Subject: Re: pf's rc.d script & startup priority
To: None <tech-security@NetBSD.org>
From: Luke Mewburn <lukem@NetBSD.org>
List: tech-security
Date: 08/08/2005 10:27:10
--Zrag5V6pnZGjLKiw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 08, 2005 at 02:14:01AM +0200, Peter Postma wrote:
  | > 	Does rc.d/pf rely upon /usr as part of its startup?
  | > 	I don't think it does, unless pfspamd [from pkgsrc?]
  | > 	or other /usr-located programs are needed by pf.
  | >=20
  |=20
  | Yes, if used as LKM. But if we start it after the LKMs then it should be
  | fine.

That could introduce a weird dependency ordering;
this will probably only work if pf is a BEFORENET lkm
(in lkm.conf) which means that /usr needs to be available=20
for this to work.
Testing this theory will be required.


  | I've tried the REQUIRE line from the ipfilter script in the pf script b=
ut it
  | still gets ordered too late. Do you have a suggestion?

That's because rc.d/network REQUIREs ipfilter.
You could try
	BEFORE: network
in rc.d/pf.


Luke.

--Zrag5V6pnZGjLKiw
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (NetBSD)

iD8DBQFC9qbepBhtmn8zJHIRAimrAJ9G01Q5b8ETA1XFtKm80G+xhwfh1QCgtYgg
ogQ4DKsh+HBfugYCxm6U3Bw=
=n4pP
-----END PGP SIGNATURE-----

--Zrag5V6pnZGjLKiw--