On Wed, Aug 26, 2026 at 09:14:25PM -0600, Theo de Raadt wrote:
> I think there is still reason to redirect the final rm -rf (or maybe
> even the find + mv to /dev/null, becuase noone wants to see any noise
> from this.

Easy enough.
(easy enough I didn't actually test it because dinner is ready)


Index: rc
===================================================================
RCS file: /cvs/src/etc/rc,v
diff -u -p -r1.590 rc
--- rc	17 Aug 2026 22:41:38 -0000	1.590
+++ rc	27 Aug 2026 03:25:27 -0000
@@ -502,6 +502,24 @@ sysctl_conf
 mount -s /var >/dev/null 2>&1		# cannot be on NFS
 mount -s /var/log >/dev/null 2>&1	# cannot be on NFS
 mount -s /usr >/dev/null 2>&1		# if NFS, fstab must use IP address
+mount -s /tmp >/dev/null 2>&1		# if NFS, fstab must use IP address
+
+# Prune /tmp before users can authenticate.  A few files are removed
+# immediately, but most of the deletion happens asynchronously while
+# daemons are being started
+( cd /tmp && {
+    echo clearing /tmp
+    skip="-mindepth 1 -maxdepth 1 ! -name lost+found ! -name quota.user 
+	! -name quota.group ! -name vi.recover"
+    find . $skip ! -perm -1000 -print0 |
+	xargs -r0J % find -d % -exec rm -rf -- {} \; -print |
+	    head -50 >/dev/null 2>&1
+    tmpdir=$(mktemp -d .delXXXXXXXXXX) && {
+	find . $skip ! -name "$tmpdir" -print0 |
+	    xargs -r0J % mv -f -- % "$tmpdir" 2>/dev/null
+	rm -rf -- "$tmpdir" 2>/dev/null &
+    }
+} )
 
 reorder_libs 2>&1 |&
 
@@ -597,26 +615,6 @@ if [[ -f /etc/ptmp ]]; then
 	    'password file may be incorrect -- /etc/ptmp exists'
 fi
 
-echo clearing /tmp
-
-# Prune /tmp before users can authenticate.  A few files are removed
-# immediately, but most of the deletion happens asyncronously while
-# daemons are being started
-clear_tmp_dir=$(cd /tmp && {
-    rm -rf .{X11,ICE}-unix
-
-    set -- rm -rf
-    TMPDIR=$(mktemp -d /tmp/.delXXXXXXXXXX) && export TMPDIR &&
-	set -- sh -c 'mv -f -- "$@" "$TMPDIR"'
-    find . -maxdepth 1 ! -name . ! -name lost+found ! -name quota.user \
-	! -name quota.group ! -name vi.recover ! -name "$(basename "$TMPDIR")" \
-	-exec "$@" -- {} \+
-    rm -rfv "$TMPDIR" 2>&1 | head -20 >/dev/null
-    echo "$TMPDIR"
-} )
-rm -rf "$clear_tmp_dir" &
-clear_tmp_pid=$!
-
 # Create Unix sockets directories for X if needed and make sure they have
 # correct permissions.
 [[ -d /usr/X11R6/lib ]] && mkdir -m 1777 /tmp/.{X11,ICE}-unix
@@ -666,8 +664,6 @@ start_daemon dhcp6leased rad hostapd lpd
 start_daemon ftpproxy ftpproxy6 tftpd tftpproxy identd inetd rarpd bootparamd
 start_daemon rbootd mopd vmd spamd spamlogd sndiod
 echo '.'
-
-wait $clear_tmp_pid
 
 # If rc.firsttime exists, run it just once, and make sure it is deleted.
 run_upgrade_script firsttime