From owner-svn-src-all@freebsd.org Mon Jun 6 16:38:11 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 90A09B6BB95; Mon, 6 Jun 2016 16:38:11 +0000 (UTC) (envelope-from lidl@FreeBSD.org) Received: from hydra.pix.net (hydra.pix.net [IPv6:2001:470:e254::4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.pix.net", Issuer "Pix.Com Technologies, LLC CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 451E5107B; Mon, 6 Jun 2016 16:38:11 +0000 (UTC) (envelope-from lidl@FreeBSD.org) Received: from torb.pix.net (torb.pix.net [192.168.16.32]) (authenticated bits=0) by hydra.pix.net (8.15.2/8.15.2) with ESMTPA id u56Gc9FR062665; Mon, 6 Jun 2016 12:38:10 -0400 (EDT) (envelope-from lidl@FreeBSD.org) Reply-To: lidl@FreeBSD.org Subject: Re: svn commit: r301226 - in head: etc etc/defaults etc/periodic/security etc/rc.d lib lib/libblacklist libexec libexec/blacklistd-helper share/mk tools/build/mk usr.sbin usr.sbin/blacklistctl usr.sbin... References: <201606021906.u52J649H019481@repo.freebsd.org> To: Matteo Riondato Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org From: Kurt Lidl Message-ID: <90df7c5b-7680-3de0-68ba-ab9bd1c9d73e@FreeBSD.org> Date: Mon, 6 Jun 2016 12:38:09 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2016 16:38:11 -0000 On 6/5/16 2:39 PM, Matteo Riondato wrote: > >> On Jun 2, 2016, at 3:06 PM, Kurt Lidl wrote: >> >> Author: lidl >> Date: Thu Jun 2 19:06:04 2016 >> New Revision: 301226 >> URL: https://svnweb.freebsd.org/changeset/base/301226 >> >> Log: >> Add basic blacklist build support >> > [snip] >> Modified: head/etc/defaults/rc.conf >> ============================================================================== >> --- head/etc/defaults/rc.conf Thu Jun 2 18:41:33 2016 (r301225) >> +++ head/etc/defaults/rc.conf Thu Jun 2 19:06:04 2016 (r301226) >> @@ -270,6 +270,8 @@ hastd_program="/sbin/hastd" # path to ha >> hastd_flags="" # Optional flags to hastd. >> ctld_enable="NO" # CAM Target Layer / iSCSI target daemon. >> local_unbound_enable="NO" # local caching resolver >> +blacklistd_enable="YES" # Run blacklistd daemon (YES/NO). >> +blacklistd_flags="" # Optional flags for blacklistd(8). > > What is the rationale for having this enabled by default? Well, from a certain standpoint, it will encourage more people to enable the packet filtering it in their pf.conf and get the benefit of having a system-wide blacklist notification system running. Without a one-line change to enable the blocking in the pf.conf file, it won't do any blocking. > Is any of the services that use it (in their default config) enabled by default? I suppose, technically speaking, no there are no daemons with blacklist support enabled by default. I am planning to commit the sshd support tomorrow morning, and even *that* daemon isn't enabled by default. I am happy enough to turn off the blacklist daemon by default. You are the first person to question this since I posted the review back near the beginning of April. -Kurt