Re: initial pf-rules -> sysctl -> networking

[Han Boetes <han@mijncomputer.nl>]

Gerber Simon wrote:
> Han wrote:
> > In /etc/rc first the initial pf-rules are loaded and then the sysctls
> > are loaded and then networking is started.
> > It seems to be more logical to first load the sysctl, then load the
> > initial pf-rules and then networking is started.

> The practical reason for this is that if you're increasing your kernel
> security level from 1 (default) to 2 it becomes impossible to alter
> the pf rule file. So you've to load it before the sysctls modify the
> kernel security level.

Ehm no.

Much later on in /etc/rc this happens:

    [ -f /etc/rc.securelevel ] && . /etc/rc.securelevel
    if [ -n "$securelevel" ]; then
        echo -n 'Setting kernel security level: '
        sysctl -w kern.securelevel=$securelevel
    fi

So putting the securelevel in /etc/sysctl.conf _is_ possible, but I
wouldn't recommend it :)




# Han