FreeBSD/i386 6.1-RELEASE Release Notes

2.1 Security Advisories

A temporary file vulnerability in texindex(1), which could allow a local attacker to overwrite files in the context of a user running the texindex(1) utility, has been fixed. For more details see security advisory FreeBSD-SA-06:01.texindex.

A temporary file vulnerability in the ee(1) text editor, which could allow a local attacker to overwrite files in the context of a user running ee(1), has been fixed. For more details see security advisory FreeBSD-SA-06:02.ee.

Several vulnerabilities in the cpio(1) utility have been corrected. For more details see security advisory FreeBSD-SA-06:03.cpio.

An error in ipfw(4) IP fragment handling, which could cause a crash, has been fixed. For more details see security advisory FreeBSD-SA-06:04.ipfw.

A potential buffer overflow in the IEEE 802.11 scanning code has been corrected. For more details see security advisory FreeBSD-SA-06:05.80211.

Two instances in which portions of kernel memory could be disclosed to users have been fixed. For more details see security advisory FreeBSD-SA-06:06.kmem.

A logic bug in the IP fragment handling in pf(4), which could cause a crash under certain circumstances, has been fixed. For more details see security advisory FreeBSD-SA-06:07.pf.

A logic bug in the NFS server code, which could cause a crash when the server received a message with a zero-length payload, has been fixed. For more details see security advisory FreeBSD-SA-06:10.nfs.

A programming error in the fast_ipsec(4) implementation results in the sequence number associated with a Security Association not being updated, allowing packets to unconditionally pass sequence number verification checks, has been fixed. For more details see security advisory FreeBSD-SA-06:11.ipsec.

A logic bug that could cause opiepasswd(1) to allow an unprivileged user to configure OPIE authentication for the root user under certain circumstances, has been fixed. For more details see security advisory FreeBSD-SA-06:12.opie.

An asynchronous signal handling vulnerability in sendmail(8), which could allow a remote attacker to execute arbitrary code with the privileges of the user running sendmail, typically root, has been fixed. For more details see security advisory FreeBSD-SA-06:13.sendmail.

An information disclosure issue found in the FreeBSD kernel running on 7th- and 8th-generation AMD processors has been fixed. For more details see security advisory FreeBSD-SA-06:14.fpu.

2.2 Kernel Changes

The ddb(4) debugger now supports the show lock command. If the argument has a valid lock class, this displays various information about the lock and calls a new function pointer in lock_class (lc_ddb_show) to dump class-specific information about the lock as well (such as the owner of a mutex or xlock'ed sx lock).

DEFAULTS kernel configuration files for each platform have been added.

The firmware(9) subsystem has been added. This allows to load binary data into the kernel via a specially crafted module.

The random(4) entropy device driver is now MPSAFE.

A new sysctl variable security.mac.biba.interfaces_equal which makes all network interfaces be created with the label biba/equal(equal-equal), has been added. This is useful where programs such as dhclient(8) and ppp(8). which initialize network interfaces do not have any labeling support. This variable is set as 0(disabled) by default.

pipe 1000 config bw 1000Kbyte/s
pipe 4000 config bw 4000Kbyte/s
table 1 add x.x.x.x 1000
table 1 add x.x.x.y 4000
pipe tablearg ip from table(1) to any

geli_da0_keyfile0_load="YES"
geli_da0_keyfile0_type="da0:geli_keyfile0"
geli_da0_keyfile0_name="/boot/keys/da0.key0"
geli_da0_keyfile1_load="YES"
geli_da0_keyfile1_type="da0:geli_keyfile1"
geli_da0_keyfile1_name="/boot/keys/da0.key1"
geli_da0_keyfile2_load="YES"
geli_da0_keyfile2_type="da0:geli_keyfile2"
geli_da0_keyfile2_name="/boot/keys/da0.key2"

geli_da1s3a_keyfile0_load="YES"
geli_da1s3a_keyfile0_type="da1s3a:geli_keyfile0"
geli_da1s3a_keyfile0_name="/boot/keys/da1s3a.key"

2.3 Userland Changes

The bsnmpd(1) utility now supports the Host Resources MIB described in RFC 2790.

The config(8) utility now supports the nocpu directive, which cancels the effect of a previous cpu directive.

The config(8) utility now reads DEFAULTS kernel configuration file if it exists in the current directory before the specified configuration file.

The csh(1) utility now supports NLS catalog. Note that this requires installing the shells/tcsh_nls port.

The devd(8) utility now supports a -f option to specify a configuration file.

The ln(1) utility now supports an -F flag which allows to delete existing empty directories, when creating symbolic links.

The locate(1) utility now supports a -0 flag to make this utility interoperable with xargs(1)'s -0 flag.

The ls(1) utility now supports an -I flag to disable the automatic -A flag for the superuser.

The ftpd(8) utility now creates a PID file /var/run/ftpd.pid even when no -p option is specified.

The getfacl(1) utility now supports a -q flag to suppress the per-file header comment listing the file name, owner, and group.

The gvinum(8) utility now supports commands to rename objects and to move a subdisk from one drive to another.

The jail(8) utility supports a -J jid_file option to write out a JidFile, similar to a PidFile, containing the jailid, path, hostname, IP and the command used to start the jail.

The kdump(1) utility now supports a -H flag, which causes kdump to print an additional field holding the threadid.

The kdump(1) program now supports a -s flag to suppress the display of I/O data.

The mergemaster(8) utility now supports an -A option to explicitly specify an architecture to pass through to the underlying makefiles.

The moused(8) daemon now supports an -H flag to enable horizontal virtual scrolling similar to a -V flag for vertical virtual scrolling.

The netstat(1) utility now supports printing ipsec(4) protocol statistics if the kernel was compiled with FAST_IPSEC rather than the KAME IPSEC stack. Note that the output of netstat -s -p ipsec differs depending on which stack is compiled into the kernel since they each keep different statistics.

The periodic(8) daily script now supports display of the status of gmirror(8), graid3(8), gstripe(8), and gconcat(8) devices. Note that these are disabled by default.

A new function, pidfile(3), which provides reliable pidfiles handling, has been implemented in libutil.

The rfcomm_sppd(1) now supports service name in addition to -c option with channel number. The supported names are: DUN (Dial-Up Networking), FAX (Fax), LAN (LAN Access Using PPP), and SP (Serial Port).

The snapinfo(8) utility, which shows snapshot locations on UFS filesystems, has been added.

The strtonum(3) library function has been implemented based on OpenBSD's implementation. This is an improved version of strtoll(3).

A bug in the ypwhich(1) utility which causes the -m option to produce an incorrect list of available named maps has been fixed.

ipv4_addrs_ed0="192.168.0.1/24 192.168.1.1-5/28"

2.4 Contributed Software

BIND has been updated from 9.3.1 to 9.3.2.

hostapd has been updated from version 0.3.9 to version 0.4.8.

GNU Troff has been updated from version 1.19 to version 1.19.2.

sendmail has been updated from 8.13.4 to 8.13.6.

The timezone database has been updated from the tzdata2005l release to the tzdata2005r release.

WPA Supplicant has been updated from version 0.3.9 to version 0.4.8.

2.5 Ports/Packages Collection Infrastructure

The pkg_add(1) command now supports an -P flag, which is the same as the -p flag except that the given prefix is also used recursively for the dependency packages if any.

The pkg_add(1) and pkg_create(1) utilities now support a -K flag to save packages to the current directory (or PKGDIR if defined) by default.

The pkg_create(1) program now supports an -x flag to support basic regular expressions for package name, an -E flag for extended regular expressions, and a -G for exact matching.

The pkg_version(1) utility now supports an -o flag to show the origin recorded on package generation instead of the package name, and an -O flag to list packages whose registered origin is origin only.

The portsnap(8) utility (sysutils/portsnap) has been added into the FreeBSD base system. This is a secure, easy to use, fast, lightweight, and generally good way for users to keep their ports trees up to date.

A incorrect handling of HTTP_PROXY_AUTH in the portsnap(8) utility has been fixed.

The startup scripts from the local_startup directory now evaluated by using rcorder(8) with scripts in the base system.

The suffix of startup scripts from the Ports Collection has been removed. This means foo.sh is renamed to foo, and now scripts whose name is something like foo.ORG will also be invoked. You are recommended to reinstall packages which install such scripts and remove extra files in the local_startup directory.

New rc.conf variables, ldconfig_local_dirs and ldconfig_local32_dirs have been added. These hold lists of local ldconfig(8) directories.

The @cwd command in pkg-plist now allows no directory argument. If no directory argument is given, it will set current working directory to the first prefix given by the @cwd command.

2.6 Release Engineering and Integration

The /var/audit directory and audit group have been added. These are for the TrustedBSD OpenBSM distribution, which will be imported in the future releases.

The supported version of the GNOME desktop environment (x11/gnome2) has been updated from 2.10.2 to 2.12.3.

The supported version of the KDE desktop environment (x11/kde2) has been updated from 3.4.2 to 3.5.1.

The supported version of the Perl interpreter (lang/perl5.8) has been updated from 5.8.7 to 5.8.8.

The supported version of the Xorg windowing system (x11/xorg) has been updated from 6.8.2 to 6.9.0.

2.7 Documentation