From: Andrew Hewus Fresh <andrew@afresh1.com>
Subject: Re: Earlier /tmp cleanup in /etc/rc
To: Klemens Nanni <kn@openbsd.org>
Cc: tech@openbsd.org
Date: Tue, 25 Aug 2026 15:39:36 -0700

On Tue, Aug 25, 2026 at 08:32:49PM +0000, Klemens Nanni wrote:
> 24.08.2026 21:30, Andrew Hewus Fresh пишет:
> Reads solid to me, a few remarks inline.

Thanks for taking a look!


> > +    skip="! -path . ! -path ./lost+found ! -path ./quota.user 
> 
> '! -path .' is '-mindepth 1', if you prefer that to match -maxdepth 1.

I think that's easier to understand.


> > +	! -path ./quota.group ! -path ./vi.recover"
> > +    find -d . $skip -print -exec rm -rf {} \; | head -50 >/dev/null
> > +    tmpdir=$(mktemp -d .delXXXXXXXXXX) &&
> > +	find . -maxdepth 1 $skip ! -name "$tmpdir" -print0 | \
> 
> \ is not needed here.

True, must be a habit


> > +	    xargs -r0J % mv -f % "$tmpdir"
> > +    rm -rf "$tmpdir" &
> 
> rm still runs on mktemp failure, which is fine as -f ensure zero-exit,
> logically it reads like oversight, though, so I'd gate both commands:

ya, `rm -f ""` being a noop in the very uncommon case of mktemp failing
seemed easier to read, but another set of braces is more correct.


Index: rc
===================================================================
RCS file: /cvs/src/etc/rc,v
diff -u -p -r1.590 rc
--- rc	17 Aug 2026 22:41:38 -0000	1.590
+++ rc	25 Aug 2026 22:13:38 -0000
@@ -502,6 +502,22 @@ sysctl_conf
 mount -s /var >/dev/null 2>&1		# cannot be on NFS
 mount -s /var/log >/dev/null 2>&1	# cannot be on NFS
 mount -s /usr >/dev/null 2>&1		# if NFS, fstab must use IP address
+mount -s /tmp >/dev/null 2>&1		# if NFS, fstab must use IP address
+
+# Prune /tmp before users can authenticate.  A few files are removed
+# immediately, but most of the deletion happens asynchronously while
+# daemons are being started
+( cd /tmp && {
+    echo clearing /tmp
+    skip="-mindepth 1 ! -path ./lost+found ! -path ./quota.user 
+	! -path ./quota.group ! -path ./vi.recover"
+    find -d . $skip -print -exec rm -rf {} \; | head -50 >/dev/null
+    tmpdir=$(mktemp -d .delXXXXXXXXXX) && {
+	find . -maxdepth 1 $skip ! -name "$tmpdir" -print0 |
+	    xargs -r0J % mv -f % "$tmpdir"
+	rm -rf "$tmpdir" &
+    }
+} )
 
 reorder_libs 2>&1 |&
 
@@ -597,26 +613,6 @@ if [[ -f /etc/ptmp ]]; then
 	    'password file may be incorrect -- /etc/ptmp exists'
 fi
 
-echo clearing /tmp
-
-# Prune /tmp before users can authenticate.  A few files are removed
-# immediately, but most of the deletion happens asyncronously while
-# daemons are being started
-clear_tmp_dir=$(cd /tmp && {
-    rm -rf .{X11,ICE}-unix
-
-    set -- rm -rf
-    TMPDIR=$(mktemp -d /tmp/.delXXXXXXXXXX) && export TMPDIR &&
-	set -- sh -c 'mv -f -- "$@" "$TMPDIR"'
-    find . -maxdepth 1 ! -name . ! -name lost+found ! -name quota.user \
-	! -name quota.group ! -name vi.recover ! -name "$(basename "$TMPDIR")" \
-	-exec "$@" -- {} \+
-    rm -rfv "$TMPDIR" 2>&1 | head -20 >/dev/null
-    echo "$TMPDIR"
-} )
-rm -rf "$clear_tmp_dir" &
-clear_tmp_pid=$!
-
 # Create Unix sockets directories for X if needed and make sure they have
 # correct permissions.
 [[ -d /usr/X11R6/lib ]] && mkdir -m 1777 /tmp/.{X11,ICE}-unix
@@ -666,8 +662,6 @@ start_daemon dhcp6leased rad hostapd lpd
 start_daemon ftpproxy ftpproxy6 tftpd tftpproxy identd inetd rarpd bootparamd
 start_daemon rbootd mopd vmd spamd spamlogd sndiod
 echo '.'
-
-wait $clear_tmp_pid
 
 # If rc.firsttime exists, run it just once, and make sure it is deleted.
 run_upgrade_script firsttime