2.1 Kernel Changes

The kern.maxvnodes limit now properly limits the number of vnodes in use. Previously only vnodes with no cached pages could be freed; this could allow the number of vnodes to grow without limit on large-memory machines accessing many small files. A vnlru kernel thread helps to flush and reuse vnodes.

Linux emulation now supports the kernel functionality required by the emulators/linux_base-7 (RedHat 7.X emulation) port.

A MAXMEM kernel option, along with the hw.physmem loader tunable, can be used to artificially reduce the memory size of a machine for testing (or other purposes).

The kernel configuration parameters MAXTSIZ, DFLDSIZ, MAXDSIZ, DFLSSIZ, MAXSSIZ, and SGROWSIZ are all loader tunables (kern.maxtsiz, kern.maxdfldsiz, etc.).

Specifying a value of 0 for the maxusers kernel configuration parameter will now cause an appropriate value to be calculated at boot-time (between 32 and 384, depending on the amount of memory present). This value is now the default for all GENERIC kernels.

The console driver has gained support for TGA-based display adapters.

Coredumps of large processes (or of a large number of processes) no longer lock up the machine for long periods of time.

The system load average computation now adds some jitter to the timing of samples, in order to avoid synchronization with processes that run periodically.

If a debugging kernel with modules is being built (i.e. using makeoptions DEBUG=-g), the modules will now be built with debugging support as well, for completeness. A side effect of this change is that modules built and installed with debugging kernels will now occupy more space on disk than they did previously.

Compaq Tru64 and FreeBSD keep the year in the TOY clock chip in different formats. Compaq Tru64 uses a year-value that is 52 years higher than FreeBSD. In order to allow dual booting of an Alpha machine without clobbering the TOY clock setting, FreeBSD now supports a boot environment variable clock_compat_osf1 to use Tru64's year values. By setting this variable to 1 from the ok prompt of the loader or by putting clock_compat_osf1=1 in /boot/loader.conf, an Alpha can be dual booted without ``time warps''.

The kernel on the installation CDs is now separated from the mfsroot image. This provides more flexibility when building custom FreeBSD distributions.

2.2 Security-Related Changes

Per-user ~/.login.conf files were disabled in FreeBSD 4.4-RELEASE to avoid a security hole caused by a bug. The bug was fixed and this feature has been re-enabled.

A security hole in OpenSSH, which could allow users to execute code with arbitrary privileges if UseLogin yes was set, has been closed. Note that the default value of this setting is UseLogin no. (See security advisory FreeBSD-SA-01:63.)

The use of an insecure temporary directory by pkg_add(1) could permit a local attacker to modify the contents of binary packages while they were being installed. This hole has been closed. (See security advisory FreeBSD-SA-02:01.)

A race condition in pw(8), which could expose the contents of /etc/master.passwd, has been eliminated. (See security advisory FreeBSD-SA-02:02.)

A bug in k5su(8) could have allowed a process that had given up superuser privileges to regain them. This bug has been fixed. (See security advisory FreeBSD-SA-02:07.)

A race condition in the exec(3) system call, which could result in local users obtaining increased privileges, has been fixed. (See security advisory FreeBSD-SA-02:08.)

2.3 Userland Changes

arp(8) now prints the applicable interface name for each ARP entry.

cat(1) now has the ability to read from UNIX-domain sockets.

edquota(8) now takes a -f option to allow limiting the prototype quota distribution (specified with -p) to a single filesystem.

find(1) can now take various units of time to be applied to the -[acm]time primaries.

fmt(1) has been rewritten; the rewrite fixes a number of bugs compared to its prior behavior.

ftpd(8) now supports -o and -O options to disable the RETR command; the former for everybody, and the latter only for guest users. Coupled with -A and appropriate file permissions, these can be used to create a relatively safe anonymous FTP drop box for others to upload to.

The groups(1) and whoami(1) shell scripts are now unnecessary; their functionality has been completely folded into id(1).

ipfw(8) will now avoid the display of dynamic firewall rules unless the -d flag is passed to it. The -e option lists expired dynamic rules.

ipfw(8) has a new limit type of firewall rule, which limits the number of sessions between address pairs.

keyinfo(1) is now a C program, rather than a Perl script.

libfetch has been synchronized to the version in FreeBSD -CURRENT; among other features, it now has support for an authentication callback.

libstand now has support for filesystems containing bzip2-compressed files.

Locale names have been renamed to improve compatibility with the names used by X11R6, as well as a number of other UNIX versions. As an example, the en_US.ISO_8859-1 locale name has been changed to en_US.ISO8859-1. Entries in /etc/locale.alias, /etc/man.alias, and /etc/nls.alias provide backward compatibility. The table below summarizes the locale changes:

lpd(8) now has some support for o-type print-file actions in its control files, which allows printing of PostScript files generated by MacOS 10.1.

natd(8) now supports a -log_ipfw_denied option to log packets that cannot be re-injected because they are blocked by ipfw(8) rules.

netstat(1) now has a -z flag to reset statistics.

netstat(1) now has a -S flag to print addresses numerically but port names symbolically.

The default number of cylinders per group in newfs(8) is now computed to be the maximum allowable given the current filesystem parameters. It can be overridden with the -c option. Formerly, the default was fixed at 16. This change leads to better fsck(8) performance and reduced fragmentation.

The default block and fragment sizes for new filesystems created by newfs(8) are now 16384 and 2048 bytes, respectively (the old defaults were 8192 and 1024 bytes). This change generally provides increased performance, at the expense of some wasted disk space.

newsyslog(8) now has the ability to compress log files using bzip2(1).

nl(1), a line numbering filter program, has been added.

pciconf(8) now supports a -v option to display the vendor/device information of configured devices, in conjunction with the -l option. The default vendor/device database can be found at /usr/share/misc/pci_vendors.

ping(8) now supports a -A option to beep when packets are lost.

route(8) is now more verbose when changing indirect routes, in the case of a gateway route that is the same route as the one being modified.

route(8) now uses host/bits syntax instead of net/bits syntax, for compatibility with netstat(1).

route(8) can now create ``proxy only'' published ARP entries.

The route(8) add command now supports the -ifp and -ifa modifiers.

send-pr(1) now takes a -a option to include a file into the Fix: section of a problem report.

sh(1) now implements test as a built-in command for improved efficiency.

sysctl(8) now supports a -e option to separate variable names and values by = rather than :. This feature is useful for producing output that can be fed back to sysctl(8).

sysinstall(8) now has the ability to load KLDs as a part of the installation.

When run from the installation media, sysinstall(8) will automatically load any device drivers found in the /stand/modules directory of the mfsroot floppy or filesystem image. Note that any drivers so loaded will not appear in the kernel's boot messages; the sysinstall(8) debugging screen will provide additional information.

sysinstall(8) now enables Soft Updates by default on all filesystems it creates, except for the root filesystem.

sysinstall(8) has received updates for its ``auto'' partitioning mode which provide more reasonable defaults for the sizes of partitions that are created; auto-sized partitions can now also recover the space that becomes available when other partitions are deleted.

syslogd(8) now has the ability to bind to a specific address (as opposed to using every available one) via the -b option.

syslogd(8) now accepts a -c flag to disable repeated line compression.

Previously, vnconfig(8) was only capable of configuring 16 devices when invoked with the -f (configuration file) option. This limit has been removed.

wall(1) now supports a -g flag to write a message to all users of a given group.

whois(1) supports a -c option to specify a country code to help direct queries towards a particular whois server.

    define(`confDEF_USER_ID', `daemon')