When collecting a script or unregistering a service, cancel timeouts

Both service and sysv stanzas support a cleanup:script (since v4.10), with an optional timeout. These timers must be stopped when collecting a PID for an svc_t, or when unregistering an svc_t, otherwise the timer callback will be continuously called, reporting "spurious problem", and cause 100% CPU usage. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Minor, drop __func__ from dbg() statements
2026-10-12 10:12:32 +00:00 · 2025-08-29 16:49:34 +02:00 · 2025-08-29 16:48:38 +02:00 · 2025-08-29 16:02:42 +02:00 · 2025-08-29 15:07:45 +02:00 · 2025-08-29 14:43:25 +02:00
271 changed files with 15009 additions and 5267 deletions
@@ -9,9 +9,9 @@ For email questions/requests/alerts there is always the risk of memory
 exhaustion on the part of the maintainer(s).

 If you are unsure of what to do, or how to implement an idea or bugfix,
-open an issue with `"[RFC: Unsure if this is a bug ... ?"`, or similar,
-so we can discuss it.  Talking about the code first is the best way to
-get started before submitting a pull request.
+open an issue with `"[RFC: Unsure if this is a bug ... ?"`, or use the
+GitHub discussions forum, so we can discuss it.  Talking about the code
+first is the best way to get started before submitting a pull request.

 Either way, when sending an email, patch, or pull request, start by
 stating the version the change is made against, what it does, and why.
@@ -24,7 +24,8 @@ the maintainer(s) and make it easier for them to include your code.
 Coding Style
 ------------

-> **Tip:** Always submit code that follows the style of surrounding code!
+> [!TIP]
+> Always submit code that follows the style of surrounding code!

 First of all, lines are allowed to be longer than 72 characters these
 days.  In fact, there exist no enforced maximum, but keeping it around
@@ -73,7 +74,6 @@ It is expected of everyone engaging in the project to, in the words of
 Bill & Ted; [be excellent to each other][conduct].


-[github]:   https://github.com/troglobit/finit/
 [KNF]:      https://en.wikipedia.org/wiki/Kernel_Normal_Form
 [gitbook]:  https://git-scm.com/book/ch5-2.html
 [conduct]:  CODE-OF-CONDUCT.md
@@ -8,63 +8,71 @@ on:
      - '**'
      - '!dev'
  pull_request:
-    branches:
-      - '**'
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true

 jobs:
  build:
    # Verify we can build on latest Ubuntu with both gcc and clang
    name: ${{ matrix.compiler }}
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
+    # Skip redundant builds for PRs - prefer PR builds over push builds
+    if: github.event_name != 'push' || github.ref == 'refs/heads/master'
    strategy:
      matrix:
        compiler: [gcc, clang]
      fail-fast: false
    env:
-      MAKEFLAGS: -j3
      CC: ${{ matrix.compiler }}
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get -y update
-          sudo apt-get -y install pkg-config
-          wget https://github.com/troglobit/libuev/releases/download/v2.3.2/libuev-2.3.2.tar.xz
-          wget https://github.com/troglobit/libite/releases/download/v2.5.2/libite-2.5.2.tar.gz
-          tar xf libuev-2.3.2.tar.xz
-          tar xf libite-2.5.2.tar.gz
-          (cd libuev-2.3.2 && ./configure --prefix=/usr && make && sudo make install-strip)
-          (cd libite-2.5.2 && ./configure --prefix=/usr && make && sudo make install-strip)
-          sudo ldconfig
-      - uses: actions/checkout@v2
+          sudo apt-get -y install pkg-config tree jq libuev-dev libite-dev
+      - uses: actions/checkout@v4
      - name: Static Finit
        run: |
          ./autogen.sh
          ./configure --prefix= --enable-static
-          make V=1
+          make -j3 V=1
      - name: Regular Finit
        run: |
-          ./configure --prefix= --enable-x11-common-plugin --with-watchdog --with-keventd
-          make clean
-          make V=1
-      - name: Install to ~/tmp and Inspect
+          ./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var \
+                      --enable-x11-common-plugin --enable-testserv-plugin --with-watchdog \
+                      --with-keventd --with-libsystemd \
+                      CFLAGS="-fsanitize=address -ggdb"
+          make -j3 clean
+          make -j3 V=1
+      - name: Install to /tmp
        run: |
          DESTDIR=/tmp make install-strip
-          tree /tmp
+          tree /tmp || true
+      - name: Check dependencies
+        run: |
          ldd  /tmp/sbin/finit
          size /tmp/sbin/finit
          ldd  /tmp/sbin/initctl
          size /tmp/sbin/initctl
          ldd  /tmp/sbin/reboot
          size /tmp/sbin/reboot
-          /tmp/sbin/finit -h
-          /tmp/sbin/initctl -h
+      - name: Verify starting and showing usage text
+        run: |
+          sudo /tmp/sbin/finit -h
+          sudo /tmp/sbin/initctl -h
+      - name: Enable unprivileged userns (unshare)
+        run: |
+          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
      - name: Run Unit Tests
        run: |
-          ver=$(/tmp/sbin/initctl -V | awk '/Finit.*/ {print $2;}')
-          dir=finit-$ver/_build/sub
-          make -j1 distcheck || (cat $dir/test/setup-root.log; cat $dir/test/test-suite.log; false)
+          make check || (cat test/test-suite.log; false)
      - name: Upload Test Results
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
        with:
          name: finit-test-${{ matrix.compiler }}
-          path: test/*
+          path: test/*.log
@@ -4,6 +4,10 @@ on:
  push:
    branches:
      - 'dev'
+  workflow_dispatch:
+
+permissions:
+  contents: read

 env:
  PROJECT_NAME: finit
@@ -15,40 +19,60 @@ jobs:
  coverity:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v2
-        id: coverity-toolchain-cache
-        with:
-          path: cov-analysis-linux64
-          key: ${{ runner.os }}-coverity
-      - name: Download Coverity Scan
-        if: steps.coverity-toolchain-cache.outputs.cache-hit != 'true'
+      - uses: actions/checkout@v4
+      - name: Fetch latest Coverity Scan MD5
+        id: var
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        run: |
-          wget -q https://scan.coverity.com/download/cxx/linux64 \
-               --post-data "token=$TOKEN&project=${COVERITY_PROJ}" \
-               -O cov-analysis-linux64.tar.gz
-          mkdir cov-analysis-linux64
-          tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
+          wget -q https://scan.coverity.com/download/cxx/linux64         \
+               --post-data "token=$TOKEN&project=${COVERITY_PROJ}&md5=1" \
+               -O coverity-latest.tar.gz.md5
+          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+      - uses: actions/cache@v4
+        id: cache
+        with:
+          path: coverity-latest.tar.gz
+          key: ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+          restore-keys: |
+            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+            ${{ runner.os }}-coverity-
+            ${{ runner.os }}-coverity
+      - name: Download Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          if [ ! -f coverity-latest.tar.gz ]; then
+            wget -q https://scan.coverity.com/download/cxx/linux64   \
+                 --post-data "token=$TOKEN&project=${COVERITY_PROJ}" \
+                 -O coverity-latest.tar.gz
+          else
+            echo "Latest Coverity Scan available from cache :-)"
+            md5sum coverity-latest.tar.gz
+          fi
+          mkdir coverity
+          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
      - name: Install dependencies
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config
-          wget https://github.com/troglobit/libuev/releases/download/v2.3.2/libuev-2.3.2.tar.xz
-          wget https://github.com/troglobit/libite/releases/download/v2.3.1/libite-2.3.1.tar.gz
-          tar xf libuev-2.3.2.tar.xz
-          tar xf libite-2.3.1.tar.gz
-          (cd libuev-2.3.2 && ./configure --prefix=/usr && make && sudo make install-strip)
-          (cd libite-2.3.1 && ./configure --prefix=/usr && make && sudo make install-strip)
+          wget https://github.com/troglobit/libuev/releases/download/v2.4.0/libuev-2.4.0.tar.xz
+          wget https://github.com/troglobit/libite/releases/download/v2.5.2/libite-2.5.2.tar.gz
+          tar xf libuev-2.4.0.tar.xz
+          tar xf libite-2.5.2.tar.gz
+          (cd libuev-2.4.0 && ./configure --prefix=/usr && make && sudo make install-strip)
+          (cd libite-2.5.2 && ./configure --prefix=/usr && make && sudo make install-strip)
          sudo ldconfig
-      - name: Build
+      - name: Configure
        run: |
          ./autogen.sh
-          ./configure --prefix= --enable-x11-common-plugin --with-watchdog --with-keventd
-          export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
+          ./configure --prefix= --enable-x11-common-plugin --with-watchdog \
+                      --with-keventd --with-libsystemd
+      - name: Build
+        run: |
+          export PATH=`pwd`/coverity/bin:$PATH
          cov-build --dir cov-int make
-      - name: Submit result to Coverity Scan
+      - name: Submit results to Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        run: |
@@ -61,3 +85,8 @@ jobs:
            --form version=trunk \
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${COVERITY_PROJ}
+      - name: Upload build.log
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverity-build.log
+          path: cov-int/build-log.txt
@@ -0,0 +1,68 @@
+name: Dotty the Documenteer
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'doc/**'
+      - 'README.md'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    paths:
+      - 'doc/**'
+      - 'README.md'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Needed for git-revision-date-localized plugin
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Install dependencies
+        run: |
+          pipx install mkdocs
+          pipx inject mkdocs mkdocs-material
+          pipx inject mkdocs pymdown-extensions
+          pipx inject mkdocs mkdocs-callouts
+
+      - name: Build documentation
+        run: mkdocs build
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site/
+
+  deploy:
+    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
@@ -5,65 +5,62 @@ on:
    tags:
      - '[0-9]+.[0-9]+*'

+permissions:
+  contents: write
+
 jobs:
  release:
-    name: Create GitHub release
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
-      release_id: ${{ steps.create_release.outputs.id }}
-    steps:
-      - uses: actions/checkout@v2
-      - name: Extract ChangeLog entry ...
-        # Hack to extract latest entry for body_path below
-        run: |
-          awk '/-----*/{if (x == 1) exit; x=1;next}x' ChangeLog.md \
-              |head -n -1 > release.md
-          cat release.md
-      - name: Create release ...
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Finit v${{ github.ref }}
-          body_path: release.md
-          draft: false
-          prerelease: false
-  tarball:
    name: Build and upload release tarball
-    needs: release
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
+    env:
+      MAKEFLAGS: -j3
    steps:
-      - uses: actions/checkout@v2
-      - name: Installing dependencies
+      - uses: actions/checkout@v4
+      - name: Installing dependencies ...
        run: |
          sudo apt-get -y update
-          sudo apt-get -y install pkg-config
-          wget https://github.com/troglobit/libuev/releases/download/v2.3.2/libuev-2.3.2.tar.xz
-          wget https://github.com/troglobit/libite/releases/download/v2.3.1/libite-2.3.1.tar.gz
-          tar xf libuev-2.3.2.tar.xz
-          tar xf libite-2.3.1.tar.gz
-          (cd libuev-2.3.2 && ./configure --prefix=/usr && make && sudo make install-strip)
-          (cd libite-2.3.1 && ./configure --prefix=/usr && make && sudo make install-strip)
-          sudo ldconfig
-      - name: Creating Makefiles
+          sudo apt-get -y install pkg-config jq libuev-dev libite-dev
+      - name: Setting release variables ...
+        id: build
+        run: |
+          ver=${GITHUB_REF#refs/tags/}
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          if echo $ver | grep -qE '^[0-9]+\.[0-9]+(\.[0-9]+)?(-alpha|-beta|-rc)[0-9]*$'; then
+            echo "pre=true"  >> $GITHUB_OUTPUT
+          else
+            echo "pre=false" >> $GITHUB_OUTPUT
+          fi
+          if echo $ver | grep -qE '^[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "latest=true"  >> $GITHUB_OUTPUT
+          else
+            echo "latest=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Creating Makefiles ...
        run: |
          ./autogen.sh
-          ./configure --prefix= --enable-x11-common-plugin --with-watchdog --with-keventd
-      - name: Building release
+          ./configure  --prefix=/usr --exec-prefix= --sysconfdir=/etc  \
+                       --localstatedir=/var --enable-x11-common-plugin \
+                       --enable-testserv-plugin --with-watchdog        \
+                       --with-keventd --with-libsystemd
+      - name: Enable unprivileged userns (unshare)
        run: |
-          make release
+          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build release ...
+        run: |
+          make release || (cat test/test-suite.log; false)
          ls -lF ../
          mkdir -p artifacts/
          mv ../*.tar.* artifacts/
-      - name: Uploading release artifacts
-        uses: skx/github-action-publish-binaries@release-0.15
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract ChangeLog entry ...
+        run: |
+          awk '/-----*/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
+              |head -n -1 > release.md
+          cat release.md
+      - uses: ncipollo/release-action@v1
        with:
-          releaseId: ${{ needs.release.outputs.release_id }}
-          args: artifacts/*
+          name: Finit v${{ github.ref_name }}
+          prerelease: ${{ steps.build.outputs.pre }}
+          makeLatest: ${{ steps.build.outputs.latest }}
+          bodyFile: "release.md"
+          artifacts: "artifacts/*"
@@ -0,0 +1,54 @@
+name: Weekly Distcheck
+
+# Verify that `make distcheck` works as intended: all tests pass, and
+# any new files are distributed in the tarballs
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  schedule:
+    runs-on: ubuntu-latest
+    outputs:
+      run: ${{ steps.check.outputs.run }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for any commits since last week
+        id: schedule
+        run: |
+          commits="$(git log --format=%H --since='1 week ago')"
+          if [ -n "$commits" ]; then
+              echo "run=true"  >> $GITHUB_OUTPUT
+          else
+              echo "run=false" >> $GITHUB_OUTPUT
+          fi
+  distcheck:
+    needs: schedule
+    if: ${{ needs.schedule.outputs.run == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install dependencies
+        run: |
+          sudo apt-get -y update
+          sudo apt-get -y install pkg-config jq libuev-dev libite-dev
+      - uses: actions/checkout@v4
+      - name: Base run
+        run: |
+          ./autogen.sh
+          ./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var
+          make -j9 V=1
+      - name: Install to /tmp
+        run: |
+          DESTDIR=/tmp make install-strip
+      - name: Enable unprivileged userns (unshare)
+        run: |
+          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Check dist tarball
+        run: |
+          ver=$(/tmp/sbin/initctl -V | awk '/Finit.*/ {print $2;}')
+          dir=finit-$ver/_build/sub
+          make -j1 distcheck || (cat $dir/test/test-suite.log; false)
@@ -14,6 +14,7 @@ GTAGS
 /autom4te.cache
 /aclocal.m4
 /ar-lib
+/backup/
 /compile
 /config.cache
 /config.h
@@ -36,6 +37,9 @@ GTAGS
 /test-driver
 /test-suite.log

+# Misc
+/.gdb_history
+
 # TroglOS build system
 /.config
 /.stamp
@@ -0,0 +1,15 @@
+# GNU Global .conf file, see /etc/gtags/gtags.conf for details.
+# This configuration is optimized for the Finit project structure.
+
+default:\
+	:tc=default@/etc/gtags/gtags.conf:\
+	:tc=common:
+
+common:\
+	:skip=tags,TAGS,ID,y.tab.c,y.tab.h,gtags.files,cscope.files,cscope.out,cscope.po.out,cscope.in.out,\
+	{arch}/,autom4te.cache/,\
+	*.orig,*.rej,*.bak,*~,#*#,*.swp,*.tmp,*_flymake.*,*_flymake,\
+	*.o,*.a,*.so,*.lo,*.la,\
+	*.zip,*.gz,*.bz2,*.xz,*.lzh,*.Z,*.tgz,\
+	*.log,*.trs,test-suite.log,stamp-*,\
+	sysroot/:
@@ -1,5 +1,5 @@
 Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
-Copyright (c) 2008-2022  Joachim Wiberg <troglobit@gmail.com>
+Copyright (c) 2008-2025  Joachim Wiberg <troglobit@gmail.com>

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,6 @@
 ACLOCAL_AMFLAGS    = -I m4
-SUBDIRS            = man plugins src test
-doc_DATA           = README.md LICENSE contrib/finit.conf
-EXTRA_DIST         = README.md LICENSE ChangeLog.md contrib/finit.conf
+SUBDIRS            = man plugins src system tmpfiles.d
+dist_doc_DATA      = README.md LICENSE contrib/finit.conf

 if CONTRIB
 SUBDIRS           += contrib
@@ -9,6 +8,17 @@ endif
 if DOC
 SUBDIRS           += doc
 endif
+if LIBSYSTEMD
+SUBDIRS           += libsystemd
+endif
+
+if LIBSYSTEMD
+SUBDIRS           += test
+# Explicit dependency to ensure libsystemd is built before test
+test: libsystemd
+else
+SUBDIRS           += test
+endif

 # Compat hook
 install-dev:
@@ -30,4 +40,7 @@ release: distcheck
 		printf "$$file.sha256\t"; cat ../$$file.sha256 | cut -f1 -d' ';	\
 	done

-DISTCHECK_CONFIGURE_FLAGS = --with-fstab=/etc/fstab
+DISTCHECK_CONFIGURE_FLAGS = --prefix=/usr --sysconfdir=/etc --localstatedir=/var   \
+			    --enable-testserv-plugin --enable-x11-common-plugin    \
+			    --with-watchdog --with-keventd --with-fstab=/etc/fstab \
+			    --with-libsystemd --with-bash-completion-dir=no
@@ -1,609 +1,46 @@
 [![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan]
-<img align="right" src="img/finit3.png" alt="Finit: Fast Init">
-
-* [Introduction](#introduction)
-* [Features](#features)
-* [Bootstrap](doc/bootstrap.md#bootstrap)
-* [Runlevels](#runlevels)
-* [Syntax](doc/config.md#syntax)
-  * [Runparts & /etc/rc.local](#runparts--etcrclocal)
-  * [Hooks, Callbacks & Plugins](doc/plugins.md#hooks-callbacks--plugins)
-* [Rebooting & Halting](#rebooting--halting)
-* [Commands & Status](#commands--status)
-* [Tips & Tricks with the kernel cmdline](doc/cmdline.md)
-* [Building](doc/build.md#building)
-  * [Running](doc/build.md#running)
-  * [Recovery](doc/build.md#recovery)
-  * [Debugging](doc/build.md#debugging)
-* [Requirements](#requirements)
-* [Origin & References](#origin--references)
-
-
-Introduction
------------
-
-Fast init for Linux systems.  Reverse engineered from the [EeePC
-fastinit][] over ten years ago by [Claudio Matsuoka][] — "gaps filled
-with frog DNA …"
-
-![Alpine screenshot](img/finit4-screenshot.png)  
-*Figure 1: Screenshot showing Finit booting [Alpine Linux](https://www.alpinelinux.org/).*
-
-Features include:
-
-  * Runlevels, defined per service
-  * One-shot tasks, services (daemons), or [SysV init][4] start/stop scripts
-  * Runparts and `/etc/rc.local` support
-  * Process supervision similar to [systemd][]
-  * Sourcing environment files
-  * Conditions for network/process/custom dependencies
-  * Pre/Post script actions
-  * Tooling to enable/disable services
-  * Built-in getty
-  * Built-in watchdog, with support for hand-over to [watchdogd](https://troglobit.com/watchdogd.html)
-  * Built-in support for Debian/BusyBox `/etc/network/interfaces`
-  * Cgroups v2, both configuration and monitoring in `initctl top`
-  * Plugin support for customization
-  * Proper rescue mode with bundled `sulogin` for protected maintenance shell
-
-Focus is on small and embedded systems, although Finit is fully usable
-on server and desktop systems as well.  For working examples, see the
-[contrib/](contrib/) section with tutorials for:
-
-  * [Void Linux](contrib/void/),
-  * [Alpine Linux](contrib/alpine/), and
-  * [Debian GNU/Linux](contrib/debian/)
-
-> **Note:** support for various Linux distributions does not mean Finit
-> installs easily on all architectures.  The bundled install scripts are
-> examples for standard installations, tested on x86_64 systems.  Custom
-> setups, targeted at embedded systems, can be found in [myLinux][].
-
-
-Example
-------
-
-This example `/etc/finit.conf` can also be split up in multiple `.conf`
-files in `/etc/finit.d`.  Available, but not yet enabled, services can
-be placed in `/etc/finit.d/available` and enabled by an operator using
-the [initctl](#commands--status) tool.
-
-```ApacheConf
-# Fallback if /etc/hostname is missing
-host default
-
-# Runlevel to start after bootstrap, 'S', default: 2
-runlevel 2
-
-# Max file size for each log file: 100 kiB, rotate max 4 copies:
-# log => log.1 => log.2.gz => log.3.gz => log.4.gz
-log size=100k count=4
-
-# Services to be monitored and respawned as needed
-service [S12345] env:-/etc/conf.d/watchdog watchdog $WATCHDOG_OPTS $WATCHDOG_DEV -- System watchdog daemon
-service [S12345] env:-/etc/conf.d/syslog syslogd -n $SYSLOGD_OPTS          -- System log daemon
-service [S12345] <pid/syslogd> env:-/etc/conf.d/klogd klogd -n $KLOGD_OPTS -- Kernel log daemon
-service   [2345] env:-/etc/conf.d/lldpd lldpd -d $LLDPD_OPTS               -- LLDP daemon (IEEE 802.1ab)
-
-# The BusyBox ntpd does not use syslog when running in the foreground
-# So we use this trick to redirect stdout/stderr to a log file.  The
-# log file is rotated with the above settings.  The condition declares
-# a dependency on a system default route (gateway) to be set.  A single
-# <!> at the beginning means ntpd does not respect SIGHUP for restart.
-service [2345] log:/var/log/ntpd.log <!net/route/default> ntpd -n -l -I eth0 -- NTP daemon
-
-# For multiple instances of the same service, add :ID somewhere between
-# the service/run/task keyword and the command.
-service :80   [2345] merecat -n -p 80   /var/www -- Web server
-service :8080 [2345] merecat -n -p 8080 /var/www -- Old web server
-
-# Alternative method instead of below runparts, can also use /etc/rc.local
-#sysv [S] /etc/init.d/keyboard-setup       -- Setting up preliminary keymap
-#sysv [S] /etc/init.d/acpid                -- Starting ACPI Daemon
-#task [S] /etc/init.d/kbd                  -- Preparing console
-
-# Run start scripts from this directory
-# runparts /etc/start.d
-
-# Virtual consoles run BusyBox getty, keep kernel default speed
-tty [12345] /sbin/getty -L 0 /dev/tty1  linux nowait noclear
-tty [2345]  /sbin/getty -L 0 /dev/tty2  linux nowait noclear
-tty [2345]  /sbin/getty -L 0 /dev/tty3  linux nowait noclear
-
-# Use built-in getty for serial port and USB serial
-#tty [12345] /dev/ttyAMA0 noclear nowait
-#tty [12345] /dev/ttyUSB0 noclear
-
-# Just give me a shell, I need to debug this embedded system!
-#tty [12345] console noclear nologin
-```
-
-The `service` stanza, as well as `task`, `run` and others are described
-in full in [doc/config.md](doc/config.md).  Here's a quick overview of
-some of the most common components needed to start a UNIX daemon:
-
-```
-service [LVLS] <COND> log env:[-]/etc/default/daemon daemon ARGS -- Daemon daemon
-^       ^      ^      ^   ^                          ^      ^       ^
-|       |      |      |   |                          |      |        `---------- Optional description
-|       |      |      |   |                          |       `------------------ Daemon arguments
-|       |      |      |   |                           `------------------------- Path to daemon
-|       |      |      |    `---------------------------------------------------- Optional env. file
-|       |      |       `-------------------------------------------------------- Redirect output to log
-|       |       `--------------------------------------------------------------- Optional conditions
-|        `---------------------------------------------------------------------- Optional Runlevels
- `------------------------------------------------------------------------------ Monitored application
-```
-
-Some components are optional: runlevel(s), condition(s) and description,
-making it easy to create simple start scripts and still possible for more
-advanced uses as well:
-
-    service /usr/sbin/sshd -D
-
-Dependencies are handled using [conditions](doc/conditions.md).  One of
-the most common conditions is to wait for basic networking to become
-available:
-
-    service <net/route/default> nginx -- High performance HTTP server
-
-Here is another example where we instruct Finit to not start BusyBox
-`ntpd` until `syslogd` has started properly.  Finit waits for `syslogd`
-to create its PID file, by default `/var/run/syslogd.pid`.
-
-    service [2345] log <!pid/syslogd> ntpd -n -N -p pool.ntp.org
-    service [S12345] syslogd -n -- Syslog daemon
-
-Notice the `log` keyword, BusyBox `ntpd` uses `stderr` for logging when
-run in the foreground.  With `log` Finit redirects `stdout` + `stderr`
-to the system log daemon using the command line `logger(1)` tool.
-
-A service, or task, can have multiple dependencies listed.  Here we wait
-for *both* `syslogd` to have started and basic networking to be up:
-
-    service [2345] log <pid/syslogd,net/route/default> ntpd -n -N -p pool.ntp.org
-
-If either condition fails, e.g. loss of networking, `ntpd` is stopped
-and as soon as it comes back up again `ntpd` is restarted automatically.
-
-**Note:** Make sure daemons *do not* fork and detach themselves from the
-  controlling TTY, usually an `-n` or `-f` flag, or `-D` as in the case
-  of OpenSSH above.  If it detaches itself, Finit cannot monitor it and
-  will instead try to restart it.
-
-
-Features
--------
-
-**Process Supervision**
-
-Start, monitor and restart services should they fail.
-
-
-**Getty**
-
-Finit supports external getty but also comes with a limited built-in
-Getty, useful for really small systems.  A getty sets up the TTY and
-waits for user input before handing over to `/bin/login`, which is
-responsible for handling the actual authentication.
-
-```conf
-tty [12345] /dev/tty1    nowait  linux
-tty [12345] /dev/ttyAMA0 noclear vt100
-tty [12345] /sbin/getty  -L /dev/ttyAMA0 vt100
-```
-
-Users of embedded systems may want to enable automatic serial console
-with the special `@console` device.  This works regardless weather the
-system uses `ttyS0`, `ttyAMA0`, `ttyMXC0`, or anything else.  Finit
-figures it out by querying sysfs: `/sys/class/tty/console/active`.
-
-```conf
-tty [12345] @console linux noclear
-```
-
-Notice the optional `noclear`, `nowait`, and `nologin` flags.  The
-latter is for skipping the login process entirely. For more information,
-see [doc/config.md](doc/config.md#syntax).
-
-
-**Runlevels**
-
-Support for SysV init-style [runlevels][5] is available, in the same
-minimal style as everything else in Finit.  The `[2345]` syntax can be
-applied to service, task, run, and TTY stanzas.
-
-Reserved runlevels are 0 and 6, halt and reboot, respectively just like
-SysV init.  Runlevel 1 can be configured freely, but is recommended to
-be kept as the system single-user runlevel since Finit will not start
-networking here.  The configured `runlevel NUM` from `/etc/finit.conf`
-is what Finit changes to after bootstrap, unless 'single' (or 'S') is
-given on the kernel cmdline, in which case runlevel 1 is started.
-
-All services in runlevel S(0) are started first, followed by the desired
-run-time runlevel.  Run tasks in runlevel S can be started in sequence
-by using `run [S] cmd`.  Changing runlevels at runtime is done like any
-other init, e.g. <kbd>init 4</kbd>, but also using the more advanced
-`intictl` tool.
-
-
-**Plugins**
-
-Plugins can *extend* the functionality of Finit and *hook into* the
-different stages of the boot process and at runtime.  Plugins are
-written in C and compiled into a dynamic library loaded automatically by
-finit at boot.  A basic set of plugins are bundled in the `plugins/`
-directory.
-
-Capabilities:
-
- **Hooks**  
-  Hook into the boot at predefined points to extend Finit
- **I/O**  
-  Listen to external events and control Finit behavior/services
-
-Extensions and functionality not purely related to what an `/sbin/init`
-needs to start a system are available as a set of plugins that either
-hook into the boot process or respond to various I/O.
-
-For more information, see [doc/plugins.md](doc/plugins.md).
-
-
-**Automatic Reload**
-
-By default, Finit monitors `/etc/finit.d/` and `/etc/finit.d/enabled/`
-registering any changes to `.conf` files.  To activate a change the user
-must call `initctl reload`, which reloads all modified files, stops any
-removed services, starts new ones, and restarts any modified ones.  If the
-command line arguments of a service have changed, the process will be
-terminated and then started again with the updated arguments. If the arguments
-have not been modified and the process supports SIGHUP, the process will
-receive a SIGHUP rather than being terminated and started.
-
-For some use-cases the extra step of calling `initctl reload` creates an
-unnecessary overhead, which can be removed at build-time using:
-
-    configure --enable-auto-reload
-
-
-**Cgroups**
-
-Finit supports cgroups v2 and comes with the following default groups
-in which services and user sessions are placed in:
-
-     /sys/fs/cgroup
-       |-- init/               # cpu.weight:100
-       |-- system/             # cpu.weight:9800
-       `-- user/               # cpu.weight:100
-
-Finit itself and its helper scripts and services are placed in the
-top-level leaf-node group `init/`, which also is _reserved_.
-
-All run/task/service/sysv processes are placed in their own sub-group
-in `system/`.  The name of each sub-group is taken from the respective
-`.conf` file from `/etc/finit.d`.
-
-All getty/tty processes are placed in their own sub-group in `user/`.
-The name of each sub-group is taken from the username.
-
-A fourth group also exists, the `root` group.  It is also _reserved_ and
-primarily intended for RT tasks.  If you have RT tasks they need to be
-declared as such in their service stanza like this:
-
-    service [...] <...> cgroup.root /path/to/foo args -- description
-
-or
-
-    cgroup.root
-    service [...] <...> /path/to/foo args -- description
-    service [...] <...> /path/to/bar args -- description
-
-See [doc/config.md](doc/config.md#cgroups) for more information, e.g.,
-how to configure per-group limits.
-
-The `initctl` tool has three commands to help debug and optimize the
-setup and monitoring of cgroups.  See the `ps`, `top`, and `cgroup`
-commands for details.
-
-
-Runparts & /etc/rc.local
------------------------
-
-At the end of the boot, when all bootstrap (`S`) tasks and services have
-started, but not networking, Finit calls its built-in [run-parts(8)][]
-command on any configured `runparts <DIR>` directory.  This happens just
-before changing to the configured runlevel (default 2).  (Networking is
-enabled just prior to changing from single user mode.)
-
-```shell
-runparts /etc/rc.d/
-```
-
-Right after the runlevel change when all services have started properly,
-`/etc/rc.local` is called.
-
-No configuration stanza in `/etc/finit.conf` is required for `rc.local`.
-If it exists and is an executable shell script Finit calls it at the very
-end of the boot, before calling the `HOOK_SYSTEM_UP`.  See more on hooks
-in [doc/plugins.md](doc/plugins.md#hooks), and about the system bootstrap
-in [doc/bootstrap.md](doc/bootstrap.md).
-
-
-Runlevels
---------
-
-Basic support for [runlevels][5] is included in Finit from v1.8.  By
-default all services, tasks, run commands and TTYs listed without a set
-of runlevels get a default set `[234]` assigned.  The default runlevel
-after boot is 2.
-
-Finit supports runlevels 0-9, and S, with 0 reserved for halt, 6 reboot
-and S for services to only run at bootstrap.  Runlevel 1 is the single
-user level, where usually no networking is enabled.  In Finit this is
-more of a policy for the user to define.  Normally only runlevels 1-6
-are used, and even more commonly, only the default runlevel is used.
-
-To specify an allowed set of runlevels for a `service`, `run` command,
-`task`, or `tty`, add `[NNN]` to your `/etc/finit.conf`, like this:
-
-```
-service [S12345] syslogd -n -x             -- System log daemon
-run     [S]      /etc/init.d/acpid start   -- Starting ACPI Daemon
-task    [S]      /etc/init.d/kbd start     -- Preparing console
-service [S12345] <pid/syslogd> klogd -n -x -- Kernel log daemon
-
-tty     [12345]  /dev/tty1
-tty     [2]      /dev/tty2
-tty     [2]      /dev/tty3
-tty     [2]      /dev/tty4
-tty     [2]      /dev/tty5
-tty     [2]      /dev/tty6
-```
-
-In this example syslogd is first started, in parallel, and then acpid is
-called using a conventional SysV init script.  It is called with the run
-command, meaning the following task command to start the kbd script is
-not called until the acpid init script has fully completed.  Then the
-keyboard setup script is called in parallel with klogd as a monitored
-service.
-
-Again, tasks and services are started in parallel, while run commands
-are called in the order listed and subsequent commands are not started
-until a run command has completed.  Also, task and run commands are run
-in a shell, so pipes and redirects can be used.
-
-The following examples illustrate this.  Bootstrap task and run commands
-are also removed when they have completed, `initctl show` will not list
-them.
-
-```
-task [S] echo "foo" | cat >/tmp/bar
-run  [S] echo "$HOME" >/tmp/secret
-```
-
-Switching between runlevels can be done by calling init with a single
-argument, e.g. <kbd>init 5</kbd>, or using `initctl runlevel 5`, both
-switch to runlevel 5.  When changing runlevels Finit also automatically
-reloads all `.conf` files in the `/etc/finit.d/` directory.  So if you
-want to set a new system config, switch to runlevel 1, change all config
-files in the system, and touch all `.conf` files in `/etc/finit.d`
-before switching back to the previous runlevel again — that way Finit
-can both stop old services and start any new ones for you, without
-rebooting the system.
-
-
-Rebooting & Halting
-------------------
-
-Traditionally, rebooting and halting a UNIX system is done by changing
-its runlevel.  Finit comes with its own tooling providing: `shutdown`,
-`reboot`, `poweroff`, and `suspend`, but also the `initctl` tool,
-detailed in the next section.
-
-For compatibility reasons Finit listens to the same set of signals as
-BusyBox init.  This is not 100% compatible with SysV init, but clearly
-the more common combination for Finit.  For more details, see
-[doc/signals.md](doc/signals.md).
-
-
-Commands & Status
-----------------
-
-Finit also implements a modern API to query status, and start/stop
-services, called `initctl`.  Unlike `telinit` the `initctl` tool does
-not return until the given command has fully completed.
-
-```
-alpine:~# initctl help
-Usage: initctl [OPTIONS] [COMMAND]
-
-Options:
-  -b, --batch               Batch mode, no screen size probing
-  -c, --create              Create missing paths (and files) as needed
-  -f, --force               Ignore missing files and arguments, never prompt
-  -1, --once                Only one lap in commands like 'top'
-  -p, --plain               Use plain table headings, no ctrl chars
-  -q, --quiet               Silent, only return status of command
-  -t, --no-heading          Skip table headings
-  -v, --verbose             Verbose output
-  -h, --help                This help text
-
-Commands:
-  debug                     Toggle Finit (daemon) debug
-  help                      This help text
-  version                   Show Finit version
-
-  ls | list                 List all .conf in /etc/finit.d
-  create   <CONF>           Create   .conf in /etc/finit.d/available
-  delete   <CONF>           Delete   .conf in /etc/finit.d/available
-  show     <CONF>           Show     .conf in /etc/finit.d/available
-  edit     <CONF>           Edit     .conf in /etc/finit.d/available
-  touch    <CONF>           Change   .conf in /etc/finit.d/available
-  enable   <CONF>           Enable   .conf in /etc/finit.d/available
-  disable  <CONF>           Disable  .conf in /etc/finit.d/enabled
-  reload                    Reload  *.conf in /etc/finit.d (activate changes)
-
-  cond     set   <COND>     Set (assert) user-defined condition     +usr/COND
-  cond     clear <COND>     Clear (deassert) user-defined condition -usr/COND
-  cond     status           Show condition status, default cond command
-  cond     dump             Dump all conditions and their status
-
-  log      [NAME]           Show ten last Finit, or NAME, messages from syslog
-  start    <NAME>[:ID]      Start service by name, with optional ID
-  stop     <NAME>[:ID]      Stop/Pause a running service by name
-  reload   <NAME>[:ID]      Reload service by name (SIGHUP or restart)
-  restart  <NAME>[:ID]      Restart (stop/start) service by name
-  status   <NAME>[:ID]      Show service status, by name
-  status                    Show status of services, default command
-
-  cgroup                    List cgroup config overview
-  ps                        List processes based on cgroups
-  top                       Show top-like listing based on cgroups
-
-  runlevel [0-9]            Show or set runlevel: 0 halt, 6 reboot
-  reboot                    Reboot system
-  halt                      Halt system
-  poweroff                  Halt and power off system
-  suspend                   Suspend system
-```
-
-For services *not* supporting `SIGHUP` the `<!>` notation in the .conf
-file must be used to tell Finit to stop and start it on `reload` and
-`runlevel` changes.  If `<>` holds more [conditions](doc/conditions.md),
-these will also affect how a service is maintained.
-
-> **Note:** even though it is possible to start services not belonging in
-> the current runlevel these services will not be respawned automatically
-> by Finit if they exit (crash).  Hence, if the runlevel is 2, the below
-> Dropbear SSH service will not be restarted if it is killed or exits.
-
-The `status` command is the default, it displays a quick overview of all
-monitored run/task/services.  Here we call `initctl -p`, suitable for
-scripting and documentation:
-
-```
-alpine:~# initctl -p
-PID   IDENT     STATUS   RUNLEVELS    DESCRIPTION
-======================================================================
-1506  acpid     running  [--2345----] ACPI daemon
-1509  crond     running  [--2345----] Cron daemon
-1489  dropbear  running  [--2345----] Dropbear SSH daemon
-1511  klogd     running  [S12345----] Kernel log daemon
-1512  ntpd      running  [--2345----] NTP daemon
-1473  syslogd   running  [S12345----] Syslog daemon
-
-alpine:~# initctl -pv
-PID   IDENT     STATUS   RUNLEVELS    COMMAND
-======================================================================
-1506  acpid     running  [--2345----] acpid -f
-1509  crond     running  [--2345----] crond -f -S $CRON_OPTS
-1489  dropbear  running  [--2345----] dropbear -R -F $DROPBEAR_OPTS
-1511  klogd     running  [S12345----] klogd -n $KLOGD_OPTS
-1512  ntpd      running  [--2345----] ntpd -n $NTPD_OPTS
-1473  syslogd   running  [S12345----] syslogd -n
-```
-
-The environment variables to each of the services above are read from,
-in the case of Alpine Linux, `/etc/conf.d/`.  Other distributions may
-have other directories, e.g., Debian use `/etc/default/`.
-
-The `status` command takes an optional `NAME:ID` argument.  Here we
-check the status of `dropbear`, which only has one instance in this
-system:
-
-```
-alpine:~# initctl -p status dropbear
-     Status : running
-   Identity : dropbear
-Description : Dropbear SSH daemon
-     Origin : /etc/finit.d/enabled/dropbear.conf
-Environment : -/etc/conf.d/dropbear
-Condition(s):
-    Command : dropbear -R -F $DROPBEAR_OPTS
-   PID file : !/run/dropbear.pid
-        PID : 1485
-       User : root
-      Group : root
-     Uptime : 2 hour 46 min 56 sec
-  Runlevels : [--2345----]
-     Memory : 1.2M
-     CGroup : /system/dropbear cpu 0 [100, max] mem [--.--, max]
-              |- 1485 dropbear -R -F
-              |- 2634 dropbear -R -F
-              |- 2635 ash
-              `- 2652 initctl -p status dropbear
-
-Apr  8 12:19:49 alpine authpriv.info dropbear[1485]: Not backgrounding
-Apr  8 12:37:45 alpine authpriv.info dropbear[2300]: Child connection from 192.168.121.1:47834
-Apr  8 12:37:46 alpine authpriv.notice dropbear[2300]: Password auth succeeded for 'root' from 192.168.121.1:47834
-Apr  8 12:37:46 alpine authpriv.info dropbear[2300]: Exit (root) from <192.168.121.1:47834>: Disconnect received
-Apr  8 15:02:11 alpine authpriv.info dropbear[2634]: Child connection from 192.168.121.1:48576
-Apr  8 15:02:12 alpine authpriv.notice dropbear[2634]: Password auth succeeded for 'root' from 192.168.121.1:48576
-```
-
-
-Requirements
------------
-
-Finit is capable of running on both desktop/server systems with udev and
-embedded systems that usually come with BusyBox mdev.  Some systems have
-systemd-udev or eudev today instead of the original udev, Finit probes
-for all of them at runtime and expects `/dev/` to be a writable file
-system using `devtmpfs`.  It is also possible to run on a statically set
-up `/dev` if needed.  It is however not a good idea to have both udev
-and mdev installed at the same time, this will lead to unpredictable
-results.
-
-At boot Finit calls either `mdev` or `udevd` to populate `/dev`, this is
-done slightly differently and on systems with udev you might want to add
-the following one-shot task early in your `/etc/finit.conf`:
-
-```conf
-run [S] udevadm settle --timeout=120 -- Waiting for udev
-```
-
-Finit has a built-in Getty for TTYs, but requires a working `/bin/login`
-or `/bin/sh`, if no TTYs are configured in `/etc/finit.conf`.
-
-For a fully operational system `/var`, `/run` and `/tmp` must be set up
-properly in `/etc/fstab` -- which is iterated over at boot.
-
-
-Origin & References
-------------------
-
-This project is based on the [original finit][] by [Claudio Matsuoka][]
-which was reverse engineered from syscalls of the [EeePC fastinit][] —
-"gaps filled with frog DNA …"
-
-Finit is developed and maintained by [Joachim Wiberg][] at [GitHub][6].
-Please file bug reports, clone it, or send pull requests for bug fixes
-and proposed extensions.
-
-
-[1]:                https://en.wikipedia.org/wiki/Process_supervision
-[2]:                https://cr.yp.to/daemontools.html
-[3]:                https://smarden.org/runit/
-[4]:                https://en.wikipedia.org/wiki/Init
-[5]:                https://en.wikipedia.org/wiki/Runlevel
-[6]:                https://github.com/troglobit/finit
-[RFC862]:           https://tools.ietf.org/html/rfc862
-[RFC863]:           https://tools.ietf.org/html/rfc863
-[RFC864]:           https://tools.ietf.org/html/rfc864
-[RFC867]:           https://tools.ietf.org/html/rfc867
-[RFC868]:           https://tools.ietf.org/html/rfc868
-[init]:             https://en.wikipedia.org/wiki/Init
-[upstart]:          https://upstart.ubuntu.com/
-[systemd]:          https://www.freedesktop.org/wiki/Software/systemd/
-[openrc]:           https://www.gentoo.org/proj/en/base/openrc/
-[run-parts(8)]:     https://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
-[original finit]:   http://helllabs.org/finit/
+<img align="right" src="doc/img/finit3.png" alt="Finit: Fast Init">
+
+Finit is an alternative to [SysV init](https://en.wikipedia.org/wiki/Init)
+and [systemd](https://www.freedesktop.org/wiki/Software/systemd/), focused
+on small and embedded Linux systems, although fully usable on server and
+[desktop systems][finix].
+
+> Reverse engineered from the [EeePC fastinit][]  
+> "gaps filled with frog DNA …"  
+> — [Claudio Matsuoka][]
+
+For detailed information, explore our extensive documentation  
+:books: **<https://troglobit.github.io/finit/>**
+
+<div align="center">
+  <img src="doc/img/alpine-screenshot2.png" alt="Alpine screenshot"><br/>
+</div>
+
+For working examples, see the :rocket: [contrib/](contrib/) section or these
+tutorials:
+
+  * :hammer_and_wrench: [Buildroot embedded Linux](https://troglobit.com/post/2022-12-26-buildroot-demo-of-fastinit-finit/),
+  * :package: [Debian GNU/Linux](contrib/debian/),
+  * :mountain: [Alpine Linux](contrib/alpine/), and
+  * :milky_way: [Void Linux](contrib/void/)
+
+> [!NOTE]
+> Support for various Linux distributions does not mean Finit installs
+> easily on all architectures.  Bundled install scripts are examples for
+> standard installations, tested on amd64 (x86_64) systems.  Custom
+> setups, e.g., for embedded systems, can be found in the following
+> [Buildroot][] based examples: [myLinux][], [Infix][], or the plain
+> [br2-finit-demo](https://github.com/troglobit/br2-finit-demo).
+
+[finix]:            https://github.com/aanderse/finix
+[Buildroot]:        https://buildroot.org
+[Infix]:            https://kernelkit.github.io
+[myLinux]:          https://github.com/troglobit/myLinux/
 [EeePC fastinit]:   https://web.archive.org/web/20071208212450/http://wiki.eeeuser.com/boot_process:the_boot_process
 [Claudio Matsuoka]: https://github.com/cmatsuoka
-[Joachim Wiberg]:   https://troglobit.com
 [License]:          https://en.wikipedia.org/wiki/MIT_License
 [License Badge]:    https://img.shields.io/badge/License-MIT-teal.svg
-[GitHub]:           https://github.com/troglobit/myLinux/
 [GitHub]:           https://github.com/troglobit/finit/actions/workflows/build.yml/
 [GitHub Status]:    https://github.com/troglobit/finit/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:    https://scan.coverity.com/projects/3545
@@ -1,21 +1,25 @@
-AC_INIT(Finit, 4.3-rc2, https://github.com/troglobit/finit/issues, finit, https://troglobit.com/projects/finit/)
+AC_INIT([Finit], [4.14], [https://github.com/troglobit/finit/issues],
+	[finit], [https://troglobit.com/projects/finit/])
 AC_CONFIG_AUX_DIR(aux)
-AM_INIT_AUTOMAKE([1.11 foreign dist-xz subdir-objects])
+AM_INIT_AUTOMAKE([1.11 foreign subdir-objects])
 AM_SILENT_RULES([yes])

 AC_CONFIG_SRCDIR([src/finit.c])
-AC_CONFIG_HEADER([config.h])
+AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_FILES([Makefile
 	contrib/Makefile
 	contrib/alpine/Makefile contrib/alpine/finit.d/Makefile contrib/alpine/finit.d/available/Makefile
 	contrib/debian/Makefile contrib/debian/finit.d/Makefile contrib/debian/finit.d/available/Makefile
 	contrib/void/Makefile   contrib/void/finit.d/Makefile   contrib/void/finit.d/available/Makefile
-	doc/Makefile
+	doc/Makefile doc/config/Makefile
+	libsystemd/Makefile libsystemd/libsystemd.pc
 	man/Makefile
 	plugins/Makefile
 	src/Makefile
+	system/Makefile system/10-hotplug.conf
 	test/test.env test/Makefile
-	test/tenv/Makefile test/common/Makefile])
+	test/lib/Makefile test/src/Makefile
+	tmpfiles.d/Makefile])

 # Older versions of autoconf (<2.58) do not have AC_CONFIG_MACRO_DIR()
 #m4_include([m4/plugin.m4])
@@ -32,7 +36,6 @@ AC_PROG_INSTALL
 AC_PROG_MKDIR_P

 # Configuration.
-AC_HEADER_STDC
 AC_CHECK_HEADERS([termios.h sys/ioctl.h mntent.h sys/sysmacros.h])
 AC_CHECK_FUNCS([strstr getopt getmntent getmntent_r])

@@ -65,12 +68,20 @@ AC_ARG_ENABLE(fsckfix,
        AS_HELP_STRING([--enable-fsckfix], [Run fsck fix mode (options: -yf) on filesystems listed in /etc/fstab]),,[
 	enable_fsckfix=no])

+AC_ARG_ENABLE(cgroup,
+        AS_HELP_STRING([--disable-cgroup], [Disable cgroup v2 support, default: autodetect from /sys/fs/cgroup]),,[
+        enable_cgroup=yes])
+
 AC_ARG_ENABLE(redirect,
        AS_HELP_STRING([--disable-redirect], [Disable redirection of service output to /dev/null]),,[
 	enable_redirect=yes])

+AC_ARG_ENABLE(kernel_logging,
+        AS_HELP_STRING([--disable-kernel-logging], [Disable kernel logging to console (use 'quiet' instead!]),,[
+	enable_kernel_logging=yes])
+
 AC_ARG_ENABLE(logrotate,
-        AS_HELP_STRING([--disable-logrotate], [Disable built-in rotation of /var/log/wtmp, default enabled]),,[
+        AS_HELP_STRING([--disable-logrotate], [Disable built-in rotation of /var/log/wtmp]),,[
 	enable_logrotate=yes])

 AC_ARG_ENABLE(doc,
@@ -81,22 +92,33 @@ AC_ARG_ENABLE(contrib,
        AS_HELP_STRING([--disable-contrib], [Disable build and install of contrib section]),,[
 	enable_contrib=yes])

+AC_ARG_ENABLE([rescue],
+	AS_HELP_STRING([--disable-rescue], [Disable potentially unsafe rescue mode]),,
+	[enable_rescue=yes])
+
 # Check for extra plugins to enable
-enable_all_plugins=auto
+AC_ARG_ENABLE(all_plugins,
+    AS_HELP_STRING([--enable-all-plugins], [Enable all plugins, default: auto]),
+	enable_all_plugins=$enableval, enable_all_plugins=auto)
 AC_PLUGIN([alsa-utils],    [no],  [Save and restore ALSA sound settings using alsactl])
 AC_PLUGIN([dbus],          [no],  [Setup and start system message bus, D-Bus])
 AC_PLUGIN([modules-load],  [no],  [Scans /etc/modules-load.d for modules to load])
-AC_PLUGIN([modprobe],      [yes], [Coldplug modules using modalias magic])
+AC_PLUGIN([modprobe],      [no],  [Coldplug modules using modalias magic])
 AC_PLUGIN([resolvconf],    [no],  [Setup necessary files for resolvconf])
 AC_PLUGIN([x11-common],    [no],  [Console setup (for X)])
 AC_PLUGIN([netlink],       [yes], [Basic netlink plugin for IFUP/IFDN and GW events. Can be replaced with externally built plugin that links with libnl or similar.])
 AC_PLUGIN([hook-scripts],  [no],  [Trigger script execution from hook points])
-AC_PLUGIN([hotplug],       [yes], [Setup and start udev or mdev hotplug daemon])
+AC_PLUGIN([hotplug],       [yes], [Start udevd or mdev kernel event datamon])
 AC_PLUGIN([rtc],           [yes], [Save and restore RTC using hwclock])
 AC_PLUGIN([tty],           [yes], [Automatically activate new TTYs, e.g. USB-to-serial])
 AC_PLUGIN([urandom],       [yes], [Setup and save random seed at boot/shutdown])
+AC_PLUGIN([testserv],      [no],  [Test plugin to start test serv daemon])

 # Check for extra arguments or packages
+AC_ARG_WITH([bash-completion-dir],
+	AS_HELP_STRING([--with-bash-completion-dir[=PATH]], [Directory to install Bash completion, default: auto]),
+	[bash_dir=$withval], [bash_dir=yes])
+
 AC_ARG_WITH(fstab,
        AS_HELP_STRING([--with-fstab=FILE], [System default fstab, default $sysconfdir/fstab]),
 	[fstab=$withval], [fstab=yes])
@@ -141,16 +163,31 @@ AC_ARG_WITH(keventd,
        AS_HELP_STRING([--with-keventd], [Enable built-in keventd, default: no]),, [with_keventd=no])

 AC_ARG_WITH(sulogin,
-        AS_HELP_STRING([--with-sulogin], [Enable built-in sulogin, default: no.]),, [with_sulogin=no])
+        AS_HELP_STRING([--with-sulogin@<:@=USER@:>@], [Enable built-in sulogin, optional USER to request password for (default root), default: no.]),[sulogin=$withval],[with_sulogin=no])

 AC_ARG_WITH(watchdog,
-        AS_HELP_STRING([--with-watchdog=[DEV]], [Enable built-in watchdog, default: /dev/watchdog]),
+        AS_HELP_STRING([--with-watchdog@<:@=DEV@:>@], [Enable built-in watchdog, default: /dev/watchdog]),
 	[watchdog=$withval], [with_watchdog=no watchdog=])

+AC_ARG_WITH(libsystemd,
+        AS_HELP_STRING([--with-libsystemd], [Build replacement libsystemd library, default: yes]),
+	[with_libsystemd=$withval], [with_libsystemd=no])
+
 AC_ARG_WITH(hook-scripts-path,
        AS_HELP_STRING([--with-hook-scripts-path=DIR], [Base directory for hook scripts, default $libexecdir/finit/hook]),
 	[hook_scripts_path=$withval], [hook_scripts_path=yes])

+AC_ARG_WITH(plugin-path,
+        AS_HELP_STRING([--with-plugin-path=DIR], [Search path for external plugins, default /usr/lib/finit/plugins:/usr/local/lib/finit/plugins]),
+	[plugin_path=$withval], [plugin_path=yes])
+
+AC_ARG_WITH(rtc-date,
+	AS_HELP_STRING([--with-rtc-date=DATE], [If RTC date/time is too old, restore to DATE, format "YYYY-MM-DD HH:MM:SS", default "2000-01-01 00:00:00"]),
+	[rtc_date=$withval], [rtc_date=no])
+
+AC_ARG_WITH(rtc-file,
+        AS_HELP_STRING([--with-rtc-file=FILE], [If RTC is missing, save and restore system clock from this file, default: no]),
+	[rtc_file=$withval], [rtc_file=no])

 ### Enable features ###########################################################################

@@ -161,6 +198,12 @@ AS_IF([test "x$enable_auto_reload" = "xyes"], [
 AS_IF([test "x$enable_kernel_cmdline" = "xyes"], [
        AC_DEFINE(KERNEL_CMDLINE, 1, [Dumpster diving after init args from /proc/cmdline])])

+AS_IF([test "x$enable_kernel_logging" = "xyes"], [
+        AC_DEFINE(KERNEL_LOGGING, 1, [Keep kernel warn/err logs to console])])
+
+AS_IF([test "x$enable_cgroup" = "xyes"], [
+        AC_DEFINE(CGROUP2_ENABLED, 1, [Autodetect cgroup v2 support from /sys/fs/cgroup])])
+
 AS_IF([test "x$enable_fastboot" = "xyes"], [
 	AC_DEFINE(FAST_BOOT, 1, [Skip fsck check on filesystems listed in /etc/fstab])])

@@ -174,9 +217,18 @@ AS_IF([test "x$enable_redirect" = "xyes"], [
 AS_IF([test "x$enable_logrotate" != "xno"], [
 	AC_DEFINE(LOGROTATE_ENABLED, 1, [Enable built-in rotation of /var/log/wtmp et al.])])

+AS_IF([test "x$enable_rescue" != "xno"], [
+	AC_DEFINE([RESCUE_MODE], 1, [Define to enable support for rescue mode.])])
+
 AM_CONDITIONAL(LOGROTATE, [test "x$enable_logrotate" = "xyes"])

 ### With features ##############################################################################
+AS_IF([test "x$bash_dir" = "xyes"], [
+	PKG_CHECK_MODULES([BASH_COMPLETION], [bash-completion >= 2.0],
+		[BASH_DIR="$(pkg-config --variable=completionsdir bash-completion)"],
+		[BASH_DIR="$datadir/bash-completion/completions"])], [
+	BASH_DIR="$bash_dir"])
+
 AS_IF([test "x$with_fstab" != "xno"], [
 	AS_IF([test "x$fstab" = "xyes"], [fstab=$sysconfdir/fstab])
 	AC_EXPAND_DIR(fstab_path, "$fstab")
@@ -198,10 +250,9 @@ AC_DEFINE_UNQUOTED(FINIT_RCSD, "$rcsd_path", [Finit rcS.d/, default /etc/finit.d
 AC_SUBST(FINIT_RCSD, "$rcsd_path")

 AS_IF([test "x$with_rc_local" != "xno"], [
-	AS_IF([test "x$rclocal" = "xyes"], [
-		rclocal=$sysconfdir/rc.local])])
-AC_EXPAND_DIR(rclocal_path, "$rclocal")
-AC_DEFINE_UNQUOTED(FINIT_RC_LOCAL, "$rclocal_path", [Compat SysV /etc/rc.local file to run last at boot.])
+	AS_IF([test "x$rclocal" = "xyes"], [rclocal=$sysconfdir/rc.local])
+	AC_EXPAND_DIR(rclocal_path, "$rclocal")
+	AC_DEFINE_UNQUOTED(FINIT_RC_LOCAL, "$rclocal_path", [Compat SysV /etc/rc.local file to run last at boot.])])

 AS_IF([test "x$with_sysconfig" != "xno"], [
 	AS_IF([test "x$sysconfig" != "xdefault"], [
@@ -235,9 +286,25 @@ AS_IF([test "x$with_random_seed" != "xno"], [
 	AC_EXPAND_DIR(random_path, "$random_seed")
 	AC_DEFINE_UNQUOTED(RANDOMSEED, "$random_path", [Improve random at boot by seeding it with sth from before.])])

+AS_IF([test "x$rtc_date" != "xno"], [
+	AC_DEFINE_UNQUOTED(RTC_TIMESTAMP_CUSTOM, "$rtc_date", [Custom RTC restore date, default: 2000-01-01 00:00])], [
+	rtc_date=""])
+
+AS_IF([test "x$rtc_file" != "xno"], [
+	AS_IF([test "x$rtc_file" = "xyes"], [
+		rtc_file=/var/lib/misc/rtc])
+	AC_EXPAND_DIR(rtcfile_path, "$rtc_file")
+	AC_DEFINE_UNQUOTED(RTC_FILE, "$rtcfile_path", [Save and restore system time from this file if /dev/rtc is missing.])],[
+	AC_DEFINE_UNQUOTED(RTC_FILE, NULL)])
+
 AS_IF([test "x$with_keventd" != "xno"], [with_keventd=yes])

-AS_IF([test "x$with_sulogin" != "xno"], [with_sulogin=yes])
+AS_IF([test "x$with_sulogin" != "xno"], [
+	AS_IF([test "x$sulogin" = "xyes"], [
+		sulogin=root])
+	with_sulogin=yes
+        AC_DEFINE_UNQUOTED(SULOGIN_USER, "$sulogin", [Built-in sulogin user, default: root])], [
+	sulogin=])

 AS_IF([test "x$with_watchdog" != "xno"], [
 	AS_IF([test "x$watchdog" = "xyes"], [
@@ -246,37 +313,74 @@ AS_IF([test "x$with_watchdog" != "xno"], [
        AC_DEFINE_UNQUOTED(WDT_DEVNODE, "$watchdog", [Built-in watchdog device node])], [
 	watchdog=])

-AS_IF([test "x$enable_hook_scripts_plugin" = "xyes" -a "x$with_hook_scripts_path" != "xno"], [
+AS_IF([test "x$with_libsystemd" != "xno"], [
+        AC_DEFINE(HAVE_LIBSYSTEMD, 1, [Build replacement libsystemd library support])])
+
+AS_IF([test "x$enable_hook_scripts_plugin" != "xno"], [
 	AS_IF([test "x$hook_scripts_path" = "xyes"], [hook_scripts_path=$libexecdir/finit/hook])
 	AC_EXPAND_DIR(hook_scripts_path, "$hook_scripts_path")
 	AC_DEFINE_UNQUOTED(PLUGIN_HOOK_SCRIPTS_PATH, "$hook_scripts_path", [Built-in default: $libexecdir/finit])])

+AS_IF([test "x$with_plugin_path" != "xno"], [
+	AS_IF([test "x$plugin_path" = "xyes"], [plugin_path=/usr/lib/finit/plugins:/usr/local/lib/finit/plugins])
+	AC_EXPAND_DIR(plugin_path, "$plugin_path")
+	AC_DEFINE_UNQUOTED(EXTERNAL_PLUGIN_PATH, "$plugin_path", [Built-in default: /usr/lib/finit/plugins:/usr/local/lib/finit/plugins])])
+
 # Control build with automake flags
-AM_CONDITIONAL(STATIC,    [test "x$enable_static" = "xyes"])
-AM_CONDITIONAL(KEVENTD,   [test "x$with_keventd"  != "xno"])
-AM_CONDITIONAL(SULOGIN,   [test "x$with_sulogin"  != "xno"])
-AM_CONDITIONAL(WATCHDOGD, [test "x$with_watchdog" != "xno"])
-AM_CONDITIONAL(DOC,       [test "x$enable_doc" = "xyes"])
-AM_CONDITIONAL(CONTRIB,   [test "x$enable_contrib" = "xyes"])
+AM_CONDITIONAL(BASH,        [test "x$bash_dir"        != "xno"])
+AM_CONDITIONAL(STATIC,      [test "x$enable_static"    = "xyes"])
+AM_CONDITIONAL(KEVENTD,     [test "x$with_keventd"    != "xno"])
+AM_CONDITIONAL(SULOGIN,     [test "x$with_sulogin"    != "xno"])
+AM_CONDITIONAL(WATCHDOGD,   [test "x$with_watchdog"   != "xno"])
+AM_CONDITIONAL(LIBSYSTEMD,  [test "x$with_libsystemd" != "xno"])
+AM_CONDITIONAL(DOC,         [test "x$enable_doc"       = "xyes"])
+AM_CONDITIONAL(CONTRIB,     [test "x$enable_contrib"   = "xyes"])
+AM_CONDITIONAL(TESTSERV,    [test "x$enable_testserv_plugin" = "xyes"])
+
+# Workaround for as-of-yet unreleased runstatedir support, planned for
+# autoconf 2.70, which some major distros have backported.
+AS_IF([test -z "$runstatedir"], runstatedir="$localstatedir/run")
+AC_SUBST(runstatedir)

 # Override default libdir, used for plugins and rescue.conf
 pkglibdir=$libdir/finit
 AC_SUBST(pkglibexecdir)
 AC_EXPAND_DIR(pkglibexecdir, "$libexecdir/finit")
-AC_DEFINE_UNQUOTED(FINIT_LIBPATH_, "$pkglibexecdir", [Finit libexec path])
+AC_DEFINE_UNQUOTED(FINIT_EXECPATH_, "$pkglibexecdir", [Finit libexec path])
+AC_EXPAND_DIR(finit_runpath, "$runstatedir/finit/system")
+AC_DEFINE_UNQUOTED(FINIT_RUNPATH_, "$finit_runpath", [Finit runtime dynamic system services])

-AC_EXPAND_DIR(plugin_path, "$libdir/finit/plugins")
+AC_EXPAND_DIR(plugin_path, "$pkglibdir/plugins")
 AC_SUBST(plugin_path)
 AC_DEFINE_UNQUOTED(PLUGIN_PATH, "$plugin_path", [Finit plugin path])

-AC_EXPAND_DIR(rescue_conf, "$libdir/finit/rescue.conf")
+AC_EXPAND_DIR(tmpfiles_path, "$libdir/tmpfiles.d")
+AC_SUBST(tmpfiles_path)
+AC_DEFINE_UNQUOTED(TMPFILES_PATH_, "$tmpfiles_path", [Main tmpfiles.d/, override in /etc])
+
+AC_EXPAND_DIR(finit_tmpfiles, "$pkglibdir/tmpfiles.d")
+AC_SUBST(finit_tmpfiles)
+AC_DEFINE_UNQUOTED(FINIT_TMPFILES, "$finit_tmpfiles", [Finit tmpfiles.d/ .conf path])
+
+AC_EXPAND_DIR(system_path, "$pkglibdir/system")
+AC_SUBST(system_path)
+AC_DEFINE_UNQUOTED(FINIT_SYSPATH_, "$system_path", [Static services, previously generated at runtime by plugins])
+
+AC_EXPAND_DIR(rescue_conf, "$pkglibdir/rescue.conf")
 AC_DEFINE_UNQUOTED(RESCUE_CONF, "$rescue_conf", [Finit rescue mode .conf])
-AC_EXPAND_DIR(sample_conf, "$libdir/finit/sample.conf")
+AC_EXPAND_DIR(sample_conf, "$pkglibdir/sample.conf")
 AC_DEFINE_UNQUOTED(SAMPLE_CONF, "$sample_conf", [Finit sameple.conf for initctl create])

+AC_EXPAND_DIR(bash_completion_dir, "$BASH_DIR")
+AC_SUBST(BASH_DIR, "$bash_completion_dir")
+
 AS_IF([test "$heading" = ""],   [heading="<DEFAULT>"])
 AS_IF([test "$heading" = "no"], [heading="<NONE>"])

+RTC_DATE=$rtc_date
+AS_IF([test "$rtc_date" = ""],   [RTC_DATE="<DEFAULT>"])
+AS_IF([test "$rtc_date" = "no"], [RTC_DATE="<DEFAULT>"])
+
 # Generate all files
 AC_OUTPUT

@@ -284,15 +388,16 @@ cat <<EOF

 ------------------ Summary ------------------
 $PACKAGE_NAME version $PACKAGE_VERSION
-  Prefix................: $prefix
-  Exec prefix...........: $eprefix
+  Prefix................: $(eval echo $prefix)
+  Exec prefix...........: $(eval echo $exec_prefix)
+  Libdir................: $(eval echo $libdir)
  Sysconfdir............: `eval echo $sysconfdir`
  Localstatedir.........: `eval echo $localstatedir`
  Default fstab.........: `eval echo $fstab`
  Finit config file.....: $conf_path
  Finit config.d path...: $rcsd_path
  Finit plugin path.....: $plugin_path
-  Compat rc.local path..: $rclocal_path
+  Compat rc.local path..: `eval echo $rclocal`
  System environment....: ${sysconfig_path:-${sysconfig}}
  Random seed path......: $random_path
  C Compiler............: $CC $CFLAGS $CPPFLAGS $LDFLAGS $LIBS
@@ -301,17 +406,25 @@ cat <<EOF
 Behavior:
  Boot heading..........: $heading
  Plugins...............: $plugins
+  RTC restore date......: $RTC_DATE
+  RTC fallback file.....: $rtc_file

 Optional features:
  Install doc/..........: $enable_doc
  Install contrib/......: $enable_contrib
+  Bash completion.......: $bash_completion_dir
  Built-in keventd......: $with_keventd
-  Built-in sulogin......: $with_sulogin
+  Built-in sulogin......: $with_sulogin $sulogin
  Built-in watchdogd....: $with_watchdog $watchdog
  Built-in logrotate....: $enable_logrotate
+  Replacement libsystemd: $with_libsystemd
+  Use cgroup v2.........: $enable_cgroup
+  Parse kernel cmdline..: $enable_kernel_cmdline
+  Keep kernel logging...: $enable_kernel_logging
  Skip fsck check.......: $enable_fastboot
  Run fsck fix mode.....: $enable_fsckfix
  Redirect output.......: $enable_redirect
+  Rescue mode...........: $enable_rescue
  Default hostname......: $hostname
  Default group.........: $group
  Default runlevel......: $runlevel
@@ -3,3 +3,8 @@ bin_SCRIPT = service
 docsdir   := @docdir@/contrib
 docs_DATA  = README.md finit.conf procmon.sh
 EXTRA_DIST = $(docs_DATA)
+
+if BASH
+bashdir            = $(BASH_DIR)
+dist_bash_DATA     = initctl
+endif
@@ -6,6 +6,7 @@ install and try out Finit on various Linux distributions.

 * [Alpine](alpine/)
 * [Debian](debian/)
+* [Void](void/)

 If you have ideas on how to simplify, extend, or even add new example
 configurations for other distributions you are most welcome! :)
@@ -1,5 +1,8 @@
-HowTo: Finit on Alpine Linux 3.4-3.6
-====================================
+HowTo: Finit on Alpine Linux 3.4...3.19
+=======================================
+
+> [!TIP]
+> https://troglobit.com/post/2021-02-12-alpine-linux-with-finit/

 HowTo use Finit to boot an [Alpine Linux][] system.  It is assumed that
 the user has already installed make, a compiler, C library header files,
@@ -17,8 +17,8 @@ PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig:/usr/local/lib/pkgconfig ./configure	\
 		 --prefix=/usr			--exec-prefix=			\
 		 --sysconfdir=/etc		--localstatedir=/var		\
 		 --enable-dbus-plugin		--enable-x11-common-plugin	\
-		 --enable-alsa-utils-plugin	--with-watchdog			\
-		 --with-keventd
+		 --enable-alsa-utils-plugin	--without-watchdog		\
+		 --with-keventd			--with-sulogin

 echo
 echo "*** Building ..."
@@ -35,4 +35,3 @@ fi
 echo
 echo "*** Done"
 echo
-
@@ -1,8 +1,7 @@
 SUBDIRS    = available
 docsdir   := @docdir@/contrib/alpine/finit.d
 d_LINKS    = acpid.conf crond.conf dropbear.conf getty.conf	\
-	     keymap.conf modules.conf ntpd.conf			\
-	     klogd.conf syslogd.conf
+	     keymap.conf modules.conf ntpd.conf syslogd.conf

 install-exec-hook:
 	@$(MKDIR_P) $(DESTDIR)$(docsdir)/available
@@ -1,4 +1,4 @@
 docsdir   := @docdir@/contrib/alpine/finit.d/available
 docs_DATA  = acpid.conf crond.conf dropbear.conf getty.conf keymap.conf	\
-             lxdm.conf modules.conf ntpd.conf syslog.conf watchdog.conf
+             lxdm.conf modules.conf ntpd.conf syslogd.conf watchdog.conf
 EXTRA_DIST = $(docs_DATA)
@@ -4,4 +4,4 @@
 #module evdev
 #module mousedev
 #module 8139cp
-module softdog
+#module softdog
@@ -1,45 +1,53 @@
 #!/bin/sh

-if [ "x`id -u`" != "x0" ]; then
-    echo
-    echo "*** This script must run as root"
-    echo
+if [ "$(id -u)" != "0" ]; then
+    printf "\n\e[1m*** This script must run as root\e[0m\n\n"
    exit 1
 fi

+# shellcheck disable=SC3037,SC3045,SC2154
+yorn()
+{
+    printf "\e[1m> %s (y/N)?\e[0m " "$*"
+    read -rn1 yorn
+    echo
+
+    if [ "$yorn" = "y" ] || [ "$yorn" = "Y" ]; then
+	return 0
+    fi
+
+    return 1
+}
+
 # Adjust base directory
-grep -q alpine Makefile 2>/dev/null
-if [ $? -eq 0 ]; then
+if grep -q contrib/alpine Makefile 2>/dev/null; then
    cd ../..
-elif [ ! -e configure.ac ]; then
-    echo "*** Please run this script from the Finit base directory."
+fi
+
+if [ ! -e configure.ac ]; then
+    printf "\n\e[1m*** Please run this script from the Finit base directory.\e[0m\n"
    exit 1
 fi

-echo
-echo "*** Install Finit on Alpine Linux"
-echo "========================================================================"
-echo "/sbin/finit           - PID 1"
-echo "/lib/finit/plugins/*  - All enabled Finit plugins"
-echo "/etc/finit.conf       - Finit configuration file"
-echo "/etc/finit.d/         - Finit services"
-echo
-read -p "Do you want to continue (y/N)? " yorn
+printf "\n\e[1mInstall Finit on Alpine Linux\n"
+printf "========================================================================\e[0m\n"
+printf "/sbin/finit           - PID 1\n"
+printf "/lib/finit/plugins/*  - All enabled Finit plugins\n"
+printf "/etc/finit.conf       - Finit configuration file\n"
+printf "/etc/finit.d/         - Finit services\n"

-if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
-    echo
-    echo "*** Installing Finit files ..."
+if yorn "Do you want to continue"; then
+    printf "\n\e[1m*** Installing Finit files ...\e[0m\n"
    make install
-    cd /usr/share/doc/finit/contrib/alpine
+    cd /usr/share/doc/finit/contrib/alpine || exit 1
    for file in finit.conf rc.local; do
 	install -vbD $file /etc/$file
    done
    cp -va finit.d /etc/

-    read -p "*** Install Finit as the system default Init (y/N)? " yorn
-    if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
-	echo "*** Updating /sbin/init symlink --> finit ..."
-	cd /sbin
+    if yorn "Install Finit as the system default Init"; then
+	printf "\e[1m*** Updating /sbin/init symlink --> finit ...\e[0m\n"
+	cd /sbin || exit 1
 	rm init
 	ln -s finit init

@@ -48,10 +56,8 @@ if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
 	ln -s reboot shutdown
 	ln -s reboot suspend
    fi
-    echo "*** Done"
+    printf "\n\e[1m*** Done\e[0m\n"
    echo
 else
-    echo
-    echo "*** Aborting install."
-    echo
+    printf "\n\e[1m*** Aborting install.\e[0m\n\n"
 fi
@@ -20,8 +20,9 @@ tools pre-systemd work as intended.

    root@debian:~# apt install initscripts console-setup

-> **Note:** as of Debian 11 (Bullseye), libuev and libite are part of
-> the main section of Debian.  So just install the -dev packages :)
+> [!TIP]
+> As of Debian 11 (Bullseye), libuev and libite are part of the main
+> section of Debian.  So just install the -dev packages :)

 The following script can then be used to configure, build, install and
 set up your system to run Finit:
@@ -47,7 +48,8 @@ comands to `initctl`, followed by `reload` to activate your changes.
 You can also use a standard [/etc/rc.local](rc.local) for one-shot tasks
 and initialization like keyboard language etc.

-> **NOTE:** X Window system, you may need to `sudo apt install elogind`
+> [!NOTE]
+> For the X Window system, you may need to `sudo apt install elogind`
 > (Bullseye and later), followed by `initctl reload` to activate it (it
 > is enabled by default), and logout/login again.  The elogind daemon
 > ensures a regular non-root user can start and interact with an X
@@ -59,6 +59,3 @@ else
    echo "*** Use 'sudo contrib/debian/install.sh' later to install Finit"
    echo
 fi
-
-
-    
@@ -0,0 +1,141 @@
+_cond()
+{
+    initctl -pt cond dump |  awk '{print $4}' | sed 's/<\(.*\)>/\1/'
+}
+
+_ident()
+{
+    if [ -n "$1" ]; then
+	initctl ident | grep -q $1
+    else
+	initctl ident
+    fi
+}
+
+_svc()
+{
+    initctl ls -pt | grep $1 | sed "s/.*\/\(.*\)/\1/g" | sort -u
+}
+
+_enabled()
+{
+    echo "$(_svc enabled)"
+}
+
+_available()
+{
+    all=$(mktemp)
+    ena=$(mktemp)
+    echo "$(_svc available)" >$all
+    echo "$(_svc enabled)"   >$ena
+    grep -v -f $ena $all
+    rm $all $ena
+}
+
+# Determine first non-option word. Usually the command
+_firstword() {
+	local firstword i
+
+	firstword=
+	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
+		if [[ ${COMP_WORDS[i]} != -* ]]; then
+			firstword=${COMP_WORDS[i]}
+			break
+		fi
+	done
+
+	echo $firstword
+}
+
+# Determine last non-option word. Uusally a sub-command
+_lastword() {
+	local lastword i
+
+	lastword=
+	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
+		if [[ ${COMP_WORDS[i]} != -* ]] && [[ -n ${COMP_WORDS[i]} ]] && [[ ${COMP_WORDS[i]} != $cur ]]; then
+			lastword=${COMP_WORDS[i]}
+		fi
+	done
+
+	echo $lastword
+}
+
+_initctl()
+{
+    local cur command
+
+    cur=${COMP_WORDS[COMP_CWORD]}
+    prev="${COMP_WORDS[COMP_CWORD-1]}"
+    firstword=$(_firstword)
+    lastword=$(_lastword)
+
+    commands="status cond debug help kill ls log version  list enable	\
+	      disable touch show cat edit create delete reload start	\
+	      stop restart signal cgroup ps top plugins runlevel reboot	\
+	      halt poweroff suspend utmp"
+    cond_cmds="set get clear status dump"
+    cond_types="hook net pid service task usr"
+    signals="int term hup stop tstp cont usr1 usr2 pwr"
+    options="-b --batch				\
+	     -c --create			\
+	     -d --debug				\
+	     -f --force				\
+	     -h --help				\
+	     -j --json				\
+	     -n --noerr				\
+	     -1 --once				\
+	     -p --plain				\
+	     -q --quiet				\
+	     -t --no-heading			\
+	     -v --verbose			\
+	     -V --version"
+
+    case "${firstword}" in
+	enable)
+	    COMPREPLY=($(compgen -W "$(_available)" -- $cur))
+	    ;;
+	disable|touch)
+	    COMPREPLY=($(compgen -W "$(_enabled)" -- $cur))
+	    ;;
+	show|cat|edit|delete)
+	    COMPREPLY=($(compgen -W "$(_svc .)" -- $cur))
+	    ;;
+	start|stop|restart|log|status)
+	    COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
+	    ;;
+	signal|kill)
+	    if $(_ident "${prev}"); then
+		COMPREPLY=($(compgen -W "$signals" -- $cur))
+	    else
+		COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
+	    fi
+	    ;;
+	cond)
+	    case "${lastword}" in
+		set|clear)
+		    compopt -o nospace
+		    COMPREPLY=($(compgen -W "usr/" -- $cur))
+		    ;;
+		get)
+		    COMPREPLY=($(compgen -W "$(_cond)" -- $cur))
+		    ;;
+		dump)
+		    COMPREPLY=($(compgen -W "$cond_types" -- $cur))
+		    ;;
+		*)
+		    COMPREPLY=($(compgen -W "$cond_cmds" -- $cur))
+		    ;;
+	    esac
+	    ;;
+	*)
+	    COMPREPLY=($(compgen -W "$commands" -- $cur))
+	    ;;
+    esac
+
+    if [[ $cur == -* ]]; then
+	COMPREPLY=($(compgen -W "$options" -- $cur))
+    fi
+}
+
+complete -F _initctl initctl
@@ -18,7 +18,7 @@ PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig:/usr/local/lib/pkgconfig ./configure	\
 		 --sysconfdir=/etc              --localstatedir=/var		\
                 --enable-dbus-plugin           --enable-x11-common-plugin	\
 		 --enable-alsa-utils-plugin	--with-watchdog			\
-		 --with-keventd
+		 --with-keventd			--with-sulogin

 echo
 echo "*** Building ..."
@@ -35,4 +35,3 @@ fi
 echo
 echo "*** Done"
 echo
-
@@ -4,7 +4,707 @@ Change Log
 All relevant changes are documented in this file.


-[4.3][UNRELEASED]
+
+[4.14][] - 2025-08-29
+---------------------
+
+Minor bug fix release.
+
+### Changes
+ - Add exit status/signal info when a process dies, by Mattias Berthel
+ - Extend `service kill:SEC` to support up to 300 sec.
+ - Extend `norespawn` debug to cover `service_retry()`
+ - Build *without* libsystemd replacement by default
+
+### Fixes
+ - Fix #449: ALSA plugin fail-to-build-from-source
+ - Fix `sysv` stop command process environment, should be same as start
+ - Fix state machine ordering issue: enter new config generation *after*
+   services disabled in previous generation have been stopped
+
+
+[4.13][] - 2025-07-10
+---------------------
+
+> [!NOTE]
+> This release introduce a bare bones `libsystemd` replacement with an
+> `<systemd/sd-daemon>.h` include file.  Other systemd features are the
+> `reload:script` and `stop:script`, mimicking ExecReload and ExecStop.
+
+### Changes
+ - `initctl signal` command has been renamed to `initctl kill`
+ - Drop xz tarballs from distribution, gzip is good enough
+ - New `tmpfiles` stand-alone program, refactored from the existing
+   tmpfiles.d support in Finit, by Aaron Andersen, PR #439
+    - `--remove` command runs only the `r` and `R` rules
+    - `--create` is used for all other cases (bootstrap)
+ - All `notify:systemd` services now log with `logit` by default.  This
+   because it supports systemd style log severity, leading `"<NUM>"`
+ - Support for quoted arguments to run/task/service options, issue #441
+ - Clear command line arguments after bootstrap, issue #442
+ - Support for `stop:'script [args]'` to stop a sysv/service instead of
+   the common `foo-stop-start.sh stop`, or `SIGTERM`, issue #412
+ - Support for `reload:'script [args]'` to trigger a configuration
+   reload in a service, issue #446
+
+### Fixes
+ - Fix #437: buffer overflow in `initctl status`
+ - Fix #438: support very long command lines in `initctl ps/top`
+ - Fix #440: broken systemd and s6 readiness notification
+ - Fix #443: build warnings, by Ming Liu, Atlas Copco
+ - Fix #444: handle loooooong arguments, by Aaron Andersen
+ - Fix service's redirected stdout/stderr log priority in fallback mode,
+   when neither `logger` or `logit` is available.  This fix also checks
+   for systemd style log severity, leading `"<NUM>"` in log messages
+ - Ensure API socket used by `initctl` is non-blocking (event loop)
+
+
+[4.12][] - 2025-04-28
+---------------------
+
+### Changes
+ - Improve notify:s6 readiness compatibility, by Aaron Andersen
+ - Update `runparts` usage text
+
+### Fixes
+ - Fix variable overloading in urandom plugin
+ - Fix buffer overwrite in urandom plugin, reported by Aaron Andersen
+
+
+[4.11][] - 2025-03-27
+---------------------
+
+### Changes
+ - Update documentation regarding transition from runlevel S to 2, how
+   run/tasks must "complete" before Finit can move to the next runlevel
+ - Improve argument handling in bundled getty when launching login
+
+### Fixes
+ - Fix #432: allow services in `setup` state to be stopped.  This fixes
+   a serious blocker introduced in 4.10 that prevented systems from
+   being rebooted when any service was in this state
+ - Fix fallback `SIGKILL` when stopping a service with `SIGTERM` does
+   not work.  This fixes a serious issue with services not responding to
+   the default `SIGTERM`
+ - Fix pre/post/ready/cleanup script execution if service has an
+   optional `env:file` (leading `-`)
+ - Fix blocked signals for pre/post/ready/cleanup scripts preventing
+   normal shutdown when a service/sysv is stopped in its setup state
+ - Fix issue where a pre:script creates a PID file in `/run` cause the
+   service to move from setup state to running.  Any `svc_t` in setup,
+   teardown, or cleanup state should be ignored in the pidfile plugin
+
+
+[4.10][] - 2025-03-03
+---------------------
+
+### Changes
+ - Add support for `cleanup:[0-3600,]script`, runs before service is
+   removed, unlike `post:script` that runs when service is stopped
+ - Improved entropy gathering in tertiary fallback of urandom plugin
+ - Reclassify `sysv` from run/task class to `service`
+
+### Fixes
+ - Fix #427: using an external getty with custom login program cause
+   Finit to use login program as the getty command
+ - Fix #428: allow `sysctl` path to be set at build time
+ - Fix #429: regression in v4.9 causing Finit to segfault at shutdown
+ - Fix possible memory leak when sourcing a service `env:file`
+ - Finit now waits until all `post:scripts` have run before returning
+   OK to `initctl <reload|runlevel>`.  This also applies to the new
+   `cleanup:scripts` introduced in this release
+ - RFC3154 conformance formatting fix for `/dev/kmsg` fallback logging
+
+
+[4.9][] - 2025-02-15
+--------------------
+
+> [!CAUTION]
+> This release changes how Finit reacts to the exit status of `pre:`
+> scripts.  Finit will now no longer start the main process if its
+> `pre:` script fails for any reason.  So, if you have pre scripts that,
+> e.g., create directories, make sure they are idempotent.
+
+### Changes
+ - Add individual timeout (optional) support for pre/post/ready scripts
+ - Add support for systems with broken RTC, i.e., those that at power-on
+   may reset the RTC to a random date instead of zero, issue #418
+ - Add support for detecting "in-container" when in `systemd-nspawn`
+ - Check exit status of `pre:` scripts, on failure drive service/sysv to
+   `crashed` state.  (The exit code of `post:` scripts remain ignored)
+ - All pre/post/ready scripts are now also searched for in `$PATH`
+ - Reset color attributes and clear screen when starting up.  This is
+   for boot loaders like GRUB, which leave background color artifacts
+
+### Fixes
+ - Fix #415: only mark reverse-dependencies "dirty" if the main service
+   does not support SIGHUP.  This helps avoid unnecessary restarts of
+   services that depend on a service that supports SIGHUP
+ - Fix #417: leaking inotify watchers in the cgroup subsystem
+ - Fix #421: add support for `nofail` mount option in `/etc/fstab`
+ - Fix #425: ordering bug in detecting .conf file changes to services
+   and `initctl reload`, or runlevel changes
+ - Fix `initctl touch` of template services, previously marking a
+   service created from a template as "dirty" did not take
+ - Fix unintended restart of template "siblings".  I.e., `initctl touch`
+   of instantiated template service A affected B from same template
+ - Fix buggy `--with-rtc-date=DATE` configure option
+ - Fix kill on timeout of pre/post/ready scripts
+
+
+[4.8][] - 2024-10-13
+--------------------
+
+### Changes
+ - Avoid remounting already mounted `/run` and `/tmp` directories.  This
+   extends the existing support for detecting mounted directories to
+   include complex mount hierarchies are in use, overlayfs and tmpfs
+   mounts.  Feature by Mathias Thore, Atlas Copco
+ - getty: trigger /etc/issue compat mode for Alpine Linux
+ - tmpfiles.d: skip `x11.conf` unless X11 common plugin is enabled
+ - tmpfiles.d: ignore x/X command, nos support for cleanup at runtime
+ - Drop debug mode `-D` from `udevd` in `hotplug.conf.in`, allow the
+   user to set this in `/etc/default/udevd` instead
+ - Certain initctl APIs at bootstrap are not supported, update warning
+   log to include command (number) for troubleshooting, issue #398
+ - Add support for hwrng to urandom plugin and check for empty seed
+ - Add `runparts -b` (batch mode) support, disables escape sequences
+ - New configure `--without-rc-local`, disables `/etc/rc.local` support
+ - New configure `--disable-cgroup` option, disables cgroup v2 detection
+ - `initctl show template@foo.conf` now shows how an enabled template
+   service has been evaluated by Finit, issue #411
+ - Extend `initctl` timeout connecting and waiting for Finit reply.  The
+   previous 2 + 2 second poll timeout has proved to be too short on more
+   complex systems.  Now a 15 + 15 second timeout is applied which should
+   be more resistant to temporary overload scenarios, issue #407
+
+### Fixes
+ - Fix #397: system shutdown/reboot can block on console input if action
+   is started remotely (ssh).  Caused by legacy TTY screen size probing,
+   removed from both bootstrap and shutdown/reboot
+ - Fix #400: both `HOOK_MOUNT_ERROR` and `sulogin()` fail to trigger on
+   either mount or `fsck` errors.  Problem caused by unresolved status
+   from pipe, calling `pclose()` without extracting exit status
+ - Fix #402: `initctl touch` does not respect `-n` (no error) flag
+ - Fix #403: `initctl touch` does not support template services
+ - Fix #404: possible undefined behavior when `--with-fstab=no` is set
+ - Fix #405: `@console` getty does not work with `tty0 ttyS0`
+ - Fix #409: prevent tmpfiles from following symlinks for `L+` and `R`,
+   otherwise symlink targets would also be removed.  Found and fixed by
+   Mathias Thore and Ming Liu, Atlas Copco
+ - Fix #414: Frr Zebra immediately restarts on `initctl stop zebra`.
+   The fix likely works for all Frr/Quagga services due to the way they
+   create and delete their pid file
+ - Cosmetic issue with `[ OK ]` messages being printed out of order at
+   shutdown/reboot.  Caused by nested calls to `service_stop()`
+ - Cosmetic issue with duplicate "Restoring RTC" message at bootstrap
+
+
+[4.7][] - 2024-01-07
+--------------------
+
+### Changes
+- Silence "not available" messages for run/task/service with `nowarn`
+- Update docs, `cgroup.root` workaround for `SCHED_RR` tasks
+- Drop runlevels 0 and 6 from `keventd`, not needed at reboot/poweroff
+- Mount `/dev/shm` with mode 1777 (sticky bit)
+- Mount `/dev/mqueue` if available, inspiration from Alpine Linux
+- Update Alpine Linux installer and configuration files, tested on
+  Alpine v3.19, some assembly still required
+
+### Fixes
+- Fix confusing warning message when tmpfiles.d fails to install symlink
+- Fix tmpfiles.d legacy `/run/lock/subsys`, ordering
+- Add missing `/var/tmp` and `/var/lock -> /run/lock` (tmpfiles.d)
+- Fix #388: log redirection broken unless Finit runs in debug mode.
+  Found and fixed by Ryan Rorison
+- Fix #389: must libc requires `libgen.h` for `basename()` function.
+  Reported and worked around with new `basenm()` function by Stargirl
+- Fix #392: `service/foo/ready` condition reasserted on pidfile removal
+
+
+[4.6][] - 2023-11-13
+--------------------
+
+### Changes
+- Add support for service `notify:pid` and `readiness none` global
+  option to change how Finit expects readiness notification, issue #386
+
+### Fixes
+- Fix #383: dbus and runparts regression in Finit v4.5.  The configure
+  script must expand `FINIT_RUNPATH_` before defining it in `config.h`
+- Fix #384: service environment variables drop everything but the first
+  argument, e.g., `VAR="foo bar qux"` drops everything but `foo`
+- Fix #385: internal conditions, e.g., `<int/bootstrap>` turn into flux
+  when leaving bootstrap, causing depending services to stop
+- Fix #387: global environment variables declared with `set VAR=NAME` do
+  not drop leading `set `, causing `'set VAR'='NAME'` in env.
+- Sanity check environment variables, for services and globally.  Ensure
+  the variable name (key) does not contain spaces, or a leading `set `
+
+
+[4.5][] - 2023-10-30
+--------------------
+
+### Changes
+- Refactor `runparts` and `/etc/rc.local` to no longer block the main
+  loop, allowing `initctl` calls to interact with Finit.  Issue #356
+- Refactor the `run` stanza to no longer block the main loop, issue #362
+- Allow `sulogin` with a user different from `root`, issue #357
+- Allow disabling invocation of rescue mode from kernel command line
+- Add `initctl -f` to force-skip asking Finit for existing services
+  when creating new services during bootstrap, e.g. `/etc/rc.local`
+- `initctl runlevel` now returns `N S` instead of `N 10` in bootstrap
+- `initctl runlevel N` during bootstrap is now allowed.  It changes
+  the next runlevel to go to when bootstrap has completed.  Effectively
+  overriding the `runlevel N` statement in `/etc/finit.conf`
+- Improved logging on failure to `execvp()` a run/task/service, now
+  with `errno`, e.g., "No such file or directory" when the command
+  is missing from `$PATH`
+- Add Bash completion support for `initctl`, configurable, issue #360
+- Handle absolute path to `initctl [enable|disable]`, not supported
+- Update `finit.conf(5)` man page with the recommended directory
+  hierarchy in `/etc/finit.d/`
+- The `runparts` code has been split into `/libexec/finit/runparts`
+- The `runparts` command now takes two options: `sysv` and `progress`.
+  The former ensures only `SNNfoo` and `KNNfoo` scripts are run.
+- Add SysV Init Compatibility section to documentation
+- Increased MAX path for commands, and arguments: 64 -> 256
+- The bundled watchdog daemon no longer tries to log at startup, because
+  syslog is not available yet, any startup message leak to console
+- Extend `if:` option with runtime evaluation of conditions.  E.g., start
+  a task only `if:<run/foo/failure>` (here the run task 'foo' failed)
+- Document new `if:`, `conflict:`, `nowarn` options for run/task/service
+  first introduced in v4.4
+- Failure to open fstab should log to console, not just log to `/dev/kmsg`
+- Rename `/lib/finit/system/*.conf`, added numbered prefix to ensure
+  proper execution order, e.g., `udevd` should always run first
+- Plugins and bundled services: dbus, keventd, watchdogd, and runparts,
+  are now loaded *after* all services in `/lib/finit/system/`.  A new
+  runtime-only path (for inspection) in `/run/finit/system/` is used
+- Redirect `log*` output to console when `finit.debug` is enabled
+- Assert `<int/container>` condition if we detect running in container
+- Add support for mdev's netlink daemon mode, issue #367
+- Add support for mdevd in `10-hotplug.conf`, preferred over plain mdev
+- Disable modprobe plugin by default, udevd and mdev/mdevd loads modules
+- Update documentation for run/task shell limitations, issue #376
+- Update documentation regarding automount of `/run` and `/tmp`
+- Update plugin documentation, add section about limited tmpfiles.d(5) support
+- Skip registering service when `if:!name` matches a known service.
+  This allows conditional loading of alternative services, e.g. if udevd
+  is already loaded we do not need mdevd
+- Drop `doc/bootstrap.md`, inaccurate and confusing to users
+
+### Fixes
+- Fix #227: believed to have been fixed in v4.3, the root cause was
+  actually that Finit was waiting for a process that was no longer in
+  the system.  The fix is to ask the kernel on process-stop-timeout and
+  replay the lost PID so that Finit can continue with reboot/shutdown
+- Fix #358: fix inotify events for `/etc/finit.conf`, improved log
+  messages and error handling
+- Fix #361: cgroup move fail if run/task/services start as non-root.
+  Regression in the v4.4 release cycle while adding support for the
+  pre:/post:/ready: scripts.  Now the latter scripts also properly run
+  in their correct cgroup
+- Fix #366: document `fsck.*` kernel command line options and simplify
+  the configure flags `--enable-fsckfix` and `--enable-fastboot` to
+  only adjust the default values for the `fsck.*` options.
+- Fix #371: swap load order of `/lib/finit/system/*` vs `/etc/finit.d/*`
+  We must run `10-hotplug.conf` first to ensure devices and modules are
+  up and loaded before the user's run/task/services are called.  The order
+  at bootstrap is now saved in `/run/finit/conf.order` for inspection,
+  `/run/finit/exec.order` shows the start order of each process
+- Fix #372: lost `udevadm` calls due to overloading
+- Adjust final `udevadm settle` timeout: 5 -> 30 sec
+- Fixed dbus plugin, the function that located `<pidfile> ...` in the
+  `dbus/system.conf` caused spurious line breaks which led to the
+  service not being loaded properly
+- The `runparts` executor now skips backup files (`foo~`)
+- The `runparts` stanza now properly appends ` start` to scripts that
+  start with `S[0-9]+`.  This has been broken for a very long time.
+- Fix #377: expand service `env:file` variables, allow constructs like:
+
+        RUNDIR=/var/run/somesvc
+        DAEMON_ARGS=--workdir $RUNDIR --other-args...
+- Fix #378: warn on console if run/task times out during bootstrap
+- Fix #378: add run/task support for `<!>` to allow transition from
+  bootstrap to multi-user runlevel even though task has not run yet.
+- Fix #382: do not clear `<service/foo/STATE>` conditions on reload.  
+  Introduced back in v4.3-rc2, 82cc10be8, the support for automatic
+  service conditions have had a weird and unintended behavior.  Any
+  change in state (see `doc/svc-machine.png`) caused Finit to clear
+  out *all* previously acquired service conditions.
+
+  However, when moving between RUNNING and PAUSED states, a service
+  should not have its conditions cleared.  The PAUSED state, seen
+  also by all conditions moving to FLUX, is only temporary while an
+  `initctl reload` is processed.  If a service has no changes to be
+  applied it will move back to RUNNING.
+
+  Also, we cannot clear the service conditions because other run/task
+  or services may depend on it and clearing them would cause Finit to
+  `SIGTERM` these processes (since they are no longer eligible to run).
+
+
+[4.4][] - 2023-05-15
+--------------------
+
+> **Note 1:** this release contains changes to the `.conf` parser.  If you
+> have .conf file statements with comment character (`#`) in the command
+> options or description, you must now escape them (`\#`).  Issue #186
+>
+> **Note 2:** prior to this release, runlevel `S` and `0` were after
+> boot treated as the same runlevel.  This caused `task [06] ...`  to
+> also run at bootstrap instead of just at shutdown and reboot.  The
+> changes made to Finit to separate `S` from `0` require you to update
+> the allowed runlevels for services that are allowed to continue
+> running at shutdown.  I.e., change `[S123456789]` to `[S0123456789]`
+> for, e.g., `sysklogd`.  Issue #352
+
+### Changes
+* Add limited tmpfiles.d(5) support
+
+  This change adds very basic `tmpfiles.d/` support to Finit.  Most of
+  the basic types are supported, but not all, so for now, please check
+  the code and examples for details on what is working.
+
+* If a run/task/service command does not exist, skip registering it
+
+  This changes the semantics of Finit a bit by checking for the command
+  to run when registering it, skipping commands that cannot be found in
+  the absolute path provided in the command, or in `$PATH`
+
+  This change includes a new `nowarn` flag that can be used to prevent
+  Finit from warning for missing commands.  See below for an example.
+
+* Add run/task/service support for `conflict:foo` handling
+* Add run/task/service support for `if:[!]ident` and `if:<[!]cond>`
+
+  Conditional loading of stanza depending on ident is already loaded (or
+  not), or condition satisfied (or not).  E.g., do not run `mdev` if we
+  found and registered `udevd`, or load service only if `<boot/testing>`
+  condition is set.
+
+  The optional leading `!` negates the comparison, if NOT foo then ...
+
+* Add support for static services in `/lib/finit/system/*.conf`
+
+  Slowly migrating away from hard-coded services in plugins.  This way
+  it's possible for the user to both inspect and override as needed.
+
+* Migrate hotplug plugin to a conditional `/lib/finit/system/hotplug.conf`
+
+  This is the first example of the just minted advanced stanza syntax with
+  `if:`-statements, `conflict:` handling, and `nowarn` flags.
+
+* Initial support for template services, `foo@.conf`, similar to systemd
+
+        $ initctl show avahi-autoipd@
+        service :%i avahi-autoipd --syslog %i -- ZeroConf for %i
+
+  To enable ZeroConf for, e.g., `eth0`, use
+
+        $ initctl enable avahi-autoipd@eth0.conf
+
+  The enabled symlink will be set up to `avahi-autoipd@.conf` and every
+  instance of `%i` will in the instantiated directive be replaced with
+  `eth0`.  Inspect the result with:
+
+        $ initctl status avahi-autoipd:eth0
+
+* Add `devmon`, a `<dev/foo>` condition provider, issue #185
+* Support for line continuation character `\` in .conf files, issue #186
+
+        service name:sysklogd [S123456789]   \
+            env:-/etc/default/sysklogd       \
+            syslogd -F $SYSLOGD_ARGS         \
+            -- System log daemon
+
+* `HOOK_BASEFS_UP` has been moved!  External plugins that need to call
+  `service_register()`, please use `HOOK_SVC_PLUGIN` from now on.  
+  Apologies for any inconveniences this might cause!
+* getty: add support for `/etc/os-release` to replace `uname` output  
+  This change, which has a fallback to `/usr/lib/os-release`, overrides
+  traditional modifiers with the os-release variant.  These values were
+  taken from `uname`, which on Linux systems are pretty useless since
+  they always return the kernel name and version instead of the
+  distro/OS values.
+
+  E.g., \s becomes `PRETTY_NAME` instead of 'Linux' and \v becomes the
+  pretty `VERSION`, while \r becomes `VERSION_ID`.
+* Support for overriding `/etc/finit.conf` and `/etc/finit.d` issue #235  
+  New (kernel) command line option `finit.config=PATH` which can be used
+  to redirect Finit to start up with, e.g., `/etc/factory.conf` instead of
+  `/etc/finit.conf`.
+
+  For the complete experience a new top-level configuration file directive
+  `rcsd PATH` has also been added.  It in turn can be used by `factory.conf`
+  as follows to override `/etc/finit.d`:
+
+        rcsd /etc/factory.d
+
+* Support for overriding `/etc/finit.d` from the alternate `finit.conf`
+  with a new `rcsd /path/to/dot.d/` .conf file directive
+* Support for `fsck_mode=[auto,skip,force]` + `fsck_repair=[preen,no,yes]`
+* Add `set` keyword for environment variables set in `/etc/finit.conf`
+* Support `finit.cond=foo` cmdline `<boot/foo>` conditions, issue #250
+* `initctl` JSON output support for status and conditions, issue #273  
+  Example:
+
+        root@infix:~$ initctl status -j resolvconf
+        {
+          "identity": "resolvconf",
+          "description": "Update DNS configuration",
+          "type": "task",
+          "forking": false,
+          "status": "done",
+          "exit": { "code": 0 },
+          "origin": "/etc/finit.d/enabled/sysrepo.conf",
+          "command": "resolvconf -u",
+          "restarts": 0,
+          "pidfile": "none",
+          "pid": 0,
+          "user": "root",
+          "group": "root",
+          "uptime": 0,
+          "runlevels": [ 1, 2, 3, 4, 5, 7, 8, 9 ]
+        }
+
+  The excellent tool `jq` can be used to extract parts of the output for
+  further scripting.  E.g. `initctl status -j foo | jq .exit.status`
+
+* Add JSON support to `initctl ls` command  
+
+  This allows for easy access to the *disabled* services:
+
+        root@anarchy:~# initctl ls --json |jq '.available - .enabled'
+        [
+          "chronyd.conf",
+          "dnsmasq.conf",
+          "gdbserver.conf",
+          "inadyn.conf",
+          "inetd.conf",
+          "isisd.conf",
+          "lldpd.conf",
+          "mstpd.conf",
+          "ntpd.conf",
+          "ospf6d.conf",
+          "ospfd.conf",
+          "querierd.conf",
+          "ripd.conf",
+          "ripng.conf",
+          "sshd.conf",
+          "syslogd.conf",
+          "telnetd.conf",
+          "uftpd.conf",
+          "wpa_supplicant.conf",
+          "zebra.conf"
+        ]
+
+* Allow `manual:yes` on sysv/service/run/task stanzas, issue #274
+* Add support for `oncrash:script` to call the `post:script` action, if
+  defined, for a crashing service.  The `EXIT_CODE` variable sent to the
+  script is set to `crashed`. Issue #282
+* Search for plugins in `/usr` and `/usr/local` as well, issue #284
+* tty: add support for `passenv` flag to `/bin/login`, issue #286
+* Add reboot/shutdown/poweroff timeout `-t SEC` to initctl, issue #295
+* Add support for s6 and systemd readiness notification, issue #299.  
+  Service readiness notification to support daemons employing systemd
+  and s6 notification.  Complementing the native Finit readiness support
+  using PID files that exist already.
+
+  The two have slightly different ways of implementing readiness:
+
+  - https://www.freedesktop.org/software/systemd/man/sd_notify.html
+  - https://skarnet.org/software/s6/notifywhenup.html
+
+  Finit now provides both a `NOTIFY_SOCKET` environment variable, for
+  systemd, and a way to start s6 daemons with a descriptor argument.
+
+  For details on the syntax, see the `service` documentation.
+
+  This change also renames internal states for run/task/services to
+  avoid any confusion with the introduction of `ready:scripts`:
+
+  - `WAITING -> PAUSED`
+  - `READY   -> WAITING`
+
+  A service condition that used, e.g., `<service/foo/ready>` should now
+  instead use `<service/foo/waiting>`
+
+* Add `ready:script` for services, called when daemon is ready, issue #300
+* Add support for running scripts at shutdown at two new hook points
+  during the shutdown process, issue #302. See doc/plugins.md for details:
+
+  - `HOOK_SVC_DN`: after all services and non-reserved processes have been
+    killed (and collected)
+  - `HOOK_SYS_DN`: after all file systems have been unmounted, *just prior*
+    to Finit calling `reboot()` to shut down or reboot the system
+
+* The `modules-load` plugin now default to runlevel `[S]`, in previous
+  releases it was `[2345]`.  This breaking change is to align it more
+  with what users mostly want (modules loaded before services start) and
+  can be changed back to the old behavior with a per-file setting:
+
+        set runlevel 2345
+
+* The `modules-load` plugin now adds silent tasks for modprobe.  This to
+  prevent confusing `[ OK ]` boot messages when in fact modprobe failed.
+* The `modules-load` plugin now support `set modprobe /path/to/modprobe`
+* The header files `finit/conf.h` and `finit/service.h` are now exported
+  for external plugins
+* Add support for multiple args to `initctl cond set/clr`, issue #329
+* Silence confusing `[ OK ]` progress from modules-load plugin, issue #332  
+
+  This change drops the confusing status progress output, which was always
+  OK since the actual modprobe operation runs in the background.  No need
+  to show status of the "added a task to finit, found modprobe" command.
+
+* dbus plugin: adapt to other operating systems
+
+  Not all Linux systems are based on Debian, and even if they are inspired
+  by Debian (Buildroot), they do not necessarily use the same defaults.
+  Probes the system at runtime for:
+
+  - dbus user and group
+  - dbus PID file
+
+  If the user/group cannot be found we fall back to `root`, if the PID
+  file cannot be determined we ignore PID file readiness.
+
+* Improve documentation for runparts and hook scripts.  Issue #315, #320
+* Add `HOOK_NETWORK_DN`, called after change to runlevel 6 or 0, issue #319
+* Use sysklogd `logger` tool instead of legacy `logit` tool, issue #344
+
+  For log redirection Finit has the legacy `logit` tool.  This change
+  allows Finit to use the `sysklogd` project's extended `logger` tool
+  instead, when available.  Allowing logging with the process' PID.
+
+* Add `initctl` aliases: `cat -> show`, `kill -> signal`
+* Add `initctl -n,--noerr` to return OK(0) if services do not exist, for
+  integration with openresolv and scripts with similar requirements
+* Add `initctl plugins`, list installed plugins
+* Add timestamp to log messages in fallback and logging to `stderr`.  
+  When there is no log daemon, and we are running in a container, or we
+  cannot log to the kernel ring buffer, then we log to `stderr`.  This
+  change improves log output by prefixing each message with a timestamp.
+
+### Fixes
+* Fix #254: document limitations in `rc.local` and `runparts` scripts
+* Fix #269: add compulsory kernel symlinks in `/dev`
+* Fix #275: `initctl status foo` should list all instances, regression
+  introduced in v4.3
+* Fix #278: enforce conditions also for running `pre:` scripts
+* Fix #279: allow `restart:always`, of crashing services.  Similar to
+  `respawn` but honors `restart_sec`
+* Fix #280: allow calling `initctl restart foo` from within foo
+* Fix #283: too quick timeout at bootstrap of lingering tasks
+* Fix #285: `initctl restart` should start crashed service
+* Fix #288: enable built-in `sulogin` in Alpine and Void Linux builds
+* Fix #293: modprobe plugin: support for coldplugging more devices.  It
+  turns out, not all buses in Linux add `modalias` attributes to their
+  devices in sysfs.  One notable exception are MDIO buses.  The plugin's
+  scan routine would thus not pick them up.
+* Fix #294: `shutdown --help` mistakenly shuts down system
+* Fix #310: Always use configured restart delay for crashing services.
+  If no delay is configured, default to an initial 2000 msec for forking
+  daemons and start-stop scripts, and 1 msec for non-forking daemons
+* Fix #311: document how to combine device tree with conditions
+* Fix #312: restart services with respawn set, e.g. ttys, immediately
+* Fix #313: Cancel pending restart timer on stop/start/restart/reload
+* Fix #314: skip run/task/service restart if conditions are lost
+* Fix #315: add environment variables to hook scripts
+
+  All hook scripts are called with at least one environment variable
+  set, `FINIT_HOOK_NAME`, useful when reusing the same hook script for
+  multiple hook points.  It is set to the string name, also used by the
+  path, e.g., `hook/net/up`
+
+  For all hook points from hook/sys/shutdown and later, `FINIT_SHUTDOWN`
+  is also set, to one of: `halt`, `poweroff`, `reboot`
+
+* Fix #317: make sure hook scripts don't run twice, also fixes #316
+* Fix #318: only show `[ OK ] Calling foo` progress for `runparts ...`
+* Fix #320: the API/IPC socket is closed immediately at shutdown/reboot
+  to protect hook scripts or services calling initctl.  There is no way
+  to service these requests safely at that time
+* Fix #333: consider a service dirty if command line args have changed
+
+  This fixes `initctl reload` correctly restarting all daemons that have
+  new command line arguments.
+
+  Previously command line arguments changes were only acted upon if the
+  service was explicitly reloaded `initctl reload myservice`.
+
+  Found and fixed by Jack Newman
+
+* Fix #338: ensure shutdown hooks are called properly; `hook/sys/down`
+  and `hook/svc/down` hook scripts, found and fixed by Jack Newman
+* Fix #339: use absolute path in `/etc/finit.d/enabled/` symlinks, for
+  use-cases when `/etc` is read-only and `/etc/finit.d/enabled ->
+  /mnt/finit.d/enabled`, reported by Jack Newman
+* Fix #340: Finit ignores deleted/moved `.conf` file sin `/etc/finit.d`
+* Fix #342: in runlevel S (bootstrap), not all `initctl` commands can be
+  supported, block the following: runlevel, reload, start/stop, restart,
+  reload, halt, poweroff, suspend.  Also, prevent `SIGHUP` and `SIGUSR1`
+  signals when in shutdown or reboot
+* Fix #352: separate runlevel S from runlevel 0
+* Fix #355: regression in v3.2 stopping a process and its group
+
+  In Finit v3.2 a regression was introduced that affects the way Finit
+  stops a supervised process and its process group.
+
+  Instead of sending SIGTERM to the process, and thus delegating the
+  responsibility to that process to inform any children it may have, as
+  of commit 91a9c83 Finit sends SIGTERM to the entire process group.
+  For SIGKILL this is fine, SIGKILL only runs as cleanup and as a last
+  ditch effort if the process doesn't respond to SIGTERM.
+
+  This regression, introduced in v3.2, directly affects services like
+  `avahi-autoipd` that have forked off children that it needs to tell to
+  exit cleanly before it returns.  With the patch in question these
+  children are never allowed to complete, which in turn causes lingering
+  169.254 link-local addresses on interfaces.
+
+* Fix bootmisc plugin: octal permission on `/run/lock` and `/var/lock`
+
+* Ensure `initctl cond get` support the flux state (exit code 255)
+* Fix potential socket leak at bootstrap and shutdown
+* Fix potential NULL pointer deref in kernel command line parser
+* Fix lingering condition in service after reload of service with new
+  config that has no condition
+* Fix wrong path to command in service after reload, may have changed
+* `logit`: fall back to package name if `$LOGNAME` and `$USER` are
+  unset.  **Note:** you should probably not use `logit` in your own
+  scripts, it is only meant for internal use by Finit.  We recommend
+  using `logger` from the `bsdutils` or `sysklogd` packages instead
+* Fix issue where `env:`/`pre:`/`post:`/etc. is removed from a service
+
+  The trick is when reloading a service like this:
+
+        service env:/etc/env    serv -np -e foo:bar
+
+  into this:
+
+        service pre:/bin/pre.sh serv -np
+
+  In the second the `env:` has been removed and `pre:` added.  Prior to
+  this patch, `env:` was kept leading to unintended behavior.
+* Fix parse/diff of command line args, e.g., `nginx -g 'daemon off;'`
+
+  Starting a service like this works fine:
+
+        service [2345789] env:-/etc/default/nginx nginx -g 'daemon off;'
+
+  However, on `initctl reload` (and no change to .conf files) the arg
+  list was lost while parsing the .conf files.  Leading to a false
+  positive 'diff' in args causing nginx to be unnecessarily restarted.
+* Fix issue with disabled "linewrap" on the console TTY after login.
+  The root cause is `qemu-system-x86_64 -nographics` disabling it when
+  starting up.  The correct `\e[?7h` escape code is now used.
+
+
+[4.3][] - 2022-05-15
 --------------------

 Critical bug fix release.  If you run a 32-bit target with GLIBC 2.34
@@ -63,6 +763,14 @@ you *need* to upgrade!
 * Document secret service option `respawn`, which bypasses the crash
  semantics, allowing endless restarts
 * Document secret `HOOK_BANNER`, the first hook point before the banner
+* Document slightly confusing `initctl reload foo` command.  It does
+  *not* reload the service's `.conf` file!  Issue #263
+* Log changes; all instances where previously the `basename cmd` of a
+  service was used to identify the service, now the proper `name:id` is
+  used instead.  Meaning, a service without a custom `:ID` or `name:`
+  will display the same as before, but with any of those customizations
+  the name and name:id will now be shown.  **Note:** this may affect any
+  log scrapers out there!
 * New plugin: `hook-scripts`, allows [run-parts(8)][] style scripts to
  run on any hook point.  Contributed by Tobias Waldekranz
 * `initctl` (`reboot`) falls back to `-f` when it detects it is in
@@ -75,6 +783,12 @@ you *need* to upgrade!
  in lexicographic order and UNIX backup files (`foo.conf~`) are skipped
 * The `name:id` tuple is now more consistently used in all log and debug
  messages instead of the basename of the command
+* Simplify error output of `initctl start/stop/restart/signal`, no more
+  extra usage help, just a plain error message
+* Exit codes of `initctl` have changed to use LSB script standard and BSD
+  sysexits.h exit codes.  As before, a non-zero exit is error or missing
+* Add support for `initctl -q` to more commands: stop, start, restart,
+  reload, signal, etc.

 [run-parts(8)]: https://manpages.debian.org/cgi-bin/man.cgi?query=run-parts

@@ -93,7 +807,7 @@ you *need* to upgrade!
 * Fix #233: initctl shows wrong status for run/task, by Sergio Morlans
  and Ming Liu, Atlas Copco
 * Fix #248: source `env:file` also in `pre:` and `post` scripts
-* Fix #260: drop limit on device name in `Checking filesystem`...` output
+* Fix #260: drop limit on device name in `Checking filesystem...` output
 * Fix start/stop and monitoring (restart) of SysV init scripts and
  forking services, see the updated documentation for details
 * Fix call to `swapoff` at shutdown, does not support `-e` flag
@@ -307,7 +1021,7 @@ make sure to read the whole change log when upgrading.
  previously hard-coded in Finit, e.g., starting the bundled watchdogd,
  various distro packed udevd and other hotplugging tools
 * A proper rescue mode has been added.  It is started extremely early
-  and is protected with a bundled `suslogin`.  Exiting rescue mode now
+  and is protected with a bundled `sulogin`.  Exiting rescue mode now
  brings up the system as a normal boot, as one expects
 * Support for `sysv` start/stop scripts as well as monitoring forking
  services, stared using `sysv` or `service` stanza
@@ -1138,38 +1852,48 @@ Major bug fix release.

 * Initial release

-[UNRELEASED]: https://github.com/troglobit/finit/compare/4.2...HEAD
-[4.3]: https://github.com/troglobit/finit/compare/4.2...4.3
-[4.2]: https://github.com/troglobit/finit/compare/4.1...4.2
-[4.1]: https://github.com/troglobit/finit/compare/4.0...4.1
-[4.0]: https://github.com/troglobit/finit/compare/3.1...4.0
-[3.1]: https://github.com/troglobit/finit/compare/3.0...3.1
-[3.0]: https://github.com/troglobit/finit/compare/2.4...3.0
-[2.4]: https://github.com/troglobit/finit/compare/2.3...2.4
-[2.3]: https://github.com/troglobit/finit/compare/2.2...2.3
-[2.2]: https://github.com/troglobit/finit/compare/2.1...2.2
-[2.1]: https://github.com/troglobit/finit/compare/2.0...2.1
-[2.0]: https://github.com/troglobit/finit/compare/1.12...2.0
+[UNRELEASED]: https://github.com/troglobit/finit/compare/4.12...HEAD
+[4.13]: https://github.com/troglobit/finit/compare/4.12...4.13
+[4.12]: https://github.com/troglobit/finit/compare/4.11...4.12
+[4.11]: https://github.com/troglobit/finit/compare/4.10...4.11
+[4.10]: https://github.com/troglobit/finit/compare/4.9...4.10
+[4.9]:  https://github.com/troglobit/finit/compare/4.8...4.9
+[4.8]:  https://github.com/troglobit/finit/compare/4.7...4.8
+[4.7]:  https://github.com/troglobit/finit/compare/4.6...4.7
+[4.6]:  https://github.com/troglobit/finit/compare/4.5...4.6
+[4.5]:  https://github.com/troglobit/finit/compare/4.4...4.5
+[4.4]:  https://github.com/troglobit/finit/compare/4.3...4.4
+[4.3]:  https://github.com/troglobit/finit/compare/4.2...4.3
+[4.2]:  https://github.com/troglobit/finit/compare/4.1...4.2
+[4.1]:  https://github.com/troglobit/finit/compare/4.0...4.1
+[4.0]:  https://github.com/troglobit/finit/compare/3.1...4.0
+[3.1]:  https://github.com/troglobit/finit/compare/3.0...3.1
+[3.0]:  https://github.com/troglobit/finit/compare/2.4...3.0
+[2.4]:  https://github.com/troglobit/finit/compare/2.3...2.4
+[2.3]:  https://github.com/troglobit/finit/compare/2.2...2.3
+[2.2]:  https://github.com/troglobit/finit/compare/2.1...2.2
+[2.1]:  https://github.com/troglobit/finit/compare/2.0...2.1
+[2.0]:  https://github.com/troglobit/finit/compare/1.12...2.0
 [1.12]: https://github.com/troglobit/finit/compare/1.11...1.12
 [1.11]: https://github.com/troglobit/finit/compare/1.10...1.11
 [1.10]: https://github.com/troglobit/finit/compare/1.9...1.10
-[1.9]: https://github.com/troglobit/finit/compare/1.8...1.9
-[1.8]: https://github.com/troglobit/finit/compare/1.7...1.8
-[1.7]: https://github.com/troglobit/finit/compare/1.6...1.7
-[1.6]: https://github.com/troglobit/finit/compare/1.5...1.6
-[1.5]: https://github.com/troglobit/finit/compare/1.4...1.5
-[1.4]: https://github.com/troglobit/finit/compare/1.3...1.4
-[1.3]: https://github.com/troglobit/finit/compare/1.2...1.3
-[1.2]: https://github.com/troglobit/finit/compare/1.1...1.2
-[1.1]: https://github.com/troglobit/finit/compare/1.0...1.1
-[1.0]: https://github.com/troglobit/finit/compare/0.9...1.0
-[0.9]: https://github.com/troglobit/finit/compare/0.8...0.9
-[0.8]: https://github.com/troglobit/finit/compare/0.7...0.8
-[0.7]: https://github.com/troglobit/finit/compare/0.6...0.7
-[0.6]: https://github.com/troglobit/finit/compare/0.5...0.6
-[0.5]: https://github.com/troglobit/finit/compare/0.4...0.5
-[0.4]: https://github.com/troglobit/finit/compare/0.3...0.4
-[0.3]: https://github.com/troglobit/finit/compare/0.2...0.3
-[0.2]: https://github.com/troglobit/finit/compare/0.1...0.2
+[1.9]:  https://github.com/troglobit/finit/compare/1.8...1.9
+[1.8]:  https://github.com/troglobit/finit/compare/1.7...1.8
+[1.7]:  https://github.com/troglobit/finit/compare/1.6...1.7
+[1.6]:  https://github.com/troglobit/finit/compare/1.5...1.6
+[1.5]:  https://github.com/troglobit/finit/compare/1.4...1.5
+[1.4]:  https://github.com/troglobit/finit/compare/1.3...1.4
+[1.3]:  https://github.com/troglobit/finit/compare/1.2...1.3
+[1.2]:  https://github.com/troglobit/finit/compare/1.1...1.2
+[1.1]:  https://github.com/troglobit/finit/compare/1.0...1.1
+[1.0]:  https://github.com/troglobit/finit/compare/0.9...1.0
+[0.9]:  https://github.com/troglobit/finit/compare/0.8...0.9
+[0.8]:  https://github.com/troglobit/finit/compare/0.7...0.8
+[0.7]:  https://github.com/troglobit/finit/compare/0.6...0.7
+[0.6]:  https://github.com/troglobit/finit/compare/0.5...0.6
+[0.5]:  https://github.com/troglobit/finit/compare/0.4...0.5
+[0.4]:  https://github.com/troglobit/finit/compare/0.3...0.4
+[0.3]:  https://github.com/troglobit/finit/compare/0.2...0.3
+[0.2]:  https://github.com/troglobit/finit/compare/0.1...0.2
 [libuEv]: https://github.com/troglobit/libuev
 [dea3ae8]: https://github.com/troglobit/finit/commit/dea3ae8
@@ -1,4 +1,11 @@
-docsdir   := @docdir@/doc
-docs_DATA  = config.md conditions.md distro.md plugins.md	\
-	     service.md signals.md svc-machine.png cmdline.md
-EXTRA_DIST = $(docs_DATA)
+SUBDIRS         = config
+EXTRA_DIST      = AUTHORS ChangeLog.md
+
+docsdir        := @docdir@/doc
+dist_docs_DATA  = build.md cmdline.md commands.md conditions.md 	\
+		  distro.md example.md features.md index.md initctl.md	\
+		  keventd.md plugins.md requirements.md runlevels.md	\
+		  runparts.md service.md signals.md state-machine.md	\
+		  watchdog.md
+dist_docs_DATA += img/logo.png img/svc-machine.png img/svc-machine.svg	\
+		  img/alpine-screenshot2.png
@@ -1 +1 @@
-config.md
+index.md
@@ -1,59 +0,0 @@
-Bootstrap
-=========
-
-0. Get bearings, disable kernel logs, initialize TTY and print banner,
-   unless `HOOK_BANNER` is defined, then call that instead
-1. Prepare emergency shell, if enabled
-2. Set up initial signal handlers
-3. Set up default $PATH early
-4. Mount `/proc` and `/sys`
-5. Check kernel command line for `debug` to figure out log level
-6. Load all `.so` plugins
-7. Call `fsck` on file systems listed in `/etc/fstab`
-8. Populate `/dev` using either udev or mdev, depending on system type
-9. Parse `/etc/finit.conf`
-10. Start built-in watchdog, if enabled and `WDT_DEVNODE` exists.  This
-    means any WDT that requires a kernel module need to be either
-    compiled into the kernel, or insmod'ed in `/etc/finit.conf`
-11. Load all `/etc/finit.d/*.conf` files and set hostname
-12. Remount `/` read-write if `/` is listed in `/etc/fstab` without `ro`
-13. Call 1st level hooks, `HOOK_ROOTFS_UP`
-14. Mount all file systems listed in `/etc/fstab` and swap, if available.
-    On mount error `HOOK_MOUNT_ERROR` is called.  After mount, regardless
-    of error, `HOOK_MOUNT_POST` is called
-15. Enable SysV init signals
-16. Call 2nd level hooks, `HOOK_BASEFS_UP`
-17. Cleanup stale files from `/tmp/*` et al, handled by `bootmisc` plugin
-18. Load kernel params from `/etc/sysctl.d/*.conf`, `/etc/sysctl.conf`
-    et al. (Supports all locations that SysV init does.), handled by
-    `procps` plugin
-19. Start all 'S' runlevel tasks and services
-20. Bring up loopback interface and all `/etc/network/interfaces`, if
-    the `.conf` setting `network <SCRIPT>` is set, it is called instead
-21. Call 3rd level hooks, `HOOK_NETWORK_UP`
-22. If `runparts <DIR>` is set, [run-parts(8)][] is called on `<DIR>`
-23. Switch to the configured runlevel from `/etc/finit.conf`, default 2.
-    At every runlevel change all `*.conf` files in `/etc/finit.d/` are
-    (re)loaded and new services, tasks, and blocking run commands are
-    started.  Provided they are allowed in the new runlevel and all of
-    their conditions, if any, are set.
-24. Call 4th level hooks, `HOOK_SVC_UP`
-25. Call `/etc/rc.local`, if it exists and is an executable shell script
-26. Call 5th level (last) hooks, `HOOK_SYSTEM_UP`
-27. Start all configured TTYs
-
-In (19) and (23) tasks and services defined in `/etc/finit.conf` and
-`/etc/finit.d/*.conf` are started.
-
-Notice the seven hook points that are called at various point in the
-bootstrap process.  This is where plugins can extend the boot in any
-way they please.  There are other hook points available, for more on
-this, see [plugins.md](plugins.md).
-
-For instance, at `HOOK_BASEFS_UP` a plugin could read an XML file from a
-USB stick, convert/copy its contents to the system's `/etc/` directory,
-well before all 'S' runlevel tasks are started.  This could be used with
-system images that are created read-only and all configuration is stored
-on external media.
-
-[run-parts(8)]: http://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
@@ -1,15 +1,5 @@
-Building
-========
-
-* [Introduction](#introduction)
-* [Configure](#configure)
-* [Example](#example)
-* [Running](#running)
-* [Debugging](#debugging)
-
-
-Introduction
------------
+Building Finit
+==============

 Finit comes with a traditional configure script to control features and
 optional plugins to enable.  It depends on two external libraries:
@@ -17,14 +7,15 @@ optional plugins to enable.  It depends on two external libraries:
 - [libuEv][], the event loop
 - [libite][] (-lite), much needed frog DNA

-**NOTE:** Most free/open source software that uses `configure` default
-  to install to `/usr/local`.  However, some Linux distributions do no
-  longer search that path for installed software, e.g. Fedora and Alpine
-  Linux.  To get finit's configure script to find its dependencies you
-  have to help the `pkg-config` tool a bit if you do not change the
-  default prefix path:
-
-    PKG_CONFIG_LIBDIR=/usr/local/lib/pkgconfig ./configure
+> [!IMPORTANT]
+> Most free/open source software packages that use `configure` default
+> to install to `/usr/local`.  However, some Linux distributions do no
+> longer search that path for installed software, e.g. Fedora and Alpine
+> Linux.  To get finit's configure script to find its dependencies you
+> have to help the `pkg-config` tool a bit if you do not change the
+> default prefix path:
+>
+>     PKG_CONFIG_LIBDIR=/usr/local/lib/pkgconfig ./configure

 The configure script checks for all dependencies, including the correct
 version of the above mentioned libraries.  Currently required versions:
@@ -65,18 +56,19 @@ Below are a few of the main switches to configure:

 * `--enable-x11-common-plugin`: Enable the optional X Window `x11-common.so` plugin.

-* `--with-sulgin`: Enable bundled `sulogin` program.  Default is to use the
+* `--with-sulogin`: Enable bundled `sulogin` program.  Default is to use the
  system `sulogin(8)`.  The sulogin shipped with Finit *allows password-less*
  login if the `root` user is disabled or has no password at all.

 For more configure flags, see <kbd>./configure --help</kbd>

-> **Note:** the configure script is not available in the GIT sources.  It is
->           however included in (officially supported) released tarballs.  The
->           idea is that you should not need GNU autotools to build, only the
->           above mentioned dependencies, a POSIX shell, a C compiler and make.
->           Any contributing to Finit can generate it from `configure.ac` using
->           the `autogen.sh` script.
+> [!NOTE]
+> The configure script is not available in the GIT sources.  It is
+> however included in (officially supported) released tarballs.  The
+> idea is that you should not need GNU autotools to build, only the
+> above mentioned dependencies, a POSIX shell, a C compiler and make.
+> Any contributing to Finit can generate it from `configure.ac` using
+> the `autogen.sh` script.


 Example
@@ -115,10 +107,11 @@ Linux config to:

    CONFIG_UEVENT_HELPER_PATH="/sbin/mdev"

-**Note:** If you run into problems starting Finit, take a look at
-  `finit.c`.  One of the most common problems is a custom Linux kernel
-  build that lack `CONFIG_DEVTMPFS`.  Another is too much cruft in the
-  system `/etc/fstab`.
+> [!TIP]
+> If you run into problems starting Finit, take a look at `finit.c`.
+> One of the most common problems is a custom Linux kernel build that
+> lack `CONFIG_DEVTMPFS`.  Another is too much cruft in the system
+> `/etc/fstab`.


 Running
@@ -157,8 +150,10 @@ enabled.  The default Finit rescue mode configuration is installed into

 By default the a root shell, without login, is started.

-> **Note:** in this mode `initctl` will not work.  Use the `-f` flag to
-> force `reboot`, `shutdown`, or `poweroff`.
+> [!IMPORTANT]
+> In rescue mode `initctl` will not work, the same goes for `reboot`,
+> `shutdown`, and `poweroff` commands, provided they are the Finit
+> versions of these commands.  Use the `-f` flag to force the action.


 Debugging
@@ -187,8 +182,9 @@ kernel usually reboots: `configure --enable-emergency-shell`.  However,
 the behavior of Finit is severely limited when this is enabled, so use
 it only for debugging start up issues when Finit crashes.

-**NOTE:** Neither of these options should be enabled on production
-         systems since they can potentially give a user root access.
+> [!CAUTION]
+> None of these options should be enabled on production systems since
+> they can potentially give a user root access.


 [1]:       ftp://troglobit.com/finit/finit-4.3.tar.gz
@@ -4,14 +4,46 @@ Tips & Tricks with the kernel cmdline
 This document summarizes the different boot parameters that can be
 passed on the Linux kernel command line.  Not limited to Finit.

-The `bool` setting is one of `on, off, true false, 1, 0`.
+> [!IMPORTANT]
+> Remember to use `--` to separate kernel parameters from parameters to
+> init.  E.g., `init=/sbin/finit -- finit.debug rescue`

-> **NOTE:** remember to use `--` to separate kernel parameters from
-> parameters to init.  E.g., `init=/sbin/finit -- finit.debug rescue`
+The `bool` setting is one of `on, off, true false, 1, 0`.

 * `debug`: Enable kernel debug.  Debug messages are printed to the
   console until Finit starts up, unless `loglevel=7` (below) is used.

+* `fsck.mode=<auto,force,skip>`, default: `auto`, unless built with
+  `configure --enable-fastboot`, in which case the default is `skip`
+
+* `fsck.repair=<preen,yes,no>`, default: `preen`, unless built with
+  `configure --enable-fsckfix`, in which case the default is `yes`.
+  This configure option also sets `fsck.mode=force`, unless fastboot
+  is selected at the same time.  I.e., the `--enable-fastboot` build
+  option overrides the `fsck.mode` default value.
+
+* `finit.cond=foo[,bar[,baz]]`: set `<boot/foo>` condition, optionally
+  multiple conditions can be set using the same option, separated with a
+  comma.  Alternatively, multiple `foo.cond=arg` can be given.  Each will
+  result in a `<boot/arg>` condition being set to control the rest of the
+  system bootstrap.
+
+  Very useful for selecting different boot modes, e.g. manufacturing test,
+  firmware upgrade, or [rescue mode][rescue].
+
+> [!NOTE]
+> `<boot/...>` conditions cannot be cleared with `initctl`!
+
+* `finit.config=/path/to/alternative/finit.conf`: override the
+  compile-time bootstrap config file, default:
+
+        ./configure --with-config=/etc/finit.conf
+
+   Useful when starting up in various [rescue mode][rescue], factory, or
+   production test setups.  Use the top-level configuration file
+   directive `rcsd /path/to/finit.d` to override the default rcS.d
+   directory.
+
 * `finit.debug[=bool]`: Enable finit debug.  This is operated
 	independently of the kernel `debug` setting.  New as of Finit v4.

@@ -43,7 +75,7 @@ The `bool` setting is one of `on, off, true false, 1, 0`.
 * `init=/bin/sh`: Bypass system default init and tell kernel to start a
 	shell.  Note, this shell is very limited and does not support
 	signals and has no job control.  Recommend using, and modifying,
-	`rescue` mode instead.
+	[`rescue` mode][rescue] instead.

 * `loglevel=<0-7>`, sets the kernel's log level, which is more granular
  than `debug`.  Also, when `loglevel=7`, Finit will *not disable*
@@ -58,20 +90,22 @@ The `bool` setting is one of `on, off, true false, 1, 0`.
 * `quiet`: Suppress kernel logging to console, except for warnings and
  errors.  Also, see `loglevel` and `quiet` above.

-* `rescue`: Start rescue/maintenance mode.  If your system comes with
-    the bundled `sulogin` program (Finit, or from util-linux/Busybox),
-    you will be given a root login to a maintenance shell.  However, if
-    `sulogin` is missing, the file `/lib/finit/rescue.conf` is read and
-    the system booted in a limited fallback mode.  See [config.md][]
-    for more information.
+* `rescue`: Start [rescue/maintenance mode][rescue].  If your system
+    comes with the bundled `sulogin` program (Finit, or from util-linux,
+    or Busybox), you will be given a root login to a maintenance shell.
+    However, if `sulogin` is missing, the file `/lib/finit/rescue.conf`
+    is read and the system booted in a limited fallback mode.
+
+    This option can be disabled with `configure --without-rescue`

    **Note:** in this mode `initctl` will not work.  Correct the problem
    and use `reboot -f` to force reboot.

-* `single`, or `S`: Single user mode, runlevel 1, in Finit.  Useful to
-    debug problems with the regular runlevel.  All services and TTYs in
-    `[1]` will be started, so a `tty [1] @console nologin` configuration
-    presents you with a root console without login.
+* `single`, or `S`: Overrides the configured runlevel (default: 2) to go
+    to after bootstrap by forcing it to runlevel 1, this is also known
+    as single user mode.  Useful to debug startup problems.  All services
+    and TTYs in `[1]` will be started, so a `tty [1] @console nologin`
+    configuration presents you with a root console without login.

 * `1-9`, except `6`: override the configured `runlevel`.  Like the `S`
   and `rescue`, giving a single number on the kernel command line tells
@@ -81,5 +115,5 @@ The `bool` setting is one of `on, off, true false, 1, 0`.

 For more on kernel boot parameters, see the man page [bootparam(7)][].

-[config.md]:    config.md#rescue-mode
+[rescue]:       config/rescue.md
 [bootparam(7)]: https://www.man7.org/linux/man-pages/man7/bootparam.7.html
@@ -0,0 +1,13 @@
+Rebooting & Halting
+===================
+
+Traditionally, rebooting and halting a UNIX system is done by switching
+to the corresponding runlevel (0 or 6).  Over time this has changed and
+Finit comes with its own tooling providing: `shutdown`, `reboot`,
+`poweroff`, and `suspend`.  These commands are also available from the
+[`initctl`](initctl.md) tool.
+
+For compatibility reasons Finit listens to the same set of signals as
+BusyBox init.  This is not 100% compatible with SysV init, but clearly
+the more common combination for Finit.  For more details, see the
+[Signal](signals.md) section.
@@ -1,21 +1,8 @@
-Finit Conditions
-================
+Conditions
+==========

-![The service state machine](svc-machine.png "The service state machine")
-
-* [Introduction](#introduction)
-* [Triggering](#triggering)
-* [Built-in Conditions](#built-in--conditions)
-* [Debugging](#debugging)
-* [Internals](#internals)
-
-
-Introduction
------------
-
-Conditions are a new addition to Finit, introduced in v3, with the
-intention of providing a mechanism for common synchronization problems.
-For example:
+Conditions were added to Finit in v3 with the intention of providing a
+mechanism for common synchronization problems.  For example:

 - *"wait for service A to start before starting service B"*, or
 - *"wait for basic network access to be available"*
@@ -27,6 +14,16 @@ specified separated by comma.  Multiple conditions are logically AND'ed
 during evaluation, i.e. all conditions must be satisfied in order for a
 service to run.

+A special syntax, using a leading `!` in run/task/service conditions,
+denote if a:
+
+ - service does not support `SIGHUP`
+ - run/task should not block runlevel changes (i.e., bootstrap)
+
+Finit guarantees by default that all run/tasks run (at least) once
+per runlevel.  For most tasks this is a good default, for example
+checking SSH host keys or loading keymap.  However, for conditions
+that are unlikely to happen it is not. (See example below.)

 ### Example

@@ -35,22 +32,41 @@ service to run.
 In this example the Network monitor daemon `netd` is not started until
 both the `pid/setupd` *and* `pid/zebra` conditions are satisfied.  A
 `pid/` condition is satisfied by the corresponding service's PID file
-being created.
+being created, i.e., the service's default readiness notification.

-**NOTE:** Conditions also stop services when a condition is no longer
-  asserted.  I.e., if the Zebra process above stops or restarts, netd
-  will also stop or restart.
+> [!IMPORTANT]
+> Conditions also stop services when a condition is no longer asserted.
+> I.e., if the `zebra` process above stops or restarts, `netd` will also
+> stop or restart.
+
+Another example is `dropbear`, it does not support `SIGHUP`, but we can
+also see optional sourcing of arguments from an environment file:
+
+    service [2345789] <!> env:-/etc/default/dropbear dropbear -F -R $DROPBEAR_ARGS -- Dropbear SSH daemon
+
+Finally, the weird "block runlevel changes" example.  Here we see what
+happens when Finit receives `SIGPWR`, sent from a power daemon like
+[powstatd(8)][].  A condition is asserted and a user can set up their
+own task to act on it.  We do not want this task to block Finit from
+moving to the next runlevel after bootstrap, so we set `<!>`:
+
+    task [S0123456789] <!sys/pwr/fail> name:pwrfail initctl poweroff -- Power failure, shutting down


 Triggering
 ----------

 Conditions are mainly triggered (asserted) by built-in plugins, e.g.,
-`netlink.so` and `pidfile.so`, see below for built-in conditions.  Finit
-also supports user-defined conditions, sometimes referred to as static
-or one-shot conditions.  They live in the `<usr/...` namespace and are
-constrained to a flat hierarchy without any sub-directories, unlike the
-pidfile plugin, for instance.
+
+  - `netlink.so`: provides `<net/...>`
+  - `pidfile.so`: provides `<pid/...>`
+  - Cmdline `finit.cond=arg`: provides `<boot/arg>`
+
+See below for built-in conditions.  Finit also supports user-defined
+conditions, sometimes referred to as static or one-shot conditions.
+They live in the `<usr/...>` namespace and are constrained to a flat
+hierarchy without any sub-directories, unlike the pidfile plugin, for
+instance.

 User-defined conditions are controlled using the `initctl cond set` and
 `initctl cond clear` commands:
@@ -60,7 +76,8 @@ User-defined conditions are controlled using the `initctl cond set` and

 The purpose of user-defined conditions is to be able to start or stop
 services, or run/task jobs, on external site-dependent stimuli.
-Example:
+
+**Example:**

    service [2345] <usr/foo> alarm --arg foo -- Foo alarm

@@ -78,24 +95,49 @@ on this, see [Internals](#internals).)  Thus, after a reconfiguration it
 is up to the "owner" of the condition to convey the new (or possibly
 unchanged) state of it.

-> **Note:** For `pid/` conditions it is expected that services "touch"
->           or recreate their PID file on `SIGHUP`.
-
 Static (one-shot) conditions, like `usr/`, never enter the `flux` state.

+> [!IMPORTANT]
+> For `pid/` conditions it is expected that the service reassert, i.e.,
+> "touch" or recreate, their PID file on `SIGHUP`.  This can be done by
+> calling `utimensat()` on the PID file.  Provided, of course, that the
+> service supports reloading on `SIGHUP`, otherwise it will be restarted
+> by Finit when they instead exit on the signal.  For such services, use
+> `<!>` to tell Finit the service does not support `SIGHUP`.
+

 Built-in Conditions
 -------------------

-Finit comes with a set of plugins for conditions: `pidfile`, `netlink`,
-`sys`, and `usr`.  The `pidfile` plugin (recursively) watches `/run/`
-(recursively) for PID files created by the monitored services, and sets
-a corresponding condition in the `pid/` namespace.  Similarly, the
-`netlink` plugin provides basic conditions for when an interface is
-brought up/down and when a default route (gateway) is set, in the `net/`
-namespace.  The `sys` and `usr` plugins monitor are passive condition
-monitors where the action is provided by `keventd`, signal handlers,
-and in the case of `usr`, the end-user via the `initctl` tool
+Finit comes with a set of plugins for conditions:
+
+ - `devmon` (built-in)
+ - `netlink`
+ - `pidfile`
+ - `sys`
+ - `usr`
+
+The `devmon` (built-in) plugin monitors `/dev` and `/dev/dir` for device
+nodes being created and removed.  It is active only when a run, task, or
+service has declared a `<dev/foo>` or `<dev/dir/bar>` condition.
+
+The `pidfile` plugin (recursively) watches `/run/` (recursively) for PID
+files created by the monitored services, and sets a corresponding
+condition in the `pid/` namespace.
+
+Similarly, the `netlink` plugin provides basic conditions for when an
+interface is brought up/down and when a default route (gateway) is set,
+in the `net/` namespace.
+
+The `sys` and `usr` plugins monitor are passive condition monitors where
+the action is provided by `keventd`, signal handlers, and in the case of
+`usr`, the end-user via the `initctl` tool.
+
+Additionally, the various states of a run/task/sysv/service can also be
+used as conditions, the image above shows the state names.  The syntax
+for a `service` type process: `<service/foo/STATE>`.  The other types,
+in particular run/task/sysv, there are the additional states `success`
+and `failure`.

 With the example listed above, finit does not start the `/sbin/netd`
 daemon until `setupd` and `zebra` has started *and* created their PID
@@ -114,14 +156,19 @@ Built-in conditions:
 - `net/<IFNAME>/exist`
 - `net/<IFNAME>/up`
 - `net/<IFNAME>/running`
+- `service/<NAME[:ID]>/<STATE>`
+- `{run, task, sysv}/<NAME[:ID]>/{<STATE>, success, failure}`
 - `sys/pwr/ac`
 - `sys/pwr/fail`
 - `sys/key/ctrlaltdel`
 - `usr/foo`
+- `boot/arg`
+- `dev/node` and `dev/dir/node`

-**Note:** `up` means administratively up, the interface flag `IFF_UP`.
-  `running` is the `IFF_RUNNING` flag, meaning operatively up.  The
-  difference is that `running` tells if the NIC has link.
+> [!NOTE]
+> Here, `up` means administratively up, the interface flag `IFF_UP`.
+> `running` is the `IFF_RUNNING` flag, meaning operatively up.  The
+> difference is that `running` tells if the NIC has link.


 Composition
@@ -153,8 +200,9 @@ the service stanza for the daemon.  It is far from optimal since any
 synchronization of depending services may fail due to the daemon not
 having reinitialized/created their IPC sockets, or similar.

-> **Note:** in versions of Finit prior to v4, the PID conditions were
->           called 'svc' conditions, and they were far more complex.
+> [!NOTE]
+> In versions of Finit prior to v4, the PID conditions were called 'svc'
+> conditions, and they were far more complex.


 Debugging
@@ -163,7 +211,7 @@ Debugging
 If a service is not being started as it should, the problem might be
 that one of its conditions is not in the expected state.  Use the
 command `initctl status` to inspect service status.  Services in the
-`ready` state are pending a condition.
+`waiting` state are pending a condition.

 In that situation, running `initctl cond show` reveals which of the
 conditions that are not satisfied.  Listed as `off` below.
@@ -217,6 +265,8 @@ A condition is always in one of three states:
 All conditions that have not explicitly been set are interpreted as
 being in the `off` state.

+![The service state machine](img/svc-machine.png "The service state machine")
+
 When a reconfiguration is requested, Finit transitions all conditions to
 the `flux` state.  As a result, services that depend on a condition are
 sent `SIGSTOP`.  Once the new state of the condition is asserted, the
@@ -231,3 +281,5 @@ Therefore, any plugin that supplies Finit with conditions must ensure
 that their state is updated after each reconfiguration.  This can be
 done by binding to the `HOOK_SVC_RECONF` hook.  For an example of how
 to do this, see `plugins/pidfile.c`.
+
+[powstatd(8)]: https://manpages.ubuntu.com/manpages/trusty/en/man8/powstatd.8.html
@@ -1,796 +0,0 @@
-Configuration
-=============
-
-* [Introduction](#introduction)
-* [Service Environment](#service-environment)
-* [Service Wrapper Scripts](#service-wrapper-scripts)
-* [Cgroups](#cgroups)
-* [Configuration File Syntax](#configuration-file-syntax)
-  * [Hostname](#hostname)
-  * [Kernel Modules](#kernel-modules)
-  * [Networking](#networking)
-  * [Resource Limits](#resource-limits)
-  * [Runlevels](#runlevels)
-  * [One-shot Commands (sequence)](#one-shot-commands--sequence-)
-  * [One-shot Commands (parallel)](#one-shot-commands--parallel-)
-  * [SysV Init Scripts](#sysv-init-scripts)
-  * [Services](#services)
-  * [Run-parts Scripts](#run-parts-scripts)
-  * [Including Finit Configs](#including-finit-configs)
-  * [General Logging](#general-logging)
-  * [TTYs and Consoles](#ttys-and-consoles)
-  * [Non-privileged Services](#non-privileged-services)
-  * [Redirecting Output](#redirecting-output)
-* [Rescue Mode](#rescue-mode)
-* [Limitations](#limitations)
-  * [/etc/finit.conf](#etcfinitconf)
-  * [/etc/finit.d](#etcfinitd)
-* [Watchdog](#watchdog)
-* [keventd](#keventd)
-
-
-Introduction
------------
-
-Finit can be configured using only the original `/etc/finit.conf` file
-or in combination with `/etc/finit.d/*.conf`.  Useful for package-based
-Linux distributions -- each package can provide its own "script" file.
-
- `/etc/finit.conf`: main configuration file
- `/etc/finit.d/*.conf`: snippets, usually one service per file
-
-Not all configuration directives are available in `/etc/finit.d/*.conf`
-and some directives are only available at [bootstrap][], runlevel `S`,
-see the section [Limitations](#limitations) below for details.
-
-To add a new service, drop a `.conf` file in `/etc/finit.d` and run
-`initctl reload`.  (It is also possible to `SIGHUP` to PID 1, or call
-`finit q`, but that has been deprecated with the `initctl` tool).  Finit
-monitors all known active `.conf` files, so if you want to force a
-restart of any service you can touch its corresponding `.conf` file in
-`/etc/finit.d` and call `initctl reload`.  Finit handle any and all
-conditions and dependencies between services automatically.
-
-It is also possible to drop `.conf` files in `/etc/finit.d/available/`
-and use `initctl enable` to enable a service `.conf` file.  This may be
-useful in particular to Linux distributions that may want to install all
-files for a package and let the user decide when to enable a service.
-
-On `initctl reload` the following is checked for all services:
-
- If a service's `.conf` file has been removed, or its conditions are no
-  longer satisfied, the service is stopped.
- If the file is modified, or a service it depends on has been reloaded,
-  the service is reloaded (stopped and started).
- If a new service is added it is automatically started — respecting
-  runlevels and return values from any callbacks.
-
-For more info on the different states of a service, see the separate
-document [Finit Services](service.md).
-
-> When running <kbd>make install</kbd> no default `/etc/finit.conf` is
-> installed since system requirements differ too much.  There are some
-> examples in the `contrib/` directory, which can be used as a base.
-
-
-### Environment Variables
-
-In Finit v4.3 support for setting environment variables in `finit.conf`,
-and any `*.conf`, was added.  It is worth noting that these are global
-and *shared with all* services -- the only way to have service-local
-environment is detailed in the next section.
-
-The syntax for global environment variables is straight forward:
-
-    foo=bar
-    baz="qux"
-
-On reload of .conf files, all tracked environment variables are cleared
-so if `foo=bar` is removed from `finit.conf`, or any `finit.d/*.conf`
-file, it will no longer be used by Finit or any new (!) started
-run/tasks or services.  The environment of already started processes can
-not be changed.
-
-The only variables reset to sane defaults on .conf reload are:
-
-    PATH=_PATH_STDPATH
-    SHELL=_PATH_BSHELL
-    LOGNAME=root
-    USER=root
-
-It is entirely possible to override these as well from the .conf files,
-but be careful.  Changing SHELL changes the behavior of `system()` and a
-lot of other commands as well.
-
-
-Service Environment
-------------------
-
-Finit supports sourcing environment variables from `/etc/default/*`, or
-similar `--with-sysconfig=DIR`.  This is a common pattern from SysV init
-scripts, where the start-stop script is a generic script for the given
-service, `foo`, and the options for the service are sourced from the
-file `/etc/default/foo`.  Like this:
-
-* `/etc/default/foo`:
-
-        FOO_OPTIONS=--extra-arg="bar" -s -x
-
-* `/etc/finit.conf`:
-
-        service [2345] env:-/etc/default/foo foo -n $FOO_OPTIONS -- Example foo daemon
-
-Here the service `foo` is started with `-n`, to make sure it runs in the
-foreground, and the with the options found in the environment file.  With
-the `ps` command we can see that the process is started with:
-
-    foo -n --extra-arg=bar -s -x
-
-> **Note:** the leading `-` determines if Finit should treat a missing
-> environment file as blocking the start of the service or not.  When
-> `-` is used, a missing environment file does *not* block the start.
-
-
-Service Wrapper Scripts
-----------------------
-
-If your service requires to run additional commands, executed before the
-service is actually started, like the systemd `ExecStartPre`, you can
-use a wrapper shell script to start your service.
-
-The Finit service `.conf` file can be put into `/etc/finit.d/available`,
-so you can control the service using `initctl`.  Then use the path to
-the wrapper script in the Finit `.conf` service stanza.  The following
-example employs a wrapper script in `/etc/start.d`.
-
-**Example:**
-
-* `/etc/finit.d/available/program.conf`:
-
-        service [235] <!> /etc/start.d/program -- Example Program
-
-* `/etc/start.d/program:`
-
-        #!/bin/sh
-        # Prepare the command line options
-        OPTIONS="-u $(cat /etc/username)"
-
-        # Execute the program
-        exec /usr/bin/program $OPTIONS
-
-> **Note:** the example sets `<!>` to denote that it doesn't support
->           `SIGHUP`.  That way Finit will stop/start the service
->           instead of sending SIGHUP at restart/reload events.
-
-
-Cgroups
-------
-
-There are three major cgroup configuration directives:
-
- 1. Global top-level group: init, system, user, or a custom group
- 2. Selecting a top-level group for a set of run/task/services
- 3. Per run/task/service limits
-
-Top-level group configuration.
-
-    # Top-level cgroups and their default settings.  All groups mandatory
-    # but more can be added, max 8 groups in total currently.  The cgroup
-    # 'root' is also available, reserved for RT processes.  Settings are
-    # as-is, only one shorthand 'mem.' exists, other than that it's the
-    # cgroup v2 controller default names.
-    cgroup init   cpu.weight:100
-    cgroup user   cpu.weight:100
-    cgroup system cpu.weight:9800
-
-Adding an extra cgroup `maint/` will require you to adjust the weight of
-the above three.  We leave `init/` and `user/` as-is reducing weight of
-`system/` to 9700.
-
-    cgroup system cpu.weight:9700
-
-    # Example extra cgroup 'maint'
-    cgroup maint  cpu.weight:100
-
-By default, the `system/` cgroup is selected for almost everything.  The
-`init/` cgroup is reserved for PID 1 itself and its closest relatives.
-The `user/` cgroup is for local TTY logins spawned by getty.
-
-To select a different top-level cgroup, e.g. `maint/`, one can either
-define it for a group of run/task/service directives in a `.conf` or per
-each stanza:
-
-    cgroup.maint
-    service [...] <...> /path/to/foo args -- description
-    service [...] <...> /path/to/bar args -- description
-
-or
-
-    service [...] <...> cgroup.maint /path/to/foo args -- description
-
-The latter form also allows per-stanza limits on the form:
-
-    service [...] <...> cgroup.maint:cpu.max:10000,mem.max:655360 /path/to/foo args -- description
-
-Notice the comma separation and the `mem.` exception to the rule: every
-cgroup setting maps directly to cgroup v2 syntax.  I.e., `cpu.max` maps
-to the file `/sys/fs/cgroup/maint/foo/cpu.max`.  There is no filtering,
-except for expanding the shorthand `mem.` to `memory.`, if the file is
-not available, either the cgroup controller is not available in your
-Linux kernel, or the name is misspelled.
-
-> Linux cgroups and details surrounding values are not explained in the
-> Finit documentation.  The Linux admin-guide cover this well:
-> <https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html>
-
-
-Configuration File Syntax
-------------------------
-
-### Hostname
-
-**Syntax:** `host <NAME>`, or `hostname <NAME>`
-
-Set system hostname to NAME, unless `/etc/hostname` exists in which case
-the contents of that file is used.
-
-Deprecated.  We recommend using `/etc/hostname` instead.
-
-> **Note:** only read and executed in runlevel S ([bootstrap][]).
-
-
-### Kernel Modules
-
-**Syntax:** `module <MODULE> [ARGS]`
-
-Load a kernel module, with optional arguments.  Similar to `insmod`
-command line tool.
-
-Deprecated, there is both a `modules-load.so` and a `modprobe.so` plugin
-that can handle module loading better.  The former supports loading from
-`/etc/modules-load.d/`, the latter uses kernel modinfo to automatically
-load (or coldplug) every required module.  For hotplug we recommend the
-BusyBox mdev tool, add to `/etc/mdev.conf`:
-
-    $MODALIAS=.*  root:root       0660    @modprobe -b "$MODALIAS"
-
-> **Note:** only read and executed in runlevel S ([bootstrap][]).
-
-
-### Networking
-
-**Syntax:** `network <PATH>`
-
-Script or program to bring up networking, with optional arguments.
-
-Deprecated.  We recommend using dedicated task/run stanzas per runlevel,
-or `/etc/network/interfaces` if you have a system with `ifupdown`, like
-Debian, Ubuntu, Linux Mint, or an embedded BusyBox system.
-
-> **Note:** only read and executed in runlevel S ([bootstrap][]).
-
-
-### Resource Limits
-
-**Syntax:** `rlimit [hard|soft] RESOURCE <LIMIT|unlimited>`
-
-Set the hard or soft limit for a resource, or both if that argument is
-omitted.  `RESOURCE` is the lower-case `RLIMIT_` string constants from
-`setrlimit(2)`, without prefix.  E.g. to set `RLIMIT_CPU`, use `cpu`.
-  
-LIMIT is an integer that depends on the resource being modified, see
-the man page, or the kernel `/proc/PID/limits` file, for details.
-Finit versions before v3.1 used `infinity` for `unlimited`, which is
-still supported, albeit deprecated.
-
-    # No process is allowed more than 8MB of address space
-    rlimit hard as 8388608
-
-    # Core dumps may be arbitrarily large
-    rlimit soft core infinity
-
-    # CPU limit for all services, soft & hard = 10 sec
-    rlimit cpu 10
-
-`rlimit` can be set globally, in `/etc/finit.conf`, or locally per
-each `/etc/finit.d/*.conf` read.  I.e., a set of task/run/service
-stanzas can share the same rlimits if they are in the same .conf.
-
-
-### Runlevels
-
-**Syntax:** `runlevel <N>`
-
-The system runlevel to go to after [bootstrap][] (S) has completed.  `N`
-is the runlevel number 0-9, where 6 is reserved for reboot and 0 for
-halt.
-
-Default: 2
-
-> **Note:** only read and executed in runlevel S ([bootstrap][]).
-
-
-### One-shot Commands (sequence)
-
-**Syntax:** `run [LVLS] <COND> /path/to/cmd ARGS -- Optional description`
-
-One-shot command to run in sequence when entering a runlevel, with
-optional arguments and description.
-  
-`run` commands are guaranteed to be completed before running the next
-command.  Highly useful if true serialization is needed.
-
-> `<COND>` is described in the [Services](#services) section.
-
-
-### One-shot Commands (parallel)
-
-**Syntax:** `task [LVLS] <COND> /path/to/cmd ARGS -- Optional description`
-
-One-shot like 'run', but starts in parallel with the next command.
-  
-Both `run` and `task` commands are run in a shell, so pipes and
-redirects can be freely used:
-
-    task [s] echo "foo" | cat >/tmp/bar
-
-> `<COND>` is described in the [Services](#services) section.
-
-
-### SysV Init Scripts
-
-**Syntax:** `sysv [LVLS] <COND> /path/to/init-script -- Optional description`
-
-Similar to `task` is the `sysv` stanza, which can be used to call SysV
-style scripts.  The primary intention for this command is to be able to
-re-use much of existing setup and init scripts in Linux distributions.
-  
-When entering an allowed runlevel, Finit calls `init-script start`, when
-entering a disallowed runlevel, Finit calls `init-script stop`, and if
-the Finit .conf, where `sysv` stanza is declared, is modified, Finit
-calls `init-script restart` on `initctl reload`.  Similar to how
-`service` stanzas work.
-
-Forking services started with `sysv` scripts can be monitored by Finit
-by declaring the PID file to look for: `pid:!/path/to/pidfile.pid`.
-Notice the leading `!`, it signifies Finit should not try to create the
-file, but rather watch that file for the resulting forked-off PID.  This
-syntax also works for forking daemons that do not have a command line
-option to run it in the foreground, more on this below in `service`.
-
-> `<COND>` is described in the [Services](#services) section.
-
-
-### Services
-
-**Syntax:** `service [LVLS] <COND> /path/to/daemon ARGS -- Optional description`
-
-Service, or daemon, to be monitored and automatically restarted if it
-exits prematurely.  Finit tries to restart services that die, by
-default 10 times before giving up and marking them as *crashed*.
-After which they have to be manually restarted with `initctl restart
-NAME`.  The limits controling this are configurable, see the options
-below.
-
-> **Tip:** to allow endless restarts, see below option `respawn`
-  
-For daemons that support it, we recommend appending `--foreground`,
-`--no-background`, `-n`, `-F`, or similar command line argument to
-prevent them from forking off a sub-process in the background.  This is
-the most reliable way to monitor a service.
-
-However, not all daemons support running in the foreground, or they may
-start logging to the foreground as well, these are forking daemons and
-are supported using the same syntax as forking `sysv` services, using
-the `pid:!/path/to/pidfile.pid` syntax.  There is an alternative syntax
-that may be more intuitive, where Finit can also guess the PID file
-based on the daemon's command name:
-
-    service type:forking ntpd -- NTP daemon
-
-This example lets BusyBox `ntpd` daemonize itself.  Finit uses the
-basename of the binary to guess the PID file to watch for the PID:
-`/var/run/ntpd.pid`.  If Finit guesses wrong, you have to submit the
-full `pid:!/path/to/file.pid`.
-
-  
-**Example:**
-
-In the case of `ospfd` (below), we omit the `-d` flag (daemonize) to
-prevent it from forking to the background:
-
-    service [2345] <pid/zebra> /sbin/ospfd -- OSPF daemon
-
-`[2345]` denote the runlevels `ospfd` is allowed to run in, they are
-optional and default to level 2-5 if omitted.
-  
-`<...>` is the condition for starting `ospfd`.  In this example Finit
-waits for another service, `zebra`, to have created its PID file in
-`/var/run/quagga/zebra.pid` before starting `ospfd`.  Finit watches
-*all* files in `/var/run`, for each file named `*.pid`, or `*/pid`,
-Finit opens it and find the matching `NAME:ID` using the PID.
-
-Some services do not maintain a PID file and rather than patching each
-application Finit provides a workaround.  A `pid` keyword can be set
-to have Finit automatically create (when starting) and later remove
-(when stopping) the PID file.  The file is created in the `/var/run`
-directory using the `basename(1)` of the service.  The default can be
-modified with an optional `pid:`-argument:
-
-    pid[:[/path/to/]filename[.pid]]
-
-For example, by adding `pid:/run/foo.pid` to the service `/sbin/bar`,
-that PID file will, not only be created and removed automatically, but
-also be used by the Finit condition subsystem.  So a service/run/task
-can depend on `<pid/bar>`.
-
->  For a detailed description of conditions, and how to debug them,
->  see the [Finit Conditions](conditions.md) document.
-
-If a service should not be automatically started, it can be configured
-as manual with the optional `manual` argument. The service can then be
-started at any time by running `initctl start <service>`.
-
-    manual:yes
-
-The name of a service, shown by the `initctl` tool, defaults to the
-basename of the service executable. It can be changed with the
-optional `name` argument:
-
-    name:<service-name>
-
-As mentioned previously, services are automatically restarted, this is
-configurable with the following options:
-
-  * `restart:NUM` -- number of times Finit tries to restart a crashing
-    service, default: 10, max: 255.  When this limit is reached the
-    service is marked *crashed* and must be restarted manually with
-    `initctl restart NAME`
-  * `restart_sec:SEC` -- number of seconds before Finit tries to restart
-    a crashing service, default: 2 seconds for the first five retries,
-	then back-off to 5 seconds.  The maximum of this configured value
-	and the above (2 and 5) will be used
-  * `norestart` -- dont restart on failures, same as `restart:0`
-  * `respawn` -- bypasses the `restart` mechanism completely, allows
-    endless restarts.  Useful in many use-cases, but not what `service`
-    was originally designed for so not the default behavior
-  * `oncrash:reboot` -- when all retries have failed, and the service
-    has *crashed*, if this option is set the system is rebooted.
-    Note, future releases may include other `oncrash:` actions
-
-When stopping a service (run/task/sysv/service), either manually or
-when moving to another runlevel, Finit starts by sending `SIGTERM`, to
-allow the process to shut down gracefully.  If the process has not
-been collected within 3 seconds, Finit sends `SIGKILL`.  To halt the
-process using a different signal, use the option `halt:SIGNAL`, e.g.,
-`halt:SIGPWR`.  To change the delay between your halt signal and KILL,
-use the option `kill:SEC`, e.g., `kill:10` to wait 10 seconds before
-sending `SIGKILL`.
-
-Services support `pre:script` and `post:script` actions as well.  These
-run as the same `@USER:GROUP` as the service itself, with any `env:file`
-sourced.  The scripts must use an absolute path, but are executed from
-the `$HOME` of the given user.  The scripts are not called with any
-argument (currently), but both get the `SERVICE_IDENT=foo` environment
-variable set.  Here `foo` denotes the identity of the service, which if
-there are multiple services named `foo`, may be `foo:1`, or any unique
-identifier specified in the .conf file.  The `post:script` is called
-with an additional set of environment variables:
-
- - `EXIT_CODE=[exited,signal]`: set to one of `exited` or `signal`
- - `EXIT_STATUS=[num,SIGNAME]`: set to one of exit status code from
-   the program, if it exited normally, or the signal name (`HUP`,
-   `TERM`, etc.) if it exited due to signal
-
-The scripts have a default execution time of 3 seconds before they are
-SIGKILLed, this can be adjusted using the above `kill:SEC` syntax.
-
-> **Note:** the `pre:script` _must_ be idempotent, because a service
->           can transition between READY and HALTED states any number
->           of times before going to RUNNING.
-
-
-### Run-parts Scripts
-
-**Syntax:** `runparts <DIR>`
-
-Call [run-parts(8)][] on `DIR` to run start scripts.  All executable
-files, or scripts, in the directory are called, in alphabetic order.
-The scripts in this directory are executed at the very end of runlevel
-`S`, [bootstrap][].
-
-It can be beneficial to use `S01name`, `S02othername`, etc. if there
-is a dependency order between the scripts.  Symlinks to existing
-daemons can talso be used, but make sure they daemonize by default.
-
-Similar to the `/etc/rc.local` shell script, make sure that all your
-services and programs either terminate or start in the background or
-you will block Finit.
-
-> **Note:** only read and executed in runlevel S ([bootstrap][]).
-
-[run-parts(8)]: http://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
-
-
-### Including Finit Configs
-
-**Syntax:** `include <CONF>`
-
-Include another configuration file.  Absolute path required.
-
-
-### General Logging
-
-**Syntax:** `log size:200k count:5`
-
-Log rotation for run/task/services using the `log` sub-option with
-redirection to a log file.  Global setting, applies to all services.
-
-The size can be given as bytes, without a specifier, or in `k`, `M`,
-or `G`, e.g. `size:10M`, or `size:3G`.  A value of `size:0` disables
-log rotation.  The default is `200k`.
-
-The count value is recommended to be between 1-5, with a default 5.
-Setting count to 0 means the logfile will be truncated when the MAX
-size limit is reached.
-
-### TTYs and Consoles
-
-**Syntax:** `tty [LVLS] <COND> DEV [BAUD] [noclear] [nowait] [nologin] [TERM]`  
-  `tty [LVLS] <COND> CMD <ARGS> [noclear] [nowait]`  
-  `tty [LVLS] <COND> [notty] [rescue]`
-
-The first variant of this option uses the built-in getty on the given
-TTY device DEV, in the given runlevels.  DEV may be the special keyword
-`@console`, which is expanded from `/sys/class/tty/console/active`,
-useful on embedded systems.
-
-The default baud rate is 0, i.e., keep kernel default.
-
-> The `tty` stanza inherits runlevel, condition (and other feature)
-> parsing from the `service` stanza.  So TTYs can run in one or many
-> runlevels and depend on any condition supported by Finit.  This is
-> useful e.g. to depend on `<pid/elogind>` before starting a TTY.
-
-**Example:**
-
-    tty [12345] /dev/ttyAMA0 115200 noclear vt220
-
-The second `tty` syntax variant is for using an external getty, like
-agetty or the BusyBox getty.
-
-The third variant is for board bringup and the `rescue` boot mode.  No
-device node is required in this variant, the same output that the kernel
-uses is reused for stdio.  If the `rescue` option is omitted, a shell is
-started (`nologin`, `noclear`, and `nowait` are implied), if the rescue
-option is set the bundled `/libexec/finit/sulogin` is started to present
-a bare-bones root login prompt.  If the root (uid:0, gid:0) user does
-not have a password set, no rescue is possible.  For more information,
-see the [Rescue Mode](#rescue-mode) section.
-
-By default, the first two syntax variants *clear* the TTY and *wait* for
-the user to press enter before starting getty.
-
-**Example:**
-
-    tty [12345] /sbin/getty  -L 115200 /dev/ttyAMA0 vt100
-    tty [12345] /sbin/agetty -L ttyAMA0 115200 vt100 nowait
-
-The `noclear` option disables clearing the TTY after each session.
-Clearing the TTY when a user logs out is usually preferable.
-  
-The `nowait` option disables the `press Enter to activate console`
-message before actually starting the getty program.  On small and
-embedded systems running multiple unused getty wastes both memory
-and CPU cycles, so `wait` is the preferred default.
-
-The `nologin` option disables getty and `/bin/login`, and gives the
-user a root (login) shell on the given TTY `<DEV>` immediately.
-Needless to say, this is a rather insecure option, but can be very
-useful for developer builds, during board bringup, or similar.
-
-Notice the ordering, the `TERM` option to the built-in getty must be
-the last argument.
-
-Embedded systems may want to enable automatic `DEV` by supplying the
-special `@console` device.  This works regardless weather the system
-uses `ttyS0`, `ttyAMA0`, `ttyMXC0`, or anything else.  Finit figures
-it out by querying sysfs: `/sys/class/tty/console/active`.  The speed
-can be omitted to keep the kernel default.
-
-> Most systems get by fine by just using `console`, which will evaluate
-> to `/dev/console`.  If you have to use `@console` to get any output,
-> you may have some issue with your kernel config.
-
-**Example:**
-
-    tty [12345] @console noclear vt220
-
-On really bare bones systems, or for board bringup, Finit can give you a
-shell prompt as soon as [bootstrap][] is done, without opening any
-device node:
-
-    tty [12345789] notty
-
-This should of course not be enabled on production systems.  Because it
-may give a user root access without having to log in.  However, for
-board bringup and system debugging it can come in handy.
-
-One can also use the `service` stanza to start a stand-alone shell:
-
-    service [12345] /bin/sh -l
-
-
-### Non-privileged Services
-
-Every `run`, `task`, or `service` can also list the privileges the
-`/path/to/cmd` should be executed with.  Prefix the command with
-`@USR[:GRP]`, group is optional, like this:
-
-    run [2345] @joe:users logger "Hello world"
-
-For multiple instances of the same command, e.g. a DHCP client or
-multiple web servers, add `:ID` somewhere between the `run`, `task`,
-`service` keyword and the command, like this:
-
-    service :80  [2345] httpd -f -h /http -p 80   -- Web server
-    service :8080[2345] httpd -f -h /http -p 8080 -- Old web server
-
-Without the `:ID` to the service the latter will overwrite the former
-and only the old web server would be started and supervised.
-
-
-### Redirecting Output
-
-The `run`, `task`, and `service` stanzas also allow the keyword `log` to
-redirect `stderr` and `stdout` of the application to a file or syslog
-using the native `logit` tool.  This is useful for programs that do not
-support syslog on their own, which is sometimes the case when running
-in the foreground.
-
-The full syntax is:
-
-    log:/path/to/file
-    log:prio:facility.level,tag:ident
-    log:console
-    log:null
-    log
-
-Default `prio` is `daemon.info` and default `tag` is the basename of the
-service or run/task command.
-
-Log rotation is controlled using the global `log` setting.
-
-**Example:**
-
-    service log:prio:user.warn,tag:ntpd /sbin/ntpd pool.ntp.org -- NTP daemon
-
-
-Rescue Mode
-----------
-
-Finit supports a rescue mode which is activated by the `rescue` option
-on the kernel command line.  See [cmdline docs](cmdline.md) for how to
-activate it.
-
-The rescue mode comes in two flavors; *traditional* and *fallback*.
-
-> **Note:** in this mode `initctl` will not work.  Use the `-f` flag to
-> force `reboot`, `shutdown`, or `poweroff`.
-
-
-### Traditional
-
-This is what most users expect.  A very early maintenance login prompt,
-served by the bundled `/libexec/finit/sulogin` program, or the standard
-`sulogin` from util-linux or BusyBox is searched for in the UNIX default
-`$PATH`.  If a successful login is made, or the user exits (Ctrl-D), the
-rescue mode is ended and the system boots up normally.
-
-> **Note:** if the user (UID 0 and GID 0) does not have a password, or
-> __the account is locked__, the user is presented with a password-less
-> `"Press enter to enter maintenance mode."`, prompt which opens up a
-> root shell.
-
-
-### Fallback
-
-If no `sulogin` program is found, Finit tries to bring up as much of its
-own functionality as possible, yet limiting many aspects, meaning; no
-network, no `fsck` of file systems in `/etc/fstab`, no `/etc/rc.local`,
-no `runparts`, and most plugins are skipped (except those that provide
-functionality for the condition subsystem).
-
-Instead of reading `/etc/finit.conf` et al, system configuration is read
-from `/lib/finit/rescue.conf`, which can be freely modified by the
-system administrator.
-
-The bundled default `rescue.conf` contains nothing more than:
-
-    runlevel 1
-    tty [12345] rescue
-
-The `tty` has the `rescue` option set, which works similar to the board
-bring-up tty option `notty`.  The major difference being that `sulogin`
-is started to query for root/admin password.  If `sulogin` is not found,
-`rescue` behaves like `notty` and gives a plain root shell prompt.
-
-If Finit cannot find `/lib/finit/rescue.conf` it defaults to:
-
-    tty [12345] rescue
-
-There is no way to exit the *fallback* rescue mode.
-
-
-Limitations
-----------
-
-As of Finit v4 there are no limitations to where `.conf` settings can be
-placed.  Except for the system/global `rlimit` and `cgroup` top-level
-group declarations, which can only be set from `/etc/finit.conf`, since
-it is the first `.conf` file Finit reads.
-
-Originally, `/etc/finit.conf` was the only way to set up a Finit system.
-Today it is mainly used for bootstrap settings like system hostname,
-early module loading for watchdogd, network bringup and system shutdown.
-These can now also be set in any `.conf` file in `/etc/finit.d`.
-
-There is, however, nothing preventing you from having all configuration
-settings in `/etc/finit.conf`.
-
-> **Note:** The `/etc/finit.d` directory was previously the default
->          Finit [runparts](#run-parts-scripts) directory.  Finit no
->          longer has a default `runparts`, make sure to update your
->          setup, or the finit configuration, accordingly.
-
-
-Watchdog
--------
-
-When built `--with-watchdog` a separate service is built and installed
-in `/libexec/finit/watchdogd`.  If this exists at runtime, and the WDT
-device node exists, Finit will start it and treat it as the elected
-watchdog service to delegate its reboot to.  See [bootstrap][] for
-details.  This delegation is to ensure that the system is rebooted by a
-hardware watchdog timer -- on many embedded systems this is crucial to
-ensure all circuits on the board are properly reset for the next boot,
-in effect ensuring the system works the same after both a power-on and
-reboot event.
-
-The delegation is performed at the very last steps of system shutdown,
-if reboot has been selected and an elected watchdog is known, first a
-`SIGPWR` is sent to advise watchdogd of the pending reboot.  Then, when
-the necessary steps of preparing the system for shutdown (umount etc.)
-are completed, Finit sends `SIGTERM` to watchdogd and puts itself in a
-10 sec timeout loop waiting for the WDT to reset the board.  If a reset
-is not done before the timeout, Finit falls back to`reboot(RB_AUTOBOOT)`
-which tells the kernel to do the reboot.
-
-An external watchdog service can also be used.  The more advanced cousin
-[watchdogd](https://github.com/troglobit/watchdogd/) is the recommended
-option here.  It can register itself with Finit using the same IPC as
-`initctl`.  If the bundled watchdogd is running a hand-over takes place,
-so it's safe to have both services installed on a system.  For the
-hand-over to work it requires that the WDT driver supports the safe exit
-functionality where `"V"` is written to the device before closing the
-device descriptor.  If the kernel driver has been built without this,
-the only option is to remove `/libexec/finit/watchdogd` or build without
-it at configure time.
-
-[bootstrap]: bootstrap.md
-
-
-keventd
-------
-
-The kernel event daemon bundled with Finit is a simple uevent monitor
-for `/sys/class/power_supply`.  It provides the `sys/pwr/ac` condition,
-which can be useful to prevent power hungry services like anacron to run
-when a laptop is only running on battery, for instance.
-
-Since keventd is not an integral part of Finit yet it is not enabled by
-default.  Enable it using `./configuure --with-keventd`.  The bundled
-contrib build scripts for Debian, Alpine, and Void have this enabled.
-
-This daemon is planned to be extended with monitoring of other uevents,
-patches and ideas are welcome in the issue tracker.
@@ -0,0 +1,6 @@
+docsdir        := @docdir@/doc/config
+dist_docs_DATA  = cgroups.md env.md files.md index.md limitations.md	\
+		  logging.md rescue.md runlevels.md runparts.md 	\
+		  service-env.md service-opts.md service-sync.md	\
+		  service-wrappers.md services.md sysv.md		\
+		  task-and-run.md templating.md tty.md
@@ -0,0 +1 @@
+index.md
@@ -0,0 +1,65 @@
+There are three major cgroup configuration directives:
+
+ 1. Global top-level group: `init`, `system`, `user`, or a custom group
+ 2. Selecting a top-level group for a set of run/task/services
+ 3. Per run/task/service limits
+
+> [!NOTE]
+> Linux cgroups and details surrounding values are not explained in the
+> Finit documentation.  The Linux admin-guide cover this well:
+> <https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html>
+
+Top-level Group Configuration
+-----------------------------
+
+    # Top-level cgroups and their default settings.  All groups mandatory
+    # but more can be added, max 8 groups in total currently.  The cgroup
+    # 'root' is also available, reserved for RT processes.  Settings are
+    # as-is, only one shorthand 'mem.' exists, other than that it's the
+    # cgroup v2 controller default names.
+    cgroup init   cpu.weight:100
+    cgroup user   cpu.weight:100
+    cgroup system cpu.weight:9800
+
+Adding an extra cgroup `maint/` will require you to adjust the weight of
+the above three.  We leave `init/` and `user/` as-is reducing weight of
+`system/` to 9700.
+
+    cgroup system cpu.weight:9700
+
+    # Example extra cgroup 'maint'
+    cgroup maint  cpu.weight:100
+
+By default, the `system/` cgroup is selected for almost everything.  The
+`init/` cgroup is reserved for PID 1 itself and its closest relatives.
+The `user/` cgroup is for local TTY logins spawned by getty.
+
+Selecting Cgroups
+------------------
+
+To select a different top-level cgroup, e.g. `maint/`, one can either
+define it for a group of run/task/service directives in a `.conf` or per
+each stanza:
+
+    cgroup.maint
+    service [...] <...> /path/to/foo args -- description
+    service [...] <...> /path/to/bar args -- description
+
+or
+
+    service [...] <...> cgroup.maint /path/to/foo args -- description
+
+The latter form also allows per-stanza limits on the form:
+
+    service [...] <...> cgroup.maint:cpu.max:10000,mem.max:655360 /path/to/foo args -- description
+
+Notice the comma separation and the `mem.` exception to the rule: every
+cgroup setting maps directly to cgroup v2 syntax.  I.e., `cpu.max` maps
+to the file `/sys/fs/cgroup/maint/foo/cpu.max`.  There is no filtering,
+except for expanding the shorthand `mem.` to `memory.`, if the file is
+not available, either the cgroup controller is not available in your
+Linux kernel, or the name is misspelled.
+
+A daemon using `SCHED_RR` currently need to run outside the default cgroups.
+
+    service [...] <...> cgroup.root /path/to/daemon arg -- Real-Time process
@@ -0,0 +1,31 @@
+Environment Variables
+---------------------
+
+In Finit v4.3 support for setting environment variables in `finit.conf`,
+and any `*.conf`, was added.  It is worth noting that these are global
+and *shared with all* services -- the only way to have a service-local
+environment is detailed in [Services Environment](service-env.md).
+
+The syntax for global environment variables is straight forward.  In
+Finit v4.4 the `set` keyword was added for completeness, but the old
+syntax (without the `set ` prefix) is still honored:
+
+    set foo=bar
+    set baz="qux"
+
+On reload of .conf files, all tracked environment variables are cleared
+so if `foo=bar` is removed from `finit.conf`, or any `finit.d/*.conf`
+file, it will no longer be used by Finit or any new (!) started
+run/tasks or services.  The environment of already started processes can
+not be changed.
+
+The only variables reset to sane defaults on .conf reload are:
+
+    PATH=_PATH_STDPATH
+    SHELL=_PATH_BSHELL
+    LOGNAME=root
+    USER=root
+
+It is entirely possible to override these as well from the .conf files,
+but be careful.  Changing SHELL changes the behavior of `system()` and a
+lot of other commands as well.
@@ -0,0 +1,208 @@
+Files & Layout
+==============
+
+Originally Finit was configured using a single file, `/etc/finit.conf`,
+and although still possible to use a single configuration file, today
+the following layout is recommended:
+
+    /
+    |- etc/
+    |  |- finit.d/
+    |  |   |- available/
+    |  |   |  `- my-service.conf
+    |  :   |- enabled/
+    |  :   |  `- my-service.conf -> ../available/my-service.conf
+    |  :   :
+    |  :   |- static-service.conf
+    |  :   `- another-static.conf
+    |  :
+    |  `- finit.conf
+    |- lib
+    |   `- finit/
+    |       `- system/
+    |           |- 10-hotplug.conf
+    |           `- ...
+    `- run/
+        `- finit/
+            `- system/
+                |- dbus.conf
+                |- keventd.conf
+                |- runparts.conf
+                |- watchdogd.conf
+                `- ...
+
+Configuration files in `/etc` are provided by the user, or projects like
+[finit-skel](https://github.com/troglobit/finit-skel) and extended by
+the user.
+
+The files in `/lib/finit/system/*.conf` are system critical services and
+setup provided by Finit, e.g. udev/mdev that must run very early at system
+bootstrap.  This system directory was introduced in Finit v4.4 to replace
+the hard-coded services provided by plugins before.  All .conf files in this
+directory be either replaced by a system administrator or overridden by a
+file with the same name in `/etc/finit.d/`.
+
+The files in `/run/finit/system/*.conf` are created by plugins and Finit
+bundled services like runparts, [watchdog](../watchdog.md), and
+[`keventd`](../keventd.md) if they are enabled.  Like
+`/lib/finit/system/*.conf`, these files can be overridden by file with
+the same name in `/etc/finit.d/`.
+
+Services in the `available/` and `enabled/` sub-directories are called
+dynamic services, in contrast to static services -- the only difference
+being where they are installed and if the `initctl` tool can manage them
+with the `enable` and `disable` commands.  An administrator can always
+create files and symlinks manually.
+
+At bootstrap, and `initctl reload`, all .conf files are read, starting
+with `finit.conf`, then `/lib/finit/system/*.conf`, `finit.d/*.conf`,
+and finally all `finit.d/enabled/*.conf` files.  Each directory is a
+unique group, where files within each group are sorted alphabetically.
+
+**Example:**
+
+    /lib/finit/system/10-hotplug.conf
+    /lib/finit/system/90-testserv.conf
+    /run/finit/system/dbus.conf
+    /run/finit/system/runparts.conf
+    /etc/finit.d/10-abc.conf
+    /etc/finit.d/20-abc.conf
+    /etc/finit.d/enabled/1-aaa.conf
+    /etc/finit.d/enabled/1-abc.conf
+
+The resulting combined configuration is read line by line, each `run`,
+`task`, and `service` added to an ordered list that ensures they are
+started in the same order.  This is important because of the blocking
+properties of the `run` statement.  For an example on the relation of
+`service` and `run` statements, and dependency handling between them,
+see [Conditional Loading](services.md#conditional-loading), below.
+
+> [!NOTE]
+> The names `finit.conf` and `finit.d/` are only defaults.  They can be
+> changed at compile-time with two `configure` options:
+> `--with-config=/etc/foo.conf` and `--with-rcsd=/var/foo.d`.
+>
+> They can also be overridden from the [kernel command line](../cmdline.md)
+> using: `-- finit.config=/etc/bar.conf` and in that file use the
+> top-level configuration directive `rcsd /path/to/finit.d`.
+
+Filesystem Layout
+-----------------
+
+Finit is most comfortable with a traditional style Linux filesystem
+layout, as specified in the [FHS][]:
+
+    /.
+     |- bin/
+     |- dev/          # Mounted automatically if devtmpfs is available
+     |   |- pts/      # Mounted automatically by Finit if it exists
+     |   `- shm/      # Mounted automatically by Finit if it exists
+     |- etc/
+     |   |- finit.d/
+     |   |   |- available/
+     |   |   `- enabled/
+     |    `- finit.conf
+     |- home/
+     |- lib/
+     |- libexec/
+     |- mnt/
+     |- proc/         # Mounted automatically by Finit if it exists
+     |- root/
+     |- run/          # Mounted automatically by Finit if it exists
+     |   `- lock/     # Created automatically if Finit mounts /run
+     |- sbin/
+     |- sys/          # Mounted automatically by Finit if it exists
+     |- tmp/          # Mounted automatically by Finit if it exists
+     |- usr/
+     `- var/
+         |- cache/
+         |- db/
+         |- lib/
+         |   `- misc/
+         |- lock/
+         |- log/
+         |- run -> ../run
+         |- spool/
+         `- tmp/
+
+Finit starts by mounting the critical file systems `/dev`, `/proc/`, and
+`/sys`, unless they are already mounted.  When all plugins and other,
+core Finit functions, have been set up, all relevant filesystems (where
+`PASS > 0`) are checked and mounted from the selected `fstab`, either
+the default `/etc/fstab`, or any custom one selected from the command
+line, or at build time.
+
+To provide a smooth ride, file system not listed in the given `fstab`,
+e.g. `/tmp` and `/run`, are automatically mounted by Finit, as listed
+above, provided their respective mount point exists.
+
+With all filesystems mounted, Finit calls `swapon`.
+
+> [!TIP]
+> To see what happens when all filesystems are mounted, have a look at
+> the [`bootmisc.so` plugin](../plugins.md).
+
+At shutdown, and after having stopped all services and other lingering
+processes have been killed, filesystems are unmounted in the reverse
+order, and `swapoff` is called.
+
+[FHS]: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html
+
+Managing Services
+-----------------
+
+Using `initctl disable my-service` the symlink (above) is removed and
+the service is queued for removal.  Several changes can be made to the
+system, but it is not until `initctl reload` is called that the changes
+are activated.
+
+To add a new static service, drop a `.conf` file in `/etc/finit.d/` and
+run `initctl reload`.  (It is also possible to `SIGHUP` PID 1, or call
+`finit q`, but that has been deprecated with the `initctl` tool).  Finit
+monitors all known active `.conf` files, so if you want to force a
+restart of any service you can touch its corresponding `.conf` file in
+`/etc/finit.d` and call `initctl reload`.  Finit handles all conditions
+and dependencies between services automatically, see the section on
+[Service Synchronization](service-sync.md) for more details.
+
+On `initctl reload` the following is checked for all services:
+
+- If a service's `.conf` file has been removed, or its conditions are no
+  longer satisfied, the service is stopped.
+- If the file is modified, or a service it depends on has been reloaded,
+  the service is reloaded (stopped and started).
+- If a new service is added it is automatically started — respecting
+  runlevels and return values from any callbacks.
+
+For more info on the different states of a service, see the separate
+document [Finit Services](../service.md).
+
+Alternate finit.d/
+------------------
+
+**Syntax:** `rcsd /path/to/finit.d`
+
+The Finit rcS.d directory is set at compile time with:
+
+    ./configure --with-rcsd=/etc/finit.d
+
+A system with multiple use-cases may be bootstrapped with different
+configurations, starting with the kernel command line option:
+
+    -- finit.config=/etc/factory.conf
+
+This file in turn can use the `rcsd` directive to tell Finit to use
+another set of .conf files, e.g.:
+
+    rcsd /etc/factory.d
+
+> [!NOTE]
+> This directive is only available from the top-level bootstrap .conf
+> file, usually `/etc/finit.conf`.
+
+Including Finit Configs
+------------------------
+
+**Syntax:** `include <CONF>`
+
+Include another configuration file.  Absolute path required.
@@ -0,0 +1,30 @@
+This section provides an overview of Finit's configuration system. For
+detailed information on specific topics, see the individual sections in
+the navigation menu.
+
+
+Configuration File Syntax
+--------------------------
+
+The file format is line based, empty lines and comments, lines starting
+with `#`, are ignored.  A configuration directive starts with a keyword
+followed by a space and the rest of the line is treated as the value.
+
+As of Finit v4.4, configuration directives can be broken up in multiple
+lines using the continuation character `\`, and trailing comments are
+also allowed.  Example:
+
+```aconf
+# Escape \# chars if you want them literal in, e.g., descriptions
+service name:sysklogd [S123456789]   \
+    env:-/etc/default/sysklogd       \
+    syslogd -F $SYSLOGD_ARGS         \
+    -- System log daemon \# 1   # Comments allowed
+```
+
+The .conf files `/etc/finit.conf` and `/etc/finit.d/*` support many
+directives.  Some are restricted, e.g., only available at bootstrap,
+runlevel `S`.  Read on in [Files & Layout](files.md) for more on how
+to structure your .conf files.
+
+For details on restrictions, see [Limitations](limitations.md).
@@ -0,0 +1,21 @@
+Limitations
+===========
+
+As of Finit v4 there are no limitations to where `.conf` settings can be
+placed.  Except for the system/global `rlimit` and `cgroup` top-level
+group declarations, which can only be set from `/etc/finit.conf`, since
+it is the first `.conf` file Finit reads.
+
+Originally, `/etc/finit.conf` was the only way to set up a Finit system.
+Today it is mainly used for bootstrap settings like system hostname,
+early module loading for watchdogd, network bringup and system shutdown.
+These can now also be set in any `.conf` file in `/etc/finit.d`.
+
+There is, however, nothing preventing you from having all configuration
+settings in `/etc/finit.conf`.
+
+> [!IMPORTANT]
+> The default `rcsd`, i.e., `/etc/finit.d`, was previously the Finit
+> [runparts](runparts.md) directory.  Finit >=v4.0 no longer has a
+> default `runparts` directory, make sure to update your setup, or the
+> finit configuration, accordingly.
@@ -0,0 +1,41 @@
+General Logging
+===============
+
+**Syntax:** `log size:200k count:5`
+
+Log rotation for run/task/services using the `log` sub-option with
+redirection to a log file.  Global setting, applies to all services.
+
+The size can be given as bytes, without a specifier, or in `k`, `M`,
+or `G`, e.g. `size:10M`, or `size:3G`.  A value of `size:0` disables
+log rotation.  The default is `200k`.
+
+The count value is recommended to be between 1-5, with a default 5.
+Setting count to 0 means the logfile will be truncated when the MAX
+size limit is reached.
+
+Redirecting Output
+------------------
+
+The `run`, `task`, and `service` stanzas also allow the keyword `log` to
+redirect `stderr` and `stdout` of the application to a file or syslog
+using the native `logit` tool.  This is useful for programs that do not
+support syslog on their own, which is sometimes the case when running
+in the foreground.
+
+The full syntax is:
+
+    log:/path/to/file
+    log:prio:facility.level,tag:ident
+    log:console
+    log:null
+    log
+
+Default `prio` is `daemon.info` and default `tag` is the basename of the
+service or run/task command.
+
+Log rotation is controlled using the global `log` setting.
+
+**Example:**
+
+    service log:prio:user.warn,tag:ntpd /sbin/ntpd pool.ntp.org -- NTP daemon
@@ -0,0 +1,62 @@
+Rescue Mode
+===========
+
+Finit supports a rescue mode which is activated by the `rescue` option
+on the kernel command line.  See [cmdline docs](../cmdline.md) for how to
+activate it.
+
+This rescue mode can be disabled at configure time using:
+
+    configure --without-rescue
+
+The rescue mode comes in two flavors; *traditional* and *fallback*.
+
+> [!NOTE]
+> In this mode `initctl` will not work.  Use the `-f` flag to force
+> `reboot`, `shutdown`, or `poweroff`.
+
+Traditional
+-----------
+
+This is what most users expect.  A very early maintenance login prompt,
+served by the system `sulogin` program from util-linux, or BusyBox.  If
+that is not found in `$PATH`, the bundled `/libexec/finit/sulogin`
+program is used instead.  If a successful login is made, or if the user
+exits (Ctrl-D), the rescue mode is ended and the system boots up
+normally.
+
+> [!WARNING]
+> The bundled sulogin in Finit can at configure time be given another
+> user than the default (root).  If the sulogin user does not have a
+> password, or __the account is locked__, the user is presented with a
+> prompt: `"Press enter to enter maintenance mode."`, which will open
+> up a root shell *without prompting for password*!
+
+Fallback
+--------
+
+If no `sulogin` program is found, Finit tries to bring up as much of its
+own functionality as possible, yet limiting many aspects, meaning; no
+network, no `fsck` of file systems in `/etc/fstab`, no `/etc/rc.local`,
+no `runparts`, and most plugins are skipped (except those that provide
+functionality for the condition subsystem).
+
+Instead of reading `/etc/finit.conf` et al, system configuration is read
+from `/lib/finit/rescue.conf`, which can be freely modified by the
+system administrator.
+
+The bundled default `rescue.conf` contains nothing more than:
+
+    runlevel 1
+    tty [12345] rescue
+
+The `tty` has the `rescue` option set, which works similar to the board
+bring-up tty option `notty`.  The major difference being that `sulogin`
+is started to query for root/admin password.  If `sulogin` is not found,
+`rescue` behaves like `notty` and gives a plain root shell prompt.
+
+If Finit cannot find `/lib/finit/rescue.conf` it defaults to:
+
+    tty [12345] rescue
+
+There is no way to exit the *fallback* rescue mode.
@@ -0,0 +1,168 @@
+Runlevels
+=========
+
+Finit supports runlevels, but unlike other init systems runlevels are
+declared per service/run/task/sysv command.  When booting up a system
+Finit pass through three phases:
+
+ 1. Setting up the console, parsing any command line options, and other
+    housekeeping tasks like mounting all filesystems, and calling `fsck`
+ 2. Starting all run/task/services in runlevel S, then waiting for all
+    services to have started, and all run/tasks to have completed
+ 3. Go to runlevel 2, or whatever the user has set in the configuration
+
+Available runlevels:
+
+ - `  S`: bootStrap
+ - `  1`: Single user mode
+ - `2-5`: traditional multi-user mode
+ - `  6`: reboot
+ - `7-9`: multi-user mode (extra)
+ - `  0`: shutdown
+
+Runlevel S (bootStrap), is for tasks supposed to run once at boot, and
+services like `syslogd`, which need to start early and run throughout
+the lifetime of your system.
+
+Example:
+
+    task [S] /lib/console-setup/console-setup.sh
+    service [S12345] env:-/etc/default/rsyslog rsyslogd -n $RSYSLOGD_ARGS
+
+When bootstrap has completed, Finit moves to runlevel 2.  This can be
+changed in `/etc/finit.conf` using the `runlevel N` directive, or by a
+script running in runlevel S that calls, e.g., `initctl runlevel 9`.
+The latter is useful if startup scripts detect problems outside of
+Finit's control, e.g., critical services/devices missing or hardware
+problems.
+
+Each runlevel must be allowed to "complete".  Meaning, all services in
+runlevel S must have started and all run/tasks have been started and
+collected (exited).  Finit waits 120 seconds for all run/tasks in S to
+complete before proceeding to 2.
+
+Finit first stops everything that is not allowed to run in 2, and then
+brings up networking.  Networking is expected to be available in all
+runlevels except: S, 1 (single user level), 6, and 0.  Networking is
+enabled either by the `network script` directive, or if you have an
+`/etc/network/interfaces` file, Finit calls `ifup -a` -- at the very
+least the loopback interface is brought up.
+
+> [!NOTE]
+> When moving from runlevel S to 2, all run/task/services that were
+> constrained to runlevel S only are dropped from bookkeeping.  So when
+> reaching the prompt, `initctl` will not show these run/tasks.  This is
+> a safety mechanism to prevent bootstrap-only tasks from accidentally
+> being run again.  E.g., `console-setup.sh` above.
+
+Runlevel Configuration
+----------------------
+
+**Syntax:** `runlevel <N>`
+
+The system runlevel to go to after bootstrap (S) has completed.  `N` is
+the runlevel number 0-9, where 6 is reserved for reboot and 0 for halt.
+Completed in this context means all services have been started and all
+run/tasks have been started and collected.
+
+It is recommended to keep runlevel 1 as single-user mode, because
+Finit disables networking in this mode.
+
+*Default:* 2
+
+> [!NOTE]
+> Only read and executed in runlevel S (bootstrap).
+
+Networking
+----------
+
+**Syntax:** `network <PATH>`
+
+Script or program to bring up networking, with optional arguments.
+
+Deprecated.  We recommend using dedicated task/run stanzas per runlevel,
+or `/etc/network/interfaces` if you have a system with `ifupdown`, like
+Debian, Ubuntu, Linux Mint, or an embedded BusyBox system.
+
+> [!NOTE]
+> Only read and executed in runlevel S (bootstrap).
+
+System Hostname
+---------------
+
+**Syntax:** `host <NAME>`, or `hostname <NAME>`
+
+Set system hostname to NAME, unless `/etc/hostname` exists in which case
+the contents of that file is used.
+
+Deprecated.  We recommend using `/etc/hostname` instead.
+
+> [!NOTE]
+> Only read and executed in runlevel S (bootstrap).
+
+Kernel Modules
+--------------
+
+**Syntax:** `module <MODULE> [ARGS]`
+
+Load a kernel module, with optional arguments.  Similar to `insmod`
+command line tool.
+
+Deprecated, there is both a `modules-load.so` and a `modprobe.so` plugin
+that can handle module loading better.  The former supports loading from
+`/etc/modules-load.d/`, the latter uses kernel modinfo to automatically
+load (or coldplug) every required module.  For hotplug we recommend the
+BusyBox mdev tool, add to `/etc/mdev.conf`:
+
+    $MODALIAS=.*  root:root       0660    @modprobe -b "$MODALIAS"
+
+> [!NOTE]
+> Only read and executed in runlevel S (bootstrap).
+
+Resource Limits
+---------------
+
+**Syntax:** `rlimit [hard|soft] RESOURCE <LIMIT|unlimited>`
+
+Set the hard or soft limit for a resource, or both if that argument is
+omitted.  `RESOURCE` is the lower-case `RLIMIT_` string constants from
+`setrlimit(2)`, without prefix.  E.g. to set `RLIMIT_CPU`, use `cpu`.
+  
+LIMIT is an integer that depends on the resource being modified, see
+the man page, or the kernel `/proc/PID/limits` file, for details.
+Finit versions before v3.1 used `infinity` for `unlimited`, which is
+still supported, albeit deprecated.
+
+    # No process is allowed more than 8MB of address space
+    rlimit hard as 8388608
+
+    # Core dumps may be arbitrarily large
+    rlimit soft core infinity
+
+    # CPU limit for all services, soft & hard = 10 sec
+    rlimit cpu 10
+
+`rlimit` can be set globally, in `/etc/finit.conf`, or locally per
+each `/etc/finit.d/*.conf` read.  I.e., a set of task/run/service
+stanzas can share the same rlimits if they are in the same .conf.
+
+Miscellaneous Settings
+----------------------
+
+**Syntax:** `reboot-delay <0-60>`
+
+Optional delay at reboot (or shutdown or halt) to allow kernel
+filesystem threads to complete after calling `sync(2)` before
+rebooting.  This applies primarily to filesystems that do not
+have a reboot notifier implemented.  At the point of writing,
+the only known filesystems affected are: ubifs, jffs2.
+
+*Default:* 0 (disabled)
+
+When enabled (non-zero), this delay runs after file systems have been
+unmounted and the root filesystem has been remounted read-only, and
+sync(2) has been called, twice.
+
+> "On Linux, sync is only guaranteed to schedule the dirty blocks for
+> writing; it can actually take a short time before all the blocks are
+> finally written.
@@ -0,0 +1,51 @@
+Run-parts Scripts
+-----------------
+
+**Syntax:** `runparts [progress] [sysv] <DIR>`
+
+Call [run-parts(8)][] on `DIR` to run start scripts.  All executable
+files in the directory are called, in alphabetic order.  The scripts in
+this directory are executed at the very end of runlevel `S`.
+
+A common use-case for runparts scripts is to create and enable/disable
+services, which Finit will then apply when changing runlevel from S to
+whatever the next runlevel is set to be (default 2).  E.g., generate a
+`/etc/chrony.conf` and call `initctl enable chronyd`.
+
+**Options:**
+
+ - `progress`: display the progress of each script being executed
+ - `sysv`: run only SysV style scripts, i.e., `SNNfoo`, or `KNNbar`,
+   where `NN` is a number (0-99).
+
+If global debug mode is enabled, the `runparts` program is also called
+with the debug flag.
+
+**Limitations:**
+
+Scripts called from `runparts`, or hook scripts (see below), are limited
+in their interaction with Finit.  Like the standalone `run` stanza and
+the `/etc/rc.local` shell script, Finit waits for their completion
+before continuing.  None of them can issue commands to start, stop, or
+restart other services.  Also, ensure all your services and programs
+either terminate or start in the background or you will block Finit.
+
+> [!NOTE]
+> `runparts` scripts are only read and executed in runlevel S.  See
+> [hook scripts](../plugins.md#hooks) for other ways to run scripts at
+> certain points during the complete lifetime of the system.
+
+**Recommendations:**
+
+It can be beneficial to use `01-name`, `02-othername`, etc., to ensure
+the scripts are started in that order, e.g., if there is a dependency
+order between scripts.  Symlinks to existing daemons can talso be used,
+but make sure they daemonize (background) themselves properly, otherwise
+Finit will lock up.
+
+If `S[0-9]foo` and `K[0-9]bar` style naming is used, the executable will
+be called with an extra argument, `start` and `stop`, respectively.
+E.g., `S01foo` will be called as `S01foo start`.  Of course, `S01foo`
+and `K01foo` may be a symlink to to `another/directory/foo`.
+
+[run-parts(8)]: http://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
@@ -0,0 +1,27 @@
+Service Environment
+-------------------
+
+Finit supports sourcing environment variables from `/etc/default/*`, or
+similar `--with-sysconfig=DIR`.  This is a common pattern from SysV init
+scripts, where the start-stop script is a generic script for the given
+service, `foo`, and the options for the service are sourced from the
+file `/etc/default/foo`.  Like this:
+
+* `/etc/default/foo`:
+
+        FOO_OPTIONS=--extra-arg="bar" -s -x
+
+* `/etc/finit.conf`:
+
+        service [2345] env:-/etc/default/foo foo -n $FOO_OPTIONS -- Example foo daemon
+
+Here the service `foo` is started with `-n`, to make sure it runs in the
+foreground, and the with the options found in the environment file.  With
+the `ps` command we can see that the process is started with:
+
+    foo -n --extra-arg=bar -s -x
+
+> [!NOTE]
+> The leading `-` in `env:` determines if Finit should treat a missing
+> environment file as blocking the start of the service or not.  When
+> `-` is used, a missing environment file does *not* block the start.
@@ -0,0 +1,134 @@
+Service Options
+===============
+
+The run/task/tty/service/sysv directives take modifiers, or options, to
+control their behavior.  This section lists them with their limitations.
+All modifiers must be placed between the directive and its command.
+
+The name of a service, shown by the `initctl` tool, defaults to the
+basename of the service executable. It can be changed with the `name:`
+option:
+
+    name:<service-name>
+
+For multiple instances of a service, with the same `name`, set the
+identifier `:ID` to prevent Finit from replacing previous instances:
+
+    service name:ssdp :eth1 ssdpd eth1 -- Windows discovery on eth1
+    service name:ssdp :eth2 ssdpd eth2 -- Windows discovery on eth2
+
+The [`initctl`](../initctl.md) tool will list these two services as:
+
+ - ssdp:eth1
+ - ssdp:eth2
+
+Conflicting services that must be prevented from starting, use the
+`conflict:` option:
+
+    service [S12345789] udevd -- Device event management daemon
+	run [S] conflict:udevd mdev -s -- Populating device tree
+
+Multiple conflicting services can be separated using `,`:
+
+    service :1 abc
+    service :2 abc
+	service conflict:abc:1,abc:2 cde
+
+If a service should not be automatically started, it can be configured
+as manual with the optional `manual` argument. The service can then be
+started at any time by running `initctl start <service>`.
+
+    manual:yes
+
+Other run/task/service options are:
+
+  * `cgroups:...` -- see the [Cgroups](cgroups.md) section
+  * `env:[-]/path/to/env` -- see the [Service Environment](service-env.md) section
+  * `log:...` -- see [Redirecting Output](logging.md#redirecting-output)
+  * `nowarn` -- see [Conditional Loading](services.md#conditional-loading)
+  * `notify:...` -- see [Service Synchronization](service-sync.md)
+  * `if:...` -- see [Conditional Execution](services.md#conditional-execution)
+  * `type:forking` -- see description of the [service](services.md) directive
+
+As mentioned previously, services are automatically started, restarted,
+and stopped, depending on the configuration and conditions.  Within the
+confines of that the following options are available:
+
+  * `restart:NUM` -- number of times Finit tries to restart a crashing
+    service, default: 10, max: 255.  When this limit is reached the
+    service is marked *crashed* and must be restarted manually with
+    `initctl restart NAME`
+  * `restart_sec:SEC` -- number of seconds before Finit tries to restart
+    a crashing service, default: 2 seconds for the first five retries,
+	then back-off to 5 seconds.  The maximum of this configured value
+	and the above (2 and 5) will be used
+  * `restart:always` -- no upper limit on the number of times Finit
+    tries to restart a crashing service.  Same as `restart:-1`
+  * `norestart` -- dont restart on failures, same as `restart:0`
+  * `respawn` -- bypasses the `restart` mechanism completely, allows
+    endless restarts.  Useful in many use-cases, but not what `service`
+    was originally designed for so not the default behavior
+  * `oncrash:reboot` -- when all retries have failed, and the service
+    has *crashed*, if this option is set the system is rebooted
+  * `oncrash:script` -- similarly, but instead of rebooting, call the
+    `post:script` action with exit code `crashed`, see below
+  * `reload:'script [args]'` -- some services do not support `SIGHUP` but
+    may have other ways to update the configuration of a running daemon.
+    When `reload:script` is defined it is preferred over `SIGHUP`.  Like
+	systemd, Finit sets `$MAINPID` as a convenience to scripts, which in
+	effect also allow `reload:'kill -HUP $MAINPID'`
+  * `stop:'script [args]'` -- some services may require alternate methods
+    to be stopped.  If a `stop:script` is defined it is preferred over
+    `SIGTERM` and `stop`, for `service` and `sysv`, respectively.
+	Similar to `reload:script`, Finit sets `$MAINPID`
+
+> [!CAUTION]
+> Both `reload:script` and `stop:script` are called as PID 1, without
+> any timeout!  Meaning, it is up to you to ensure the script is not
+> blocking for seconds at a time or never terminates.
+
+When stopping a service (run/task/sysv/service), either manually or when
+moving to another runlevel, Finit starts by sending `SIGTERM`, to allow
+the process to shut down gracefully (unless a `stop:'script'` is used).
+However, if the process has not been collected within 3 seconds, Finit
+will send `SIGKILL`.  To stop the process using a different signal than
+`SIGTERM`, use `halt:SIGNAL`, e.g., `halt:SIGPWR`.  To change the delay
+between the stop signal and KILL, use the option `kill:<1-60>`, e.g.,
+`kill:10` to wait 10 seconds before sending `SIGKILL`.
+
+Services, including the `sysv` variant, support pre/post/ready and
+cleanup scripts:
+
+  * `pre:[0-3600,]script` -- called before the sysv/service is stated
+  * `post:[0-3600,]script` -- called after the sysv/service has stopped
+  * `ready:[0-3600,]script` -- called when the sysv/service is ready
+  * `cleanup:[0-3600,]script` -- called when run/task/sysv/service is removed
+
+The optional number (0-3600) is the timeout before Finit kills the
+script, it defaults to the kill delay value and can be disabled by
+setting it to zero.  These scripts run as the same `@USER:GROUP` as the
+service itself, with any `env:file` sourced.  The scripts are executed
+from the `$HOME` of the given user.  The scripts are not called with any
+argument, but get a set of environment variables:
+
+  * `SERVICE_IDENT=foo:1`
+  * `SERVICE_NAME=foo`
+  * `SERVICE_ID=1`
+
+The `post:script` is called with an additional set of environment
+variables.  Yes, the text is correct, the naming was an accident:
+
+ - `EXIT_CODE=[exited,signal,crashed]`: normal exit, signaled, or
+   crashed
+ - `EXIT_STATUS=[num,SIGNAME]`: set to one of exit status code from
+   the program, if it exited normally, or the signal name (`HUP`,
+   `TERM`, etc.) if it exited due to signal
+
+When a run/task/sys/service is removed (disable + reload) it is first
+stopped and then removed from the runlevel.  The `post:script` always
+runs when the process has stopped, and the `cleanup:script` runs when
+the the stanza has been removed from the runlevel.
+
+> [!IMPORTANT]
+> These script actions are intended for setup, cleanup, and readiness
+> notification.  It is up to the user to ensure the scripts terminate.
@@ -0,0 +1,74 @@
+Service Synchronization
+=======================
+
+Finit was created for fast booting systems.  Faster than a regular SysV
+Init based system at the time.  Early on the need for a guaranteed start
+order of services (daemons) arose.  I.e., service `A` must be guaranteed
+to have started (and be ready!) before `B`.  The model that was chosen
+to determine this was very simple: PID files.
+
+Early on in UNIX daemons were controlled with basic IPC like signals,
+and the way for a user to know that a daemon was ready to respond to
+signals (minimally having set up its signal handler), was to tell the
+user;
+
+> "Hey, you can send signals to me using the PID in this file:
+> `/var/run/daemon.pid`".
+
+Since most systems run fairly unchanged after boot, Finit could rely on
+the PID file for `A` being created before launching `B`.  This method
+has worked well for a long time, and for systems based on Open Source it
+was easy to either add PID file support to a daemon without support for
+it, or fix ordering issues (PID file created before signal handler is
+set up) in existing daemons.
+
+However, with the advent of other Init systems (Finit is rather old),
+most notably systemd and s6, other methods for signaling "readiness"
+arrived and daemons were adapted to these new schemes to a larger
+extent.
+
+As of Finit v4.4 partial support for systemd and s6 style readiness
+notification is available, and the native PID file mode of operation is,
+as of Finit v4.6 optional, by default it is still enabled, but this can
+be changed in `finit.conf`:
+
+    readiness none
+
+This will be made the default in Finit 5.0.  In this mode of operation,
+every service needs to explicitly declare their readiness notification,
+like this:
+
+    service notify:pid     watchdogd
+    service notify:systemd foo
+    service notify:s6      bar
+    service notify:none    qux
+
+The `notify:none` syntax is for completeness in systems which run in
+`readiness pid` mode (default).  Services declared with `notify:none`
+will transition to ready as soon as Finit has started them, e.g.,
+`service/qux/ready`.
+
+To synchronize two services the following condition can be used:
+
+    service notify:pid                 watchdogd
+    service <service/watchdogd/ready>  stress-ng --cpu 8
+
+For details on the syntax and options, see below.
+
+> [!NOTE]
+> On `initctl reload` conditions are set in "flux", while figuring out
+> which services to stop, start or restart.  Services that need to be
+> restarted have their `ready` condition removed before Finit issue a
+> SIGHUP (if they support that), or stop-starting them.  A daemon is
+> expected to reassert its readiness, e.g. systemd style daemons to
+> write `READY=1\n`.
+>
+> However, the s6 notify mode does not support this because in s6 you
+> are expected to close your notify descriptor after having written
+> `\n`.  This means s6 style daemons currently must be stop-started.
+> (Declare the service with `<!>` in its condition statement.)
+>
+> For default, PID file style readiness notification, daemons are
+> expected to either create their PID files, or touch it using
+> `utimensat()` to reassert readiness.  Triggering both the `<pid/>`
+> and `<.../ready>` conditions.
@@ -0,0 +1,31 @@
+Service Wrapper Scripts
+=======================
+
+If your service requires to run additional commands, executed before the
+service is actually started, like the systemd `ExecStartPre`, you can
+use a wrapper shell script to start your service.
+
+The Finit service `.conf` file can be put into `/etc/finit.d/available`,
+so you can control the service using `initctl`.  Then use the path to
+the wrapper script in the Finit `.conf` service stanza.  The following
+example employs a wrapper script in `/etc/start.d`.
+
+**Example:**
+
+* `/etc/finit.d/available/program.conf`:
+
+        service [235] <!> /etc/start.d/program -- Example Program
+
+* `/etc/start.d/program:`
+
+        #!/bin/sh
+        # Prepare the command line options
+        OPTIONS="-u $(cat /etc/username)"
+
+        # Execute the program
+        exec /usr/bin/program $OPTIONS
+
+> [!NOTE]
+> The example sets `<!>` to denote that it doesn't support `SIGHUP`.
+> That way Finit will stop/start the service instead of sending SIGHUP
+> at restart/reload events.
@@ -0,0 +1,201 @@
+Services
+========
+
+**Syntax:** `service [LVLS] <COND> /path/to/daemon ARGS -- Optional description`
+
+Service, or daemon, to be monitored and automatically restarted if it
+exits prematurely.  Finit tries to restart services that die, by default
+10 times before giving up and marking them as *crashed*.  After which
+they have to be manually restarted with `initctl restart NAME`.  The
+limits controlling this are configurable, see the options below.
+
+> [!TIP]
+> To allow endless restarts, see the [`respawn` option](service-opts.md)
+  
+For daemons that support it, we recommend appending `--foreground`,
+`--no-background`, `-n`, `-F`, or similar command line argument to
+prevent them from forking off a sub-process in the background.  This is
+the most reliable way to monitor a service.
+
+However, not all daemons support running in the foreground, or they may
+start logging to the foreground as well, these are forking daemons and
+are supported using the same syntax as forking `sysv` services, using
+the `pid:!/path/to/pidfile.pid` syntax.  There is an alternative syntax
+that may be more intuitive, where Finit can also guess the PID file
+based on the daemon's command name:
+
+    service type:forking ntpd -- NTP daemon
+
+This example lets BusyBox `ntpd` daemonize itself.  Finit uses the
+basename of the binary to guess the PID file to watch for the PID:
+`/var/run/ntpd.pid`.  If Finit guesses wrong, you have to submit the
+full `pid:!/path/to/file.pid`.
+
+**Example:**
+
+In the case of `ospfd` (below), we omit the `-d` flag (daemonize) to
+prevent it from forking to the background:
+
+    service [2345] <pid/zebra> /sbin/ospfd -- OSPF daemon
+
+`[2345]` denote the runlevels `ospfd` is allowed to run in, they are
+optional and default to level 2-5 if omitted.
+  
+`<...>` is the condition for starting `ospfd`.  In this example Finit
+waits for another service, `zebra`, to have created its PID file in
+`/var/run/quagga/zebra.pid` before starting `ospfd`.  Finit watches
+*all* files in `/var/run`, for each file named `*.pid`, or `*/pid`,
+Finit opens it and find the matching `NAME:ID` using the PID.
+
+Some services do not maintain a PID file and rather than patching each
+application Finit provides a workaround.  A `pid` keyword can be set
+to have Finit automatically create (when starting) and later remove
+(when stopping) the PID file.  The file is created in the `/var/run`
+directory using the `basename(1)` of the service.  The default can be
+modified with an optional `pid:`-argument:
+
+    pid[:[/path/to/]filename[.pid]]
+
+For example, by adding `pid:/run/bar.pid` to the service `/sbin/bar`,
+that PID file will, not only be created and removed automatically, but
+also be used by the Finit condition subsystem.  So a service/run/task
+can depend on `<pid/bar>`, like this foo will not be started until bar
+has started:
+
+    service pid:/run/bar.pid bar -- Bar Service
+    service <pid/bar> foo -- Foo Service
+
+Needless to say, it is better if `bar` creates its own PID file when it
+has completed starting up and is ready for service.
+
+As an alternative "readiness" notification, Finit supports both systemd
+and s6 style notification.  This can be enabled by using the `notify`
+option:
+
+  * `notify:systemd` -- tells Finit the service uses the `sd_notify()`
+    API to signal PID 1 when it has completed its startup and is ready
+    to service events.  The [sd_notify()][] API expects `NOTIFY_SOCKET`
+    to be set to the socket where the application can send `"READY=1\n"`
+    when it is starting up or has processed a `SIGHUP`.
+  * `notify:s6` -- puts Finit in s6 compatibility mode.  Compared to the
+    systemd notification, [s6 expect][] compliant daemons to send `"\n"`
+    and then close their socket.  Finit takes care of "hard-wiring" the
+    READY state as long as the application is running, events across any
+    `SIGHUP`.  Since s6 can give its applications the descriptor number
+    (must be >3) on then command line, Finit provides the following
+    syntax (`%n` is replaced by Finit with then descriptor number):
+
+        service [S12345789] notify:s6 mdevd -O 4 -D %n
+
+[sd_notify()]: https://www.freedesktop.org/software/systemd/man/sd_notify.html
+[s6 expect]:   https://skarnet.org/software/s6/notifywhenup.html
+
+When a service is ready, either by Finit detecting its PID file, or
+their respective readiness mechanism has been triggered, Finit creates
+then service's ready condition which other services can depend on:
+
+    $ initctl -v cond get service/mdevd/ready
+    on
+
+This can be used to synchronize the start of another run/task/service:
+
+    task [S] <service/mdevd/ready> @root:root mdevd-coldplug
+
+Finit waits for `mdevd` to notify it, before starting `mdevd-coldplug`.
+Notice how both start in runlevel S, and the coldplug task only runs in
+S.  When the system moves to runlevel 2 (the default), coldplug is no
+longer part of the running configuration (`initctl show`), this is to
+ensure that coldplug is not called more than once.
+
+>  For a detailed description of conditions, and how to debug them,
+>  see the [Finit Conditions](../conditions.md) document.
+
+
+Non-privileged Services
+-----------------------
+
+Every `run`, `task`, or `service` can also list the privileges the
+`/path/to/cmd` should be executed with.  Prefix the command with
+`@USR[:GRP]`, group is optional, like this:
+
+    run [2345] @joe:users logger "Hello world"
+
+For multiple instances of the same command, e.g. a DHCP client or
+multiple web servers, add `:ID` somewhere between the `run`, `task`,
+`service` keyword and the command, like this:
+
+    service :80  [2345] httpd -f -h /http -p 80   -- Web server
+    service :8080[2345] httpd -f -h /http -p 8080 -- Old web server
+
+Without the `:ID` to the service the latter will overwrite the former
+and only the old web server would be started and supervised.
+
+
+Conditional Loading
+-------------------
+
+Finit support conditional loading of stanzas.  The following example is
+take from the `system/hotplug.conf` file in the Finit distribution.
+Here we only show a simplified subset.
+
+Starting with the `nowarn` option.
+
+    service nowarn name:udevd pid:udevd /lib/systemd/systemd-udevd
+    service nowarn name:udevd pid:udevd udevd
+
+When loading the .conf file Finit looks for `/lib/systemd/systemd-udevd`
+if that is not found Finit automatically logs a warning.  The `nowarn`
+option disables this warning so that the second line can be evaluated,
+which also provides a service named `udevd`.
+
+    run nowarn if:udevd <pid/udevd> :1 udevadm settle -t 0
+
+This line is only loaded if we know of a service named `udevd`.  Again,
+we do not warn if `udevadm` is not found, execution will also stop here
+until the PID condition is asserted, i.e., Finit detecting udevd has
+started.
+
+    run nowarn conflict:udevd [S] mdev -s -- Populating device tree
+
+If `udevd` is not available, we try to run `mdev`, but if that is not
+found, again we do not warn.
+
+Conditional loading statements can also be negated, so the previous stanza
+can also be written as:
+
+    run nowarn if:!udevd [S] mdev -s -- Populating device tree
+
+The reason for using `conflict` in this example is that a conflict can be
+resolved.  Stanzas marked with `conflict:foo` are rechecked at runtime.
+
+
+Conditional Execution
+---------------------
+
+Similar to conditional loading of stanzas there is conditional runtime
+execution.  This can be confusing at first, since Finit already has a
+condition subsystem, but this is more akin to the qualification to a
+runlevel.  E.g., a `task [123]` is qualified to run only in runlevel 1,
+2, and 3.  It is not considered for other runlevels.
+
+Conditional execution qualify a run/task/service based on a condition.
+Consider this (simplified) example from the Infix operating system:
+
+    run [S]                       name:startup <pid/sysrepo> confd -b --load startup-config
+    run [S] if:<usr/fail-startup> name:failure <pid/sysrepo> confd    --load failure-config
+
+The two run statements reside in the same .conf file so Finit runs them
+in true sequence.  If loading the file `startup-config` fails confd sets
+the condition `usr/fail-startup`, thus allowing the next run statement
+to load `failure-config`.
+
+Notice the critical difference between the `<pid/sysrepo>` condition and
+`if:<usr/fail-startup>`.  The former is a condition for starting and the
+latter is a condition to check if a run/task/service is qualified to
+even be considered.
+
+Conditional execution statements can also be negated, so provided the
+file loaded did the opposite, i.e., set a condition on success, the
+previous stanza can also be written as:
+
+    run [S] if:<!usr/startup-ok> name:failure <pid/sysrepo> confd ...
@@ -0,0 +1,94 @@
+SysV Init Compatibility
+=======================
+
+It is not possible to run unmodified SysV init systems with Finit.  This
+was never the intention and is not the strength of Finit.  However, it
+comes with a few SysV Init compatibility features to ease the transition
+from a serialized boot process.
+
+SysV Init Scripts
+-----------------
+
+**Syntax:** `sysv [LVLS] <COND> /path/to/init-script -- Optional description`
+
+> `<COND>` is described in the [Services](services.md) section.
+
+Similar to `task` is the `sysv` stanza, which can be used to call SysV
+style scripts.  The primary intention for this command is to be able to
+reuse much of existing setup and init scripts in Linux distributions.
+  
+When entering an allowed runlevel, Finit calls `init-script start`, when
+entering a disallowed runlevel, Finit calls `init-script stop`, and if
+the Finit .conf, where `sysv` stanza is declared, is modified, Finit
+calls `init-script restart` on `initctl reload`.  Similar to how
+`service` stanzas work.
+
+Forking services started with `sysv` scripts can be monitored by Finit
+by declaring the PID file to look for: `pid:!/path/to/pidfile.pid`.
+Notice the leading `!`, it signifies Finit should not try to create the
+file, but rather watch that file for the resulting forked-off PID.  This
+syntax also works for forking daemons that do not have a command line
+option to run it in the foreground, more on this below in `service`.
+
+> [!TIP]
+> See also [SysV Init Compatibility](#sysv-init-compatibility).
+
+`runparts DIRECTORY`
+--------------------
+
+For a directory with traditional start/stop scripts that should run, in
+order, at bootstrap, Finit provides the `runparts` directive.  It runs
+in runlevel S, at the very end of it (before calling `/etc/rc.local`)
+making it perfect for most scenarios.
+
+For syntax details, see the [Run-parts Scripts](runparts.md) section.
+Here is an example take from a Debian installation:
+
+    runparts /etc/rc2.d
+
+Files in these directories are usually named `SNNfoo` and `KNNfoo`,
+which Finit knows about and automatically appends the correct argument:
+
+    /bin/sh -c /etc/rc2.d/S01openbsd-inetd start
+
+or
+
+    /bin/sh -c /etc/rc0.d/K01openbsd-inetd stop
+
+Files that do not match this pattern are started similarly but without
+the extra command line argument.
+
+Start/Stop Scripts
+------------------
+
+For syntax details, see [SysV Init Scripts](#sysv-init-scripts), above.
+Here follows an example taken from a Debian installation:
+
+    sysv [2345] <pid/syslogd> /etc/init.d/openbsd-inetd -- OpenBSD inet daemon
+
+The init script header could be parsed to extract `Default-Start:` and
+other parameters for the `sysv` command to Finit.  There is currently no
+way to detail a generic syslogd dependency in Finit, so `Should-Start:`
+in the header must be mapped to the condition system in Finit using an
+absolute reference, here we depend on the sysklogd project's syslogd.
+
+`/etc/rc.local`
+---------------
+
+One often requested feature, early on, was a way to run a site specific
+script to set up, e.g., static routes or firewall rules.  A user can add
+a `task` or `run` command in the Finit configuration for this, but for
+compatibility reasons the more widely know `/etc/rc.local` is used if
+it exists, and is executable.  It is called very late in the boot process
+when the system has left runlevel S, stopped all old and started all new
+services in the target runlevel (default 2).
+
+> In Finit releases before v4.5 this script blocked Finit execution and
+> made it as good as impossible to call `initctl` during that time.
+
+`init q`
+--------
+
+When `/sbin/finit` is installed as `/sbin/init`, it is possible to use
+`init q` to reload the configuration.  This is the same as calling
+`initctl reload`.
@@ -0,0 +1,46 @@
+run (sequence)
+--------------
+
+**Syntax:** `run [LVLS] <COND> /path/to/cmd ARGS -- Optional description`
+
+> `<COND>` is described in the [Services](services.md) section.
+
+One-shot command to run in sequence when entering a runlevel, with
+optional arguments and description.  `run` commands are guaranteed to be
+completed before running the next command.  Useful when serialization is
+required.
+
+> [!WARNING]
+> Try to avoid the `run` command.  It blocks much of the functionality
+> in Finit, like (re)starting other (perhaps crashing) services while a
+> `run` task is executing.  Use other synchronization mechanisms
+> instead, like conditions.
+
+Incomplete list of unsupported `initctl` commands in `run` tasks:
+
+ - `initctl runlevel N`, setting runlevel
+ - `initctl reboot`
+ - `initctl halt`
+ - `initctl poweroff`
+ - `initctl suspend`
+
+To prevent `initctl` from calling Finit when enabling and disabling
+services from inside a `run` task, use the `--force` option.  See
+also the `--quiet` and `--batch` options.
+
+task (parallel)
+---------------
+
+**Syntax:** `task [LVLS] <COND> /path/to/cmd ARGS -- Optional description`
+
+> `<COND>` is described in the [Services](services.md) section.
+
+One-shot like 'run', but starts in parallel with the next command.
+  
+Both `run` and `task` commands are run in a shell, so basic pipes and
+redirects can be used:
+
+    task [s] echo "foo" | cat >/tmp/bar
+
+Please note, `;`, `&&`, `||`, and similar are *not supported*.  Any
+non-trivial constructs are better placed in a separate shell script.
@@ -0,0 +1,39 @@
+Templating
+==========
+
+Finit comes with rudimentary support for templating, similar to that of
+systemd.  Best illustrated with an example:
+
+    $ initctl show avahi-autoipd@
+    service :%i avahi-autoipd --syslog %i -- ZeroConf for %i
+
+To enable ZeroConf for, e.g., `eth0`, use
+
+    $ initctl enable avahi-autoipd@eth0.conf
+
+The enabled symlink will be set up to `avahi-autoipd@.conf` and every
+instance of `%i` will in the instantiated directive be replaced with
+`eth0`.  Inspect the resulting instantiated template with `initctl show
+avahi-autoipd:eth0` and check the status of a running instance with:
+
+```
+$ initctl status avahi-autoipd:eth0
+     Status : running
+   Identity : avahi-autoipd:eth0
+Description : ZeroConf for eth0
+     Origin : /etc/finit.d/enabled/avahi-autoipd@eth0.conf
+Environment : -/etc/default/avahi-autoipd-eth0
+    Command : avahi-autoipd $AVAHI_AUTOIPD_ARGS eth0
+   PID file : /run/avahi-autoipd.eth0.pid
+        PID : 4190
+       User : root
+      Group : root
+     Uptime : 24 sec
+   Restarts : 0 (0/10)
+  Runlevels : [---2345-789]
+     Memory : 20.0k
+     CGroup : /system/avahi-autoipd@eth0 cpu 0 [100, max] mem [0, max]
+              └─ 4190 avahi-autoipd: [eth0] bound 169.254.1.9  
+
+Jul  8 11:51:42 infix-c0-ff-ee finit[1]: Starting avahi-autoipd:eth0[4190]
+```
@@ -0,0 +1,86 @@
+TTYs and Consoles
+=================
+
+**Syntax:** `tty [LVLS] <COND> DEV [BAUD] [noclear] [nowait] [nologin] [TERM]`  
+  `tty [LVLS] <COND> CMD <ARGS> [noclear] [nowait]`  
+  `tty [LVLS] <COND> [notty] [rescue]`
+
+The first variant of this option uses the built-in getty on the given
+TTY device DEV, in the given runlevels.  DEV may be the special keyword
+`@console`, which is expanded from `/sys/class/tty/console/active`,
+useful on embedded systems.
+
+The default baud rate is 0, i.e., keep kernel default.
+
+> The `tty` stanza inherits runlevel, condition (and other feature)
+> parsing from the `service` stanza.  So TTYs can run in one or many
+> runlevels and depend on any condition supported by Finit.  This is
+> useful e.g. to depend on `<pid/elogind>` before starting a TTY.
+
+**Example:**
+
+    tty [12345] /dev/ttyAMA0 115200 noclear vt220
+
+The second `tty` syntax variant is for using an external getty, like
+agetty or the BusyBox getty.
+
+The third variant is for board bringup and the `rescue` boot mode.  No
+device node is required in this variant, the same output that the kernel
+uses is reused for stdio.  If the `rescue` option is omitted, a shell is
+started (`nologin`, `noclear`, and `nowait` are implied), if the rescue
+option is set the bundled `/libexec/finit/sulogin` is started to present
+a bare-bones root login prompt.  If the root (uid:0, gid:0) user does
+not have a password set, no rescue is possible.  For more information,
+see the [Rescue Mode](rescue.md) section.
+
+By default, the first two syntax variants *clear* the TTY and *wait* for
+the user to press enter before starting getty.
+
+**Example:**
+
+    tty [12345] /sbin/getty  -L 115200 /dev/ttyAMA0 vt100
+    tty [12345] /sbin/agetty -L ttyAMA0 115200 vt100 nowait
+
+The `noclear` option disables clearing the TTY after each session.
+Clearing the TTY when a user logs out is usually preferable.
+  
+The `nowait` option disables the `press Enter to activate console`
+message before actually starting the getty program.  On small and
+embedded systems running multiple unused getty wastes both memory
+and CPU cycles, so `wait` is the preferred default.
+
+The `nologin` option disables getty and `/bin/login`, and gives the
+user a root (login) shell on the given TTY `<DEV>` immediately.
+Needless to say, this is a rather insecure option, but can be very
+useful for developer builds, during board bringup, or similar.
+
+Notice the ordering, the `TERM` option to the built-in getty must be
+the last argument.
+
+Embedded systems may want to enable automatic `DEV` by supplying the
+special `@console` device.  This works regardless weather the system
+uses `ttyS0`, `ttyAMA0`, `ttyMXC0`, or anything else.  Finit figures
+it out by querying sysfs: `/sys/class/tty/console/active`.  The speed
+can be omitted to keep the kernel default.
+
+> Most systems get by fine by just using `console`, which will evaluate
+> to `/dev/console`.  If you have to use `@console` to get any output,
+> you may have some issue with your kernel config.
+
+**Example:**
+
+    tty [12345] @console noclear vt220
+
+On really bare bones systems, or for board bringup, Finit can give you a
+shell prompt as soon as bootstrap is done, without opening any device
+node:
+
+    tty [12345789] notty
+
+This should of course not be enabled on production systems.  Because it
+may give a user root access without having to log in.  However, for
+board bringup and system debugging it can come in handy.
+
+One can also use the `service` stanza to start a stand-alone shell:
+
+    service [12345] /bin/sh -l
@@ -34,8 +34,9 @@ build time:
 ./configure --with-rcsd=/etc/init.d --with-config=/etc/init.d/init.conf
 ```

-> **Note:** remember `--prefix` et al as well, the default is likely
->           *not* what you want.  See the [build docs][1] for details.
+> [!IMPORTANT]
+> Remember `--prefix` et al as well, the default is likely *not* what
+> you want.  See the [build docs][1] for details.

 The resulting directory structure is depicted below.  Please notice how
 `/etc/finit.conf` now resides in the same sub-directory as a non-symlink
@@ -0,0 +1,137 @@
+Configuration Example
+=====================
+
+This example `/etc/finit.conf` can also be split up in multiple `.conf`
+files in `/etc/finit.d`.  Available, but not yet enabled, services can
+be placed in `/etc/finit.d/available` and enabled by an operator using
+the [initctl](initctl.md) tool.
+
+See the [contrib/][contrib] directory on GitHub for examples, or take a
+peek at systems using Finit, like [Infix OS][infix] and [myLinux][].
+
+> [!TIP]
+> As of Finit v4.4, `.conf` lines can be broken up using the standard UNIX
+> continuation character (`\`), trailing comments are also supported.  The
+> latter means you must escape any hashes used in directives and descriptions
+> (`\#`).  For more on this and examples, see the [finit.conf(5)][] manual or
+> the [Configuration](config/index.md) section.
+
+```ApacheConf
+# Fallback if /etc/hostname is missing
+host default
+
+# Runlevel to start after bootstrap, 'S', default: 2
+#runlevel 2
+
+# Support for setting global environment variables, using foo=bar syntax
+# be careful though with variables like PATH, SHELL, LOGNAME, etc.
+#PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# Max file size for each log file: 100 kiB, rotate max 4 copies:
+# log => log.1 => log.2.gz => log.3.gz => log.4.gz
+log size=100k count=4
+
+# Services to be monitored and respawned as needed
+service [S12345] env:-/etc/conf.d/watchdog watchdog $WATCHDOG_OPTS $WATCHDOG_DEV -- System watchdog daemon
+service [S12345] env:-/etc/conf.d/syslog syslogd -n $SYSLOGD_OPTS          -- System log daemon
+service [S12345] <pid/syslogd> env:-/etc/conf.d/klogd klogd -n $KLOGD_OPTS -- Kernel log daemon
+service   [2345] env:-/etc/conf.d/lldpd lldpd -d $LLDPD_OPTS               -- LLDP daemon (IEEE 802.1ab)
+
+# The BusyBox ntpd does not use syslog when running in the foreground
+# So we use this trick to redirect stdout/stderr to a log file.  The
+# log file is rotated with the above settings.  The condition declares
+# a dependency on a system default route (gateway) to be set.  A single
+# <!> at the beginning means ntpd does not respect SIGHUP for restart.
+service [2345] log:/var/log/ntpd.log <!net/route/default> ntpd -n -l -I eth0 -- NTP daemon
+
+# For multiple instances of the same service, add :ID somewhere between
+# the service/run/task keyword and the command.
+service :80   [2345] merecat -n -p 80   /var/www -- Web server
+service :8080 [2345] merecat -n -p 8080 /var/www -- Old web server
+
+# Alternative method instead of below runparts, can also use /etc/rc.local
+#sysv [S] /etc/init.d/keyboard-setup       -- Setting up preliminary keymap
+#sysv [S] /etc/init.d/acpid                -- Starting ACPI Daemon
+#task [S] /etc/init.d/kbd                  -- Preparing console
+
+# Hidden from boot progress, using empty `--` description
+#sysv [S] /etc/init.d/keyboard-setup       --
+#sysv [S] /etc/init.d/acpid                --
+#task [S] /etc/init.d/kbd                  --
+
+# Run start scripts from this directory
+# runparts /etc/start.d
+
+# Virtual consoles run BusyBox getty, keep kernel default speed
+tty [12345] /sbin/getty -L 0 /dev/tty1  linux nowait noclear
+tty [2345]  /sbin/getty -L 0 /dev/tty2  linux nowait noclear
+tty [2345]  /sbin/getty -L 0 /dev/tty3  linux nowait noclear
+
+# Use built-in getty for serial port and USB serial
+#tty [12345] /dev/ttyAMA0 noclear nowait
+#tty [12345] /dev/ttyUSB0 noclear
+
+# Just give me a shell, I need to debug this embedded system!
+#tty [12345] console noclear nologin
+```
+
+The `service` stanza, as well as `task`, `run` and others are described in
+full in the [Services Syntax](config/services.md) section.
+
+Here's a quick overview of some of the most common components needed to start
+a UNIX daemon:
+
+```
+service [LVLS] <COND> log env:[-]/etc/default/daemon daemon ARGS -- Example daemon
+^       ^      ^      ^   ^                          ^      ^       ^
+|       |      |      |   |                          |      |        `---------- Optional description
+|       |      |      |   |                          |       `------------------ Daemon arguments
+|       |      |      |   |                           `------------------------- Path to daemon
+|       |      |      |    `---------------------------------------------------- Optional env. file
+|       |      |       `-------------------------------------------------------- Redirect output to log
+|       |       `--------------------------------------------------------------- Optional conditions
+|        `---------------------------------------------------------------------- Optional Runlevels
+ `------------------------------------------------------------------------------ Supervised program (daemon)
+```
+
+Some components are optional: runlevel(s), condition(s) and description,
+making it easy to create simple start scripts and still possible for more
+advanced uses as well:
+
+    service /usr/sbin/sshd -D
+
+Dependencies are handled using [conditions](conditions.md).  One of
+the most common conditions is to wait for basic networking to become
+available:
+
+    service <net/route/default> nginx -- High performance HTTP server
+
+Here is another example where we instruct Finit to not start BusyBox
+`ntpd` until `syslogd` has started properly.  Finit waits for `syslogd`
+to create its PID file, by default `/var/run/syslogd.pid`.
+
+    service [2345] log <!pid/syslogd> ntpd -n -N -p pool.ntp.org
+    service [S12345] syslogd -n -- Syslog daemon
+
+Notice the `log` keyword, BusyBox `ntpd` uses `stderr` for logging when
+run in the foreground.  With `log` Finit redirects `stdout` + `stderr`
+to the system log daemon using the command line `logger(1)` tool.
+
+A service, or task, can have multiple dependencies listed.  Here we wait
+for *both* `syslogd` to have started and basic networking to be up:
+
+    service [2345] log <pid/syslogd,net/route/default> ntpd -n -N -p pool.ntp.org
+
+If either condition fails, e.g. loss of networking, `ntpd` is stopped
+and as soon as it comes back up again `ntpd` is restarted automatically.
+
+> [!NOTE]
+> Make sure daemons do *not* fork and detach themselves from the controlling
+> TTY, usually an `-n` or `-f` flag, or `-D` as in the case of OpenSSH above.
+> If it detaches itself, Finit cannot monitor it and will instead try to
+> restart it.
+
+[finit.conf(5)]: https://man.troglobit.com/man5/finit.conf.5.html
+[infix]:         https://kernelkit.github.io
+[myLinux]:       https://github.com/troglobit/myLinux/
+[contrib]:       https://github.com/troglobit/finit/tree/master/contrib
@@ -0,0 +1,11 @@
+.md-header__topic:first-child {
+    font-weight: 500;
+    font-style: italic;
+}
+
+.md-header__title {
+    font-size: 1.1rem;
+    font-style: italic;
+    font-weight: 500;
+    line-height: 2.6rem;
+}
@@ -0,0 +1,178 @@
+Finit Features
+==============
+
+**Process Supervision**
+
+Start, monitor and restart services should they fail.
+
+
+**Getty**
+
+Finit supports external getty but also comes with a limited built-in
+Getty, useful for really small systems.  A getty sets up the TTY and
+waits for user input before handing over to `/bin/login`, which is
+responsible for handling the actual authentication.
+
+```conf
+tty [12345] /dev/tty1    nowait  linux
+tty [12345] /dev/ttyAMA0 noclear vt100
+tty [12345] /sbin/getty  -L /dev/ttyAMA0 vt100
+```
+
+Users of embedded systems may want to enable automatic serial console
+with the special `@console` device.  This works regardless whether the
+system uses `ttyS0`, `ttyAMA0`, `ttyMXC0`, or anything else.  Finit
+figures it out by querying sysfs: `/sys/class/tty/console/active`.
+
+```conf
+tty [12345] @console linux noclear
+```
+
+Notice the optional `noclear`, `nowait`, and `nologin` flags.  The
+latter is for skipping the login process entirely. For more information,
+see the [TTY and Consoles](config/tty.md) section.
+
+
+**Runlevels**
+
+Support for SysV init-style [runlevels][5] is available, in the same
+minimal style as everything else in Finit.  The `[2345]` syntax can be
+applied to service, task, run, and TTY stanzas.
+
+Reserved runlevels are 0 and 6, halt and reboot, respectively just like
+SysV init.  Runlevel 1 can be configured freely, but is recommended to
+be kept as the system single-user runlevel since Finit will not start
+networking here.  The configured `runlevel NUM` from `/etc/finit.conf`
+is what Finit changes to after bootstrap, unless 'single' (or 'S') is
+given on the kernel cmdline, in which case runlevel 1 is started.
+
+All services in runlevel S) are started first, followed by the desired
+run-time runlevel.  Run tasks in runlevel S can be started in sequence
+by using `run [S] cmd`.  Changing runlevels at runtime is done like any
+other init, e.g. <kbd>init 4</kbd>, but also using the more advanced
+[`initctl`](initctl.md) tool.
+
+
+**Conditions**
+
+As mentioned previously, Finit has an advanced dependency system to
+handle synchronization, called [conditions](conditions.md).  It can
+be used in many ways; depend on another service, network availability,
+etc.
+
+One *really cool* example useful for embedded systems is to run certain
+scripts if a board has a certain feature encoded in its device tree.  At
+bootstrap we run the following `ident` script:
+
+```sh
+#!/bin/sh
+conddir=/var/run/finit/cond/hw/model
+dtmodel=/sys/firmware/devicetree/base/model
+
+if ! test -e $dtmodel; then
+    exit 0
+fi
+
+model=$(cat $dtmodel | tr "[A-Z] " "[a-z]-")
+mkdir -p $conddir && ln -s ../../reconf $conddir/$model
+```
+
+Provided the device tree node exists, and is a string, we can then use
+the condition `<hw/model/foo>` when starting other scripts.  Here is an
+example:
+
+```
+run  [S]                /path/to/ident    --
+task [2] <hw/model/foo> /path/to/foo-init -- Initializing Foo board
+```
+
+> [!TIP]
+> Notice the trick with an empty description to hide the call to `ident`
+> in the Finit progress output.
+
+
+**Plugins**
+
+Plugins can *extend* the functionality of Finit and *hook into* the
+different stages of the boot process and at runtime.  Plugins are
+written in C and compiled into a dynamic library loaded automatically by
+finit at boot.  A basic set of plugins are bundled in the `plugins/`
+directory.
+
+Capabilities:
+
+- **Hooks**  
+  Hook into the boot at predefined points to extend Finit
+- **I/O**  
+  Listen to external events and control Finit behavior/services
+
+Extensions and functionality not purely related to what an `/sbin/init`
+needs to start a system are available as a set of plugins that either
+hook into the boot process or respond to various I/O.
+
+For more information, see the [Plugins](plugins.md) section.
+
+
+**Automatic Reload**
+
+By default, Finit monitors `/etc/finit.d/` and `/etc/finit.d/enabled/`
+registering any changes to `.conf` files.  To activate a change the user
+must call `initctl reload`, which reloads all modified files, stops any
+removed services, starts new ones, and restarts any modified ones.  If the
+command line arguments of a service have changed, the process will be
+terminated and then started again with the updated arguments. If the arguments
+have not been modified and the process supports SIGHUP, the process will
+receive a SIGHUP rather than being terminated and started.
+
+For some use-cases the extra step of calling `initctl reload` creates an
+unnecessary overhead, which can be removed at build-time using:
+
+    configure --enable-auto-reload
+
+
+**Cgroups**
+
+Finit supports cgroups v2 and comes with the following default groups in
+which services and user sessions are placed in:
+
+     /sys/fs/cgroup
+       |-- init/               # cpu.weight:100
+       |-- system/             # cpu.weight:9800
+       `-- user/               # cpu.weight:100
+
+Finit itself and its helper scripts and services are placed in the
+top-level leaf-node group `init/`, which also is _reserved_.
+
+All run/task/service/sysv processes are placed in their own sub-group
+in `system/`.  The name of each sub-group is taken from the respective
+`.conf` file from `/etc/finit.d`.
+
+All getty/tty processes are placed in their own sub-group in `user/`.
+The name of each sub-group is taken from the username.
+
+A fourth group also exists, the `root` group.  It is also _reserved_ and
+primarily intended for RT tasks.  If you have RT tasks they need to be
+declared as such in their service stanza like this:
+
+    service [...] <...> cgroup.root /path/to/foo args -- description
+
+or
+
+    cgroup.root
+    service [...] <...> /path/to/foo args -- description
+    service [...] <...> /path/to/bar args -- description
+
+See the [Cgroups](config/cgroups.md) section for more information, e.g.,
+how to configure per-group limits.
+
+The `initctl` tool has three commands to help debug and optimize the
+setup and monitoring of cgroups.  See the `ps`, `top`, and `cgroup`
+commands for details.
+
+> [!NOTE]
+> Systems that do not support cgroups, specifically version 2, are
+> automatically detected.  On such systems the above functionality is
+> disabled early at boot.
+
+
+[5]: https://en.wikipedia.org/wiki/Runlevel
@@ -0,0 +1,76 @@
+Introduction
+============
+
+![Alpine screenshot](img/alpine-screenshot2.png){ align=right }
+
+> Reverse engineered from the [EeePC fastinit][]  
+> "gaps filled with frog DNA …"  
+> — [Claudio Matsuoka][]
+
+Finit is a process starter and [supervisor][1] designed to run as PID 1
+on Linux systems.  It consists of a set of [plugins](plugins.md) and can
+be set up using [configuration files](config/files.md).  Plugins start
+at [hook points](plugins.md#hooks) and can run various set up tasks
+and/or install event handlers that later provide runtime services, e.g.,
+PID file monitoring, or [conditions](conditions.md).
+
+Features
+--------
+
+  * [Runlevels][5], defined per service
+  * One-shot tasks, services (daemons), or [SysV init][4] start/stop scripts
+  * Runparts and `/etc/rc.local` support
+  * Process supervision similar to [systemd][]
+  * Sourcing environment files
+  * Conditions for network/process/custom dependencies
+  * Readiness notification; PID files (native) for synchronizing system
+    startup, support for systemd [sd_notify()][], or [s6 style][] too
+  * Limited support for [tmpfiles.d(5)][] (no aging, attributes, or subvolumes)
+  * Pre/Post script actions
+  * Rudimentary [templating support](config/templating.md)
+  * Tooling to enable/disable services
+  * Built-in getty
+  * Built-in watchdog, with support for hand-over to [watchdogd][]
+  * Built-in support for Debian/BusyBox [`/etc/network/interfaces`][3]
+  * Cgroups v2, both configuration and monitoring in `initctl top`
+  * Plugin support for customization
+  * Proper rescue mode with bundled `sulogin` for protected maintenance shell
+  * Integration with [watchdogd][] for full system supervision
+  * Logging to kernel ring buffer before `syslogd` has started, see the
+    recommended [sysklogd][] project for complete logging integration
+	and how to log to the kernel ring buffer from scripts using `logger`
+
+For a more thorough overview, see the [Features](features.md) section.
+
+> [!TIP]
+> See [SysV Init Compatibility](config/sysv.md) for help to
+> quickly get going with an existing SysV or BusyBox init setup.
+
+
+Origin
+------
+
+This project is based on the [original finit][] by [Claudio Matsuoka][]
+which was reverse engineered from syscalls of the [EeePC fastinit][].
+
+Finit is developed and maintained by [Joachim Wiberg][] at [GitHub][6].
+Please file bug reports, clone it, or send pull requests for bug fixes
+and proposed extensions.
+
+
+
+[1]:                https://en.wikipedia.org/wiki/Process_supervision
+[3]:                https://manpages.debian.org/unstable/ifupdown2/interfaces.5.en.html
+[4]:                https://en.wikipedia.org/wiki/Init
+[5]:                https://en.wikipedia.org/wiki/Runlevel
+[6]:                https://github.com/troglobit/finit
+[systemd]:          https://www.freedesktop.org/wiki/Software/systemd/
+[sd_notify()]:      https://www.freedesktop.org/software/systemd/man/sd_notify.html
+[s6 style]:         https://skarnet.org/software/s6/notifywhenup.html
+[tmpfiles.d(5)]:    https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html
+[EeePC fastinit]:   https://web.archive.org/web/20071208212450/http://wiki.eeeuser.com/boot_process:the_boot_process
+[original finit]:   http://helllabs.org/finit/
+[Claudio Matsuoka]: https://github.com/cmatsuoka
+[Joachim Wiberg]:   https://troglobit.com
+[watchdogd]:        https://troglobit.com/watchdogd.html
+[sysklogd]:         https://github.com/troglobit/sysklogd/
@@ -0,0 +1,145 @@
+Commands & Status
+=================
+
+Finit also implements a modern API to query status, and start/stop
+services, called `initctl`.  Unlike `telinit` the `initctl` tool does
+not return until the given command has fully completed.
+
+```
+Usage: initctl [OPTIONS] [COMMAND]
+
+Options:
+  -b, --batch               Batch mode, no screen size probing
+  -c, --create              Create missing paths (and files) as needed
+  -f, --force               Ignore missing files and arguments, never prompt
+  -h, --help                This help text
+  -j, --json                JSON output in 'status' and 'cond' commands
+  -1, --once                Only one lap in commands like 'top'
+  -p, --plain               Use plain table headings, no ctrl chars
+  -q, --quiet               Silent, only return status of command
+  -t, --no-heading          Skip table headings
+  -v, --verbose             Verbose output
+  -V, --version             Show program version
+
+Commands:
+  debug                     Toggle Finit (daemon) debug
+  help                      This help text
+  version                   Show program version
+
+  ls | list                 List all .conf in /etc/finit.d
+  create   <CONF>           Create   .conf in /etc/finit.d/available
+  delete   <CONF>           Delete   .conf in /etc/finit.d/available
+  show     <CONF>           Show     .conf in /etc/finit.d/available
+  edit     <CONF>           Edit     .conf in /etc/finit.d/available
+  touch    <CONF>           Change   .conf in /etc/finit.d/available
+  enable   <CONF>           Enable   .conf in /etc/finit.d/available
+  disable  <CONF>           Disable  .conf in /etc/finit.d/enabled
+  reload                    Reload  *.conf in /etc/finit.d (activate changes)
+
+  cond     set   <COND>     Set (assert) user-defined conditions     +usr/COND
+  cond     get   <COND>     Get status of user-defined condition, see $? and -v
+  cond     clear <COND>     Clear (deassert) user-defined conditions -usr/COND
+  cond     status           Show condition status, default cond command
+  cond     dump  [TYPE]     Dump all, or a type of, conditions and their status
+
+  log      [NAME]           Show ten last Finit, or NAME, messages from syslog
+  start    <NAME>[:ID]      Start service by name, with optional ID
+  stop     <NAME>[:ID]      Stop/Pause a running service by name
+  reload   <NAME>[:ID]      Reload service as if .conf changed (SIGHUP or restart)
+                            This allows restart of run/tasks that have already run
+                            Note: Finit .conf file(s) are *not* reloaded!
+  restart  <NAME>[:ID]      Restart (stop/start) service by name
+  kill     <NAME>[:ID] <S>  Send signal S to service by name, with optional ID
+  ident    [NAME]           Show matching identities for NAME, or all
+  status   <NAME>[:ID]      Show service status, by name
+  status                    Show status of services, default command
+
+  cgroup                    List cgroup config overview
+  ps                        List processes based on cgroups
+  top                       Show top-like listing based on cgroups
+
+  plugins                   List installed plugins
+
+  runlevel [0-9]            Show or set runlevel: 0 halt, 6 reboot
+  reboot                    Reboot system
+  halt                      Halt system
+  poweroff                  Halt and power off system
+  suspend                   Suspend system
+
+  utmp     show             Raw dump of UTMP/WTMP db
+```
+
+For services *not* supporting `SIGHUP` the `<!>` notation in the .conf
+file must be used to tell Finit to stop and start it on `reload` and
+`runlevel` changes.  If `<>` holds more [conditions](conditions.md),
+these will also affect how a service is maintained.
+
+> [!NOTE]
+> Even though it is possible to start services not belonging in the
+> current runlevel these services will not be respawned automatically by
+> Finit if they exit (crash).  Hence, if the runlevel is 2, the below
+> Dropbear SSH service will not be restarted if it is killed or exits.
+
+The `status` command is the default, it displays a quick overview of all
+monitored run/task/services.  Here we call `initctl -p`, suitable for
+scripting and documentation:
+
+```
+alpine:~# initctl -p
+PID   IDENT     STATUS   RUNLEVELS     DESCRIPTION
+======================================================================
+1506  acpid     running  [---2345----] ACPI daemon
+1509  crond     running  [---2345----] Cron daemon
+1489  dropbear  running  [---2345----] Dropbear SSH daemon
+1511  klogd     running  [S-12345----] Kernel log daemon
+1512  ntpd      running  [---2345----] NTP daemon
+1473  syslogd   running  [S-12345----] Syslog daemon
+
+alpine:~# initctl -pv
+PID   IDENT     STATUS   RUNLEVELS     COMMAND
+======================================================================
+1506  acpid     running  [---2345----] acpid -f
+1509  crond     running  [---2345----] crond -f -S $CRON_OPTS
+1489  dropbear  running  [---2345----] dropbear -R -F $DROPBEAR_OPTS
+1511  klogd     running  [S-12345----] klogd -n $KLOGD_OPTS
+1512  ntpd      running  [---2345----] ntpd -n $NTPD_OPTS
+1473  syslogd   running  [S-12345----] syslogd -n
+```
+
+The environment variables to each of the services above are read from,
+in the case of Alpine Linux, `/etc/conf.d/`.  Other distributions may
+have other directories, e.g., Debian use `/etc/default/`.
+
+The `status` command takes an optional `NAME:ID` argument.  Here we
+check the status of `dropbear`, which only has one instance in this
+system:
+
+```
+alpine:~# initctl -p status dropbear
+     Status : running
+   Identity : dropbear
+Description : Dropbear SSH daemon
+     Origin : /etc/finit.d/enabled/dropbear.conf
+Environment : -/etc/conf.d/dropbear
+Condition(s):
+    Command : dropbear -R -F $DROPBEAR_OPTS
+   PID file : !/run/dropbear.pid
+        PID : 1485
+       User : root
+      Group : root
+     Uptime : 2 hour 46 min 56 sec
+  Runlevels : [---2345----]
+     Memory : 1.2M
+     CGroup : /system/dropbear cpu 0 [100, max] mem [--.--, max]
+              |- 1485 dropbear -R -F
+              |- 2634 dropbear -R -F
+              |- 2635 ash
+              `- 2652 initctl -p status dropbear
+
+Apr  8 12:19:49 alpine authpriv.info dropbear[1485]: Not backgrounding
+Apr  8 12:37:45 alpine authpriv.info dropbear[2300]: Child connection from 192.168.121.1:47834
+Apr  8 12:37:46 alpine authpriv.notice dropbear[2300]: Password auth succeeded for 'root' from 192.168.121.1:47834
+Apr  8 12:37:46 alpine authpriv.info dropbear[2300]: Exit (root) from <192.168.121.1:47834>: Disconnect received
+Apr  8 15:02:11 alpine authpriv.info dropbear[2634]: Child connection from 192.168.121.1:48576
+Apr  8 15:02:12 alpine authpriv.notice dropbear[2634]: Password auth succeeded for 'root' from 192.168.121.1:48576
+```
@@ -0,0 +1,14 @@
+keventd
+=======
+
+The kernel event daemon bundled with Finit is a simple uevent monitor
+for `/sys/class/power_supply`.  It provides the `sys/pwr/ac` condition,
+which can be useful to prevent power hungry services like anacron to run
+when a laptop is only running on battery, for instance.
+
+Since keventd is not an integral part of Finit yet it is not enabled by
+default.  Enable it using `./configure --with-keventd`.  The bundled
+`contrib/` build scripts for Debian, Alpine, and Void have this enabled.
+
+This daemon is planned to be extended with monitoring of other uevents,
+patches and ideas are welcome in the issue tracker.
@@ -1,14 +1,9 @@
 Hooks & Plugins
 ===============

-* [Plugins](#plugins)
-* [Hooks](#hooks)
-  * [Bootstrap Hooks](#bootstrap-hooks)
-  * [Runtime Hooks](#runtime-hooks)
-  * [Shutdown Hooks](#shutdown-hooks)
-
 Finit can be extended to add general functionality in the form of I/O
-monitors, or hook plugins.
+monitors, or hook plugins.  It is even possible to run scripts at these
+hook points, see below.

 The following sections detail existing plugins and hook points.  For
 more information, see the plugins listed below.
@@ -27,21 +22,45 @@ For your convenience a set of *optional* plugins are available:
  system and runs at `HOOK_BASEFS_UP`.  The `/var`, `/run`, and `/dev`
  file systems must be writable for this plugin to work.

-  Note: On an embedded system both `/var` and `/run` can be `tmpfs` RAM
-  disks and `/dev` is usually a `devtmpfs`.  This must be defined in the
-  `/etc/fstab` file and in the Linux kernel config.
+  This plugin is a wrapper for the [tmpfiles.d(5)][] implementation that
+  Finit has.  Capable but limited: no aging, attributes, or subvolumes.
+
+  By default, `/lib/finit/tmpfiles.d` carries all the default .conf
+  files distributed with Finit.  It is read first but can be overridden
+  by any of the standard tmpfiles.d directories, e.g. `/etc/tmpfiles.d`.
+
+> [!NOTE]
+> On an embedded system both `/var` and `/run` can be `tmpfs` RAM
+> disks and `/dev` is usually a `devtmpfs`.  This must be defined in
+> the `/etc/fstab` file and in the Linux kernel config.

 * *dbus.so*: Setup and start system message bus, D-Bus, at boot.
  _Optional plugin._

 * *hook-scripts.so*: Trigger the execution of scripts from plugin hook
-  points (see [Hooks](#hooks)).  Scripts are located in
-  `/libexec/finit/hook` by default, this can be build-time customized
-  by using the `--with-hook-scripts-path=PATH` argument to
-  `configure`.  _Optional plugin._
+  points (see [Hooks](#hooks)).  _Optional plugin._

-* *hotplug.so*: Setup and start either udev or mdev hotplug daemon, if
-  available.  Enabled by default.
+  This plugin is particularly useful for early boot debugging that needs
+  to take place before regular services are available.
+
+  For example, say that you want to enable some kernel tracing before
+  modules are loaded. With hook scripts, you can just drop in a shell
+  script in `/libexec/finit/hook/mount/all/` that will poke the right
+  control files in tracefs.
+
+  Scripts are located in `/libexec/finit/hook` by default, this can be
+  customized at build-time using the `--with-hook-scripts-path=PATH`
+  argument to `configure`.
+
+* *hotplug.so*: Replaced with `/lib/finit/system/10-hotplug.conf`, which
+  checks for `udevd` and `mdev` at boot.  This file can be overridden by a
+  file in `/etc/finit.d/10-hotplug.conf`.
+
+  Enabled by default.
+  
+> [!TIP]
+> See the [Services](config/services.md) section in the configuration
+> guide for an example how to run `mdevd`, alternative to plain mdev.

 * *rtc.so*: Restore and save system clock from/to RTC on boot/halt.
  Enabled by default.
@@ -49,20 +68,34 @@ For your convenience a set of *optional* plugins are available:
 * *modules-load.so*: Scans `/etc/modules-load.d/*.conf` for modules to
  load using `modprobe`.  Each file can contain multiple lines with the
  name of the module to load.  Any line starting with the standard UNIX
-  comment character, `#`, is skipped.
+  comment character, `#`, or `;`, is skipped.
  
-  Modules are loaded when entering runlevel `[2345]` using the `task`
-  stanza.  Each module gets a unique `name:modprobe.foo`, and
-  optional`:ID`.  The `:ID` is a globally incremented index, which can
-  be disabled per file (anywhere) using the following config line:
+  Modules are by default loaded in runlevel `S` using the `task` stanza.
+  Each module gets a unique `name:modprobe.foo`, and optional`:ID`.  The
+  runlevel can be changed per file using:
+
+        set runlevel 2345
+
+  The `:ID` is a globally incremented index, which can be disabled per
+  file (anywhere) using the following config line:

        set noindex

-  **Note:** unlike the traditional .conf `module` directive, which load
-  any listed module immediately, this plugin creates standard `taks`
-  directives which load the module(s) in the background.  As long as
-  the `modprobe` program is found in the path, these tasks will always
-  return `[ OK ]` at boot.  Check the actual status using `initctl`.
+  To change the index used by the plugin:
+
+        set index 1234
+
+  Since these tasks run in the background, they return `[ OK ]` at boot,
+  unless the modprobe tool does not exist.  Check syslog for warnings
+  and the actual status of the operation using `initctl`.
+
+> [!IMPORTANT]
+> Unlike the traditional .conf `module` directive, which load any listed
+> module immediately, this plugin creates a background `task` which load
+> the module(s) in the background.  The program is modprobe,
+> `/sbin/modprobe`, which you can override per .conf file:
+> 
+>     set modprobe /path/to/maybe-a-modprobe-wrapper

 * *netlink.so*: Listens to Linux kernel Netlink events for gateway and
  interfaces.  These events are then sent to the Finit service monitor
@@ -91,45 +124,107 @@ state, etc.  Available hook points are:
 Hooks
 -----

+In the below listings, the first label is the hook point for a C plugin,
+the second is the condition name and hook script path.  A hook script is
+a plain shell script, or program, that does a very small dedicated job
+at the below hook points.
+
+See [Run-parts Scripts](config/runparts.md) for details on the
+requirements, possibilities, and *limitations* of hook scripts.
+
+All hook scripts are called with at least one environment variable set,
+the hook name, useful when reusing the same hook script for multiple
+hook points:
+
+  - `FINIT_HOOK_NAME`: set to the second label, e.g., `hook/net/up`
+  - `FINIT_SHUTDOWN`: set for `hook/sys/shutdown` and later to one
+    of `halt`, `poweroff`, or `reboot`.
+
+**Example:**
+
+    $ mkdir -p /libexec/finit/hook/sys/down
+    $ cat <<EOF >/libexec/finit/hook/sys/down/foo.sh
+    #!/bin/sh
+    echo 'I run just before the reboot() syscall at shutdown/reboot'
+    echo 'I have access to /dev since devtmpfs is exempt from umount'
+    echo "FINIT_HOOK_NAME: $FINIT_HOOK_NAME"
+    if [ -n "$FINIT_SHUTDOWN" ]; then
+            echo "FINIT_SHUTDOWN:  $FINIT_SHUTDOWN"
+    fi
+    exit 0
+    EOF
+    $ chmod +x /libexec/finit/hook/sys/down/foo.sh
+
+> [!IMPORTANT]
+> To use hook scripts, even for pre-bootstrap and pre-shutdown tasks,
+> you must build with `configure --enable-hook-scripts-plugin`.
+
+
 ### Bootstrap Hooks

-* `HOOK_BANNER`: The very first point at which a plugin can run.
-  Intended to be used as a banner replacement.  Essentially this runs
-  just before entering runlevel S.  Assume nothing is available, so
-  be prepared to use absolute paths, etc.
+* `HOOK_BANNER`, `hook/sys/banner`: The very first point at which a
+  plugin can run.  Intended to be used as a banner replacement.
+  Essentially this runs just before entering runlevel S.  Assume nothing
+  is available, so be prepared to use absolute paths, etc.

-* `HOOK_ROOTFS_UP`: When `finit.conf` has been read and `/` has is
-  mounted — very early
+* `HOOK_ROOTFS_UP`, `hook/mount/root`: When `finit.conf` has been read
+  and `/` has is mounted — very early

-* `HOOK_BASEFS_UP`: All of `/etc/fstab` is mounted, swap is available
-  and default init signals are setup
+* `HOOK_MOUNT_ERROR`, `hook/mount/error`: executed if `mount -a` fails

-* `HOOK_NETWORK_UP`: System bootstrap, runlevel S, has completed and
-  networking is up (`lo` is up and the `network` script has run)
+* `HOOK_MOUNT_POST`, `hook/mount/post`: always executed after `mount -a`

-* `HOOK_SVC_UP`: All services in the active runlevel has been launched
+* `HOOK_BASEFS_UP`, `hook/mount/all`: All of `/etc/fstab` is mounted,
+  swap is available and default init signals are setup

-* `HOOK_SYSTEM_UP`: All services *and* everything in `/etc/finit.d`
-  has been launched
+* `HOOK_SVC_PLUGIN`, `hook/svc/plugin`: Called in `conf_init()` right
+  before loading `/etc/finit.conf`.  For plugins to register any early
+  run/task/services, please do NOT use any earlier hook point.  That
+  will cause uninitialized rlimits that lead to unpredictable results
+  when Finit later tries to start the run/task/service.
+
+* `HOOK_NETWORK_UP`, `hook/net/up`: System bootstrap, runlevel S, has
+  completed and networking is up (`lo` is up and the `network` script
+  has run)
+
+* `HOOK_SVC_UP`, `hook/svc/up`: All services in the active runlevel have
+  been launched
+
+* `HOOK_SYSTEM_UP`, `hook/sys/up`: All services *and* everything in
+  `/etc/finit.d` has been launched

 ### Runtime Hooks

-* `HOOK_SVC_RECONF`: Called when the user has changed something in the
-  `/etc/finit.d` directory and issued `SIGHUP`.  The hook is called when
-  all modified/removed services have been stopped.  When the hook has
-  completed, Finit continues to start all modified and new services.
+* `HOOK_SVC_RECONF`, N/A: Called when the user has changed something in
+  the `/etc/finit.d` directory and issued `SIGHUP`.  The hook is called
+  when all modified/removed services have been stopped.  When the hook
+  has completed, Finit continues to start all modified and new services.

-* `HOOK_RUNLEVEL_CHANGE`: Called when the user has issued a runlevel
-  change.  The hook is called when services not matching the new
-  runlevel have been been stopped.  When the hook has completed, Finit
-  continues to start all services in the new runlevel.
+* `HOOK_RUNLEVEL_CHANGE`, N/A: Called when the user has issued a
+  runlevel change.  The hook is called when services not matching the
+  new runlevel have been been stopped.  When the hook has completed,
+  Finit continues to start all services in the new runlevel.

 ### Shutdown Hooks

-* `HOOK_SHUTDOWN`: Called at shutdown/reboot, right before all
-  services are sent `SIGTERM`
+* `HOOK_NETWORK_DN`, `hook/net/down`: Called right after having changed
+  to runlevel 6, or 0, when all services have received their 'stop' signal.
+
+* `HOOK_SHUTDOWN`, `hook/sys/shutdown`: Called at shutdown/reboot, right
+  before all services are sent `SIGTERM`
+
+* `HOOK_SVC_DN`, `hook/svc/down`: In shutdown/reboot, all services and
+  non-reserved processes have been killed.  **Note:** only hook scripts
+  can run here!
+
+* `HOOK_SYSTEM_DN`, `hook/sys/down`: In shutdown/reboot, called after
+  all non-reserved file systems have been unmounted, just before Finit
+  tells the kernel to reboot or shut down.  **Note:** only hook scripts
+  can run here!

 Plugins like `tty.so` extend finit by acting on events, they are called
 I/O plugins and are called from the finit main loop when `poll()`
 detects an event.  See the source code for `plugins/*.c` for more help
 and ideas.
+
+[tmpfiles.d(5)]: https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html
@@ -0,0 +1,25 @@
+Requirements
+============
+
+Finit is capable of running on both desktop/server systems with udev and
+embedded systems that usually come with BusyBox mdev.  Some systems have
+systemd-udev or eudev today instead of the original udev, Finit probes
+for all of them at runtime and expects `/dev/` to be a writable file
+system using `devtmpfs`.  It is also possible to run on a statically set
+up `/dev` if needed.  It is however not a good idea to have both udev
+and mdev installed at the same time, this will lead to unpredictable
+results.
+
+At boot Finit calls either `mdev` or `udevd` to populate `/dev`, this is
+done slightly differently and on systems with udev you might want to add
+the following one-shot task early in your `/etc/finit.conf`:
+
+```conf
+run [S] udevadm settle --timeout=120 -- Waiting for udev
+```
+
+Finit has a built-in Getty for TTYs, but requires a working `/bin/login`
+or `/bin/sh`, if no TTYs are configured in `/etc/finit.conf`.
+
+For a fully operational system `/var`, `/run` and `/tmp` must be set up
+properly in `/etc/fstab` -- which is iterated over at boot.
@@ -0,0 +1,64 @@
+Runlevel Support
+================
+
+Basic support for [runlevels][5] is included in Finit from v1.8.  By
+default all services, tasks, run commands and TTYs listed without a set
+of runlevels get a default set `[234]` assigned.  The default runlevel
+after boot is 2.
+
+Finit supports runlevels 0-9, and S, with 0 reserved for halt, 6 reboot
+and S for services that only run at bootstrap.  Runlevel 1 is the single
+user level, where usually no networking is enabled.  In Finit this is
+more of a policy for the user to define.  Normally only runlevels 1-6
+are used, and even more commonly, only the default runlevel is used.
+
+To specify an allowed set of runlevels for a `service`, `run` command,
+`task`, or `tty`, add `[NNN]` to your `/etc/finit.conf`, like this:
+
+```
+service [S12345] syslogd -n -x             -- System log daemon
+run     [S]      /etc/init.d/acpid start   -- Starting ACPI Daemon
+task    [S]      /etc/init.d/kbd start     -- Preparing console
+service [S12345] <pid/syslogd> klogd -n -x -- Kernel log daemon
+
+tty     [12345]  /dev/tty1
+tty     [2]      /dev/tty2
+tty     [2]      /dev/tty3
+tty     [2]      /dev/tty4
+tty     [2]      /dev/tty5
+tty     [2]      /dev/tty6
+```
+
+In this example syslogd is first started, in parallel, and then acpid is
+called using a conventional SysV init script.  It is called with the run
+command, meaning the following task command to start the kbd script is
+not called until the acpid init script has fully completed.  Then the
+keyboard setup script is called in parallel with klogd as a monitored
+service.
+
+Again, tasks and services are started in parallel, while run commands
+are called in the order listed and subsequent commands are not started
+until a run command has completed.  Also, task and run commands are run
+in a shell, so pipes and redirects can be used.
+
+The following examples illustrate this.  Bootstrap task and run commands
+are also removed when they have completed, `initctl show` will not list
+them.
+
+```
+task [S] echo "foo" | cat >/tmp/bar
+run  [S] echo "$HOME" >/tmp/secret
+```
+
+Switching between runlevels can be done by calling init with a single
+argument, e.g. <kbd>init 5</kbd>, or using `initctl runlevel 5`, both
+switch to runlevel 5.  When changing runlevels Finit also automatically
+reloads all `.conf` files in the `/etc/finit.d/` directory.  So if you
+want to set a new system config, switch to runlevel 1, change all config
+files in the system, and touch all `.conf` files in `/etc/finit.d`
+before switching back to the previous runlevel again — that way Finit
+can both stop old services and start any new ones for you, without
+rebooting the system.
+
+
+[5]: https://en.wikipedia.org/wiki/Runlevel
@@ -0,0 +1,49 @@
+Runparts & `/etc/rc.local`
+==========================
+
+At the end of the boot, when all bootstrap (`S`) tasks and services have
+started, but not networking, Finit calls its built-in [run-parts(8)][]
+command on any configured `runparts <DIR>` directory.  This happens just
+before changing to the configured runlevel (default 2).  (Networking is
+enabled just prior to changing from single user mode.)
+
+```shell
+runparts /etc/rc.d/
+```
+
+Right after the runlevel change when all services have started properly,
+`/etc/rc.local` is called.
+
+No configuration stanza in `/etc/finit.conf` is required for `rc.local`.
+If it exists and is an executable shell script Finit calls it at the very
+end of the boot, before calling the `HOOK_SYSTEM_UP`.  See more in the
+[Hook Scripts](plugins.md#hooks) section.
+
+
+### Limitations
+
+It is not possible to call Finit via signals or use `initctl` in any
+runparts or `/etc/rc.local` script.  This because Finit is single
+threaded and is calling these scripts in a blocking fashion at the end
+of runlevel S, at which point the event loop has not yet been started.
+
+The event loop is the whole thing which Finit is built around, except
+for runlevel S, which remains a slow procession through a lot of set up,
+with a few hooks and blocking call outs to external scripts.
+
+However, not all `initctl` commands are prohibited. Supported commands:
+
+ - `initctl cond`: only operate on files in `/run/finit/cond`
+ - `initctl enable/disable`: enabled run/task/service is activated on
+   the runlevel change from S to 2
+ - `initctl touch/show/create/delete/list`: `create`, provided the
+   non-interactive mode is used, again changes take effect in the
+   runlevel change directly after bootstrap
+ - `initctl -f reboot/poweroff/halt`: provided the `-f` flag is used to
+   force direct kernel commands
+
+> [!TIP]
+> you can set a `usr/` condition in `/etc/rc.local` and have a
+> service/task in runlevel 2 depend on it to execute.
+
+[run-parts(8)]:     https://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
@@ -1,15 +1,13 @@
-Finit Services
-==============
-
 Starting & Monitoring
---------------------
+=====================

 Finit can start and monitor the following types of daemons:

 * Forks to background, creates a PID file
-* Runs in foreground:
-  - creates a PID file
+* Runs in foreground and signals ready by:
+  - creating a PID file
  - does not create a PID file -- Finit can create it for you (optional)
+  - [other mechanism][1] (systemd, s6)

 Finit can *not* start and monitor a daemon that:

@@ -22,10 +20,12 @@ Finit can *not* start and monitor a daemon that:
 | ✔ | No      | No               | Yes, optionally        |
 | ✘ | Yes     | No               | No                     |

-> **Note:** PID files is one mechanism used to assert conditions to
-> synchronize the start and stop of other, dependent, services.
+> [!NOTE]
+> PID files is one mechanism used to assert conditions to synchronize
+> the start and stop of other, dependent, services.  Other mechanisms
+> are described in the [Service Synchronization][1] section.

-### Forks to Background w/ PID File
+### Forks to bg w/ PID file

 There are two syntax variants, type 1 and type 2.  The former is the
 traditional one used also for `sysv` start/stop scripts, and the latter
@@ -39,49 +39,19 @@ In this example the resulting files to watch for are `/run/serv.pid` and
 `/var/run/serv.pid`, respectively.  On most modern Linux systems this is
 the same directory (`/var/run` is a symlink to `../run`).

-### Runs in Foreground w/ PID File
+### Runs in fg w/ PID file

    service                    serv -n -p -- Foreground service w/ PID file

-### Runs in Foreground w/o PID File
+### Runs in fg w/o PID file

 Same as previous, but we tell Finit to create the PID file, because we
 need it to synchronize start/stop of a dependent service.

    service pid:/run/serv.pid  serv -n    -- Foreground service w/o PID file

-### Runs in Foreground w/ Custom PID File
+### Runs in fg w/ custom PID file

    service pid:/run/servy.pid serv -n -p -P /run/servy.pid -- Foreground service w/ custom PID file

-
-State Machine
-------------
-
-A service is bound to a state machine that is in one of six (6) states.
-For `run`s and `task`s there is an additional end state called `DONE`,
-not shown in the diagram for brevity.  Services start in the `HALTED`
-state.
-
-![The service state machine](svc-machine.png "The service state machine")
-
-The current state depends on the two following conditions:
-
-* `E`: Service enabled. In order for `E` to be satisfied, the service
-  must be allowed to run in the current runlevel and not be stopped.
-  
-  A service may be stopped, or blocked, for several reasons:
-
-  - The user has manually stopped the service using `initctl stop NAME`
-  - The program exits immediately. I.e. keeps crashing (make sure to use
-    the 'run this service in the foreground' command line option)
-  - The binary is missing in the filesystem
-
-* `C`: Service conditions are satisfied:
-
-  - `on` (+): The condition is asserted.
-  - `off` (-): The condition is deasserted.
-  - `flux` (~): The condition state is unknown.
-
-For a detailed description of conditions, and how to debug them,
-see the [Finit Conditions](conditions.md) document.
+[1]: config/service-sync.md
@@ -0,0 +1,30 @@
+State Machine
+=============
+
+A service is bound to a state machine that is in one of ten states.  For
+run/tasks there is an additional end state called `DONE`.  All processes
+managed by Finit start in the `HALTED` state.  The image shows how both
+conditions and commands drive the machine.
+
+![The service state machine](img/svc-machine.png "The service state machine")
+
+The current state depends on the two following conditions:
+
+* `E`: Service enabled. In order for `E` to be satisfied, the service
+  must be allowed to run in the current runlevel and not be stopped.
+  
+  A service may be stopped, or blocked, for several reasons:
+
+  - The user has manually stopped the service using `initctl stop NAME`
+  - The program exits immediately. I.e. keeps crashing (make sure to use
+    the 'run this service in the foreground' command line option)
+  - The binary is missing in the filesystem
+
+* `C`: Service conditions are satisfied:
+
+  - `on` (+): The condition is asserted.
+  - `off` (-): The condition is deasserted.
+  - `flux` (~): The condition state is unknown.
+
+For a detailed description of conditions, and how to debug them,
+see the [Finit Conditions](conditions.md) document.
@@ -0,0 +1,31 @@
+Bundled Watchdog Daemon
+=======================
+
+When built `--with-watchdog` a separate service is built and installed
+in `/libexec/finit/watchdogd`.  If this exists at runtime, and the WDT
+device node exists, Finit will start it and treat it as the elected
+watchdog service to delegate its reboot to.  This delegation is to
+ensure that the system is rebooted by a hardware watchdog timer -- on
+many embedded systems this is crucial to ensure all circuits on the
+board are properly reset for the next boot, in effect ensuring the
+system works the same after both a power-on and reboot event.
+
+The delegation is performed at the very last steps of system shutdown,
+if reboot has been selected and an elected watchdog is known, first a
+`SIGPWR` is sent to advise watchdogd of the pending reboot.  Then, when
+the necessary steps of preparing the system for shutdown (umount etc.)
+are completed, Finit sends `SIGTERM` to watchdogd and puts itself in a
+10 sec timeout loop waiting for the WDT to reset the board.  If a reset
+is not done before the timeout, Finit falls back to`reboot(RB_AUTOBOOT)`
+which tells the kernel to do the reboot.
+
+An external watchdog service can also be used.  The more advanced cousin
+[watchdogd](https://github.com/troglobit/watchdogd/) is the recommended
+option here.  It can register itself with Finit using the same IPC as
+`initctl`.  If the bundled watchdogd is running a hand-over takes place,
+so it's safe to have both services installed on a system.  For the
+hand-over to work it requires that the WDT driver supports the safe exit
+functionality where `"V"` is written to the device before closing the
+device descriptor.  If the kernel driver has been built without this,
+the only option is to remove `/libexec/finit/watchdogd` or build without
+it at configure time.
@@ -0,0 +1,7 @@
+.deps/*
+.libs/*
+.dirstamp
+*.lo
+libsystemd.*
+Makefile
+Makefile.in
@@ -0,0 +1,14 @@
+# libsystemd replacement library
+lib_LTLIBRARIES          = libsystemd.la
+libsystemd_la_SOURCES    = sd-daemon.c sd-daemon.h
+libsystemd_la_LDFLAGS    = -version-info 0:0:0
+libsystemd_la_CFLAGS     = $(lite_CFLAGS)
+libsystemd_la_LIBADD     = $(lite_LIBS)
+
+# pkg-config support
+pkgconfigdir = $(libdir)/pkgconfig
+pkgconfig_DATA = libsystemd.pc
+
+# Install header to systemd/ subdirectory
+systemddir = $(includedir)/systemd
+systemd_HEADERS = sd-daemon.h
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: libsystemd
+Description: Finit replacement for systemd notification library
+Version: @PACKAGE_VERSION@
+Libs: -L${libdir} -lsystemd
+Cflags: -I${includedir}
@@ -0,0 +1,221 @@
+/* SPDX-License-Identifier: MIT-0 */
+
+/*
+ * systemd notify protocol, supporting readiness notification on startup
+ * and reloading, according to the protocol defined at:
+ * https://www.freedesktop.org/software/systemd/man/latest/sd_notify.html
+ *
+ * This protocol is guaranteed to be stable as per:
+ * https://systemd.io/PORTABILITY_AND_STABILITY/
+ */
+
+#define _GNU_SOURCE 1
+#include <errno.h>
+#include <inttypes.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <time.h>
+#include <unistd.h>
+#ifdef _LIBITE_LITE
+# include <libite/lite.h>
+#else
+# include <lite/lite.h>
+#endif
+
+#include "sd-daemon.h"
+
+/*
+ * NOTE: As per spec., this function does not return POSIX OK(0) but
+ *       rather "a positive value", i.e., 1.
+ */
+int sd_notify(int unset_environment, const char *state)
+{
+	struct sockaddr_un sun = {
+		.sun_family = AF_UNIX,
+	};
+	size_t len, sun_len;
+	const char *path;
+	ssize_t written;
+	int sd;
+
+	if (!state)
+		return -EINVAL;
+
+	len = strlen(state);
+	if (len == 0)
+		return -EINVAL;
+
+	/* If the variable is not set, the protocol is a noop */
+	path = getenv("NOTIFY_SOCKET");
+	if (!path)
+		return 0;	/* Not set? Nothing to do */
+
+	/* Only AF_UNIX is supported, with path or abstract sockets */
+	if (path[0] != '/' && path[0] != '@')
+		return -EAFNOSUPPORT;
+
+	/* Ensure there is room for NUL byte */
+	sun_len = strlen(path);
+	if (sun_len >= sizeof(sun.sun_path))
+		return -E2BIG;
+
+	strlcpy(sun.sun_path, path, sizeof(sun.sun_path));
+	if (sun.sun_path[0] == '@')
+		sun.sun_path[0] = 0;
+
+	sd = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+	if (sd == -1)
+		return -errno;
+
+	if (connect(sd, (struct sockaddr *)&sun, offsetof(struct sockaddr_un, sun_path) + sun_len) == -1) {
+		close(sd);
+		return -errno;
+	}
+
+	if (unset_environment)
+		unsetenv("NOTIFY_SOCKET");
+
+	written = write(sd, state, len);
+	close(sd);
+	if (written != (ssize_t) len)
+		return written < 0 ? -errno : -EPROTO;
+
+	return 1;
+}
+
+/*
+ * Printf-style notification function
+ */
+int sd_notifyf(int unset_environment, const char *format, ...)
+{
+	va_list ap;
+	char *state;
+	int ret;
+
+	if (!format)
+		return -EINVAL;
+
+	va_start(ap, format);
+	ret = vasprintf(&state, format, ap);
+	va_end(ap);
+
+	if (ret < 0)
+		return -ENOMEM;
+
+	ret = sd_notify(unset_environment, state);
+	free(state);
+
+	return ret;
+}
+
+/*
+ * PID-specific notification function
+ */
+int sd_pid_notify(pid_t pid, int unset_environment, const char *state)
+{
+	char path[256], *env;
+	size_t len;
+	int ret;
+
+	if (!state)
+		return -EINVAL;
+
+	len = strlen(state);
+	if (len == 0)
+		return -EINVAL;
+
+	if (pid == 0)
+		pid = getpid();
+
+	env = getenv("NOTIFY_SOCKET");
+	if (env) {
+		env = strdup(env);
+		if (!env)
+			return -errno;
+	}
+
+	snprintf(path, sizeof(path), "@run/finit/notify/%d", pid);
+	setenv("NOTIFY_SOCKET", path, 1);
+
+	ret = sd_notify(unset_environment, state);
+
+	if (env) {
+		setenv("NOTIFY_SOCKET", env, 1);
+		free(env);
+	}
+
+	return ret;
+}
+
+/*
+ * PID-specific printf-style notification function
+ */
+int sd_pid_notifyf(pid_t pid, int unset_environment, const char *format, ...)
+{
+	va_list ap;
+	char *state;
+	int ret;
+
+	if (!format)
+		return -EINVAL;
+
+	va_start(ap, format);
+	ret = vasprintf(&state, format, ap);
+	va_end(ap);
+
+	if (ret < 0)
+		return -ENOMEM;
+
+	ret = sd_pid_notify(pid, unset_environment, state);
+	free(state);
+
+	return ret;
+}
+
+/*
+ * Socket activation stub - Finit doesn't support socket activation yet
+ * Returns 0 (no file descriptors passed)
+ */
+int sd_listen_fds(int unset_environment)
+{
+	if (unset_environment) {
+		unsetenv("LISTEN_PID");
+		unsetenv("LISTEN_FDS");
+		unsetenv("LISTEN_FDNAMES");
+	}
+
+	return 0;
+}
+
+/*
+ * Watchdog stub - Finit doesn't support watchdog yet
+ * Returns 0 (no watchdog enabled)
+ */
+int sd_watchdog_enabled(int unset_environment, uint64_t *usec)
+{
+	if (unset_environment) {
+		unsetenv("WATCHDOG_PID");
+		unsetenv("WATCHDOG_USEC");
+	}
+
+	if (usec)
+		*usec = 0;
+
+	return 0;
+}
+
+/*
+ * System detection function
+ * Returns 1 to indicate systemd compatibility (trick applications)
+ */
+int sd_booted(void)
+{
+	return 1;
+}
@@ -0,0 +1,38 @@
+#ifndef SD_DAEMON_H_
+#define SD_DAEMON_H_
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#define SD_LISTEN_FDS_START 3
+
+/* systemd logging defines for stderr parsing by Finit */
+#define SD_EMERG    "<0>"  /* system is unusable */
+#define SD_ALERT    "<1>"  /* action must be taken immediately */
+#define SD_CRIT     "<2>"  /* critical conditions */
+#define SD_ERR      "<3>"  /* error conditions */
+#define SD_WARNING  "<4>"  /* warning conditions */
+#define SD_NOTICE   "<5>"  /* normal but significant condition */
+#define SD_INFO     "<6>"  /* informational */
+#define SD_DEBUG    "<7>"  /* debug-level messages */
+
+/* Basic notification function */
+int sd_notify(int unset_environment, const char *state);
+
+/* Printf-style notification functions */
+int sd_notifyf(int unset_environment, const char *format, ...);
+
+/* PID-specific notification functions */
+int sd_pid_notify(pid_t pid, int unset_environment, const char *state);
+int sd_pid_notifyf(pid_t pid, int unset_environment, const char *format, ...);
+
+/* Socket activation stubs */
+int sd_listen_fds(int unset_environment);
+
+/* Watchdog stub */
+int sd_watchdog_enabled(int unset_environment, uint64_t *usec);
+
+/* System detection */
+int sd_booted(void);
+
+#endif	/* SD_DAEMON_H_ */
@@ -1,8 +1,6 @@
 # From https://github.com/collectd/collectd/blob/master/configure.ac
 # Dependency handling currently unused

-define([toupper], [translit([$1], [a-z], [A-Z])])
-define([sanitize], [translit([$1], [-], [_])])
 define([enadis], [ifelse([$1], [yes], [disable], [enable])])

 # AC_PLUGIN(name, default, info)
@@ -10,27 +8,25 @@ define([enadis], [ifelse([$1], [yes], [disable], [enable])])
 AC_DEFUN([AC_PLUGIN],[
    m4_divert_once([HELP_ENABLE], [
 Optional Plugins:])
+define(PLUGGY, m4_translit([$1],[a-z-][A-Z-]))dnl
+AC_ARG_ENABLE([$1-plugin], AS_HELP_STRING([--enadis($2)-$1-plugin], [$3]), [
+  if test "x$enableval" = "xyes"; then
+    enable_plugin="yes"
+  else
    enable_plugin="no"
-    define(pluggy, sanitize($1))
-    define(PLUGGY, toupper(pluggy))
-    AC_ARG_ENABLE([$1-plugin], AS_HELP_STRING([--enadis($2)-$1-plugin], [$3]), [
-    if test "x$enableval" = "xyes"; then
-             enable_plugin="yes"
+  fi], [
+  if test "x$enable_all_plugins" = "xauto"; then
+    if test "x$2" = "xyes"; then
+        enable_plugin="yes"
    else
-             enable_plugin="no"
-    fi], [
-    if test "x$enable_all_plugins" = "xauto"; then
-             if test "x$2" = "xyes"; then
-                     enable_plugin="yes"
-             else
-                     enable_plugin="no"
-             fi
-    else
-             enable_plugin="$enable_all_plugins"
-    fi])
-    if test "x$enable_plugin" = "xyes"; then
-       	    AC_DEFINE([HAVE_]PLUGGY[_PLUGIN], 1, [Define to 1 if the $1 plugin is enabled.])
-	    plugins="$1 $plugins"
+        enable_plugin="no"
    fi
-    AM_CONDITIONAL([BUILD_]PLUGGY[_PLUGIN], test "x$enable_plugin" = "xyes")
-    enable_pluggy="$enable_plugin"])
+  else
+    enable_plugin="$enable_all_plugins"
+  fi])
+  if test "x$enable_plugin" = "xyes"; then
+    AC_DEFINE(HAVE_[]m4_translit($1,[-a-z],[_A-Z])_PLUGIN, 1, [Define to 1 if the $1 plugin is enabled.])
+    plugins="$1 $plugins"
+  fi
+
+AM_CONDITIONAL(BUILD_[]m4_translit($1,[-a-z],[_A-Z])_PLUGIN, test "x$enable_plugin" = "xyes")])
@@ -2,7 +2,7 @@
 .\" First parameter, NAME, should be all caps
 .\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
 .\" other parameters are allowed: see man(7), man(1)
-.Dd June 6, 2021
+.Dd Jul 9, 2025
 .\" Please adjust this date whenever revising the manpage.
 .Dt FINIT 8 SMM
 .Os Linux
@@ -10,24 +10,66 @@
 .Nm finit
 .Nd Fast init for Linux systems
 .Sh SYNOPSIS
-.Nm /sbin/finit
-.Op --
-.Op finit.debug
-.Op finit.fstab=/etc/fstab.alt
-.Op finit.status=<on,off>
-.Op finit.status_style=<classic,modern>
+.Nm /sbin/finit --
+.Op debug
+.Op quiet
 .Op rescue | recover
 .Op single | S
+.Op panic=SEC
+.Op loglevel=<0-7>
+.Op fsck.mode=[auto,skip,force]
+.Op fsck.repair=[no,yes,preen]
+.Op finit.debug=<true,false>
+.Op finit.fstab=/path/to/fstab
+.Op finit.cond=foo[,bar[,baz]]
+.Op finit.config=/path/to/finit.conf
+.Op finit.status_style=<classic,modern>
+.Op finit.status=<on,off>
 .Nm /sbin/telinit
 .Op Fl hv
-.Op q | Q | 0-9
+.Op q | Q | s | S | 0-9
 .Sh DESCRIPTION
 Fast init for Linux systems.  Reverse engineered from the EeePC
 fastinit, 10+ years ago by Claudio Matsuoka, "gaps filled with frog
 DNA ...".  Focus is on small and embedded systems, although Finit is
 fully usable on server and desktop systems as well.
+.Sh OPTIONS
+When
+.Sy not
+started as PID 1,
+.Nm
+behaves like
+.Nm telinit ,
+following classic UNIX command line syntax.  The options are:
 .Pp
-Features include:
+.Bl -tag -width Ds -compact -offset indent
+.It Fl h
+Show built-in help text.
+.It Fl v
+Show program version.
+.El
+.Pp
+More options are implemented for SysV init support, but are ignored.
+.Sh ARGUMENTS
+When
+.Sy not
+started as PID 1,
+.Nm ,
+or
+.Nm telinit ,
+take these arguments:
+.Pp
+.Bl -tag -width Ds -compact -offset indent
+.It q | Q
+Reload configuration, same as
+.Cm initctl reload .
+.It 0 - 9
+Go to runlevel N, same as
+.Cm initctl reload N .
+.It s | S
+Go to single user mode, runlevel 1.
+.El
+.Sh FEATURES
 .Bl -bullet -width 1n -compact
 .It
 Runlevels, defined per service
@@ -45,6 +87,15 @@ Sourcing environment files
 .It
 Conditions for network/process/custom dependencies
 .It
+Process readiness notification for synchronizing system startup as well
+as reconfiguration at runtime.  Natively PID files are used, but systemd
+.Cm sd_notify()
+and s6 notification is also supported.
+.It
+Limited support for
+.Xr tmpfiles.d 5 ,
+no aging, attributes, or subvolumes
+.It
 Pre/Post script actions
 .It
 Tooling to enable/disable services
@@ -73,6 +124,59 @@ PID 1.  For more information on this, and available kernel command line
 options, see
 .Xr bootparam 7 .
 .Bl -tag -width pid -offset indent
+.It Cm debug
+Enable kernel debug.  Debug messages are printed to the console until
+Finit starts up, unless
+.Cm loglevel=7
+(below) is used.
+.It Cm fsck.mode=<auto,force,skip>
+Defaults to
+.Cm auto ,
+unless Finit is built with
+.Cm configure --enable-fastboot ,
+in which case the default is
+.Cm skip .
+.It Cm fsck.repair=<preen,yes,no>
+Defaults to
+.Cm preen ,
+unless Finit is built with
+.Cm configure --enable-fsckfix ,
+in which case the default is
+.Cm yes .
+This configure option also sets
+.Cm fsck.mode=force ,
+unless fastboot is also enabled.  I.e.,
+.Cm configure --enable-fastboot
+build option overrides the
+.Cm fsck.mode
+default value.
+.It Cm finit.cond=foo[,bar[,baz]]
+set
+.Cm <boot/foo>
+condition, optionally multiple conditions can be set using the same
+option, separated with a comma.  Alternatively, multiple
+.Cm foo.cond=arg
+can be given.  Each will result in a
+.Cm <boot/arg>
+condition being set to control the rest of the system bootstrap.
+.Pp
+Very useful for selecting different boot modes, e.g. manufacturing test,
+firmware upgrade, or rescue mode.
+.Pp
+.Sy Note:
+.Cm <boot/...>
+conditions cannot be cleared with
+.Nm initctl !
+.It Cm finit.config=/path/to/alternative/finit.conf
+override the compile-time bootstrap config file, default:
+.Bd -unfilled -offset indent
+./configure --with-config=/etc/finit.conf
+.Ed
+Useful when starting up in various rescue mode, factory, or
+production test setups.  Use the top-level configuration file
+directive
+.Cm rcsd Ar /path/to/finit.d
+to override the default rcS.d directory.
 .It Cm finit.debug
 Enable Finit debug messages on system console and log.  Sometimes useful
 when doing board bringup.  Before the system log daemon has started,
@@ -121,6 +225,33 @@ Control finit boot progress, including banner.  This used to be called
 which still works but is deprecated.
 .It Cm finit.status_style=<classic,modern>
 Set Finit boot progress style, when enabled.
+.It Cm loglevel=<0-7>
+set the kernel's log level, which is more granular than
+.Cm debug .
+Also, when
+.Cm loglevel=7 ,
+Finit will
+.Em not disable
+kernel logs to the console.  This is very useful when debugging the
+kernel at system bring-up.  Since
+.Cm loglevel=7
+is the same as
+.Cm debug
+this means you have to use
+.Cm quiet
+for a quiet boot, until sysklogd takes over logging of kernel events.
+.It Cm panic=SEC
+By default the kernel does not reboot after a kernel panic.  This
+setting will cause a kernel reboot after
+.Ar SEC
+seconds.
+.It Cm quiet
+Suppress kernel logging to console, except for warnings and errors.
+Also, see
+.Cm loglevel
+and
+.Cm quiet
+above.
 .It Cm rescue | recover
 Start rescue/maintenance mode.  If your system comes with the bundled
 .Cm sulogin
@@ -139,6 +270,10 @@ the regular runlevel.  All services and TTYs in
 will be started, e.g., a
 .Cm tty [1] @console nologin
 configuration presents you with a root console without login.
+.Pp
+.Sy Note:
+by definition, single user mode does not have networking enabled.  This
+is also true for runlevel 1.
 .El
 .Sh BOOTING
 .Pp
@@ -192,14 +327,22 @@ file removed, service B is also stopped.
 .Pp
 The following condition families are available today:
 .Pp
-.Bl -tag -width pid -offset indent
+.Bl -tag -width service -offset indent
 .It Cm net
 Linux netlink events, e.g. net/route/default, net/eth0/up, and
 net/et0/running
 .It Cm pid
-PID files basd on the service declaration
+PID files based on the service declaration
 .Cm name:id ,
 gives the condition pid/name:id
+.It Cm service
+Tracks run/task/service state stansitions, including readiness.  E.g.,
+.Cm service/foo/ready
+can be used as a condition for service
+.Cm bar ,
+provided
+.Cm foo
+properly signals its readiness to Finit.
 .It Cm sys
 System conditions, e.g. sys/key/ctrlaltdel and sys/pwr/fail
 .It Cm usr
@@ -255,6 +398,7 @@ Runtime files, including the condition subsystem
 .Sh SEE ALSO
 .Xr finit.conf 5
 .Xr initctl 8
+.Xr tmpfiles.d 5
 .Sh AUTHORS
 .Nm
 was conceived and reverse engineered by Claudio Matsuoka.  Since v1.0,
@@ -2,7 +2,7 @@
 .\" First parameter, NAME, should be all caps
 .\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
 .\" other parameters are allowed: see man(7), man(1)
-.Dd Oct 17, 2020
+.Dd July 10, 2025
 .Dt FINIT.CONF 5 SMM
 .Os Linux
 .Sh NAME
@@ -12,48 +12,79 @@
 .Nm /etc/finit.conf
 .Nm /etc/finit.d/*.conf
 .Nm /etc/finit.d/available/*.conf
+.Nm /etc/finit.d/enabled/*.conf
 .Sh DESCRIPTION
-.Nm finit
-can be configured using only the original
-.Pa /etc/finit.conf
-file or in combination with
-.Pa /etc/finit.d/*.conf .
-Useful for package-based Linux distributions \(em each package can
-provide its own "script" file.
+.Nm Finit
+based systems can be set up with a single file:
+.Pa /etc/finit.conf .
+This is the traditional way of doing it which can be ideal for some
+setups since it gives a great overview of the system configuration.
 .Pp
-.Bl -tag -width /etc/finit.d/*.conf -offset indent -compact
-.It Pa /etc/finit.conf
-Main configuration file
-.It Pa /etc/finit.d/*.conf
-Snippets, usually one service per file
-.El
+More comprehensive setups, however, require more careful planning.
+The recommendation is per-package
+.Cm *.conf
+files in
+.Pa /etc/finit.d/available/ .
+This allows end users to enable and disable parts of the system
+configuration at runtime.  Finit tracks which tasks and services belong
+to a given file, so that when the user calls
+.Cm initctl reload
+to activate the changes they have made, only the affected tasks and
+services are stopped, started, or restarted.  Hence, this approach is
+useful for modern package-based Linux distributions.
 .Pp
-Not all configuration directives are available in
-.Pa /etc/finit.d/*.conf
-and some directives are only available at bootstrap, runlevel
-.Cm S ,
-see the section
-.Sx Limitations
-below for details.
+The following sections describe the more of this in detail, starting
+with files, the file format, and available directives.  Remember to
+also visit the other manual pages (references at the bottom).
 .Sh FILES
 .Bl -tag -width /etc/finit.d/available/*.conf -compact
 .It Pa /etc/finit.conf
-Main configuration file
+Main configuration file, optional
 .It Pa /etc/finit.d/*.conf
-Static service definitions
+Static (system) service definitions
 .It Pa /etc/finit.d/available/*.conf
-Available services
+Available (installed) services
 .It Pa /etc/finit.d/enabled/*.conf
-Enabled services, symlinks from available
+Enabled services (symlink back)
 .El
-.Sh FILE FORMAT
-Lines starting with `#' are ignored. Note that end-of-line comments are
-NOT supported, comments must be on a line of their own.
 .Pp
-A configuration stanza must be on a single (long) line and
-.Em cannot
-be broken up in multiple lines by use of a backslash as the last
-character.
+Static services,
+.Cm .conf
+files in
+.Pa /etc/finit.d/ ,
+cannot be enabled or disabled using
+.Cm initctl [enable | disable] service[.conf] .
+An enabled service is a symlink back to the corresponding
+.Cm ../available/
+service
+.Cm .conf
+file.  Please use the
+.Cm initctl
+tool to manage these symlinks to ensure proper operation.
+.Pp
+.Sy NOTE:
+Previous versions of
+.Nm Finit
+created symlinks in
+.Pa /etc/finit.d/
+if
+.Pa /etc/finit.d/enabled/
+was missing, this is as of v4.4 not supported.
+.Sh FILE FORMAT
+The file format is line based, empty lines and comments, lines starting
+with `#', are ignored.  A configuration directive starts with a keyword
+followed by a space and the rest of the line is treated as the value.
+.Pp
+As of Finit v4.4, configuration directives can be broken up in multiple
+lines using the continuation character `\\', and trailing comments are
+also allowed.  Example:
+.Bd -unfilled -offset indent
+# Escape \\# chars if you want them literal in, e.g., descriptions
+service name:sysklogd [S123456789]   \\
+    env:-/etc/default/sysklogd       \\
+    syslogd -F $SYSLOGD_ARGS         \\
+    -- System log daemon \\# 1   # Comments allowed now
+.Ed
 .Sh DIRECTIVES
 This section lists all supported configuration directives.  There also exist
 deprecated directives, see the Markdown documentation for details on these.
@@ -108,6 +139,10 @@ is the runlevel number 0-9, where 6 is reserved for reboot and 0 for
 halt.  All other can be used by operating system administrators.
 Default: 2
 .Pp
+It s recommended to keep runlevel 1 as single-user mode, because
+.Nm
+disables networking in this mode.
+.Pp
 .Sy Note:
 only read and executed in runlevel S (bootstrap).
 .It Cm run Oo LVLS Oc Ao COND Ac Ar /path/to/cmd ARGS Op -- Optional description
@@ -140,13 +175,13 @@ task [s] echo "foo" | cat >/tmp/bar
 .Ed
 .It Cm sysv Oo LVLS Oc Ao COND Ac Ar /path/to/script ARGS Op -- Optional description
 Similar to
-.Cm task
+.Cm service
 is the
 .Cm sysv
-stanza, which can be used to call SysV style start/stop scripts.  The
-primary intention for this command is to be able to re-use much of
-existing setup and init scripts in Linux distributions.
-.Pp  
+directive, which can be used to call SysV style start/stop scripts.  The
+primary intention for this command is to be able to re-use traditional
+SysV init scripts in Linux distributions.
+.Pp
 When entering an allowed runlevel, Finit calls
 .Cm init-script start ,
 when entering a disallowed runlevel, Finit calls
@@ -159,7 +194,7 @@ on
 .Cm initctl reload .
 Similar to how
 .Cm service
-stanzas work.
+directives work.
 .Pp
 Forking services started with
 .Cm sysv
@@ -275,6 +310,51 @@ can depend on the
 .Cm <pid/bar>
 condition.
 .Pp
+As an alternative "readiness" notification, Finit supports both systemd
+and s6 style notification.  This can be enabled by using the `notify`
+option:
+.Bl -tag -width 1n
+.It Cm notify:systemd
+tells Finit the service uses the
+.Cm sd_notify()
+API to signal PID 1 when it has completed its startup and is ready
+to service events.  This API expects
+the environment variable
+.Cm NOTIFY_SOCKET
+to be set to the socket where the application can send
+.Cm "READY=1\n"
+when it is starting up or has processed a
+.Cm SIGHUP .
+For details, see:
+.Pp
+.Lk https://www.freedesktop.org/software/systemd/man/sd_notify.html
+.It Cm notify:s6
+puts Finit in s6 compatibility mode.  Compared to the systemd
+notification, s6 expect compliant daemons to send
+.Cm "\\n"
+and then close their socket.  For details, see:
+.Pp
+.Lk https://skarnet.org/software/s6/notifywhenup.html
+.Pp
+Finit takes care of "hard-wiring" the READY state as long as the
+application is running, events across any `SIGHUP`.  Since s6 can give
+its applications the descriptor number (must be >3) on then command
+line, Finit provides the following syntax (
+.Cm %n
+is replaced by Finit with then descriptor number):
+.Bd -unfilled -offset indent
+service notify:s6 mdevd -C -O 4 -D %n
+.Ed
+.Pp
+When a service is ready, either by Finit detecting its PID file, or
+their respective readiness mechanism has been triggered, Finit creates
+then service's ready condition which other services can depend on:
+.Bd -unfilled -offset indent
+$ initctl -v cond get service/mdevd/ready
+on
+.Ed
+.El
+.Pp
 If a service should not be automatically started, it can be configured
 as manual with the
 .Cm manual:yes
@@ -304,6 +384,10 @@ number of seconds before Finit tries to restart
 a crashing service, default: 2 seconds for the first five retries,
 then back-off to 5 seconds.  The maximum of this configured value
 and the above (2 and 5) will be used
+.It Cm restart:always
+no upper limit on the number of times Finit tries to restart a crashing
+service.  Same as
+.Cm restart:-1
 .It Cm norestart
 dont restart on failures, same as
 .Cm restart:0
@@ -318,10 +402,44 @@ was originally designed for so not the default behavior.
 when all retries have failed, and the service
 has
 .Em crashed ,
-if this option is set the system is rebooted.  Note, future releases
-may include other
-.Cm oncrash:
-actions.
+if this option is set the system is rebooted.
+.It Cm oncrash:script
+Similar to
+.Cm oncrash:reboot ,
+but instead of rebooting this action calls the
+.Cm post:script
+(see below) to let the operator decide the best course of action.  If
+the post:script option is not set, this is a no-op.
+.Pp
+The post:script is called with the same environment variables
+.Sy except
+for the
+.Cm EXIT_CODE
+variable which is set to
+.Cm "crashed"
+.It Cm reload:'script [args]'
+some services do not support SIGHUP but may have other ways to update
+the configuration of a running daemon.  When
+.Cm reload:script
+is defined it is preferred over SIGHUP.  Like systemd,
+.Nm finit
+sets
+.Cm $MAINPID
+as a convenience to scripts, which in effect also allow
+.Cm reload:'kill -HUP $MAINPID'
+.It Cm stop:'script [args]'
+Some services may require alternate methods to be stopped.  When
+.Cm stop:script
+is defined it is preferred over SIGTERM and stop, for
+.Cm service
+and
+.Cm sysv
+directives, respectively.
+Similar to
+.Cm reload:script ,
+.Nm finit
+sets
+.Cm $MAINPID .
 .El
 .Pp
 When stopping a service (run/task/sysv/service), either manually or when
@@ -339,52 +457,61 @@ e.g.,
 .Cm kill:10
 to wait 10 seconds before sending SIGKILL.
 .Pp
-Services support the
-.Cm pre:script
-and
-.Cm post:script
-command actions as well.  These run as the same
+Services, including the
+.Cm sysv
+variant, support pre/post/ready and cleanup scripts:
+.Bl -tag -width 1n
+.It Cm pre:[0-3600,]script
+called before the sysv/service is stated
+.It Cm post:[0-3600,]script
+called after the sysv/service has stopped
+.It Cm ready:[0-3600,]script
+called when the sysv/service is ready
+.It Cm cleanup:[0-3600,]script
+called when run/task/sysv/service is removed
+.El
+.Pp
+The optional number (0-3600) is the timeout before Finit kills the
+script, it defaults to the kill delay value and can be disabled by
+setting it to zero.  These scripts run as the same
 .Cm @USER:GROUP
 as the service itself, with any
 .Cm env:file
 sourced.  The scripts must use an absolute path, but are executed from
 the
 .Cm $HOME
-of the given user.  The scripts are not called with any argument
-(currently), but both get the
-.Cm SERVICE_IDENT=foo
-environment variable set.  Here
-.Cm foo
-denotes the identity of the service, which if there are multiple
-services named
-.Cm foo ,
-may be
-.Cm foo:1 ,
-or any unique identifier specified in the .conf file.  The
+of the given user.  The scripts are not called with any argument, but
+both get a set of environment variables:
+.Pp
+.Bl -tag -width 1n -compact
+.It Cm SERVICE_IDENT=foo:1
+.It Cm SERVICE_NAME=foo
+.It Cm SERVICE_ID=1
+.El
+.Pp
+The
 .Cm post:script
-is called with an additional set of environment variables:
+is called with an additional set of environment variables, and yes the
+naming looks like it should be swapped:
 .Bl -tag -offset indent -width 1n
-.It Cm EXIT_CODE=[exited,signal]
+.It Cm EXIT_CODE=[exited,signal,crashed]
 set to one of
-.Cm exited
+.Cm exited ,
+.Cm signal ,
 or
-.Cm signal
+.Cm crashed
+(see above).
 .It Cm EXIT_STATUS=[num,SIGNAME]
 set to one of exit status code from the program, if it exited normally,
 or the signal name (HUP, TERM, etc.) if it exited due to signal
 .El
 .Pp
-The scripts have a default execution time of 3 seconds before they are
-SIGKILLed, this can be adjusted using the
-.Cm kill:SEC
-modifier syntax.
-.Pp
-.Sy Note:
-the
-.Cm pre:script
-.Em must
-be idempotent, because a service can transition between READY and HALTED
-states any number of times before going to RUNNING.
+When a run/task/sys/service is removed (disable + reload) it is first
+stopped and then removed from the runlevel.  The
+.Cm post:script
+always runs when the process has stopped, and the
+.Cm cleanup:script
+runs when the the stanza has been removed from the runlevel.
 .It Cm runparts Aq DIR
 Call
 .Xr run-parts 8
@@ -431,7 +558,7 @@ size limit is reached.
 .It Cm tty Oo LVLS Oc Ao COND Ac Ar DEV Oo BAUD Oc Oo noclear Oc Oo nowait Oc Oo nologin Oc Oo TERM Oc
 This form of the
 .Cm tty
-stanza uses the built-in getty on the given TTY device
+directive uses the built-in getty on the given TTY device
 .Ar DEV ,
 in the given runlevels.
 .Ar DEV may be the special keyword
@@ -441,8 +568,8 @@ useful on embedded systems.
 .Pp
 The default baud rate is 0, i.e., keep kernel default.
 .Pp
-The `tty` stanza inherits runlevel, condition (and other feature)
-parsing from the `service` stanza.  So TTYs can run in one or many
+The `tty` directive inherits runlevel, condition (and other feature)
+parsing from the `service` directive.  So TTYs can run in one or many
 runlevels and depend on any condition supported by Finit.  This is
 useful e.g. to depend on `<pid/elogind>` before starting a TTY.
 .Bd -unfilled -offset indent
@@ -451,7 +578,7 @@ tty [12345] /dev/ttyAMA0 115200 noclear vt220
 .It Cm tty Oo LVLS Oc Ao COND Ac Ar CMD DEV Oo noclear Oc Oo nowait Oc
 This form of the
 .Cm tty
-stanza is for using an external getty, like agetty or the BusyBox getty.
+directive is for using an external getty, like agetty or the BusyBox getty.
 .Pp
 By default, these first two syntax variants
 .Em clear
@@ -521,7 +648,7 @@ board bringup and system debugging it can come in handy.
 .Pp
 One can also use the
 .Cm service
-stanza to start a stand-alone shell:
+directive to start a stand-alone shell:
 .Bd -unfilled -offset indent
 service [12345] /bin/sh -l
 .Ed
@@ -546,9 +673,9 @@ is started to present a bare-bones root login prompt.  If the root
 (uid:0, gid:0) user does not have a password set, no rescue is possible.
 .El
 .Sh COMMAND MODIFIERS
-The run/task/tty/service/sysv stanzas take modifiers, or options, to
+The run/task/tty/service/sysv directives take modifiers, or options, to
 control their behavior.  This section lists them with their limitations.
-All modifiers must be placed between the stanza and its command.
+All modifiers must be placed between the directive and its command.
 .Bl -tag -width 1n
 .It Cm @user:group
 Every
@@ -753,6 +880,31 @@ the example sets
 to denote that it doesn't support SIGHUP.  That way Finit will
 stop/start the service instead of sending SIGHUP at restart/reload
 events.
+.Sh TEMPLATING
+Finit comes with rudimentary support for templating, similar to that of
+systemd.  Best illustrated with an example:
+.Bd -unfilled -offset indent
+$ initctl show avahi-autoipd@
+service :%i avahi-autoipd --syslog %i -- ZeroConf for %i
+.Ed
+.Pp
+To enable ZeroConf for, e.g.,
+.Cm eth0 ,
+use
+.Bd -unfilled -offset indent
+$ initctl enable avahi-autoipd@eth0.conf
+.Ed
+.Pp
+The enabled symlink will be set up to
+.Cm avahi-autoipd@.conf
+and every instance of
+.Cm %i
+will in the instantiated directive be replaced with
+.Cm eth0 .
+Inspect the result with:
+.Bd -unfilled -offset indent
+$ initctl status avahi-autoipd:eth0
+.Ed
 .Sh CGROUPS
 There are three major cgroup configuration directives:
 .Pp
@@ -817,9 +969,10 @@ or
 service [...] <...> cgroup.maint /path/to/foo args -- description
 .Ed
 .Pp
-The latter form also allows per-stanza limits on the form:
+The latter form also allows per-stanza limits on the form (notice the
+single quotes for arguments that contain spaces):
 .Bd -unfilled -offset indent
-service [...] <...> cgroup.maint:cpu.max:10000,mem.max:655360 /path/to/foo args -- description
+service [...] <...> cgroup.maint:cpu.max:'200000 100000',mem.max:655360 /path/to/foo args -- description
 .Ed
 .Pp
 Notice the comma separation and the
@@ -839,6 +992,97 @@ available in your Linux kernel, or the name is misspelled.
 Linux cgroups and details surrounding values are not explained in the
 Finit documentation.  The Linux admin-guide cover this well:
 .Lk https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
+.Sh CONDITIONAL LOADING
+Finit support conditional loading of stanzas.  The following example is
+take from the
+.Pa system/hotplug.conf
+file in the Finit distribution.  Here we only show a simplified subset.
+.Pp
+Starting with the
+.Cm nowarn
+option.
+.Bd -unfilled -offset indent
+service nowarn name:udevd pid:udevd /lib/systemd/systemd-udevd
+service nowarn name:udevd pid:udevd udevd
+.Ed
+.Pp
+When loading the .conf file Finit looks for
+.Pa /lib/systemd/systemd-udevd
+if that is not found Finit automatically logs a warning.  The
+.Cm nowarn
+option disables this warning so that the second line can be evaluated,
+which also provides a service named
+.Cm udevd .
+.Bd -unfilled -offset indent
+run nowarn if:udevd <pid/udevd> :1 udevadm settle -t 0
+.Ed
+.Pp
+This line is only loaded if we know of a service named
+.Cm udevd .
+Again, we do not warn if
+.Cm udevadm
+is not found, execution will also stop here until the PID condition is
+asserted, i.e., Finit detecting udevd has started.
+.Bd -unfilled -offset indent
+run nowarn conflict:udevd [S] mdev -s -- Populating device tree
+.Ed
+.Pp
+If
+.Cm udevd
+is not available, we try to run
+.Cm mdev ,
+but if that is not found, again we do not warn.
+.Pp
+Conditional loading statements can also be negated, so the previous stanza
+can also be written as:
+.Bd -unfilled -offset indent
+run nowarn if:!udevd [S] mdev -s -- Populating device tree
+.Ed
+.Pp
+The reason for using
+.Cm conflict
+in this example is that a conflict can be resolved.  Stanzas marked with
+.C, conflict:foo
+are rechecked at runtime.
+.Sh CONDITIONAL EXECUTION
+Similar to conditional loading of stanzas there is conditional runtime
+execution.  This can be confusing at first, since Finit already has a
+condition subsystem, but this is more akin to the qualification to a
+runlevel.  E.g., a
+.Cm task [123]
+is qualified to run only in runlevel 1, 2, and 3.  It is not considered
+for other runlevels.
+.Pp
+Conditional execution qualify a run/task/service based on a condition.
+Consider this (simplified) example from the Infix operating system:
+.Bd -unfilled -offset indent
+run [S]                       name:startup <pid/sysrepo> confd -b --load startup-config
+run [S] if:<usr/fail-startup> name:failure <pid/sysrepo> confd    --load failure-config
+.Ed
+.Pp
+The two run statements reside in the same .conf file so Finit runs them
+in true sequence.  If loading the file
+.Cm startup-config
+fails
+.Cm confd
+sets the condition
+.Cm usr/fail-startup ,
+thus allowing the next run statement to load
+.Cm failure-config .
+.Pp
+Notice the critical difference between the
+.Cm <pid/sysrepo>
+condition and
+.Cm if:<usr/fail-startup> .
+The former is a condition for starting and the latter is a condition to
+check if a run/task/service is qualified to even be considered.
+.Pp
+Conditional execution statements can also be negated, so provided the
+file loaded did the opposite, i.e., set a condition on success, the
+previous stanza can also be written as:
+.Bd -unfilled -offset indent
+run [S] if:<!usr/startup-ok> name:failure <pid/sysrepo> confd ...
+.Ed
 .Sh LIMITATIONS
 As of Finit v4 there are no limitations to where
 .Cm .conf
@@ -869,6 +1113,6 @@ settings in
 .Xr finit 8 ,
 .Xr initctl 8
 .Sh AUTHORS
-.Nm finit
+.Nm Finit
 was conceived and reverse engineered by Claudio Matsuoka.  Since v1.0,
 maintained by Joachim Wiberg, with contributions by many others.
@@ -2,7 +2,7 @@
 .\" First parameter, NAME, should be all caps
 .\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
 .\" other parameters are allowed: see man(7), man(1)
-.Dd June 6, 2021
+.Dd July 10, 2025
 .\" Please adjust this date whenever revising the manpage.
 .Dt INITCTL 8 SMM
 .Os Linux
@@ -11,7 +11,7 @@
 .Nd Control tool for Finit
 .Sh SYNOPSIS
 .Nm /sbin/initctl
-.Op Fl bcfhlpqtvV
+.Op Fl bcfhjlpqtvV
 .Op COMMAND
 .Sh DESCRIPTION
 .Nm
@@ -24,25 +24,39 @@ This program follows the usual UNIX command line syntax, with long
 options starting with two dashes (`-').  The options are as follows:
 .Bl -tag -width Ds
 .It Fl b, -batch
-Batch mode, no screen size probing.
+Batch mode, no screen size probing.  Useful for scripting
 .It Fl c, -create
-Create missing paths (and files) as needed.  Useful with the edit command.
+Create missing paths (and files) as needed.  Useful with the
+.Cm edit
+command
 .It Fl f, -force
-Ignore missing files and arguments, never prompt.
+Ignore missing files and arguments, never prompt
 .It Fl h, -help
-Show built-in help text.
+Show built-in help text
+.It Fl j, -json
+JSON output in
+.Ar status
+and
+.Ar cond
+commands
+.It Fl n, -noerr
+When scripting
+.Nm
+to stop, start, restart, or signal a task or service, this option can be
+used to ignore error 69 (no such task or service) and instead return 0
+(OK)
 .It Fl 1, -once
-Only one lap in commands like top.
+Only one lap in commands like top
 .It Fl p, -plain
-Use plain table headings, no ANSI control characters.
+Use plain table headings, no ANSI control characters
 .It Fl q, -quiet
-Silent, only return status of command.
+Silent, only return status of command
 .It Fl t, -no-heading
-Skip table headings.
+Skip table headings
 .It Fl v, -verbose
-Verbose output, where applicable.
+Verbose output, where applicable
 .It Fl V, -version
-Show program version.
+Show program version
 .El
 .Sh COMMANDS
 .Bl -tag -width Ds
@@ -64,7 +78,16 @@ files in
 Create
 .Cm .conf
 in
-.Pa /etc/finit.d/available
+.Pa /etc/finit.d/available .
+.Pp
+Piping the contents into
+.Nm
+works as one would expect:
+.Bd -literal -offset indent
+echo "task name:foo /tmp/foo.sh -- Foo logger" | initctl create foo
+initctl enable foo
+initctl reload
+.Ed
 .It Nm Ar delete Ar CONF
 Delete
 .Cm .conf
@@ -89,9 +112,10 @@ like
 .Ar edit
 this tells
 .Nm finit
-that a configuration has been changed and is a candidate to be restarted
-(or SIGHUP'ed) on
+that a configuration has been changed and is a candidate to be reloaded
+(SIGHUP'ed or restarted) on
 .Cm initctl reload
+in dependency order
 .It Nm Ar enable Ar CONF
 Enable
 .Cm .conf
@@ -106,22 +130,40 @@ in
 .Pa /etc/finit.d/enabled ,
 i.e., removes symlink
 .It Nm Ar reload
-Reload
+Reload all (touched)
 .Cm *.conf in
-.Pa /etc/finit.d ,
-i.e., activates changes
-.It Nm Ar cond set Ar COND
+.Pa /etc/finit.d
+and activate changes
+.It Nm Ar cond set Ar COND Op COND ...
 Set (assert) user-defined condition,
 .Cm +usr/COND
-.It Nm Ar cond clr | clear Ar COND
+.It Nm Ar cond get Ar COND
+Get (quietly) the status of any condition.  Defaults to user-defined
+condions, but if a slash is detected, e.g.,
+.Cm pid/foo
+or
+.Cm net/eth0/exist ,
+then any condition can be read.
+.Pp
+The command is geared for scripting, check the exit code to get the
+status of the condition: 0 - on, 1 - off, 255 - flux.  For a more
+verbose output, use the
+.Fl v
+option
+.It Nm Ar cond clr | clear Ar COND Op COND ...
 Clear (deassert) user-defined condition,
 .Cm -usr/COND
 .It Nm Ar cond status
 Show condition status, default
 .Cm cond
-command.
-.It Nm Ar cond dump
-Dump all conditions and their status
+command.  Also supports the
+.Fl j
+option for detailed JSON output
+.It Nm Ar cond dump Op Cm TYPE
+Dump all, or a given type of, conditions and their status.  Also
+supports the
+.Fl j
+option for detailed JSON output
 .It Nm Ar ident Op Cm NAME
 Display indentities of all run/task/services, or only instances
 matching
@@ -139,49 +181,93 @@ Start service by name, with optional ID, e.g.,
 .It Nm Ar stop Cm NAME[:ID]
 Stop/Pause a running service by name
 .It Nm Ar reload Cm NAME[:ID]
-Reload service by name (SIGHUP or restart)
-.It Nm Ar signal Cm NAME:[ID] S
+Reload service as if its configuration had changed.  Internally,
+.Nm finit
+marks the named service as "dirty" and turns the state machine,
+resulting in a SIGHUP or restart of (at least) the named service.
+Any dependant services are also restarted.
+.Pp
+.Sy Note:
+no .conf file is reloaded with this variant of the command.  Essentially
+it is the same as calling
+.Cm restart .
+Except for two things:
+.Bl -enum -offset indent -compact
+.It
+if the service supports HUP (or has a
+.Cm reload:script )
+it is signaled instead of stop-started, and
+.It
+it allows restarting run/task in the same runlevel -- which is otherwise
+restricted
+.El
+.It Nm Ar <kill | signal> Cm NAME:[ID] S
 Send signal S to service, by name.
 .Cm S
-may be a complete signal name such as SIGHUP, or short name such as HUP, or the signal number such as 1 (SIGHUP).
+may be a complete signal name such as SIGHUP, or short name such as HUP, or the signal number such as 1 (SIGHUP)
 .It Nm Ar restart Cm NAME[:ID]
 Restart (stop/start) service by name
 .It Nm Ar status Cm NAME[:ID]
 Show service status, by name.  If only
 .Cm NAME
 is given and multiple instances exits, a summary of all matching
-instances are shown.  Only an exact match displays the detailed status
-for a particular instance
+instances are shown.  Only an exact match displays detailed status
+for a given instance.
+.Pp
+With the
+.Fl q
+option this command is silent, provided the
+.Ar NAME[:ID]
+selection matches a single run/task/service. The exit code of
+.Nm
+is non-zero if there is a problem.  Zero is returned if a run/task has
+run (at least) once in the current runlevel, and when a service is running
+(as expected).  See the
+.Fl j
+option for detailed JSON output suitable for machine parsing.
+.Pp
+.Sy Tip:
+.Xr jq 1
+is a useful scripting tool in combination with JSON output
 .It Nm Ar status
-Show status of all services, default command
+Show status of all services, default command.  Also supports the
+.Fl j
+option for detailed JSON output
 .It Nm Ar cgroup
 List cgroup config overview
 .It Nm Ar ps
 List processes based on cgroups
 .It Nm Ar top
 Show top-like listing based on cgroups
+.It Nm Ar plugins
+List installed plugins
 .It Nm Ar runlevel Op Ar 0-9
-Show or set runlevel: 0 halt, 6 reboot
+Show or set runlevel: 0 halt, 6 reboot.
+.Pp
+If called at boot (runlevel S) to set the runlevel, Finit only schedules
+the change, effectively overriding the configured runlevel from
+.Pa /etc/finit.conf .
+Useful to trigger a fail-safe mode, or similar
 .It Nm Ar reboot
 Reboot system, default if
 .Cm reboot
 is symlinked to
-.Nm
+.Nm 
 .It Nm Ar halt
 Halt system, default if
 .Cm halt
 is symlinked to
-.Nm
+.Nm 
 .It Nm Ar poweroff
 Power-off system, default if
 .Cm poweroff
 is symlinked to
-.Nm
+.Nm 
 .It Nm Ar suspend
 Suspend system, default if
 .Cm suspend
 is symlinked to
-.Nm
+.Nm 
 .It Nm Ar utmp show
 Raw dump of UTMP/WTMP db
 .El
@@ -0,0 +1,114 @@
+site_name: Documentation
+site_description: Fast Init for Linux Systems
+site_url: https://troglobit.github.io/finit/
+repo_url: https://github.com/troglobit/finit
+repo_name: troglobit/finit
+copyright: Copyright &copy; 2008-2025 Joachim Wiberg
+docs_dir: doc/
+edit_uri: edit/master/doc/
+extra_css:
+  - extra.css
+
+exclude_docs: |
+  TODO.md
+
+theme:
+  logo: img/logo.png
+  name: material
+  features:
+    - toc.follow
+    - toc.integrate
+    - navigation.path
+    - navigation.instant
+    - navigation.instant.progress
+    - navigation.tracking
+#    - navigation.tabs
+#    - navigation.sections
+#    - navigation.expand
+#    - navigation.top
+    - navigation.footer
+    - search.highlight
+    - search.share
+#    - content.action.edit
+    - content.code.copy
+    - content.code.annotate
+  palette:
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      primary: orange
+      accent: orange
+      toggle:
+        icon: material/weather-night
+        name: Switch to dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      primary: black
+      accent: black
+      toggle:
+        icon: material/weather-sunny
+        name: Switch to light mode
+
+nav:
+  - Introduction: index.md
+  - Example: example.md
+  - Features: features.md
+  - Commands & Status: initctl.md
+  - Rebooting & Halting: commands.md
+  - Runlevels: runlevels.md
+  - Runparts & /etc/rc.local: runparts.md
+  - Configuration:
+    - Overview: config/index.md
+    - Files & Layout: config/files.md
+    - Conditions: conditions.md
+    - Cgroups: config/cgroups.md
+    - Environment Variables: config/env.md
+    - One-shot Tasks: config/task-and-run.md
+    - Services:
+      - Syntax: config/services.md
+      - Options: config/service-opts.md
+      - Environment: config/service-env.md
+      - Synchronization: config/service-sync.md
+      - Wrapper Scripts: config/service-wrappers.md
+    - Run-parts Scripts: config/runparts.md
+    - Runlevels: config/runlevels.md
+    - TTY & Console: config/tty.md
+    - Templating: config/templating.md
+    - Logging: config/logging.md
+    - SysV Compatibility: config/sysv.md
+    - Rescue Mode: config/rescue.md
+    - Limitations: config/limitations.md
+  - Usage:
+    - Building: build.md
+    - Command Line: cmdline.md
+    - Plugins: plugins.md
+    - Services: service.md
+    - Signals: signals.md
+  - Reference:
+    - Distributions: distro.md
+    - keventd: keventd.md
+    - Watchdog: watchdog.md
+    - Service State Machine: state-machine.md
+    - Requirements: requirements.md
+
+markdown_extensions:
+  - admonition
+  - attr_list
+  - pymdownx.details
+  - pymdownx.superfences
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.tabbed:
+      alternate_style: true
+  - tables
+  - toc:
+      permalink: true
+
+plugins:
+  - search
+  - callouts
+
+
+extra:
+  homepage: https://troglobit.com/projects/finit/
@@ -1,9 +1,9 @@
 pkglibdir           = $(plugin_path)
 AM_LDFLAGS          = -module -avoid-version -shared
 AM_CFLAGS           = -W -Wall -Wextra -Wno-unused-parameter -std=gnu99
-AM_CPPFLAGS         = -I$(top_srcdir)/src -U_FORTIFY_SOURCE
+AM_CPPFLAGS         = -I$(top_srcdir)/src
 AM_CPPFLAGS        += -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_GNU_SOURCE -D_DEFAULT_SOURCE
-AM_CPPFLAGS        += $(lite_CFLAGS) $(uev_CFLAGS)
+AM_CPPFLAGS        += -D__FINIT__ $(lite_CFLAGS) $(uev_CFLAGS)

 if STATIC
 noinst_LTLIBRARIES  = libplug.la
@@ -17,10 +17,6 @@ if BUILD_DBUS_PLUGIN
 libplug_la_SOURCES += dbus.c
 endif

-if BUILD_HOTPLUG_PLUGIN
-libplug_la_SOURCES += hotplug.c
-endif
-
 if BUILD_MODULES_LOAD_PLUGIN
 libplug_la_SOURCES += modules-load.c
 endif
@@ -68,10 +64,6 @@ if BUILD_HOOK_SCRIPTS_PLUGIN
 pkglib_LTLIBRARIES += hook-scripts.la
 endif

-if BUILD_HOTPLUG_PLUGIN
-pkglib_LTLIBRARIES += hotplug.la
-endif
-
 if BUILD_MODULES_LOAD_PLUGIN
 pkglib_LTLIBRARIES += modules-load.la
 endif
@@ -1,6 +1,6 @@
 /* Save and restore ALSA sound settings using alsactl
 *
- * Copyright (c) 2012-2022  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2025  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -27,21 +27,23 @@
 # include <lite/lite.h>
 #endif

+#include "conf.h"
 #include "finit.h"
 #include "helpers.h"
 #include "plugin.h"
+#include "log.h"

 #define ALSACTL "alsactl"

 static void save(void *arg)
 {
 	if (rescue) {
-		_d("Skipping %s plugin in rescue mode.", __FILE__);
+		dbg("Skipping %s plugin in rescue mode.", __FILE__);
 		return;
 	}

 	if (whichp(ALSACTL)) {
-		_d("Saving sound settings ...");
+		dbg("Saving sound settings ...");
 		run_interactive(ALSACTL " -g store", "Saving sound settings");
 	}
 }
@@ -49,12 +51,12 @@ static void save(void *arg)
 static void restore(void *arg)
 {
 	if (rescue) {
-		_d("Skipping %s plugin in rescue mode.", __FILE__);
+		dbg("Skipping %s plugin in rescue mode.", __FILE__);
 		return;
 	}

 	if (whichp(ALSACTL)) {
-		_d("Restoring sound settings ...");
+		dbg("Restoring sound settings ...");
 		run_interactive(ALSACTL " -g restore", "Restoring sound settings");
 	}
 }
@@ -65,12 +67,12 @@ static plugin_t plugin = {
 	.hook[HOOK_SHUTDOWN]  = { .cb  = save    }
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -1,6 +1,6 @@
 /* Setup necessary system files for, e.g. UTMP (tracking logins)
 *
- * Copyright (c) 2012-2022  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2025  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -40,6 +40,7 @@
 #include "plugin.h"
 #include "util.h"
 #include "utmp-api.h"
+#include "log.h"

 static int is_tmpfs(char *path)
 {
@@ -80,7 +81,7 @@ static int bootclean(const char *fpath, const struct stat *sb, int tflag, struct
 	if (ftw->level == 0)
 		return 1;

-	_d("Removing %s ...", fpath);
+	dbg("Removing %s ...", fpath);
 	(void)remove(fpath);

 	return 0;
@@ -110,10 +111,43 @@ static void clean(void *arg)
 	}
 }

-static void ln(const char *target, const char *linkpath)
+/* Kernel defines the following compulsory and recommended links
+ * https://github.com/torvalds/linux/blob/v5.18/Documentation/admin-guide/devices.rst#compulsory-links
+ */
+static void kernel_links(void)
 {
-	if (symlink(target, linkpath) && errno != EEXIST)
-		_pe("Failed creating %s -> %s symlink", target, linkpath);
+	struct {
+		char *tgt, *lnk;
+		int  optional;
+	} k[] = {
+		{ "/proc/self/fd", "/dev/fd", 0 },
+		{ "fd/0", "/dev/stdin",  0 },
+		{ "fd/1", "/dev/stdout", 0 },
+		{ "fd/2", "/dev/stderr", 0 },
+		{ "socksys", "/dev/nfsd", 0 },
+		{ "null", "/dev/X0R", 0 },
+		{ "/proc/kcore", "/dev/core", 1 },
+		{ "ram0", "/dev/ramdisk", 1 },
+		{ "qft0", "/dev/ftape", 1 },
+		{ "video0", "/dev/bttv0", 1 },
+		{ "radio0", "/dev/radio", 1 },
+	};
+	char *fn, buf[80];
+	size_t i;
+
+	for (i = 0; i < NELEMS(k); i++) {
+		fn = k[i].tgt;
+
+		if (k[i].optional) {
+			if (fn[0] != '/') {
+				snprintf(buf, sizeof(buf), "/dev/%s", k[i].tgt);
+				fn = buf;
+			}
+			if (!fexist(fn))
+				continue;
+		}
+		ln(k[i].tgt, k[i].lnk);
+	}
 }

 /*
@@ -125,87 +159,15 @@ static void setup(void *arg)

 	prev = umask(0);

-	_d("Setting up FHS structure in /var ...");
-	makedir("/var/cache",      0755);
-	makedir("/var/db",         0755); /* _PATH_VARDB on some systems */
-	makedir("/var/games",      0755);
-	makedir("/var/lib",        0755);
-	makedir("/var/lib/misc",   0755); /* _PATH_VARDB on some systems */
-	makedir("/var/lib/alarm",  0755);
-	makedir("/var/lib/urandom",0755);
-	if (fisdir("/run")) {
-		_d("System with new /run tmpfs ...");
-		if (!fisdir("/run/lock"))
-			makedir("/run/lock", 1777);
-		ln("/run/lock", "/var/lock");
-		ln("/dev/shm", "/run/shm");
+	/* Kernel symlinks, e.g. /proc/self/fd -> /dev/fd */
+	kernel_links();

-		/* compat only, should really be set up by OS/dist */
-		ln("/run", "/var/run");
-	} else {
-		makedir("/var/lock", 1777);
-		makedir("/var/run", 0755);
-	}
-	makedir("/var/log",        0755);
-	makedir("/var/mail",       0755);
-	makedir("/var/opt",        0755);
-	makedir("/var/spool",      0755);
-	makedir("/var/spool/cron", 0755);
-	makedir("/var/tmp",        0755);
-	makedir("/var/empty",      0755);
-
-	/*
-	 * UTMP actually needs multiple db files
-	 */
-	if (has_utmp()) {
-		int gid;
-
-		/*
-		 * If /etc/group or "utmp" group is missing, default to
-		 * "root", or "wheel", group.
-		 */
-		_d("Setting up necessary UTMP files ...");
-		gid = getgroup("utmp");
-		if (gid < 0)
-			gid = 0;
-
-		create("/var/run/utmp",    0644, 0, gid); /* Currently logged in */
-		create("/var/log/wtmp",    0644, 0, gid); /* Login history       */
-		create("/var/log/btmp",    0600, 0, gid); /* Failed logins       */
-		create("/var/log/lastlog", 0644, 0, gid);
-	}
+	/* Create all system tmpfiles.d(5) */
+	run_interactive(_PATH_TMPFILES " --create", "Creating required directories and files");

 	/* Set BOOT_TIME UTMP entry */
 	utmp_set_boot();

-#ifdef TOUCH_ETC_NETWORK_RUN_IFSTATE
-	touch("/etc/network/run/ifstate");
-#else
-	erase("/etc/network/run/ifstate");
-#endif
-
-	_d("Setting up misc files ...");
-	makedir("/var/run/network",0755); /* Needed by Debian/Ubuntu ifupdown */
-	makedir("/var/run/lldpd",  0755); /* Needed by lldpd */
-	makedir("/var/run/pluto",  0755); /* Needed by Openswan */
-	mksubsys("/var/run/quagga", 0755, "quagga", "quagga");
-	mksubsys("/var/log/quagga", 0755, "quagga", "quagga");
-	mksubsys("/var/run/frr",    0755, "frr", "frr");
-	mksubsys("/var/log/frr",    0755, "frr", "frr");
-	makedir("/var/run/sshd",  01755); /* OpenSSH  */
-
-	if (!fexist("/etc/mtab"))
-		ln("../proc/self/mounts", "/etc/mtab");
-
-	/* Void Linux has a uuidd that runs as uuid:uuid and needs /run/uuid */
-	mksubsys("/var/run/uuidd", 0755, "uuidd", "uuidd");
-
-	/* Debian has /run/sudo, ensure correct perms and SELinux label */
-	mksubsys("/var/run/sudo", 0711, "root", "root");
-	mksubsys("/var/run/sudo/ts", 0700, "root", "root");
-	if (whichp("restorecon"))
-		run("restorecon /var/run/sudo /var/run/sudo/ts", "restorecon");
-
 	umask(prev);
 }

@@ -216,12 +178,12 @@ static plugin_t plugin = {
 	.depends = { "pidfile" },
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -1,6 +1,6 @@
 /* Setup and start system message bus, D-Bus
 *
- * Copyright (c) 2012-2022  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2025  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -33,70 +33,147 @@
 #include "helpers.h"
 #include "plugin.h"
 #include "service.h"
+#include "util.h"
 #include "conf.h"
+#include "log.h"

-#define DAEMON "dbus-daemon"
-#define ARGS   "--nofork --system --syslog-only"
-#define DESC   "D-Bus message bus daemon"
+#define DBUS_DAEMON "dbus-daemon"
+#define DBUS_ARGS   "--nofork --system --syslog-only"
+#define DBUS_DESC   "D-Bus message bus daemon"

-#ifndef DAEMONUSER
-#define DAEMONUSER "messagebus"
+#ifndef DBUS_DAEMONUSER
+#define DBUS_DAEMONUSER "messagebus"
 #endif

-#ifndef DAEMONPIDFILE
-#define DAEMONPIDFILE "/var/run/dbus/pid"
+#ifndef DBUS_DAEMONGROUP
+#define DBUS_DAEMONGROUP "messagebus"
 #endif

+/*
+ * Dumnpster diving for the D-Bus main configuration file
+ * where <pidfile> is defined.
+ */
+static char *dbus_pidfn(void)
+{
+	char *alt[] = {
+		"/usr/share/dbus-1/system.conf",
+		"/etc/dbus-1/system.conf",
+		NULL
+	};
+	int i;
+
+	for (i = 0; alt[i]; i++) {
+		char *fn = alt[i];
+		char buf[256];
+		FILE *fp;
+
+		fp = fopen(fn, "r");
+		if (!fp)
+			continue;
+
+		fn = NULL;
+		while (fgets(buf, sizeof(buf), fp)) {
+			char *pos;
+
+			pos = strstr(buf, "<pidfile>");
+			if (!pos)
+				continue;
+			fn = pos + strlen("<pidfile>");
+			pos = strstr(fn, "</pidfile>");
+			if (!pos) {
+				fn = NULL;
+				break;
+			}
+			*pos = 0;
+			break;
+		}
+
+		fclose(fp);
+		if (fn)
+			return strdup(fn);
+	}
+
+	return NULL;
+}
+
 static void setup(void *arg)
 {
+	char *group = DBUS_DAEMONGROUP;
+	char *user = DBUS_DAEMONUSER;
 	char line[256];
+	char *pidfn;
 	mode_t prev;
 	char *cmd;

 	if (rescue) {
-		_d("Skipping %s plugin in rescue mode.", __FILE__);
+		dbg("Skipping %s plugin in rescue mode.", __FILE__);
 		return;
 	}

-	cmd = which(DAEMON);
+	cmd = which(DBUS_DAEMON);
 	if (!cmd) {
-		_d("Skipping plugin, %s is not installed.", DAEMON);
+		dbg("Skipping plugin, %s is not installed.", DBUS_DAEMON);
 		return;
 	}

-	prev =umask(0);
+	if (getuser(user, NULL) == -1) {
+		if (getuser("dbus", NULL) == -1)
+			user = "root"; /* fallback */
+		else
+			user = "dbus"; /* e.g., Buildroot */
+	}

-	mksubsys("/var/run/dbus", 0755, DAEMONUSER, DAEMONUSER);
-	if (whichp("dbus-uuidgen"))
-		run_interactive("dbus-uuidgen --ensure", "Creating machine UUID for D-Bus");
+	if (getgroup(group) == -1) {
+		if (getgroup("dbus") == -1)
+			group = "root"; /* fallback */
+		else
+			group = "dbus"; /* e.g., Buildroot */
+	}

 	/* Clean up from any previous pre-bootstrap run */
-	remove(DAEMONPIDFILE);
-
-	/* Register service with Finit */
-	snprintf(line, sizeof(line), "[S12345789] cgroup.system pid:!%s @%s:%s %s %s -- %s",
-		 DAEMONPIDFILE, DAEMONUSER, DAEMONUSER, cmd, ARGS, DESC);
-	if (service_register(SVC_TYPE_SERVICE, line, global_rlimit, NULL))
-		_pe("Failed registering %s", DAEMON);
-	free(cmd);
+	pidfn = dbus_pidfn();
+	if (pidfn)
+		remove(pidfn);

+	dbg("Creating D-Bus Required Directories ...");
+	prev = umask(0);
+	mksubsys("/var/run/dbus", 0755, user, group);
+	mksubsys("/var/run/lock/subsys", 0755, user, group);
+	mksubsys("/var/lib/dbus", 0755, user, group);
+	mksubsys("/tmp/dbus", 0755, user, group);
 	umask(prev);
+
+	/* Generate machine id for dbus */
+	if (whichp("dbus-uuidgen"))
+		run_interactive("dbus-uuidgen --ensure", "Verifying D-Bus machine UUID");
+
+	/*
+	 * Register service with Finit
+	 * Note: dbus drops privs after starting up.
+	 */
+	if (pidfn) {
+		snprintf(line, sizeof(line), "[S123456789] cgroup.system notify:none name:dbus pid:!%s %s %s -- %s",
+			 pidfn, cmd, DBUS_ARGS, DBUS_DESC);
+		free(pidfn);
+	} else
+		snprintf(line, sizeof(line), "[S123456789] cgroup.system notify:none name:dbus %s %s -- %s",
+			 cmd, DBUS_ARGS, DBUS_DESC);
+
+	conf_save_service(SVC_TYPE_SERVICE, line, "dbus.conf");
+	free(cmd);
 }

 static plugin_t plugin = {
-	.name = __FILE__,
-	.hook[HOOK_BASEFS_UP] = {
-		.cb  = setup
-	},
-	.depends = { "bootmisc", },
+	.name                  = __FILE__,
+	.hook[HOOK_SVC_PLUGIN] = { .cb  = setup },
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -26,18 +26,11 @@
 #include "plugin.h"
 #include "config.h"

-#define CHOOSE(x, y) y
-static const char *hscript_paths[] = HOOK_TYPES;
-#undef CHOOSE
+extern void plugin_script_run(hook_point_t no);

-static void hscript_run_parts(hook_point_t hook)
+static void hscript_run_parts(hook_point_t no)
 {
-	char path[CMD_SIZE] = "";
-
-	strlcat(path, PLUGIN_HOOK_SCRIPTS_PATH, sizeof(path));
-	strlcat(path, hscript_paths[hook] + 4, sizeof(path));
-
-	run_parts(path, NULL);
+	plugin_script_run(no);
 }

 static void hscript_banner(void *arg)
@@ -96,14 +89,22 @@ static plugin_t plugin = {
 	.hook[HOOK_SVC_UP]      = { .cb  = hscript_svc_up      },
 	.hook[HOOK_SYSTEM_UP]   = { .cb  = hscript_system_up   },
 	.hook[HOOK_SHUTDOWN]    = { .cb  = hscript_shutdown    },
+/*
+ * We have exited here, so these are handled a bit differently by Finit,
+ * when hook scripts are enabled, just to provide the user with the same
+ * interface:
+ *
+ *	.hook[HOOK_SVC_DN]      = { .cb  = hscript_svc_down    },
+ *	.hook[HOOK_SYS_DN]      = { .cb  = hscript_system_down },
+ */
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -1,116 +0,0 @@
-/* Heuristically find and initialize a suitable hotplug daemon
- *
- * Copyright (c) 2012-2022  Joachim Wiberg <troglobit@gmail.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include <stdio.h>
-
-#include "config.h"
-#include "conf.h"
-#include "finit.h"
-#include "helpers.h"
-#include "plugin.h"
-#include "service.h"
-
-static void setup(void *arg)
-{
-	char cmd[256];
-	char *path;
-
-	if (rescue) {
-		_d("Skipping %s plugin in rescue mode.", __FILE__);
-		return;
-	}
-
-	/*
-	 * Populate /dev and prepare for runtime events from kernel.
-	 * Prefer udev if mdev is also available on the system.
-	 */
-	path = which("udevd");
-	if (!path)
-		path = which("/lib/systemd/systemd-udevd");
-	if (path) {
-		/* Register udevd as a monitored service */
-		snprintf(cmd, sizeof(cmd), "[S12345789] cgroup.system pid:udevd name:udevd log %s "
-			 "-- Device event managing daemon", path);
-		if (service_register(SVC_TYPE_SERVICE, cmd, global_rlimit, NULL)) {
-			_pe("Failed registering %s", path);
-		} else {
-			snprintf(cmd, sizeof(cmd), "cgroup.init :1 [S] <pid/udevd> log "
-				 "udevadm trigger -c add -t devices "
-				 "-- Requesting device events");
-			service_register(SVC_TYPE_RUN, cmd, global_rlimit, NULL);
-
-			snprintf(cmd, sizeof(cmd), "cgroup.init :2 [S] <pid/udevd> log "
-				 "udevadm trigger -c add -t subsystems "
-				 "-- Requesting subsystem events");
-			service_register(SVC_TYPE_RUN, cmd, global_rlimit, NULL);
-		}
-
-		free(path);
-
-		/* Debian has this little script to copy generated
-		 * rules while the system was read-only. TODO: When
-		 * this functionality was hardcoded in finit.c, this
-		 * call was made in crank_worker(). Now that
-		 * filesystems are mounted earlier we should be able
-		 * to make this call directly after the triggers have
-		 * run, but this has not been tested AT ALL. */
-		if (fexist("/lib/udev/udev-finish"))
-			run_interactive("/lib/udev/udev-finish", "Finalizing udev");
-	} else {
-		path = which("mdev");
-		if (path) {
-			/* Embedded Linux systems usually have BusyBox mdev */
-			if (debug)
-				touch("/dev/mdev.log");
-
-			snprintf(cmd, sizeof(cmd), "%s -s", path);
-			free(path);
-
-			run_interactive(cmd, "Populating device tree");
-		}
-	}
-}
-
-static plugin_t plugin = {
-	.name = __FILE__,
-	.hook[HOOK_BASEFS_UP] = {
-		.cb  = setup
-	},
-	.depends = { "bootmisc" },
-};
-
-PLUGIN_INIT(plugin_init)
-{
-	plugin_register(&plugin);
-}
-
-PLUGIN_EXIT(plugin_exit)
-{
-	plugin_unregister(&plugin);
-}
-
-/**
- * Local Variables:
- *  indent-tabs-mode: t
- *  c-file-style: "linux"
- * End:
- */
@@ -1,6 +1,6 @@
 /* Coldplug modules using modalias magic
 *
- * Copyright (c) 2021-2022  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2025  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -50,6 +50,7 @@
 #include "finit.h"
 #include "util.h"
 #include "plugin.h"
+#include "log.h"

 struct module {
 	TAILQ_ENTRY(module) link;
@@ -71,14 +72,14 @@ static int modprobe(char *alias)
 	pid = fork();
 	switch (pid) {
 	case -1:
-		_pe("Failed forking modprobe child");
+		err(1, "Failed forking modprobe child");
 		return 1;
 	case 0:
 		execvp(args[0], args);
 		break;
 	default:
 		if (!complete(args[0], pid))
-			_d("Successful modprobe of %s", alias);
+			dbg("Successful modprobe of %s", alias);
 		break;
 	}

@@ -106,7 +107,7 @@ static void alias_remove(struct module *m)
 	TAILQ_REMOVE(&modules, m, link);
 	free(m->alias);
 	free(m);
-}	
+}

 static int alias_exist(char *alias)
 {
@@ -120,27 +121,86 @@ static int alias_exist(char *alias)
 	return 0;
 }

-static int scan_alias(const char *path, const struct stat *st, int flag, struct FTW *unused)
+static void alias_add_uniq(char *alias)
+{
+	if (alias_exist(alias))
+		return;
+
+	alias_add(alias);
+}
+
+static FILE *maybe_fopen_alias(const char *file, const char *path)
+{
+	const char *basename;
+
+	basename = basenm(path);
+	if (!strcmp(basename, path))
+		return NULL;
+
+	if (strcmp(file, basename))
+		return NULL;
+
+	return fopen(path, "r");
+}
+
+static int scan_modalias(const char *path)
 {
-	FILE *fp;
 	char buf[256];
+	FILE *fp;

-	if (fnmatch("*/modalias", path, 0))
-		return 0;
-
-	fp = fopen(path, "r");
+	fp = maybe_fopen_alias("modalias", path);
 	if (!fp)
-		return 0;
+		return 1;
+
 	if (fgets(buf, sizeof(buf), fp)) {
 		chomp(buf);
-		if (!alias_exist(buf))
-			alias_add(buf);
+		alias_add_uniq(buf);
 	}
+
 	fclose(fp);

 	return 0;
 }

+static int scan_uevent(const char *path)
+{
+	char buf[256];
+	FILE *fp;
+
+	fp = maybe_fopen_alias("uevent", path);
+	if (!fp)
+		return 1;
+
+	while (fgets(buf, sizeof(buf), fp)) {
+		if (strstr(buf, "MODALIAS=") != buf)
+			continue;
+
+		chomp(buf);
+
+		alias_add_uniq(buf + strlen("MODALIAS="));
+		break;
+	}
+
+	fclose(fp);
+
+	return 0;
+}
+
+static int scan_alias(const char *path, const struct stat *st,
+		      int flag, struct FTW *unused)
+{
+	/* Sanity check: is this a regular file we can read? */
+	if (!(S_ISREG(st->st_mode) && (st->st_mode & S_IRUSR)))
+		return 0;
+
+	if (!scan_uevent(path))
+		return 0;
+
+	scan_modalias(path);
+
+	return 0;
+}
+
 static void coldplug(void *arg)
 {
 	struct module *m, *tmp;
@@ -173,12 +233,12 @@ static plugin_t plugin = {
 	.depends = { "bootmisc", }
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -41,7 +41,7 @@
 *
 * Please note, the :ID is there for your benefit, it ensures that tasks
 * in Finit are unique.  If you have two tasks with the same name and ID
- * (or no ID), the last one read replaces any preceeding one!
+ * (or no ID), the last one read replaces any preceding one!
 */

 #include <unistd.h>
@@ -58,66 +58,125 @@
 #include "plugin.h"
 #include "service.h"
 #include "conf.h"
+#include "log.h"

 #ifndef MODULES_LOAD_PATH
 #define MODULES_LOAD_PATH "/etc/modules-load.d"
 #endif
+#define MODPROBE_PATH     "/sbin/modprobe"
 #define SERVICE_LINE \
-	"cgroup.init name:modprobe.%s :%d [2345] /sbin/modprobe %s %s -- Kernel module: %s"
+	"cgroup.init name:modprobe.%s :%d [%s] %s %s %s --"
 #define SERVICE_LINE_NOINDEX \
-	"cgroup.init name:modprobe.%s [2345] /sbin/modprobe %s %s -- Kernel module: %s"
+	"cgroup.init name:modprobe.%s [%s] %s %s %s --"

-static int load_file(const char *file, int index)
+static int modules_load(const char *file, int index)
 {
 	char module_path[PATH_MAX];
-	char line[256];
+	char *modprobe_path;
 	int num = 0;
+	char *line;
+	char *lvl;
 	FILE *fp;

 	strlcpy(module_path, MODULES_LOAD_PATH "/", sizeof(module_path));
 	strlcat(module_path, file, sizeof(module_path));

 	fp = fopen(module_path, "r");
-	if (!fp)
+	if (!fp) {
+		warnx("failed opening %s for reading, skipping ...", module_path);
 		return 0;
+	}

-	while (fgets(line, sizeof(line), fp)) {
-		char cmd[CMD_SIZE], *mod, *args;
+	modprobe_path = strdup(MODPROBE_PATH);
+	if (!modprobe_path) {
+	fail:
+		warnx("failed allocating memory in modules-load plugin.");
+		fclose(fp);
+		return -1;
+	}

-		chomp(line);
+	lvl = strdup("S");
+	if (!lvl) {
+		free(modprobe_path);
+		goto fail;
+	}

+	while ((line = fparseln(fp, NULL, NULL, NULL, 0))) {
+		char cmd[CMD_SIZE], *mod, *args, *set;
+
+		/*
+		 * fparseln() skips regular UNIX comments only.
+		 * This is for modules-load.d(5) compat.
+		 */
+		if (line[0] == ';')
+			goto next;
+
+		/* trim whitespace */
 		mod = strip_line(line);
 		if (!mod[0])
-			continue;
+			goto next;

-		if (mod[0] == '#' || mod[0] == ';')
-			continue;
+		/* Finit extension 'set foo bar' */
+		if ((set = fgetval(mod, "set", "= \t"))) {
+			char *val = mod;

-		if (!strcmp(mod, "set noindex")) {
-			index = 0;
-			continue;
-		}
-		if (!strncmp(mod, "set index", 9)) {
-			mod += 9;
-			args = strchr(mod, '=');
-			if (args) /* optional */
-				mod = args + 1;
-			index = atoi(mod);
-			continue;
+			if (!strcmp(set, "noindex")) {
+				index = 0;
+				free(set);
+				goto next;
+			}
+
+			if ((val = fgetval(set, "index", "= \t"))) {
+				index = atoi(val);
+				free(set);
+				free(val);
+				goto next;
+			}
+
+			if ((val = fgetval(set, "runlevel", "= \t"))) {
+				free(lvl);
+				lvl = val;
+				free(set);
+				goto next;
+			}
+
+			if ((val = fgetval(set, "modprobe", "= \t"))) {
+				if (access(val, X_OK)) {
+					warn("%s: cannot use %s", module_path, val);
+					free(set);
+					free(val);
+					free(line);
+					goto skip;
+				} else {
+					free(modprobe_path);
+					modprobe_path = val;
+				}
+				free(set);
+				goto next;
+			}
+
+			/* unknown 'set' command, ignore. */
+			goto next;
 		}

 		mod = strtok_r(mod, " ", &args);
 		if (!mod)
-			continue;
+			goto next;

 		if (!index)
-			snprintf(cmd, sizeof(cmd), SERVICE_LINE_NOINDEX, mod, mod, args, mod);
+			snprintf(cmd, sizeof(cmd), SERVICE_LINE_NOINDEX, mod, lvl, modprobe_path, mod, args);
 		else
-			snprintf(cmd, sizeof(cmd), SERVICE_LINE, mod, index++, mod, args, mod);
+			snprintf(cmd, sizeof(cmd), SERVICE_LINE, mod, index++, lvl, modprobe_path, mod, args);

+		dbg("task %s", cmd);
 		service_register(SVC_TYPE_TASK, cmd, global_rlimit, NULL);
 		num++;
+	next:
+		free(line);
 	}
+skip:
+	free(modprobe_path);
+	free(lvl);
 	fclose(fp);

 	return num;
@@ -142,11 +201,11 @@ static void load(void *arg)
 	int index = 1;
 	int i, num;

-	_d("Scanning " MODULES_LOAD_PATH " for config files ...");
+	dbg("Scanning " MODULES_LOAD_PATH " for config files ...");
 	num = scandir(MODULES_LOAD_PATH, &dentry, module_filter, alphasort);
 	if (num > 0) {
 		for (i = 0; i < num; i++) {
-			index += load_file(dentry[i]->d_name, index);
+			index += modules_load(dentry[i]->d_name, index);
 			free(dentry[i]);
 		}
 		free(dentry);
@@ -154,18 +213,16 @@ static void load(void *arg)
 }

 static plugin_t plugin = {
-	.name = __FILE__,
-	.hook[HOOK_BASEFS_UP] = {
-		.cb  = load
-	},
+	.name                  = __FILE__,
+	.hook[HOOK_SVC_PLUGIN] = { .cb  = load },
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 }
@@ -2,7 +2,7 @@
 /* Netlink plugin for IFUP/IFDN and GW events
 *
 * Copyright (C) 2009-2011  Mårten Wikström <marten.wikstrom@keystream.se>
- * Copyright (C) 2009-2022  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (C) 2009-2025  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -29,6 +29,7 @@

 #include "finit.h"
 #include "cond.h"
+#include "log.h"
 #include "helpers.h"
 #include "plugin.h"
 #include "service.h"
@@ -62,7 +63,7 @@ static void nl_route(struct nlmsghdr *nlmsg, ssize_t len)
 	int la;

 	if (nlmsg->nlmsg_len < NLMSG_LENGTH(sizeof(struct rtmsg))) {
-		_e("Packet too small or truncated!");
+		errx(1, "Packet too small or truncated!");
 		return;
 	}

@@ -70,7 +71,7 @@ static void nl_route(struct nlmsghdr *nlmsg, ssize_t len)
 	a  = RTM_RTA(r);
 	la = RTM_PAYLOAD(nlmsg);
 	if (la >= len) {
-		_e("Packet too large!");
+		errx(1, "Packet too large!");
 		return;
 	}

@@ -80,18 +81,18 @@ static void nl_route(struct nlmsghdr *nlmsg, ssize_t len)
 		switch (a->rta_type) {
 		case RTA_GATEWAY:
 			gw = *((int *)data);
-			//_d("GW: 0x%04x", gw);
+			//dbg("GW: 0x%04x", gw);
 			break;

 		case RTA_DST:
 			dst = *((int *)data);
 			plen = r->rtm_dst_len;
-			//_d("Prefix LEN: 0x%04x", plen);
+			//dbg("Prefix LEN: 0x%04x", plen);
 			break;

 		case RTA_OIF:
 			idx = *((int *)data);
-			//_d("IDX: 0x%04x", idx);
+			//dbg("IDX: 0x%04x", idx);
 			break;
 		}

@@ -102,7 +103,7 @@ static void nl_route(struct nlmsghdr *nlmsg, ssize_t len)
 	ing.s_addr = gw;
 	inet_ntop(AF_INET, &ind, daddr, sizeof(daddr));
 	inet_ntop(AF_INET, &ing, gaddr, sizeof(gaddr));
-	_d("Got gw %s dst/len %s/%d ifindex %d", gaddr, daddr, plen, idx);
+	dbg("Got gw %s dst/len %s/%d ifindex %d", gaddr, daddr, plen, idx);

 	if ((!dst && !plen) && (gw || idx)) {
 		if (nlmsg->nlmsg_type == RTM_DELROUTE) {
@@ -167,7 +168,7 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)
 	int la;

 	if (nlmsg->nlmsg_len < NLMSG_LENGTH(sizeof(struct ifinfomsg))) {
-		_e("Packet too small or truncated!");
+		errx(1, "Packet too small or truncated!");
 		return;
 	}

@@ -175,7 +176,7 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)
 	a  = (struct rtattr *)((char *)i + NLMSG_ALIGN(sizeof(struct ifinfomsg)));
 	la = NLMSG_PAYLOAD(nlmsg, sizeof(struct ifinfomsg));
 	if (la >= len) {
-		_e("Packet too large!");
+		errx(1, "Packet too large!");
 		return;
 	}

@@ -185,7 +186,7 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)

 		strlcpy(ifname, RTA_DATA(a), sizeof(ifname));
 		if (validate_ifname(ifname)) {
-			_d("Invalid interface name '%s', skipping ...", ifname);
+			dbg("Invalid interface name '%s', skipping ...", ifname);
 			continue;
 		}

@@ -195,7 +196,7 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)
 			 * New interface has appeared, or interface flags has changed.
 			 * Check ifi_flags here to see if the interface is UP/DOWN
 			 */
-			_d("%s: New link, flags 0x%x, change 0x%x", ifname, i->ifi_flags, i->ifi_change);
+			dbg("%s: New link, flags 0x%x, change 0x%x", ifname, i->ifi_flags, i->ifi_change);
 			net_cond_set(ifname, "exist",   1);
 			net_cond_set(ifname, "up",      i->ifi_flags & IFF_UP);
 			net_cond_set(ifname, "running", i->ifi_flags & IFF_RUNNING);
@@ -205,7 +206,7 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)

 		case RTM_DELLINK:
 			/* NOTE: Interface has disappeared, not link down ... */
-			_d("%s: Delete link", ifname);
+			dbg("%s: Delete link", ifname);
 			net_cond_set(ifname, "exist",   0);
 			net_cond_set(ifname, "up",      0);
 			net_cond_set(ifname, "running", 0);
@@ -213,15 +214,15 @@ static void nl_link(struct nlmsghdr *nlmsg, ssize_t len)
 			break;

 		case RTM_NEWADDR:
-			_d("%s: New Address", ifname);
+			dbg("%s: New Address", ifname);
 			break;

 		case RTM_DELADDR:
-			_d("%s: Deconfig Address", ifname);
+			dbg("%s: Deconfig Address", ifname);
 			break;

 		default:
-			_d("%s: Msg 0x%x", ifname, nlmsg->nlmsg_type);
+			dbg("%s: Msg 0x%x", ifname, nlmsg->nlmsg_type);
 			break;
 		}
 	}
@@ -246,46 +247,46 @@ static int nl_parse(int sd)
 				break;

 			default:
-				_pe("recv()");
+				err(1, "recv()");
 				break;
 			}

 			return -1;
 		}

-//		_d("recv %zd bytes", len);
+//		dbg("recv %zd bytes", len);
 		l = (size_t)len;
 		for (nh = (struct nlmsghdr *)nl_buf; NLMSG_OK(nh, l); nh = NLMSG_NEXT(nh, l)) {
 			struct nlmsgerr *nle;

 			switch (nh->nlmsg_type) {
 			case NLMSG_DONE:
-//				_d("Done with netlink messages.");
+//				dbg("Done with netlink messages.");
 				return 0;

 			case NLMSG_ERROR:
-//				_d("Kernel netlink comm. error.");
+//				dbg("Kernel netlink comm. error.");
 				nle = NLMSG_DATA(nh);
 				if (nle) {
 					errno = -nle->error;
-					_pe("Kernel netlink error %d", errno);
+					err(1, "Kernel netlink error %d", errno);
 				}
 				return -1;

 			case RTM_NEWROUTE:
 			case RTM_DELROUTE:
-//				_d("Netlink route ...");
+//				dbg("Netlink route ...");
 				nl_route(nh, len);
 				break;

 			case RTM_NEWLINK:
 			case RTM_DELLINK:
-//				_d("Netlink link ...");
+//				dbg("Netlink link ...");
 				nl_link(nh, len);
 				break;

 			default:
-				_w("unhandled netlink message, type %d", nh->nlmsg_type);
+				warnx("unhandled netlink message, type %d", nh->nlmsg_type);
 				break;
 			}
 		}
@@ -304,21 +305,21 @@ static int nl_request(int sd, unsigned int seq, int type)

 	switch (type) {
 	case RTM_GETROUTE:
-//		_d("RTM_GETROUTE");
+//		dbg("RTM_GETROUTE");
 		nlr->rtm.rtm_family = AF_INET;
 		nlr->rtm.rtm_table  = RT_TABLE_MAIN;
 		nlr->nh.nlmsg_len   = NLMSG_LENGTH(sizeof(struct rtmsg));
 		break;

 	case RTM_GETLINK:
-//		_d("RTM_GETLINK");
+//		dbg("RTM_GETLINK");
 		nlr->ifi.ifi_family = AF_UNSPEC;
 		nlr->ifi.ifi_change = 0xFFFFFFFF;
 		nlr->nh.nlmsg_len   = NLMSG_LENGTH(sizeof(struct ifinfomsg));
 		break;

 	default:
-		_w("Cannot resync, unhandled message type %d", type);
+		warnx("Cannot resync, unhandled message type %d", type);
 		return -1;
 	}

@@ -331,13 +332,13 @@ static int nl_request(int sd, unsigned int seq, int type)
 static void nl_resync_routes(int sd, unsigned int seq)
 {
 	if (nl_request(sd, seq, RTM_GETROUTE))
-		_pe("Failed netlink route request");
+		err(1, "Failed netlink route request");
 }

 static void nl_resync_ifaces(int sd, unsigned int seq)
 {
 	if (nl_request(sd, seq, RTM_GETLINK))
-		_pe("Failed netlink link request");
+		err(1, "Failed netlink link request");
 }

 /*
@@ -350,12 +351,12 @@ static void nl_resync(int all)

 	sd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
 	if (sd < 0) {
-		_pe("netlink socket");
+		err(1, "netlink socket");
 		return;
 	}

 	if (all) {
-		_d("============================ RESYNC =================================");
+		dbg("============================ RESYNC =================================");
 		/* this doesn't update conditions, and thus does not stop services */
 		cond_deassert("net/");

@@ -364,7 +365,7 @@ static void nl_resync(int all)

 		/* delayed update after we've corrected things */
 		service_step_all(SVC_TYPE_ANY);
-		_d("=========================== RESYNCED ================================");
+		dbg("=========================== RESYNCED ================================");
 	} else
 		nl_resync_routes(sd, seq++);

@@ -375,7 +376,7 @@ static void nl_callback(void *arg, int sd, int events)
 {
 	if (nl_parse(sd) < 0) {
 		if (errno == ENOBUFS) {	/* netlink(7) */
-			_w("busy system, resynchronizing with kernel.");
+			warnx("busy system, resynchronizing with kernel.");
 			nl_resync(1);
 			return;
 		}
@@ -386,7 +387,7 @@ static void nl_callback(void *arg, int sd, int events)
 	 * we need to check ourselves, e.g. for loss of default route.
 	 */
 	if (nl_ifdown) {
-		_d("interface down, checking default route.");
+		dbg("interface down, checking default route.");
 		if (nl_defidx > 0) {
 			nl_defidx = 0;
 			nl_resync(0);
@@ -414,14 +415,14 @@ static plugin_t plugin = {
 	},
 };

-PLUGIN_INIT(plugin_init)
+PLUGIN_INIT(__init)
 {
 	struct sockaddr_nl sa;
 	int sd;

 	sd = socket(AF_NETLINK, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, NETLINK_ROUTE);
 	if (sd < 0) {
-		_pe("socket()");
+		err(1, "socket()");
 		return;
 	}

@@ -431,14 +432,14 @@ PLUGIN_INIT(plugin_init)
 	sa.nl_pid    = getpid();

 	if (bind(sd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
-		_pe("bind()");
+		err(1, "bind()");
 		close(sd);
 		return;
 	}

 	nl_buf = malloc(NL_BUFSZ);
 	if (!nl_buf) {
-		_pe("malloc()");
+		err(1, "malloc()");
 		close(sd);
 		return;
 	}
@@ -447,7 +448,7 @@ PLUGIN_INIT(plugin_init)
 	plugin_register(&plugin);
 }

-PLUGIN_EXIT(plugin_exit)
+PLUGIN_EXIT(__exit)
 {
 	plugin_unregister(&plugin);
 	close(plugin.io.fd);
--- a/Show More
+++ b/Show More