HardenedBSD/src c035552libexec/rc rc.subr, libexec/rc/tests svcj_test.sh

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+1,178-0libexec/rc/tests/svcj_test.sh
+153-54sys/dev/igc/if_igc.c
+29-2libexec/rc/rc.subr
+21-3share/man/man4/igc.4
+2-18sys/compat/linuxkpi/common/include/linux/pci.h
+20-0sys/dev/igc/igc_mac.c
+1,403-7718 files not shown
+1,489-10224 files

HardenedBSD/src eb6bd71libexec/rc rc.subr, libexec/rc/tests svcj_test.sh

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+1,178-0libexec/rc/tests/svcj_test.sh
+153-54sys/dev/igc/if_igc.c
+29-2libexec/rc/rc.subr
+21-3share/man/man4/igc.4
+2-18sys/compat/linuxkpi/common/include/linux/pci.h
+20-0sys/dev/igc/igc_mac.c
+1,403-7718 files not shown
+1,489-10224 files

FreeBSD/src 5076e9binclude assert.h time.h, sys/sys stdatomic.h

libc: Fix C23 version macro visibility

In headers that existed prior to C23, these should be visible only in
C23 or BSD mode.

Fixes:          0fe73dcf7c32 ("libc: Add <assert.h> C23 feature test macro")
Fixes:          1f09e354297c ("sys/limits.h: Add BOOL_MAX, BITINT_MAXWIDTH, and C23 feature test macro")
Fixes:          cd0727ec709b ("libc: Add <stdio.h> C23 feature test macro")
Fixes:          fc9d02cb29ed ("libc: Add <time.h> C23 feature test macro")
Fixes:          4aeed6e9d213 ("libc: Add <setjmp.h> C23 feature test macro")
Reviewed by:    fuz, kfv, dteske
Differential Revision:  https://reviews.freebsd.org/D59272
DeltaFile
+4-2sys/sys/stdatomic.h
+4-2include/time.h
+4-2include/stdio.h
+4-2include/setjmp.h
+4-2include/limits.h
+2-0include/assert.h
+22-106 files

HardenedBSD/src 5076e9binclude assert.h time.h, sys/sys stdatomic.h

libc: Fix C23 version macro visibility

In headers that existed prior to C23, these should be visible only in
C23 or BSD mode.

Fixes:          0fe73dcf7c32 ("libc: Add <assert.h> C23 feature test macro")
Fixes:          1f09e354297c ("sys/limits.h: Add BOOL_MAX, BITINT_MAXWIDTH, and C23 feature test macro")
Fixes:          cd0727ec709b ("libc: Add <stdio.h> C23 feature test macro")
Fixes:          fc9d02cb29ed ("libc: Add <time.h> C23 feature test macro")
Fixes:          4aeed6e9d213 ("libc: Add <setjmp.h> C23 feature test macro")
Reviewed by:    fuz, kfv, dteske
Differential Revision:  https://reviews.freebsd.org/D59272
DeltaFile
+4-2sys/sys/stdatomic.h
+4-2include/time.h
+4-2include/stdio.h
+4-2include/setjmp.h
+4-2include/limits.h
+2-0include/assert.h
+22-106 files

HardenedBSD/ports 72e2be8audio/praat Makefile distinfo, audio/praat/files patch-LPC_CPP.cpp

audio/praat: update to 7.0.02, latest upstream

Release notes, as always, are at
        https://www.fon.hum.uva.nl/praat/manual/What_s_new_.html

One previous patch has now been resolved upstream.
DeltaFile
+0-21audio/praat/files/patch-LPC_CPP.cpp
+3-3audio/praat/distinfo
+1-1audio/praat/Makefile
+4-253 files

FreeBSD/ports 72e2be8audio/praat Makefile distinfo, audio/praat/files patch-LPC_CPP.cpp

audio/praat: update to 7.0.02, latest upstream

Release notes, as always, are at
        https://www.fon.hum.uva.nl/praat/manual/What_s_new_.html

One previous patch has now been resolved upstream.
DeltaFile
+0-21audio/praat/files/patch-LPC_CPP.cpp
+3-3audio/praat/distinfo
+1-1audio/praat/Makefile
+4-253 files

LLVM/project 5bea437llvm/lib/Target/X86 X86CodeGenPassBuilder.cpp, llvm/test/CodeGen/X86/GlobalISel binop.ll

[X86][NewPM] Wire up GISel pipeline (#219785)
DeltaFile
+42-6llvm/lib/Target/X86/X86CodeGenPassBuilder.cpp
+1-0llvm/test/CodeGen/X86/GlobalISel/binop.ll
+43-62 files

HardenedBSD/ports 1520f08multimedia/avidemux Makefile Makefile.common, multimedia/avidemux-cli Makefile

multimedia/avidemux*: Take maintainership, undeprecate

Approved by:    multimedia (implicit - maintainer isn't interested in supporting these ports)
Sponsored by:   UNIS Labs
DeltaFile
+2-3multimedia/avidemux/Makefile.common
+0-1multimedia/avidemux/Makefile
+0-1multimedia/avidemux-qt5/Makefile
+0-1multimedia/avidemux-plugins/Makefile
+0-1multimedia/avidemux-cli/Makefile
+2-75 files

FreeBSD/ports 1520f08multimedia/avidemux Makefile Makefile.common, multimedia/avidemux-cli Makefile

multimedia/avidemux*: Take maintainership, undeprecate

Approved by:    multimedia (implicit - maintainer isn't interested in supporting these ports)
Sponsored by:   UNIS Labs
DeltaFile
+2-3multimedia/avidemux/Makefile.common
+0-1multimedia/avidemux/Makefile
+0-1multimedia/avidemux-qt5/Makefile
+0-1multimedia/avidemux-plugins/Makefile
+0-1multimedia/avidemux-cli/Makefile
+2-75 files

NetBSD/pkgsrc dZbb3pBemulators/qemu Makefile.common

   qemu: use ${.CURDIR} before relative paths
VersionDeltaFile
1.2+3-3emulators/qemu/Makefile.common
+3-31 files

FreeBSD/ports 0fecff0devel/php-composer Makefile distinfo

devel/php-composer: Update to 2.10.3

PR:             298000
Approved by:    Naram Qashat <cyberbotx at cyberbotx.com> (maintainer)
MFH:            2026Q3
Security:       db135cd1-a232-11f1-85ed-10ffe07f9334

(cherry picked from commit 6bb8b425827335b0ec57b25d80edb694696d431e)
DeltaFile
+3-3devel/php-composer/distinfo
+1-1devel/php-composer/Makefile
+4-42 files

HardenedBSD/ports 6bb8b42devel/php-composer Makefile distinfo

devel/php-composer: Update to 2.10.3

PR:             298000
Approved by:    Naram Qashat <cyberbotx at cyberbotx.com> (maintainer)
MFH:            2026Q3
Security:       db135cd1-a232-11f1-85ed-10ffe07f9334
DeltaFile
+3-3devel/php-composer/distinfo
+1-1devel/php-composer/Makefile
+4-42 files

FreeBSD/ports 982ecd4games/corsix-th Makefile distinfo

games/corsix-th: Update to 0.70.1
DeltaFile
+3-3games/corsix-th/distinfo
+1-1games/corsix-th/Makefile
+4-42 files

HardenedBSD/ports 982ecd4games/corsix-th Makefile distinfo

games/corsix-th: Update to 0.70.1
DeltaFile
+3-3games/corsix-th/distinfo
+1-1games/corsix-th/Makefile
+4-42 files

FreeBSD/ports 6bb8b42devel/php-composer Makefile distinfo

devel/php-composer: Update to 2.10.3

PR:             298000
Approved by:    Naram Qashat <cyberbotx at cyberbotx.com> (maintainer)
MFH:            2026Q3
Security:       db135cd1-a232-11f1-85ed-10ffe07f9334
DeltaFile
+3-3devel/php-composer/distinfo
+1-1devel/php-composer/Makefile
+4-42 files

FreeBSD/src b5dcd8flibexec/rc/tests Makefile svcj_test.sh

rc.subr tests: service jail behaviour of run_rc_command

Twenty cases over where each rc option and each method executes for a
jailed service, the jail's lifetime, and the svcj option handling.  Each
case drives the service inside a chroot built in its ATF work directory.

MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+1,178-0libexec/rc/tests/svcj_test.sh
+1-1libexec/rc/tests/Makefile
+1,179-12 files

HardenedBSD/src b5dcd8flibexec/rc/tests Makefile svcj_test.sh

rc.subr tests: service jail behaviour of run_rc_command

Twenty cases over where each rc option and each method executes for a
jailed service, the jail's lifetime, and the svcj option handling.  Each
case drives the service inside a chroot built in its ATF work directory.

MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+1,178-0libexec/rc/tests/svcj_test.sh
+1-1libexec/rc/tests/Makefile
+1,179-12 files

FreeBSD/src be834d6share/man/man5 rc.conf.5

rc.conf.5: note that a negative nice value does not reach a service jail

Raising a process' priority is not permitted inside a jail, and nice(1)
warns and executes the command anyway, so the service comes up at its login
class priority.

Not changing the date, as a commit a moment before this, one changed it
already.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+8-0share/man/man5/rc.conf.5
+8-01 files

HardenedBSD/src be834d6share/man/man5 rc.conf.5

rc.conf.5: note that a negative nice value does not reach a service jail

Raising a process' priority is not permitted inside a jail, and nice(1)
warns and executes the command anyway, so the service comes up at its login
class priority.

Not changing the date, as a commit a moment before this, one changed it
already.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+8-0share/man/man5/rc.conf.5
+8-01 files

HardenedBSD/src 9125bc0libexec/rc rc.subr, share/man/man5 rc.conf.5

rc.subr: svcj - add a setaudit option

setaudit(8) is prefixed to the command inside the jail when
${name}_audit_user is set, and needs allow.setaudit.

This is not added automatically when ${name}_audit_user is set, this
needs an administrative setting of the options on purpose.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+5-1share/man/man5/rc.conf.5
+3-0libexec/rc/rc.subr
+8-12 files

FreeBSD/src 9125bc0libexec/rc rc.subr, share/man/man5 rc.conf.5

rc.subr: svcj - add a setaudit option

setaudit(8) is prefixed to the command inside the jail when
${name}_audit_user is set, and needs allow.setaudit.

This is not added automatically when ${name}_audit_user is set, this
needs an administrative setting of the options on purpose.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+5-1share/man/man5/rc.conf.5
+3-0libexec/rc/rc.subr
+8-12 files

FreeBSD/src 327dae5libexec/rc rc.subr

rc.subr: svcj - run a service's own restart and status methods in its jail

A script that defines non-default restart_cmd or status_cmd should
execute them in the service jail.  Where there is no jail to enter,
restart starts the service instead of failing.

Fixes:                  2efbd480f1d3 rc: add service jails framework
MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+17-1libexec/rc/rc.subr
+17-11 files

HardenedBSD/src 327dae5libexec/rc rc.subr

rc.subr: svcj - run a service's own restart and status methods in its jail

A script that defines non-default restart_cmd or status_cmd should
execute them in the service jail.  Where there is no jail to enter,
restart starts the service instead of failing.

Fixes:                  2efbd480f1d3 rc: add service jails framework
MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+17-1libexec/rc/rc.subr
+17-11 files

FreeBSD/src a70ca1elibexec/rc rc.subr

rc.subr: svcj - remove the service jail when the service is not running

A service whose tracked process had died while another process of its own
kept the jail alive, therefore left svcj-${name} behind, and the next start
would fail.

Fixes:                  2efbd480f1d3 rc: add service jails framework
MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+4-0libexec/rc/rc.subr
+4-01 files

HardenedBSD/src a70ca1elibexec/rc rc.subr

rc.subr: svcj - remove the service jail when the service is not running

A service whose tracked process had died while another process of its own
kept the jail alive, therefore left svcj-${name} behind, and the next start
would fail.

Fixes:                  2efbd480f1d3 rc: add service jails framework
MFC after:              1 week
MFC to:                 stable/15
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+4-0libexec/rc/rc.subr
+4-01 files

HardenedBSD/src 21e53eelibexec/rc rc.conf rc.subr

rc.subr: svcj - let svcj_all_enable enable service jails

Fix the logic for svcj_all_enable.

Fixes:          2efbd480f1d3 rc: add service jails framework
MFC after:      1 week
MFC to:         stable/15
DeltaFile
+2-1libexec/rc/rc.subr
+2-0libexec/rc/rc.conf
+4-12 files

FreeBSD/src 21e53eelibexec/rc rc.conf rc.subr

rc.subr: svcj - let svcj_all_enable enable service jails

Fix the logic for svcj_all_enable.

Fixes:          2efbd480f1d3 rc: add service jails framework
MFC after:      1 week
MFC to:         stable/15
DeltaFile
+2-1libexec/rc/rc.subr
+2-0libexec/rc/rc.conf
+4-12 files

FreeBSD/src 6155e17libexec/rc rc.subr

rc.subr: svcj - send the stop signal from inside the service jail

A service running under ${name}_user was signalled from the host as that
user, which the parent of a jail may no longer do: since 8a5ceebece03 an
unprivileged process would need allow.unprivileged_parent_tampering.
Stop and reload therefore failed and left both the service and its jail
running.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+3-0libexec/rc/rc.subr
+3-01 files

HardenedBSD/src 6155e17libexec/rc rc.subr

rc.subr: svcj - send the stop signal from inside the service jail

A service running under ${name}_user was signalled from the host as that
user, which the parent of a jail may no longer do: since 8a5ceebece03 an
unprivileged process would need allow.unprivileged_parent_tampering.
Stop and reload therefore failed and left both the service and its jail
running.

MFC after:      1 week
MFC to:         stable/15
DeltaFile
+3-0libexec/rc/rc.subr
+3-01 files

FreeBSD/ports a225a20net/bsdec2-image-upload Makefile distinfo

net/bsdec2-image-upload: Update to 1.4.12

Sponsored by:   Amazon

(cherry picked from commit 50cf9cdc6aa18443f7e522cb33458a078aaaea82)
DeltaFile
+3-3net/bsdec2-image-upload/distinfo
+1-1net/bsdec2-image-upload/Makefile
+4-42 files