From: Andrew Hewus Fresh <andrew@afresh1.com>
Subject: Re: Earlier /tmp cleanup in /etc/rc
To: tech@openbsd.org
Date: Wed, 26 Aug 2026 09:20:20 -0700

As noticed by landry@ and deraadt@, the previous incantation of find
searching by depth left the paths in $skip, but attempted to remove up
to 50 files from them which it isn't supposed to.

So, instead, we need another round of indirection using xargs to only
use depth into the directories we actually want to remove.  We also
-print only if the rm succeeds (although with -f, I think it always
"succeeds") and hide STDERR from the `find ... rm`.

While here, we also stop trying to remove any top-level entries with the
sticky bit.


Index: rc
===================================================================
RCS file: /cvs/src/etc/rc,v
diff -u -p -r1.590 rc
--- rc	17 Aug 2026 22:41:38 -0000	1.590
+++ rc	26 Aug 2026 16:04:34 -0000
@@ -502,6 +502,23 @@ sysctl_conf
 mount -s /var >/dev/null 2>&1		# cannot be on NFS
 mount -s /var/log >/dev/null 2>&1	# cannot be on NFS
 mount -s /usr >/dev/null 2>&1		# if NFS, fstab must use IP address
+mount -s /tmp >/dev/null 2>&1		# if NFS, fstab must use IP address
+
+# Prune /tmp before users can authenticate.  A few files are removed
+# immediately, but most of the deletion happens asynchronously while
+# daemons are being started
+( cd /tmp && {
+    echo clearing /tmp
+    skip="-maxdepth 1 -mindepth 1 ! -perm -1000 ! -path ./lost+found 
+	! -path ./quota.user ! -path ./quota.group ! -path ./vi.recover"
+    find . $skip -print0 | xargs -r0J % find -d % -exec rm -rf {} \; -print |
+	head -50 >/dev/null 2>&1
+    tmpdir=$(mktemp -d .delXXXXXXXXXX) && {
+	find . $skip ! -name "$tmpdir" -print0 |
+	    xargs -r0J % mv -f % "$tmpdir"
+	rm -rf "$tmpdir" &
+    }
+} )
 
 reorder_libs 2>&1 |&
 
@@ -597,26 +614,6 @@ if [[ -f /etc/ptmp ]]; then
 	    'password file may be incorrect -- /etc/ptmp exists'
 fi
 
-echo clearing /tmp
-
-# Prune /tmp before users can authenticate.  A few files are removed
-# immediately, but most of the deletion happens asyncronously while
-# daemons are being started
-clear_tmp_dir=$(cd /tmp && {
-    rm -rf .{X11,ICE}-unix
-
-    set -- rm -rf
-    TMPDIR=$(mktemp -d /tmp/.delXXXXXXXXXX) && export TMPDIR &&
-	set -- sh -c 'mv -f -- "$@" "$TMPDIR"'
-    find . -maxdepth 1 ! -name . ! -name lost+found ! -name quota.user \
-	! -name quota.group ! -name vi.recover ! -name "$(basename "$TMPDIR")" \
-	-exec "$@" -- {} \+
-    rm -rfv "$TMPDIR" 2>&1 | head -20 >/dev/null
-    echo "$TMPDIR"
-} )
-rm -rf "$clear_tmp_dir" &
-clear_tmp_pid=$!
-
 # Create Unix sockets directories for X if needed and make sure they have
 # correct permissions.
 [[ -d /usr/X11R6/lib ]] && mkdir -m 1777 /tmp/.{X11,ICE}-unix
@@ -666,8 +663,6 @@ start_daemon dhcp6leased rad hostapd lpd
 start_daemon ftpproxy ftpproxy6 tftpd tftpproxy identd inetd rarpd bootparamd
 start_daemon rbootd mopd vmd spamd spamlogd sndiod
 echo '.'
-
-wait $clear_tmp_pid
 
 # If rc.firsttime exists, run it just once, and make sure it is deleted.
 run_upgrade_script firsttime