXX: Undocumented .It Li kern.posix ( ? ) 848.\" This is a node in which the only variable is semmax. 849.It Li kern.posix1version ( KERN_POSIX1 ) 850The version of ISO/IEC 9945 851.Pq St -p1003.1 852with which the system attempts to comply. 853.It Li kern.posix_aio 854The version of 855.St -p1003.1 856and its Asynchronous I/O option to which the system attempts to conform. 857.It Li kern.posix_barriers ( KERN_POSIX_BARRIERS ) 858The version of 859.St -p1003.1 860and its 861Barriers 862option to which the system attempts to conform, 863otherwise\ 0. 864.It Li kern.posix_reader_writer_locks ( KERN_POSIX_READER_WRITER_LOCKS ) 865The version of 866.St -p1003.1 867and its 868Read-Write Locks 869option to which the system attempts to conform, 870otherwise\ 0. 871.\".It Li kern.posix_sched 872.\" XXX: Undocumented. 873.It Li kern.posix_semaphores ( KERN_POSIX_SEMAPHORES ) 874The version of 875.St -p1003.1 876and its 877Semaphores 878option to which the system attempts to conform, 879otherwise\ 0. 880.It Li kern.posix_spin_locks ( KERN_POSIX_SPIN_LOCKS ) 881The version of 882.St -p1003.1 883and its 884Spin Locks 885option to which the system attempts to conform, 886otherwise\ 0. 887.It Li kern.posix_threads ( KERN_POSIX_THREADS ) 888The version of 889.St -p1003.1 890and its 891Threads 892option to which the system attempts to conform, 893otherwise\ 0. 894.It Li kern.posix_timers ( KERN_POSIX_TIMERS ) 895The version of 896.St -p1003.1 897and its 898Timers 899option to which the system attempts to conform, 900otherwise\ 0. 901.It Li kern.proc ( KERN_PROC ) 902Return the entire process table, or a subset of it. 903An array of 904.Vt struct kinfo_proc 905structures is returned, 906whose size depends on the current number of such objects in the system. 907The third and fourth level numeric names are as follows: 908.Bl -column "KERN_PROC_SESSION" "Fourth level is:" -offset indent 909.It Sy Third level name Fourth level is: 910.It KERN_PROC_ALL None 911.It KERN_PROC_GID A group ID 912.It KERN_PROC_PID A process ID 913.It KERN_PROC_PGRP A process group 914.It KERN_PROC_RGID A real group ID 915.It KERN_PROC_RUID A real user ID 916.It KERN_PROC_SESSION A session ID 917.It KERN_PROC_TTY A tty device 918.It KERN_PROC_UID A user ID 919.El 920.It Li kern.proc2 ( KERN_PROC2 ) 921As for 922.Dv KERN_PROC , 923but an array of 924.Vt struct kinfo_proc2 925structures are returned. 926The fifth level name is the size of the 927.Vt struct kinfo_proc2 928and the sixth level name is the number of structures to return. 929.It Li kern.proc_args ( KERN_PROC_ARGS ) 930Return the argv or environment strings (or the number thereof) 931of a process. 932Multiple strings are returned separated by NUL characters. 933The third level name is the process ID. 934The fourth level name is as follows: 935.Bl -column "KERN_PROG_NARGV" "The number of environ strings" -offset indent 936.It KERN_PROC_ARGV The argv strings 937.It KERN_PROC_ENV The environ strings 938.It KERN_PROC_NARGV The number of argv strings 939.It KERN_PROC_NENV The number of environ strings 940.El 941.It Li kern.profiling ( KERN_PROF ) 942Return profiling information about the kernel. 943If the kernel is not compiled for profiling, 944attempts to retrieve any of the 945.Dv KERN_PROF 946values will fail with 947.Er EOPNOTSUPP . 948The third level names for the string and integer profiling information 949is detailed below. 950The changeable column shows whether a process with appropriate 951privilege may change the value. 952.Bl -column "kern.profiling.gmonparam" "struct gmonparam" "Changeable" -offset indent 953.It Sy Third level name Type Changeable 954.It kern.profiling.count u_short[\|] yes 955.It kern.profiling.froms u_short[\|] yes 956.It kern.profiling.gmonparam struct gmonparam no 957.It kern.profiling.state integer yes 958.It kern.profiling.tos struct tostruct yes 959.El 960.Pp 961The variables are as follows: 962.Bl -tag -width "123456" 963.It Li kern.profiling.count ( GPROF_COUNT ) 964Array of statistical program counter counts. 965.It Li kern.profiling.froms ( GPROF_FROMS ) 966Array indexed by program counter of call-from points. 967.It Li kern.profiling.gmonparams ( GPROF_GMONPARAM ) 968Structure giving the sizes of the above arrays. 969.It Li kern.profiling.state ( GPROF_STATE ) 970Profiling state. 971If set to 972.Dv GMON_PROF_ON , 973starts profiling. 974If set to 975.Dv GMON_PROF_OFF , 976stops profiling. 977.It Li kern.profiling.tos ( GPROF_TOS ) 978Array of 979.Vt struct tostruct 980describing destination of calls and their counts. 981.El 982.\" .It Li kern.pset 983.\" XXX: Undocumented. 984.It Li kern.rawpartition ( KERN_RAWPARTITION ) 985The raw partition of a disk (a == 0). 986.It Li kern.root_device ( KERN_ROOT_DEVICE ) 987The name of the root device (e.g., 988.Dq wd0 ) . 989.It Li kern.root_partition ( KERN_ROOT_PARTITION ) 990The root partition on the root device (a == 0). 991.It Li kern.rtc_offset ( KERN_RTC_OFFSET ) 992Return the offset of real time clock from UTC in minutes. 993.It Li kern.saved_ids ( KERN_SAVED_IDS ) 994Returns 1 if saved set-group and saved set-user ID is available. 995.It Li kern.sbmax ( KERN_SBMAX ) 996Maximum socket buffer size. 997.\" XXX units? 998.It Li kern.securelevel ( KERN_SECURELVL ) 999See 1000.Xr secmodel_securelevel 9 . 1001.\" .It Li kern.sched 1002.\" XXX: Undocumented. 1003.It Li kern.somaxkva ( KERN_SOMAXKVA ) 1004Maximum amount of kernel memory to be used for socket buffers. 1005.\" XXX units? 1006.It Li kern.synchronized_io ( KERN_SYNCHRONIZED_IO ) 1007Returns 1 if the 1008.St -p1003.1b-93 1009Synchronized I/O Option is available on this system, 1010otherwise\ 0. 1011.It Li kern.timecounter ( dynamic ) 1012Display and control the timecounter source of the system. 1013.Bl -column "kern.timecounter.timestepwarnings" "integer" "Changeable" -offset indent 1014.It Sy Third level name Type Changeable 1015.It kern.timecounter.choice string no 1016.It kern.timecounter.hardware string yes 1017.It kern.timecounter.timestepwarnings integer yes 1018.El 1019.Pp 1020The variables are as follows: 1021.Bl -tag -width "123456" 1022.It Li kern.timecounter.choice ( dynamic ) 1023The list of available timecounters with their quality and frequency. 1024.It Li kern.timecounter.hardware ( dynamic ) 1025The currently selected timecounter source. 1026.It Li kern.timecounter.timestepwarnings ( dynamic ) 1027If non-zero display a message each time the time is stepped. 1028.El 1029.It Li kern.timex ( KERN_TIMEX ) 1030Not available. 1031.It Li kern.tkstat ( KERN_TKSTAT ) 1032Return information about the number of characters sent and received 1033on ttys. 1034The third level names for the tty statistic variables are detailed below. 1035The changeable column shows whether a process 1036with appropriate privilege may change the value. 1037.Bl -column "kern.tkstat.cancc" "quad" "Changeable" -offset indent 1038.It Sy Third level name Type Changeable 1039.It kern.tkstat.cancc quad no 1040.It kern.tkstat.nin quad no 1041.It kern.tkstat.nout quad no 1042.It kern.tkstat.rawcc quad no 1043.El 1044.Pp 1045The variables are as follows: 1046.Bl -tag -width "123456" 1047.It Li kern.tkstat.cancc ( KERN_TKSTAT_CANCC ) 1048The number of canonical input characters. 1049.It Li kern.tkstat.nin ( KERN_TKSTAT_NIN ) 1050The total number of input characters. 1051.It Li kern.tkstat.nout ( KERN_TKSTAT_NOUT ) 1052The total number of output characters. 1053.It Li kern.tkstat.rawcc ( KERN_TKSTAT_RAWCC ) 1054The number of raw input characters. 1055.El 1056.It Li kern.tty 1057The third level names for the tty setup variables are detailed below. 1058The changeable column shows whether a process 1059with appropriate privilege may change the value. 1060.Bl -column "kern.tty.qsize" "int" "Changeable" -offset indent 1061.It Sy Third level name Type Changeable 1062.It kern.tty.qsize int yes 1063.El 1064.Pp 1065The variables are as follows: 1066.Bl -tag -width "123456" 1067.It Li kern.tty.qsize 1068Control/display the size of the default input and output queues selected 1069during tty creation. 1070Is converted to a power of two and its range is between 1071.Dv 1024 1072and 1073.Dv 65536 . 1074.El 1075.It Li kern.uidinfo 1076Resource usage for the current user. 1077.Bl -column "kern.uidinfo.proccnt" "integer" "Changeable" -offset indent 1078.It Sy Third level name Type Changeable 1079.It kern.uidinfo.proccnt integer no 1080.It kern.uidinfo.lwpcnt integer no 1081.It kern.uidinfo.lockcnt integer no 1082.It kern.uidinfo.sbsize integer no 1083.El 1084.Bl -tag -width "123456" 1085.It Li kern.uidinfo.proccnt 1086Returns the number of active processes for the current user. 1087.It Li kern.uidinfo.lwpcnt 1088Returns the number of active threads for the current user; the first thread 1089of each process is not counted. 1090.It Li kern.uidinfo.lockcnt 1091Number of locks held by the current user. 1092.It Li kern.uidinfo.sbsize 1093Number of bytes in socket buffers allocated to the current user. 1094.El 1095.It Li kern.urandom ( KERN_URND ) 1096Random integer value. 1097.It Li kern.usercrypto 1098When enabled, allows userland to 1099.Xr open 2 1100the 1101.Pa /dev/crypto 1102special device, used by the 1103.Xr crypto 4 1104system. 1105.It Li kern.userasymcrypto 1106Enables or disables the use of software asymmetric crypto support in the 1107.Xr crypto 4 1108system. 1109.It Li kern.veriexec 1110Runtime information for 1111.Xr veriexec 8 . 1112.Bl -column "kern.veriexec.algorithms" "integer" "Changeable" -offset indent 1113.It Sy Third level name Type Changeable 1114.It kern.veriexec.algorithms string no 1115.It kern.veriexec.count node not applicable 1116.It kern.veriexec.strict integer yes 1117.It kern.veriexec.verbose integer yes 1118.El 1119.Bl -tag -width "123456" 1120.It Li kern.veriexec.algorithms 1121Returns a string with the supported algorithms in Veriexec. 1122.It Li kern.veriexec.count 1123Sub-nodes are added to this node as new mounts are monitored by Veriexec. 1124Each mount will be under its own 1125.No tableN 1126node. 1127Under each node there will be three variables, indicating the mount 1128point, the file system type, and the number of entries. 1129.It Li kern.veriexec.strict 1130Controls the strict level of Veriexec. 1131See 1132.Xr security 7 1133for more information on each level's implications. 1134.It Li kern.veriexec.verbose 1135Controls the verbosity level of Veriexec. 1136If 0, only the minimal 1137indication required will be given about what's happening - fingerprint 1138mismatches, removal of entries from the tables, modification of a 1139fingerprinted file. 1140If 1, more messages will be printed (ie., when a file with a valid 1141fingerprint is accessed). 1142Verbose level 2 is debug mode. 1143.El 1144.It Li kern.version ( KERN_VERSION ) 1145The system version string. 1146.It Li kern.vnode ( KERN_VNODE ) 1147Return the entire vnode table. 1148Note, the vnode table is not necessarily a consistent snapshot of 1149the system. 1150The returned data consists of an array whose size depends on the 1151current number of such objects in the system. 1152Each element of the array contains the kernel address of a vnode 1153.Vt struct vnode * 1154followed by the vnode itself 1155.Vt struct vnode . 1156.\" XXX: Undocumented: kern.lwp: no children? 1157.El 1158.Ss The machdep.* subtree 1159The set of variables defined is architecture dependent. 1160Most architectures define at least the following variables. 1161.Bl -column "machdep.booted_kernel" "Type" "Changeable" -offset indent 1162.It Sy Second level name Type Changeable 1163.It Li machdep.booted_kernel string no 1164.El 1165.\" XXX: Document the above. 1166.Ss The net.* subtree 1167The string and integer information available for the 1168.Li net 1169level is detailed below. 1170The changeable column shows whether a process with appropriate 1171privilege may change the value. 1172The second and third levels are typically the protocol family and 1173protocol number, though this is not always the case. 1174.Bl -column "Second level name" "IPsec key management values" "Changeable" -offset indent 1175.It Sy Second level name Type Changeable 1176.It net.route routing messages no 1177.It net.inet IPv4 values yes 1178.It net.inet6 IPv6 values yes 1179.It net.key IPsec key management values yes 1180.El 1181.Pp 1182.Bl -tag -width "123456" 1183.It Li net.route ( PF_ROUTE ) 1184.\" XXX really? 1185Return the entire routing table or a subset of it. 1186The data is returned as a sequence of routing messages (see 1187.Xr route 4 1188for the header file, format and meaning). 1189The length of each message is contained in the message header. 1190.Pp 1191The third level name is a protocol number, which is currently always\ 0. 1192The fourth level name is an address family, which may be set to 0 to 1193select all address families. 1194The fifth and sixth level names are as follows: 1195.Bl -column "Fifth level name" "Sixth level is:" -offset indent 1196.It Sy Fifth level name Sixth level is: 1197.It NET_RT_FLAGS rtflags 1198.It NET_RT_DUMP None 1199.It NET_RT_IFLIST None 1200.El 1201.It Li net.inet ( PF_INET ) 1202Get or set various global information about the IPv4 1203.Pq Internet Protocol version 4 . 1204The third level name is the protocol. 1205The fourth level name is the variable name. 1206The currently defined protocols and names are: 1207.Bl -column "Protocol name" "sack.globalmaxholes" "integer" "Changeable" -offset 4n 1208.It Sy Protocol name Variable name Type Changeable 1209.It arp down integer yes 1210.It arp keep integer yes 1211.It arp log_movements integer yes 1212.It arp log_permanent_modify integer yes 1213.It arp log_wrong_iface integer yes 1214.It arp prune integer yes 1215.It arp refresh integer yes 1216.It carp allow integer yes 1217.It carp preempt integer yes 1218.It carp log integer yes 1219.It carp arpbalance integer yes 1220.It icmp errppslimit integer yes 1221.It icmp maskrepl integer yes 1222.It icmp rediraccept integer yes 1223.It icmp redirtimeout integer yes 1224.It icmp bmcastecho integer yes 1225.It ip allowsrcrt integer yes 1226.It ip anonportmax integer yes 1227.It ip anonportmin integer yes 1228.It ip checkinterface integer yes 1229.It ip directed-broadcast integer yes 1230.It ip do_loopback_cksum integer yes 1231.It ip forwarding integer yes 1232.It ip forwsrcrt integer yes 1233.It ip gifttl integer yes 1234.It ip grettl integer yes 1235.It ip hashsize integer yes 1236.It ip hostzerobroadcast integer yes 1237.It ip lowportmin integer yes 1238.It ip lowportmax integer yes 1239.It ip maxflows integer yes 1240.It ip maxfragpackets integer yes 1241.It ip mtudisc integer yes 1242.It ip mtudisctimeout integer yes 1243.It ip random_id integer yes 1244.It ip redirect integer yes 1245.It ip subnetsarelocal integer yes 1246.It ip ttl integer yes 1247.It tcp rfc1323 integer yes 1248.It tcp sendspace integer yes 1249.It tcp recvspace integer yes 1250.It tcp mssdflt integer yes 1251.It tcp syn_cache_limit integer yes 1252.It tcp syn_bucket_limit integer yes 1253.It tcp syn_cache_interval integer yes 1254.It tcp init_win integer yes 1255.It tcp init_win_local integer yes 1256.It tcp mss_ifmtu integer yes 1257.It tcp win_scale integer yes 1258.It tcp timestamps integer yes 1259.It tcp compat_42 integer yes 1260.It tcp cwm integer yes 1261.It tcp cwm_burstsize integer yes 1262.It tcp ack_on_push integer yes 1263.It tcp keepidle integer yes 1264.It tcp keepintvl integer yes 1265.It tcp keepcnt integer yes 1266.It tcp slowhz integer no 1267.It tcp keepinit integer yes 1268.It tcp log_refused integer yes 1269.It tcp rstppslimit integer yes 1270.It tcp ident struct no 1271.It tcp drop struct no 1272.It tcp sack.enable integer yes 1273.It tcp sack.globalholes integer no 1274.It tcp sack.globalmaxholes integer yes 1275.It tcp sack.maxholes integer yes 1276.It tcp ecn.enable integer yes 1277.It tcp ecn.maxretries integer yes 1278.It tcp congctl.selected string yes 1279.It tcp congctl.available string yes 1280.It tcp abc.enable integer yes 1281.It tcp abc.aggressive integer yes 1282.It udp checksum integer yes 1283.It udp do_loopback_cksum integer yes 1284.It udp recvspace integer yes 1285.It udp rfc6056.selected string yes 1286.It udp rfc6056.available string yes 1287.It udp sendspace integer yes 1288.El 1289.Pp 1290The variables are as follows: 1291.Bl -tag -width "123456" 1292.It Li arp.down 1293Failed ARP entry lifetime. 1294.It Li arp.keep 1295Valid ARP entry lifetime. 1296.It Li arp.prune 1297ARP cache pruning interval. 1298.It Li arp.refresh 1299ARP entry refresh interval. 1300.It Li carp.allow 1301If set to 0, incoming 1302.Xr carp 4 1303packets will not be processed. 1304If set to any other value, processing will occur. 1305Enabled by default. 1306.It Li carp.arpbalance 1307If set to any value other than 0, the ARP balancing functionality of 1308.Xr carp 4 1309is enabled. 1310When ARP requests are received for an IP address which is part of any virtual 1311host, carp will hash the source IP in the ARP request to select one of the 1312virtual hosts from the set of all the virtual hosts which have that IP address. 1313The master of that host will respond with the correct virtual MAC address. 1314Disabled by default. 1315.It Li carp.log 1316If set to any value other than 0, 1317.Xr carp 4 1318will log errors. 1319Disabled by default. 1320.It Li carp.preempt 1321If set to 0, 1322.Xr carp 4 1323will not attempt to become master if it is receiving advertisements from 1324another active master. 1325If set to any other value, carp will become master of the virtual host if it 1326believes it can send advertisements more frequently than the current master. 1327Disabled by default. 1328.It Li ip.allowsrcrt 1329If set to 1, the host accepts source routed packets. 1330.It Li ip.anonportmax 1331The highest port number to use for TCP and UDP ephemeral port allocation. 1332This cannot be set to less than 1024 or greater than 65535, and must 1333be greater than 1334.Li ip.anonportmin . 1335.It Li ip.anonportmin 1336The lowest port number to use for TCP and UDP ephemeral port allocation. 1337This cannot be set to less than 1024 or greater than 65535. 1338.It Li ip.checkinterface 1339If set to non-zero, the host will reject packets addressed to it 1340that arrive on an interface not bound to that address. 1341Currently, this must be disabled if ipnat is used to translate the 1342destination address to another local interface, or if addresses 1343are added to the loopback interface instead of the interface where 1344the packets for those packets are received. 1345.It Li ip.directed-broadcast 1346If set to 1, enables directed broadcast behavior for the host. 1347.It Li ip.do_loopback_cksum 1348Perform IP checksum on loopback. 1349.It Li ip.forwarding 1350If set to 1, enables IP forwarding for the host, 1351meaning that the host is acting as a router. 1352.It Li ip.forwsrcrt 1353If set to 1, enables forwarding of source-routed packets for the host. 1354This value may only be changed if the kernel security level is less than 1. 1355.It Li ip.gifttl 1356The maximum time-to-live (hop count) value for an IPv4 packet generated by 1357.Xr gif 4 1358tunnel interface. 1359.It Li ip.grettl 1360The maximum time-to-live (hop count) value for an IPv4 packet generated by 1361.Xr gre 4 1362tunnel interface. 1363.It Li ip.hashsize 1364The size of IPv4 Fast Forward hash table. 1365This value must be a power of 2 (64, 256...). 1366A larger hash table size results in fewer collisions. 1367Also see 1368.Li ip.maxflows . 1369.It Li ip.hostzerobroadcast 1370All zeroes address is broadcast address. 1371.It Li ip.lowportmax 1372The highest port number to use for TCP and UDP reserved port allocation. 1373This cannot be set to less than 0 or greater than 1024, and must 1374be greater than 1375.Li ip.lowportmin . 1376.It Li ip.lowportmin 1377The lowest port number to use for TCP and UDP reserved port allocation. 1378This cannot be set to less than 0 or greater than 1024, and must 1379be smaller than 1380.Li ip.lowportmax . 1381.It Li ip.maxflows 1382IPv4 Fast Forwarding is enabled by default. 1383If set to 0, IPv4 Fast Forwarding is disabled. 1384.Li ip.maxflows 1385controls the maximum amount of flows which can be created. 1386The default value is 256. 1387.It Li ip.maxfragpackets 1388The maximum number of fragmented packets the node will accept. 13890 means that the node will not accept any fragmented packets. 1390\-1 means that the node will accept as many fragmented packets as it receives. 1391The flag is provided basically for avoiding possible DoS attacks. 1392.It Li ip.mtudisc 1393If set to 1, enables Path MTU Discovery (RFC 1191). 1394When Path MTU Discovery is enabled, the transmitted TCP segment 1395size will be determined by the advertised maximum segment size 1396(MSS) from the remote end, as constrained by the path MTU. 1397If MTU Discovery is disabled, the transmitted segment size will 1398never be greater than 1399.Li tcp.mssdflt 1400(the local maximum segment size). 1401.It Li ip.mtudisctimeout 1402The number of seconds in which a route added by the Path MTU 1403Discovery engine will time out. 1404When the route times out, the Path 1405MTU Discovery engine will attempt to probe a larger path MTU. 1406.It Li ip.random_id 1407Assign random ip_id values. 1408.It Li ip.redirect 1409If set to 1, ICMP redirects may be sent by the host. 1410This option is ignored unless the host is routing IP packets, 1411and should normally be enabled on all systems. 1412.It Li ip.subnetsarelocal 1413If set to 1, subnets are to be considered local addresses. 1414.It Li ip.ttl 1415The maximum time-to-live (hop count) value for an IP packet sourced by 1416the system. 1417This value applies to normal transport protocols, not to ICMP. 1418.It Li icmp.errppslimit 1419The variable specifies the maximum number of outgoing ICMP error messages, 1420per second. 1421ICMP error messages that exceeded the value are subject to rate limitation 1422and will not go out from the node. 1423Negative value disables rate limitation. 1424.It Li icmp.maskrepl 1425If set to 1, ICMP network mask requests are to be answered. 1426.It Li icmp.rediraccept 1427If set to non-zero, the host will accept ICMP redirect packets. 1428Note that routers will never accept ICMP redirect packets, 1429and the variable is meaningful on IP hosts only. 1430.It Li icmp.redirtimeout 1431The variable specifies lifetime of routing entries generated by incoming 1432ICMP redirect. 1433This defaults to 600 seconds. 1434.It Li icmp.returndatabytes 1435Number of bytes to return in an ICMP error message. 1436.It Li icmp.bmcastecho 1437If set to 1, enables responding to ICMP echo or timestamp request to the 1438broadcast address. 1439.It Li tcp.ack_on_push 1440If set to 1, TCP is to immediately transmit an ACK upon reception of 1441a packet with PUSH set. 1442This can avoid losing a round trip time in some rare situations, 1443but has the caveat of potentially defeating TCP's delayed ACK algorithm. 1444Use of this option is generally not recommended, but 1445the variable exists in case your configuration really needs it. 1446.It Li tcp.compat_42 1447If set to 1, enables work-arounds for bugs in the 4.2BSD TCP implementation. 1448Use of this option is not recommended, although it may be 1449required in order to communicate with extremely old TCP implementations. 1450.It Li tcp.cwm 1451If set to 1, enables use of the Hughes/Touch/Heidemann Congestion Window 1452Monitoring algorithm. 1453This algorithm prevents line-rate bursts of packets that could 1454otherwise occur when data begins flowing on an idle TCP connection. 1455These line-rate bursts can contribute to network and router congestion. 1456This can be particularly useful on World Wide Web servers 1457which support HTTP/1.1, which has lingering connections. 1458.It Li tcp.cwm_burstsize 1459The Congestion Window Monitoring allowed burst size, in terms 1460of packet count. 1461.It Li tcp.delack_ticks 1462Number of ticks to delay sending an ACK. 1463.It Li tcp.do_loopback_cksum 1464Perform TCP checksum on loopback. 1465.It Li tcp.init_win 1466A value indicating the TCP initial congestion window. 1467If this value is 0, an auto-tuning algorithm designed to use an initial 1468window of approximately 4K bytes is in use. 1469Otherwise, this value indicates a fixed number of packets. 1470.It Li tcp.init_win_local 1471Like 1472.Li tcp.init_win , 1473but used when communicating with hosts on a local network. 1474.It Li tcp.keepcnt 1475Number of keepalive probes sent before declaring a connection dead. 1476If set to zero, there is no limit; 1477keepalives will be sent until some kind of 1478response is received from the peer. 1479.It Li tcp.keepidle 1480Time a connection must be idle before keepalives are sent (if keepalives 1481are enabled for the connection). 1482See also tcp.slowhz. 1483.It Li tcp.keepintvl 1484Time after a keepalive probe is sent until, in the absence of any response, 1485another probe is sent. 1486See also tcp.slowhz. 1487.It Li tcp.log_refused 1488If set to 1, refused TCP connections to the host will be logged. 1489.It Li tcp.keepinit 1490Timeout in seconds during connection establishment. 1491.It Li tcp.mss_ifmtu 1492If set to 1, TCP calculates the outgoing maximum segment size based on 1493the MTU of the appropriate interface. 1494If set to 0, it is calculated based on the greater of the MTU of the 1495interface, and the largest (non-loopback) interface MTU on the system. 1496.It Li tcp.mssdflt 1497The default maximum segment size both advertised to the peer 1498and to use when either the peer does not advertise a maximum segment size to 1499us during connection setup or Path MTU Discovery 1500.Li ( ip.mtudisc ) 1501is disabled. 1502Do not change this value unless you really know what you are doing. 1503.It Li tcp.recvspace 1504The default TCP receive buffer size. 1505.It Li tcp.rfc1323 1506If set to 1, enables RFC 1323 extensions to TCP. 1507.It Li tcp.rstppslimit 1508The variable specifies the maximum number of outgoing TCP RST packets, 1509per second. 1510TCP RST packet that exceeded the value are subject to rate limitation 1511and will not go out from the node. 1512Negative value disables rate limitation. 1513.It Li tcp.ident 1514Return the user ID of a connected socket pair. 1515(RFC1413 Identification Protocol lookups.) 1516.It Li tcp.drop 1517Drop a TCP socket pair connection. 1518.It Li tcp.sack.enable 1519If set to 1, enables RFC 2018 Selective ACKnowledgement. 1520.It Li tcp.sack.globalholes 1521Global number of TCP SACK holes. 1522.It Li tcp.sack.globalmaxholes 1523Global maximum number of TCP SACK holes. 1524.It Li tcp.sack.maxholes 1525Maximum number of TCP SACK holes allowed per connection. 1526.It Li tcp.ecn.enable 1527If set to 1, enables RFC 3168 Explicit Congestion Notification. 1528.It Li tcp.ecn.maxretries 1529Number of times to retry sending the ECN-setup packet. 1530.It Li tcp.sendspace 1531The default TCP send buffer size. 1532.It Li tcp.slowhz 1533The units for tcp.keepidle and tcp.keepintvl; those variables are in ticks 1534of a clock that ticks tcp.slowhz times per second. 1535(That is, their values 1536must be divided by the tcp.slowhz value to get times in seconds.) 1537.It Li tcp.syn_bucket_limit 1538The maximum number of entries allowed per hash bucket in the TCP 1539compressed state engine. 1540.It Li tcp.syn_cache_limit 1541The maximum number of entries allowed in the TCP compressed state 1542engine. 1543.It Li tcp.timestamps 1544If rfc1323 is enabled, a value of 1 indicates RFC 1323 time stamp options, 1545used for measuring TCP round trip times, are enabled. 1546.It Li tcp.win_scale 1547If rfc1323 is enabled, a value of 1 indicates RFC 1323 window scale options, 1548for increasing the TCP window size, are enabled. 1549.It Li tcp.congctl.available 1550The available TCP congestion control algorithms. 1551.It Li tcp.congctl.selected 1552The currently selected TCP congestion control algorithm. 1553.It Li tcp.abc.enable 1554If set to 1, use RFC 3465 Appropriate Byte Counting (ABC). 1555If set to 0, use traditional Packet Counting. 1556.It Li tcp.abc.aggressive 1557Choose the L parameter found in RFC 3465. 1558L is the maximum cwnd increase for an ack during slow start. 1559If set to 1, use L=2*SMSS. 1560If set to 0, use L=1*SMSS. 1561It has no effect unless tcp.abc.enable is set to 1. 1562.It Li udp.checksum 1563If set to 1, UDP checksums are being computed. 1564Received non-zero UDP checksums are always checked. 1565Disabling UDP checksums is strongly discouraged. 1566.It Li udp.recvspace 1567The default UDP receive buffer size. 1568.It Li udp.rfc6056.available 1569The available RFC 6056 port randomization algorithms. 1570.It Li udp.rfc6056.selected 1571The currently selected RFC 6056 port randomization algorithm. 1572.It Li udp.sendspace 1573The default UDP send buffer size. 1574.El 1575.Pp 1576For variables net.*.ipsec, please refer to 1577.Xr ipsec 4 . 1578.It Li net.inet6 ( PF_INET6 ) 1579Get or set various global information about the IPv6 1580.Pq Internet Protocol version 6 . 1581The third level name is the protocol. 1582The fourth level name is the variable name. 1583The currently defined protocols and names are: 1584.Bl -column "Protocol name" "do_loopback_cksum" "integer" "Changeable" -offset indent 1585.It Sy Protocol name Variable name Type Changeable 1586.It icmp6 errppslimit integer yes 1587.It icmp6 mtudisc_hiwat integer yes 1588.It icmp6 mtudisc_lowat integer yes 1589.It icmp6 nd6_debug integer yes 1590.It icmp6 nd6_delay integer yes 1591.It icmp6 nd6_maxnudhint integer yes 1592.It icmp6 nd6_mmaxtries integer yes 1593.It icmp6 nd6_prune integer yes 1594.It icmp6 nd6_umaxtries integer yes 1595.It icmp6 nd6_useloopback integer yes 1596.It icmp6 nodeinfo integer yes 1597.It icmp6 rediraccept integer yes 1598.It icmp6 redirtimeout integer yes 1599.It ip6 accept_rtadv integer yes 1600.It ip6 anonportmax integer yes 1601.It ip6 anonportmin integer yes 1602.It ip6 auto_flowlabel integer yes 1603.It ip6 dad_count integer yes 1604.It ip6 defmcasthlim integer yes 1605.It ip6 forwarding integer yes 1606.It ip6 gifhlim integer yes 1607.It ip6 hashsize integer yes 1608.It ip6 hlim integer yes 1609.It ip6 hdrnestlimit integer yes 1610.It ip6 kame_version string no 1611.It ip6 keepfaith integer yes 1612.It ip6 log_interval integer yes 1613.It ip6 lowportmax integer yes 1614.It ip6 lowportmin integer yes 1615.It ip6 maxflows integer yes 1616.It ip6 maxfragpackets integer yes 1617.It ip6 maxfrags integer yes 1618.It ip6 redirect integer yes 1619.It ip6 rr_prune integer yes 1620.It ip6 use_deprecated integer yes 1621.It ip6 v6only integer yes 1622.It udp6 do_loopback_cksum integer yes 1623.It udp6 recvspace integer yes 1624.It udp6 rfc6056.selected string yes 1625.It udp6 rfc6056.available string yes 1626.It udp6 sendspace integer yes 1627.El 1628.Pp 1629The variables are as follows: 1630.Bl -tag -width "123456" 1631.It Li ip6.accept_rtadv 1632If set to non-zero, the node will accept ICMPv6 router advertisement packets 1633and autoconfigures address prefixes and default routers. 1634The node must be a host 1635.Pq not a router 1636for the option to be meaningful. 1637.It Li ip6.anonportmax 1638The highest port number to use for TCP and UDP ephemeral port allocation. 1639This cannot be set to less than 1024 or greater than 65535, and must 1640be greater than 1641.Li ip6.anonportmin . 1642.It Li ip6.anonportmin 1643The lowest port number to use for TCP and UDP ephemeral port allocation. 1644This cannot be set to less than 1024 or greater than 65535. 1645.It Li ip6.auto_flowlabel 1646On connected transport protocol packets, 1647fill IPv6 flowlabel field to help intermediate routers to identify packet flows. 1648.It Li ip6.dad_count 1649The variable configures number of IPv6 DAD 1650.Pq duplicated address detection 1651probe packets. 1652The packets will be generated when IPv6 interface addresses are configured. 1653.It Li ip6.defmcasthlim 1654The default hop limit value for an IPv6 multicast packet sourced by the node. 1655This value applies to all the transport protocols on top of IPv6. 1656There are APIs to override the value, as documented in 1657.Xr ip6 4 . 1658.It Li ip6.forwarding 1659If set to 1, enables IPv6 forwarding for the node, 1660meaning that the node is acting as a router. 1661If set to 0, disables IPv6 forwarding for the node, 1662meaning that the node is acting as a host. 1663IPv6 specification defines node behavior for 1664.Dq router 1665case and 1666.Dq host 1667case quite differently, and changing this variable during operation 1668may cause serious trouble. 1669It is recommended to configure the variable at bootstrap time, 1670and bootstrap time only. 1671.It Li ip6.gifhlim 1672The maximum hop limit value for an IPv6 packet generated by 1673.Xr gif 4 1674tunnel interface. 1675.It Li ip6.hdrnestlimit 1676The number of IPv6 extension headers permitted on incoming IPv6 packets. 1677If set to 0, the node will accept as many extension headers as possible. 1678.It Li ip6.hashsize 1679The size of IPv6 Fast Forward hash table. 1680This value must be a power of 2 (64, 256, ...). 1681A larger hash table size results in fewer collisions. 1682Also see 1683.Li ip6.maxflows . 1684.It Li ip6.hlim 1685The default hop limit value for an IPv6 unicast packet sourced by the node. 1686This value applies to all the transport protocols on top of IPv6. 1687There are APIs to override the value, as documented in 1688.Xr ip6 4 . 1689.It Li ip6.kame_version 1690The string identifies the version of KAME IPv6 stack implemented in the kernel. 1691.It Li ip6.keepfaith 1692If set to non-zero, it enables 1693.Dq FAITH 1694TCP relay IPv6-to-IPv4 translator code in the kernel. 1695Refer 1696.Xr faith 4 1697and 1698.Xr faithd 8 1699for detail. 1700.It Li ip6.log_interval 1701The variable controls amount of logs generated by IPv6 packet 1702forwarding engine, by setting interval between log output 1703.Pq in seconds . 1704.It Li ip6.lowportmax 1705The highest port number to use for TCP and UDP reserved port allocation. 1706This cannot be set to less than 0 or greater than 1024, and must 1707be greater than 1708.Li ip6.lowportmin . 1709.It Li ip6.lowportmin 1710The lowest port number to use for TCP and UDP reserved port allocation. 1711This cannot be set to less than 0 or greater than 1024, and must 1712be smaller than 1713.Li ip6.lowportmax . 1714.It Li ip6.maxflows 1715IPv6 Fast Forwarding is enabled by default. 1716If set to 0, IPv6 Fast Forwarding is disabled. 1717.Li ip6.maxflows 1718controls the maximum amount of flows which can be created. 1719The default value is 256. 1720.It Li ip6.maxfragpackets 1721The maximum number of fragmented packets the node will accept. 17220 means that the node will not accept any fragmented packets. 1723\-1 means that the node will accept as many fragmented packets as it receives. 1724The flag is provided basically for avoiding possible DoS attacks. 1725.It Li ip6.maxfrags 1726The maximum number of fragments the node will accept. 17270 means that the node will not accept any fragments. 1728\-1 means that the node will accept as many fragments as it receives. 1729The flag is provided basically for avoiding possible DoS attacks. 1730.It Li ip6.redirect 1731If set to 1, ICMPv6 redirects may be sent by the node. 1732This option is ignored unless the node is routing IP packets, 1733and should normally be enabled on all systems. 1734.It Li ip6.rr_prune 1735The variable specifies interval between IPv6 router renumbering prefix 1736babysitting, in seconds. 1737.It Li ip6.use_deprecated 1738The variable controls use of deprecated address, specified in RFC 2462 5.5.4. 1739.It Li ip6.v6only 1740The variable specifies initial value for 1741.Dv IPV6_V6ONLY 1742socket option for 1743.Dv AF_INET6 1744socket. 1745Please refer to 1746.Xr ip6 4 1747for detail. 1748.It Li icmp6.errppslimit 1749The variable specifies the maximum number of outgoing ICMPv6 error messages, 1750per second. 1751ICMPv6 error messages that exceeded the value are subject to rate limitation 1752and will not go out from the node. 1753Negative value disables rate limitation. 1754.It Li icmp6.mtudisc_hiwat 1755.It Li icmp6.mtudisc_lowat 1756The variables define the maximum number of routing table entries, 1757created due to path MTU discovery 1758.Pq prevents denial-of-service attacks with ICMPv6 too big messages . 1759When IPv6 path MTU discovery happens, we keep path MTU information into 1760the routing table. 1761If the number of routing table entries exceed the value, 1762the kernel will not attempt to keep the path MTU information. 1763.Li icmp6.mtudisc_hiwat 1764is used when we have verified ICMPv6 too big messages. 1765.Li icmp6.mtudisc_lowat 1766is used when we have unverified ICMPv6 too big messages. 1767Verification is performed by using address/port pairs kept in connected pcbs. 1768Negative value disables the upper limit. 1769.It Li icmp6.nd6_debug 1770If set to non-zero, kernel IPv6 neighbor discovery code will generate 1771debugging messages. 1772The debug outputs are useful to diagnose IPv6 interoperability issues. 1773The flag must be set to 0 for normal operation. 1774.It Li icmp6.nd6_delay 1775The variable specifies 1776.Dv DELAY_FIRST_PROBE_TIME 1777timing constant in IPv6 neighbor discovery specification 1778.Pq RFC 2461 , 1779in seconds. 1780.It Li icmp6.nd6_maxnudhint 1781IPv6 neighbor discovery permits upper layer protocols to supply reachability 1782hints, to avoid unnecessary neighbor discovery exchanges. 1783The variable defines the number of consecutive hints the neighbor discovery 1784layer will take. 1785For example, by setting the variable to 3, neighbor discovery layer 1786will take 3 consecutive hints in maximum. 1787After receiving 3 hints, neighbor discovery layer will perform 1788normal neighbor discovery process. 1789.It Li icmp6.nd6_mmaxtries 1790The variable specifies 1791.Dv MAX_MULTICAST_SOLICIT 1792constant in IPv6 neighbor discovery specification 1793.Pq RFC 2461 . 1794.It Li icmp6.nd6_prune 1795The variable specifies interval between IPv6 neighbor cache babysitting, 1796in seconds. 1797.It Li icmp6.nd6_umaxtries 1798The variable specifies 1799.Dv MAX_UNICAST_SOLICIT 1800constant in IPv6 neighbor discovery specification 1801.Pq RFC 2461 . 1802.It Li icmp6.nd6_useloopback 1803If set to non-zero, kernel IPv6 stack will use loopback interface for 1804local traffic. 1805.It Li icmp6.nodeinfo 1806The variable enables responses to ICMPv6 node information queries. 1807If you set the variable to 0, responses will not be generated for 1808ICMPv6 node information queries. 1809Since node information queries can have a security impact, it is 1810possible to fine tune which responses should be answered. 1811Two separate bits can be set. 1812.Bl -tag -width "12345" 1813.It 1 1814Respond to ICMPv6 FQDN queries, e.g. 1815.Li ping6 -w . 1816.It 2 1817Respond to ICMPv6 node addresses queries, e.g. 1818.Li ping6 -a . 1819.El 1820.It Li icmp6.rediraccept 1821If set to non-zero, the host will accept ICMPv6 redirect packets. 1822Note that IPv6 routers will never accept ICMPv6 redirect packets, 1823and the variable is meaningful on IPv6 hosts 1824.Pq non-router 1825only. 1826.It Li icmp6.redirtimeout 1827The variable specifies lifetime of routing entries generated by incoming 1828ICMPv6 redirect. 1829.It Li udp6.do_loopback_cksum 1830Perform UDP checksum on loopback. 1831.It Li udp6.recvspace 1832Default UDP receive buffer size. 1833.It Li udp6.rfc6056.available 1834The available RFC 6056 port randomization algorithms for IPv6. 1835.It Li udp6.rfc6056.selected 1836The currently selected RFC 6056 port randomization algorithm for IPv6. 1837.It Li udp6.sendspace 1838Default UDP send buffer size. 1839.El 1840.Pp 1841We reuse net.*.tcp for 1842.Tn TCP 1843over 1844.Tn IPv6 , 1845and therefore we do not have variables net.*.tcp6. 1846Variables net.inet6.udp6 have identical meaning to net.inet.udp. 1847Please refer to 1848.Li PF_INET 1849section above. 1850For variables net.*.ipsec6, please refer to 1851.Xr ipsec 4 . 1852.It Li net.key ( PF_KEY ) 1853Get or set various global information about the IPsec key management. 1854The third level name is the variable name. 1855The currently defined variable and names are: 1856.Bl -column "blockacq_lifetime" "integer" "Changeable" -offset indent 1857.It Sy Variable name Type Changeable 1858.It debug integer yes 1859.It spi_try integer yes 1860.It spi_min_value integer yes 1861.It spi_max_value integer yes 1862.It larval_lifetime integer yes 1863.It blockacq_count integer yes 1864.It blockacq_lifetime integer yes 1865.It esp_keymin integer yes 1866.It esp_auth integer yes 1867.It ah_keymin integer yes 1868.El 1869.Pp 1870The variables are as follows: 1871.Bl -tag -width "123456" 1872.It Li debug 1873Turn on debugging message from within the kernel. 1874The value is a bitmap, as defined in 1875.In netkey/key_debug.h . 1876.It Li spi_try 1877The number of times the kernel will try to obtain an unique SPI 1878when it generates it from random number generator. 1879.It Li spi_min_value 1880Minimum SPI value when generating it within the kernel. 1881.It Li spi_max_value 1882Maximum SPI value when generating it within the kernel. 1883.It Li larval_lifetime 1884Lifetime for LARVAL SAD entries, in seconds. 1885.It Li blockacq_count 1886Number of ACQUIRE PF_KEY messages to be blocked after an ACQUIRE message. 1887It avoids flood of ACQUIRE PF_KEY from being sent from the kernel to the 1888key management daemon. 1889.It Li blockacq_lifetime 1890Lifetime of ACQUIRE PF_KEY message. 1891.It Li esp_keymin 1892Minimum ESP key length, in bits. 1893The value is used when the kernel creates proposal payload 1894on ACQUIRE PF_KEY message. 1895.It Li esp_auth 1896Whether ESP authentication should be used or not. 1897Non-zero value indicates that ESP authentication should be used. 1898The value is used when the kernel creates proposal payload 1899on ACQUIRE PF_KEY message. 1900.It Li ah_keymin 1901Minimum AH key length, in bits, 1902The value is used when the kernel creates proposal payload 1903on ACQUIRE PF_KEY message. 1904.El 1905.El 1906.Ss The proc.* subtree 1907The string and integer information available for the 1908.Li proc 1909level is detailed below. 1910The changeable column shows whether a process with appropriate 1911privilege may change the value. 1912These values are per-process, 1913and as such may change from one process to another. 1914When a process is created, 1915the default values are inherited from its parent. 1916When a set-user-ID or set-group-ID binary is executed, the 1917value of PROC_PID_CORENAME is reset to the system default value. 1918The second level name is either the magic value PROC_CURPROC, which 1919points to the current process, or the PID of the target process. 1920.Bl -column "proc.pid.corename" "string" "not applicable" -offset indent 1921.It Sy Third level name Type Changeable 1922.It proc.pid.corename string yes 1923.It proc.pid.rlimit node not applicable 1924.It proc.pid.stopfork int yes 1925.It proc.pid.stopexec int yes 1926.It proc.pid.stopexit int yes 1927.El 1928.Bl -tag -width "123456" 1929.It Li proc.pid.corename ( PROC_PID_CORENAME ) 1930The template used for the core dump file name (see 1931.Xr core 5 1932for details). 1933The base name must either be 1934.Pa core 1935or end with the suffix 1936.Pa .core 1937(the super-user may set arbitrary names). 1938By default it points to 1939.Dv KERN_DEFCORENAME . 1940.It Li proc.pid.rlimit ( PROC_PID_LIMIT ) 1941Return resources limits, as defined for the 1942.Xr getrlimit 2 1943and 1944.Xr setrlimit 2 1945system calls. 1946The fourth level name is one of: 1947.Bl -tag -width "123456" 1948.It Li proc.pid.rlimit.cputime ( PROC_PID_LIMIT_CPU ) 1949The maximum amount of CPU time (in seconds) to be used by each process. 1950.It Li proc.pid.rlimit.filesize ( PROC_PID_LIMIT_FSIZE ) 1951The largest size (in bytes) file that may be created. 1952.It Li proc.pid.rlimit.datasize ( PROC_PID_LIMIT_DATA ) 1953The maximum size (in bytes) of the data segment for a process; 1954this defines how far a program may extend its break with the 1955.Xr sbrk 2 1956system call. 1957.It Li proc.pid.rlimit.stacksize ( PROC_PID_LIMIT_STACK ) 1958The maximum size (in bytes) of the stack segment for a process; 1959this defines how far a program's stack segment may be extended. 1960Stack extension is performed automatically by the system. 1961.It Li proc.pid.rlimit.coredumpsize ( PROC_PID_LIMIT_CORE ) 1962The largest size (in bytes) 1963.Pa core 1964file that may be created. 1965.It Li proc.pid.rlimit.memoryuse ( PROC_PID_LIMIT_RSS ) 1966The maximum size (in bytes) to which a process's resident set size may 1967grow. 1968This imposes a limit on the amount of physical memory to be given to 1969a process; if memory is tight, the system will prefer to take memory 1970from processes that are exceeding their declared resident set size. 1971.It Li proc.pid.rlimit.memorylocked ( PROC_PID_LIMIT_MEMLOCK ) 1972The maximum size (in bytes) which a process may lock into memory 1973using the 1974.Xr mlock 2 1975function. 1976.It Li proc.pid.rlimit.maxproc ( PROC_PID_LIMIT_NPROC ) 1977The maximum number of simultaneous processes for this user id. 1978.It Li proc.pid.rlimit.descriptors ( PROC_PID_LIMIT_NOFILE ) 1979The maximum number of open files for this process. 1980.It Li proc.pid.rlimit.sbsize ( PROC_PID_LIMIT_SBSIZE ) 1981The maximum size (in bytes) of the socket buffers 1982set by the 1983.Xr setsockopt 2 1984.Dv SO_RCVBUF 1985and 1986.Dv SO_SNDBUF 1987options. 1988.El 1989.Pp 1990The fifth level name is one of 1991.Li soft ( PROC_PID_LIMIT_TYPE_SOFT ) 1992or 1993.Li hard ( PROC_PID_LIMIT_TYPE_HARD ) , 1994to select respectively the soft or hard limit. 1995Both are of type integer. 1996.It Li proc.pid.stopfork ( PROC_PID_STOPFORK ) 1997If non zero, the process' children will be stopped after 1998.Xr fork 2 1999calls. 2000The children is created in the SSTOP state and is never scheduled 2001for running before being stopped. 2002This feature helps attaching a process with a debugger such as 2003.Xr gdb 1 2004before it had the opportunity to actually do anything. 2005.Pp 2006This value is inherited by the process's children, and it also 2007apply to emulation specific system calls that fork a new process, such as 2008.Fn sproc 2009or 2010.Fn clone . 2011.It Li proc.pid.stopexec ( PROC_PID_STOPEXEC ) 2012If non zero, the process will be stopped on next 2013.Xr exec 3 2014call. 2015The process created by 2016.Xr exec 3 2017is created in the SSTOP state and is never scheduled for running 2018before being stopped. 2019This feature helps attaching a process with a debugger such as 2020.Xr gdb 1 2021before it had the opportunity to actually do anything. 2022.Pp 2023This value is inherited by the process's children. 2024.It Li proc.pid.stopexit ( PROC_PID_STOPEXIT ) 2025If non zero, the process will be stopped on when it has cause to exit, 2026either by way of calling 2027.Xr exit 3 , 2028.Xr _exit 2 , 2029or by the receipt of a specific signal. 2030The process is stopped before any of its resources or vm space is 2031released allowing examination of the termination state of a process 2032before it disappears. 2033This feature can be used to examine the final conditions of the 2034process's vmspace via 2035.Xr pmap 1 2036or its resource settings with 2037.Xr sysctl 8 2038before it disappears. 2039.Pp 2040This value is also inherited by the process's children. 2041.El 2042.Ss The user.* subtree ( CTL_USER ) 2043The string and integer information available for the 2044.Li user 2045level is detailed below. 2046The changeable column shows whether a process with appropriate 2047privilege may change the value. 2048.Bl -column "user.coll_weights_max" "integer" "Changeable" -offset indent 2049.It Sy Second level name Type Changeable 2050.It user.atexit_max integer no 2051.It user.bc_base_max integer no 2052.It user.bc_dim_max integer no 2053.It user.bc_scale_max integer no 2054.It user.bc_string_max integer no 2055.It user.coll_weights_max integer no 2056.It user.cs_path string no 2057.It user.expr_nest_max integer no 2058.It user.line_max integer no 2059.It user.posix2_c_bind integer no 2060.It user.posix2_c_dev integer no 2061.It user.posix2_char_term integer no 2062.It user.posix2_fort_dev integer no 2063.It user.posix2_fort_run integer no 2064.It user.posix2_localedef integer no 2065.It user.posix2_sw_dev integer no 2066.It user.posix2_upe integer no 2067.It user.posix2_version integer no 2068.It user.re_dup_max integer no 2069.It user.stream_max integer no 2070.It user.stream_max integer no 2071.It user.tzname_max integer no 2072.El 2073.Bl -tag -width "123456" 2074.It Li user.atexit_max ( USER_ATEXIT_MAX ) 2075The maximum number of functions that may be registered with 2076.Xr atexit 3 . 2077.It Li user.bc_base_max ( USER_BC_BASE_MAX ) 2078The maximum ibase/obase values in the 2079.Xr bc 1 2080utility. 2081.It Li user.bc_dim_max ( USER_BC_DIM_MAX ) 2082The maximum array size in the 2083.Xr bc 1 2084utility. 2085.It Li user.bc_scale_max ( USER_BC_SCALE_MAX ) 2086The maximum scale value in the 2087.Xr bc 1 2088utility. 2089.It Li user.bc_string_max ( USER_BC_STRING_MAX ) 2090The maximum string length in the 2091.Xr bc 1 2092utility. 2093.It Li user.coll_weights_max ( USER_COLL_WEIGHTS_MAX ) 2094The maximum number of weights that can be assigned to any entry of 2095the LC_COLLATE order keyword in the locale definition file. 2096.It Li user.cs_path ( USER_CS_PATH ) 2097Return a value for the 2098.Ev PATH 2099environment variable that finds all the standard utilities. 2100.It Li user.expr_nest_max ( USER_EXPR_NEST_MAX ) 2101The maximum number of expressions that can be nested within 2102parenthesis by the 2103.Xr expr 1 2104utility. 2105.It Li user.line_max ( USER_LINE_MAX ) 2106The maximum length in bytes of a text-processing utility's input 2107line. 2108.It Li user.posix2_char_term ( USER_POSIX2_CHAR_TERM ) 2109Return 1 if the system supports at least one terminal type capable of 2110all operations described in 2111.St -p1003.2 , 2112otherwise\ 0. 2113.It Li user.posix2_c_bind ( USER_POSIX2_C_BIND ) 2114Return 1 if the system's C-language development facilities support the 2115C-Language Bindings Option, otherwise\ 0. 2116.It Li user.posix2_c_dev ( USER_POSIX2_C_DEV ) 2117Return 1 if the system supports the C-Language Development Utilities Option, 2118otherwise\ 0. 2119.It Li user.posix2_fort_dev ( USER_POSIX2_FORT_DEV ) 2120Return 1 if the system supports the FORTRAN Development Utilities Option, 2121otherwise\ 0. 2122.It Li user.posix2_fort_run ( USER_POSIX2_FORT_RUN ) 2123Return 1 if the system supports the FORTRAN Runtime Utilities Option, 2124otherwise\ 0. 2125.It Li user.posix2_localedef ( USER_POSIX2_LOCALEDEF ) 2126Return 1 if the system supports the creation of locales, otherwise\ 0. 2127.It Li user.posix2_sw_dev ( USER_POSIX2_SW_DEV ) 2128Return 1 if the system supports the Software Development Utilities Option, 2129otherwise\ 0. 2130.It Li user.posix2_upe ( USER_POSIX2_UPE ) 2131Return 1 if the system supports the User Portability Utilities Option, 2132otherwise\ 0. 2133.It Li user.posix2_version ( USER_POSIX2_VERSION ) 2134The version of 2135.St -p1003.2 2136with which the system attempts to comply. 2137.It Li user.re_dup_max ( USER_RE_DUP_MAX ) 2138The maximum number of repeated occurrences of a regular expression 2139permitted when using interval notation. 2140.It Li user.stream_max ( USER_STREAM_MAX ) 2141The minimum maximum number of streams that a process may have open 2142at any one time. 2143.It Li user.tzname_max ( USER_TZNAME_MAX ) 2144The minimum maximum number of types supported for the name of a 2145timezone. 2146.El 2147.Ss The vm.* subtree ( CTL_VM ) 2148The string and integer information available for the 2149.Li vm 2150level is detailed below. 2151The changeable column shows whether a process with appropriate 2152privilege may change the value. 2153.Bl -column "Second level name" "struct uvmexp_sysctl" "Changeable" -offset indent 2154.It Sy Second level name Type Changeable 2155.It vm.anonmax int yes 2156.It vm.anonmin int yes 2157.It vm.bufcache int yes 2158.It vm.bufmem int no 2159.It vm.bufmem_hiwater int yes 2160.It vm.bufmem_lowater int yes 2161.It vm.execmax int yes 2162.It vm.execmin int yes 2163.It vm.filemax int yes 2164.It vm.filemin int yes 2165.It vm.loadavg struct loadavg no 2166.It vm.maxslp int no 2167.It vm.nkmempages int no 2168.It vm.uspace int no 2169.It vm.uvmexp struct uvmexp no 2170.It vm.uvmexp2 struct uvmexp_sysctl no 2171.It vm.vmmeter struct vmtotal no 2172.El 2173.Pp 2174.Bl -tag -width "123456" 2175.It Li vm.anonmax ( VM_ANONMAX ) 2176The percentage of physical memory which will be reclaimed 2177from other types of memory usage to store anonymous application data. 2178.It Li vm.anonmin ( VM_ANONMIN ) 2179The percentage of physical memory which will be always be available for 2180anonymous application data. 2181.It Li vm.bufcache ( VM_BUFCACHE ) 2182The percentage of physical memory which will be available 2183for the buffer cache. 2184.It Li vm.bufmem ( VM_BUFMEM ) 2185The amount of kernel memory that is being used by the buffer cache. 2186.It Li vm.bufmem_lowater ( VM_BUFMEM_LOWATER ) 2187The minimum amount of kernel memory to reserve for the 2188buffer cache. 2189.It Li vm.bufmem_hiwater ( VM_BUFMEM_HIWATER ) 2190The maximum amount of kernel memory to be used for the 2191buffer cache. 2192.It Li vm.execmax ( VM_EXECMAX ) 2193The percentage of physical memory which will be reclaimed 2194from other types of memory usage to store cached executable data. 2195.It Li vm.execmin ( VM_EXECMIN ) 2196The percentage of physical memory which will be always be available for 2197cached executable data. 2198.It Li vm.filemax ( VM_FILEMAX ) 2199The percentage of physical memory which will be reclaimed 2200from other types of memory usage to store cached file data. 2201.It Li vm.filemin ( VM_FILEMIN ) 2202The percentage of physical memory which will be always be available for 2203cached file data. 2204.It Li vm.loadavg ( VM_LOADAVG ) 2205Return the load average history. 2206The returned data consists of a 2207.Vt struct loadavg . 2208.It Li vm.maxslp ( VM_MAXSLP ) 2209The value of the maxslp kernel global variable. 2210.It Li vm.vmmeter ( VM_METER ) 2211Return system wide virtual memory statistics. 2212The returned data consists of a 2213.Vt struct vmtotal . 2214.It vm.user_va0_disable 2215A flag which controls whether user processes can map virtual address\ 0. 2216.It Li vm.uspace ( VM_USPACE ) 2217The number of bytes allocated for each kernel stack. 2218.It Li vm.uvmexp ( VM_UVMEXP ) 2219Return system wide virtual memory statistics. 2220The returned data consists of a 2221.Vt struct uvmexp . 2222.It Li vm.uvmexp2 ( VM_UVMEXP2 ) 2223Return system wide virtual memory statistics. 2224The returned data consists of a 2225.Vt struct uvmexp_sysctl . 2226.\" XXX vm.idlezero 2227.El 2228.Ss The ddb.* subtree ( CTL_DDB ) 2229The information available for the 2230.Li ddb 2231level is detailed below. 2232The changeable column shows whether a process with appropriate 2233privilege may change the value. 2234.\" XXX sort 2235.Bl -column "Second level name" "integer" "Changeable" -offset indent 2236.It Sy Second level name Type Changeable 2237.It ddb.radix integer yes 2238.It ddb.maxoff integer yes 2239.It ddb.maxwidth integer yes 2240.It ddb.lines integer yes 2241.It ddb.tabstops integer yes 2242.It ddb.onpanic integer yes 2243.It ddb.fromconsole integer yes 2244.It ddb.tee_msgbuf integer yes 2245.It ddb.commandonenter string yes 2246.El 2247.Pp 2248.Bl -tag -width "123456" 2249.It Li ddb.radix ( DDBCTL_RADIX ) 2250The input and output radix. 2251.It Li ddb.maxoff ( DDBCTL_MAXOFF ) 2252The maximum symbol offset. 2253.It Li ddb.maxwidth ( DDBCTL_MAXWIDTH ) 2254The maximum output line width. 2255.It Li ddb.lines ( DDBCTL_LINES ) 2256Number of display lines. 2257.It Li ddb.tabstops ( DDBCTL_TABSTOPS ) 2258Tab width. 2259.It Li ddb.onpanic ( DDBCTL_ONPANIC ) 2260If greater than zero, DDB will be entered if the kernel panics. 2261A value of 1 causes the system to enter DDB on panic, while a value of 2 2262causes the kernel to attempt to print out a stack trace before entering DDB. 2263A value of 0 causes the kernel to attempt to print a stack trace, then 2264reboot, while a value of \-1 means neither a stack trace will be printed 2265nor DDB entered. 2266.It Li ddb.fromconsole ( DDBCTL_FROMCONSOLE ) 2267If not zero, DDB may be entered by sending a break on a serial 2268console or by a special key sequence on a graphics console. 2269.It Li ddb.tee_msgbuf 2270If not zero, DDB will output also to the kernel message buffer. 2271.It Li ddb.commandonenter 2272If not empty, a command to be executed on each enter to the 2273.Tn DDB . 2274.\" 2275.\" XXX: (a) ddb.commandonenter is missing in ddb(4); 2276.\" (b) No DDBCTL definitions for tee_msgbuf and commandonenter. 2277.El 2278.Pp 2279Some of these 2280.Tn MIB 2281nodes are also available as variables from within the debugger. 2282See 2283.Xr ddb 4 2284for more details. 2285.Ss The security.* subtree ( CTL_SECURITY ) 2286The 2287.Li security 2288level contains various security-related settings for 2289the system. 2290The available second level names are: 2291.Bl -column "Second level name" "integer" "Changeable" -offset indent 2292.It Sy Second level name Type Changeable 2293.It Li security.curtain integer yes 2294.It Li security.models node not applicable 2295.It Li security.pax node not applicable 2296.El 2297.Pp 2298Available settings are detailed below. 2299.Pp 2300.Bl -tag -width "123456" 2301.It Li security.curtain 2302If non-zero, will filter return objects according to the user 2303.Tn ID 2304requesting information about them, preventing from users any 2305access to objects they do not own. 2306.Pp 2307At the moment, it affects 2308.Xr ps 1 , 2309.Xr netstat 1 2310(for 2311.Dv PF_INET , 2312.Dv PF_INET6 , 2313and 2314.Dv PF_UNIX 2315PCBs), and 2316.Xr w 1 . 2317.It Li security.models 2318.Nx 2319supports pluggable security models. 2320Every security model used, whether if loaded as a module or built with the system, 2321is required to add an entry to this node with at least one element, 2322.Dq name , 2323indicating the name of the security model. 2324.Pp 2325In addition to the name, any settings and other information private to the 2326security model will be available under this node. 2327See 2328.Xr secmodel 9 2329for more information. 2330.It Li security.pax 2331Settings for PaX -- exploit mitigation features. 2332For more information on any of the PaX features, please see 2333.Xr paxctl 8 2334and 2335.Xr security 7 . 2336The available third and fourth level names are: 2337.Bl -column "security.pax.segvguard.suspend_timeout" "integer" "Changeable" \ 2338-offset 2n 2339.It Sy Third and fourth level names Ta Sy Type Ta Sy Changeable 2340.It Li security.pax.aslr.enabled integer yes 2341.\".It Li security.pax.aslr.exec_len integer yes 2342.It Li security.pax.aslr.global integer yes 2343.\".It Li security.pax.aslr.mmap_len integer yes 2344.\".It Li security.pax.aslr.stack_len integer yes 2345.It Li security.pax.mprotect.enabled integer yes 2346.It Li security.pax.mprotect.global integer yes 2347.It Li security.pax.segvguard.enabled integer yes 2348.It Li security.pax.segvguard.expiry_timeout integer yes 2349.It Li security.pax.segvguard.global integer yes 2350.It Li security.pax.segvguard.max_crashes integer yes 2351.It Li security.pax.segvguard.suspend_timeout integer yes 2352.El 2353.Pp 2354.Bl -tag -width "123456" 2355.It Li security.pax.aslr.enabled 2356Enable PaX ASLR (Address Space Layout Randomization). 2357.Pp 2358The value of this 2359knob must be non-zero for PaX ASLR to be enabled, even if a program is set to 2360explicit enable. 2361.\".It Li security.pax.aslr.exec_len 2362.\" XXX: Undocumented. 2363.It Li security.pax.aslr.global 2364Specifies the default global policy for programs without an 2365explicit enable/disable flag. 2366.Pp 2367When non-zero, all programs will get PaX ASLR, except those exempted with 2368.Xr paxctl 8 . 2369Otherwise, all programs will not get PaX ASLR, except those specifically 2370marked as such with 2371.Xr paxctl 8 . 2372.\".It Li security.pax.aslr.mmap_len 2373.\" XXX: Undocumented. 2374.\" .It Li security.pax.aslr.stack_len 2375.\" XXX: Undocumented. 2376.It Li security.pax.mprotect.enabled 2377Enable PaX MPROTECT restrictions. 2378.Pp 2379These are 2380.Xr mprotect 2 2381restrictions to better enforce a W^X policy. 2382The value of this 2383knob must be non-zero for PaX MPROTECT to be enabled, even if a 2384program is set to explicit enable. 2385.It Li security.pax.mprotect.global 2386Specifies the default global policy for programs without an 2387explicit enable/disable flag. 2388.Pp 2389When non-zero, all programs will get the PaX MPROTECT restrictions, 2390except those exempted with 2391.Xr paxctl 8 . 2392Otherwise, all programs will not get the PaX MPROTECT restrictions, 2393except those specifically marked as such with 2394.Xr paxctl 8 . 2395.It Li security.pax.segvguard.enabled 2396Enable PaX Segvguard. 2397.Pp 2398PaX Segvguard can detect and prevent certain exploitation attempts, where 2399an attacker may try for example to brute-force function return addresses 2400of respawning daemons. 2401.Pp 2402.Em Note : 2403The 2404.Nx 2405interface and implementation of the Segvguard is still experimental, and may 2406change in future releases. 2407.It Li security.pax.segvguard.expiry_timeout 2408If the max number was not reached within this timeout (in seconds), the entry 2409will expire. 2410.It Li security.pax.segvguard.global 2411Specifies the default global policy for programs without an 2412explicit enable/disable flag. 2413.Pp 2414When non-zero, all programs will get the PaX Segvguard, 2415except those exempted with 2416.Xr paxctl 8 . 2417Otherwise, no program will get the PaX Segvguard restrictions, 2418except those specifically marked as such with 2419.Xr paxctl 8 . 2420.It Li security.pax.segvguard.max_crashes 2421The maximum number of segfaults a program can receive before suspension. 2422.It Li security.pax.segvguard.suspend_timeout 2423Number of seconds to suspend a user from running a faulting program when the 2424limit was exceeded. 2425.El 2426.El 2427.Ss The vendor.* subtree ( CTL_VENDOR ) 2428The 2429.Li vendor 2430toplevel name is reserved to be used by vendors who wish to 2431have their own private MIB tree. 2432Intended use is to store values under 2433.Dq vendor.\*[Lt]yourname\*[Gt].* . 2434.Sh SEE ALSO 2435.Xr sysctl 3 , 2436.Xr ipsec 4 , 2437.Xr tcp 4 , 2438.Xr security 7 , 2439.Xr sysctl 8 2440.Sh HISTORY 2441The 2442.Nm 2443variables first appeared in 2444.Bx 4.4 . 2445