Update ChangeLog and bump version for v4.7 release

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
.github: update actions
2026-10-12 10:12:32 +00:00 · 2024-01-07 19:48:31 +01:00 · 2024-01-07 19:47:12 +01:00 · 2024-01-07 15:18:52 +01:00 · 2024-01-07 13:59:49 +01:00 · 2024-01-07 13:56:31 +01:00
151 changed files with 1946 additions and 920 deletions
@@ -28,7 +28,7 @@ jobs:
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config tree jq libuev-dev libite-dev
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Static Finit
        run: |
          ./autogen.sh
@@ -61,7 +61,7 @@ jobs:
        run: |
          make check || (cat test/test-suite.log; false)
      - name: Upload Test Results
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: finit-test-${{ matrix.compiler }}
          path: test/*.log
@@ -15,22 +15,39 @@ jobs:
  coverity:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
-        id: coverity-toolchain-cache
-        with:
-          path: cov-analysis-linux64
-          key: ${{ runner.os }}-coverity
-      - name: Download Coverity Scan
-        if: steps.coverity-toolchain-cache.outputs.cache-hit != 'true'
+      - uses: actions/checkout@v4
+      - name: Fetch latest Coverity Scan MD5
+        id: var
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        run: |
-          wget -q https://scan.coverity.com/download/cxx/linux64 \
-               --post-data "token=$TOKEN&project=${COVERITY_PROJ}" \
-               -O cov-analysis-linux64.tar.gz
-          mkdir cov-analysis-linux64
-          tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
+          wget -q https://scan.coverity.com/download/cxx/linux64         \
+               --post-data "token=$TOKEN&project=${COVERITY_PROJ}&md5=1" \
+               -O coverity-latest.tar.gz.md5
+          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+      - uses: actions/cache@v3
+        id: cache
+        with:
+          path: coverity-latest.tar.gz
+          key: ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+          restore-keys: |
+            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
+            ${{ runner.os }}-coverity-
+            ${{ runner.os }}-coverity
+      - name: Download Coverity Scan
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+        run: |
+          if [ ! -f coverity-latest.tar.gz ]; then
+            wget -q https://scan.coverity.com/download/cxx/linux64   \
+                 --post-data "token=$TOKEN&project=${COVERITY_PROJ}" \
+                 -O coverity-latest.tar.gz
+          else
+            echo "Latest Coverity Scan available from cache :-)"
+            md5sum coverity-latest.tar.gz
+          fi
+          mkdir coverity
+          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
      - name: Install dependencies
        run: |
          sudo apt-get -y update
@@ -42,13 +59,15 @@ jobs:
          (cd libuev-2.4.0 && ./configure --prefix=/usr && make && sudo make install-strip)
          (cd libite-2.5.2 && ./configure --prefix=/usr && make && sudo make install-strip)
          sudo ldconfig
-      - name: Build
+      - name: Configure
        run: |
          ./autogen.sh
          ./configure --prefix= --enable-x11-common-plugin --with-watchdog --with-keventd
-          export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
+      - name: Build
+        run: |
+          export PATH=`pwd`/coverity/bin:$PATH
          cov-build --dir cov-int make
-      - name: Submit result to Coverity Scan
+      - name: Submit results to Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
        run: |
@@ -61,3 +80,8 @@ jobs:
            --form version=trunk \
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${COVERITY_PROJ}
+      - name: Upload build.log
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverity-build.log
+          path: cov-int/build-log.txt
@@ -10,12 +10,29 @@ jobs:
    name: Build and upload release tarball
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
+    env:
+      MAKEFLAGS: -j3
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Installing dependencies ...
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config jq libuev-dev libite-dev
+      - name: Setting release variables ...
+        id: build
+        run: |
+          ver=${GITHUB_REF#refs/tags/}
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          if echo $ver | grep -qE '^[0-9]+\.[0-9]+(\.[0-9]+)?(-alpha|-beta|-rc)[0-9]*$'; then
+            echo "pre=true"  >> $GITHUB_OUTPUT
+          else
+            echo "pre=false" >> $GITHUB_OUTPUT
+          fi
+          if echo $ver | grep -qE '^[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "latest=true"  >> $GITHUB_OUTPUT
+          else
+            echo "latest=false" >> $GITHUB_OUTPUT
+          fi
      - name: Creating Makefiles ...
        run: |
          ./autogen.sh
@@ -36,5 +53,7 @@ jobs:
      - uses: ncipollo/release-action@v1
        with:
          name: Finit v${{ github.ref_name }}
+          prerelease: ${{ steps.build.outputs.pre }}
+          makeLatest: ${{ steps.build.outputs.latest }}
          bodyFile: "release.md"
          artifacts: "artifacts/*"
@@ -13,8 +13,9 @@ jobs:
    outputs:
      run: ${{ steps.check.outputs.run }}
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Check for any commits since last week
+        id: schedule
        run: |
          commits="$(git log --format=%H --since='1 week ago')"
          if [ -n "$commits" ]; then
@@ -22,7 +23,6 @@ jobs:
          else
              echo "run=false" >> $GITHUB_OUTPUT
          fi
-
  distcheck:
    needs: schedule
    if: ${{ needs.schedule.outputs.run == 'true' }}
@@ -32,7 +32,7 @@ jobs:
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config jq libuev-dev libite-dev
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Base run
        run: |
          ./autogen.sh
@@ -14,6 +14,7 @@ GTAGS
 /autom4te.cache
 /aclocal.m4
 /ar-lib
+/backup/
 /compile
 /config.cache
 /config.h
@@ -36,6 +37,9 @@ GTAGS
 /test-driver
 /test-suite.log

+# Misc
+/.gdb_history
+
 # TroglOS build system
 /.config
 /.stamp
@@ -4,43 +4,149 @@ Change Log
 All relevant changes are documented in this file.


-[4.5][] - 2023-09-14
+[4.7][] - 2024-01-07
+--------------------
+
+### Changes
+- Silence "not available" messages for run/task/service with `nowarn`
+- Update docs, `cgroup.root` workaround for `SCHED_RR` tasks
+- Drop runlevels 0 and 6 from `keventd`, not needed at reboot/poweroff
+- Mount `/dev/shm` with mode 1777 (sticky bit)
+- Mount `/dev/mqueue` if available, inspiration from Alpine Linux
+- Update Alpine Linux installer and configuration files, tested on
+  Alpine v3.19, some assembly still required
+
+### Fixes
+- Fix confusing warning message when tmpfiles.d fails to install symlink
+- Fix tmpfiles.d legacy `/run/lock/subsys`, ordering
+- Add missing `/var/tmp` and `/var/lock -> /run/lock` (tmpfiles.d)
+- Fix #388: log redirection broken unless Finit runs in debug mode.
+  Found and fixed by Ryan Rorison
+- Fix #389: must libc requires `libgen.h` for `basename()` function.
+  Reported and worked around with new `basenm()` function by Stargirl
+
+
+[4.6][] - 2023-11-13
+--------------------
+
+### Changes
+- Add support for service `notify:pid` and `readiness none` global
+  option to change how Finit expects readiness notification, issue #386
+
+### Fixes
+- Fix #383: dbus and runparts regression in Finit v4.5.  The configure
+  script must expand `FINIT_RUNPATH_` before defining it in `config.h`
+- Fix #384: service environment variables drop everything but the first
+  argument, e.g., `VAR="foo bar qux"` drops everything but `foo`
+- Fix #385: internal conditions, e.g., `<int/bootstrap>` turn into flux
+  when leaving bootstrap, causing depending services to stop
+- Fix #387: global environment variables declared with `set VAR=NAME` do
+  not drop leading `set `, causing `'set VAR'='NAME'` in env.
+- Sanity check environment variables, for services and globally.  Ensure
+  the variable name (key) does not contain spaces, or a leading `set `
+
+
+[4.5][] - 2023-10-30
 --------------------

 ### Changes
 - Refactor `runparts` and `/etc/rc.local` to no longer block the main
-  loop, allowing these scripts to call `initctl` to interact with Finit.
-  Still in a limited way due to them being used at bootstrap, issue #356
+  loop, allowing `initctl` calls to interact with Finit.  Issue #356
 - Refactor the `run` stanza to no longer block the main loop, issue #362
 - Allow `sulogin` with a user different from `root`, issue #357
 - Allow disabling invocation of rescue mode from kernel command line
 - Add `initctl -f` to force-skip asking Finit for existing services
  when creating new services during bootstrap, e.g. `/etc/rc.local`
 - `initctl runlevel` now returns `N S` instead of `N 10` in bootstrap
+- `initctl runlevel N` during bootstrap is now allowed.  It changes
+  the next runlevel to go to when bootstrap has completed.  Effectively
+  overriding the `runlevel N` statement in `/etc/finit.conf`
 - Improved logging on failure to `execvp()` a run/task/service, now
  with `errno`, e.g., "No such file or directory" when the command
  is missing from `$PATH`
- Add support for Bash completion to `initctl`, issue #360
+- Add Bash completion support for `initctl`, configurable, issue #360
 - Handle absolute path to `initctl [enable|disable]`, not supported
 - Update `finit.conf(5)` man page with the recommended directory
  hierarchy in `/etc/finit.d/`
 - The `runparts` code has been split into `/libexec/finit/runparts`
+- The `runparts` command now takes two options: `sysv` and `progress`.
+  The former ensures only `SNNfoo` and `KNNfoo` scripts are run.
 - Add SysV Init Compatibility section to documentation
+- Increased MAX path for commands, and arguments: 64 -> 256
+- The bundled watchdog daemon no longer tries to log at startup, because
+  syslog is not available yet, any startup message leak to console
+- Extend `if:` option with runtime evaluation of conditions.  E.g., start
+  a task only `if:<run/foo/failure>` (here the run task 'foo' failed)
+- Document new `if:`, `conflict:`, `nowarn` options for run/task/service
+  first introduced in v4.4
+- Failure to open fstab should log to console, not just log to `/dev/kmsg`
+- Rename `/lib/finit/system/*.conf`, added numbered prefix to ensure
+  proper execution order, e.g., `udevd` should always run first
+- Plugins and bundled services: dbus, keventd, watchdogd, and runparts,
+  are now loaded *after* all services in `/lib/finit/system/`.  A new
+  runtime-only path (for inspection) in `/run/finit/system/` is used
+- Redirect `log*` output to console when `finit.debug` is enabled
+- Assert `<int/container>` condition if we detect running in container
+- Add support for mdev's netlink daemon mode, issue #367
+- Add support for mdevd in `10-hotplug.conf`, preferred over plain mdev
+- Disable modprobe plugin by default, udevd and mdev/mdevd loads modules
+- Update documentation for run/task shell limitations, issue #376
+- Update documentation regarding automount of `/run` and `/tmp`
+- Update plugin documentation, add section about limited tmpfiles.d(5) support
+- Skip registering service when `if:!name` matches a known service.
+  This allows conditional loading of alternative services, e.g. if udevd
+  is already loaded we do not need mdevd
+- Drop `doc/bootstrap.md`, inaccurate and confusing to users

 ### Fixes
- Fix #227: believed to have been fixed in [4.3][], the root cause was
+- Fix #227: believed to have been fixed in v4.3, the root cause was
  actually that Finit was waiting for a process that was no longer in
  the system.  The fix is to ask the kernel on process-stop-timeout and
  replay the lost PID so that Finit can continue with reboot/shutdown
 - Fix #358: fix inotify events for `/etc/finit.conf`, improved log
  messages and error handling
 - Fix #361: cgroup move fail if run/task/services start as non-root.
-  Regression in the [4.4][] release cycle while adding support for the
+  Regression in the v4.4 release cycle while adding support for the
  pre:/post:/ready: scripts.  Now the latter scripts also properly run
  in their correct cgroup
+- Fix #366: document `fsck.*` kernel command line options and simplify
+  the configure flags `--enable-fsckfix` and `--enable-fastboot` to
+  only adjust the default values for the `fsck.*` options.
+- Fix #371: swap load order of `/lib/finit/system/*` vs `/etc/finit.d/*`
+  We must run `10-hotplug.conf` first to ensure devices and modules are
+  up and loaded before the user's run/task/services are called.  The order
+  at bootstrap is now saved in `/run/finit/conf.order` for inspection,
+  `/run/finit/exec.order` shows the start order of each process
+- Fix #372: lost `udevadm` calls due to overloading
+- Adjust final `udevadm settle` timeout: 5 -> 30 sec
+- Fixed dbus plugin, the function that located `<pidfile> ...` in the
+  `dbus/system.conf` caused spurious line breaks which led to the
+  service not being loaded properly
 - The `runparts` executor now skips backup files (`foo~`)
 - The `runparts` stanza now properly appends ` start` to scripts that
  start with `S[0-9]+`.  This has been broken for a very long time.
+- Fix #377: expand service `env:file` variables, allow constructs like:
+
+        RUNDIR=/var/run/somesvc
+        DAEMON_ARGS=--workdir $RUNDIR --other-args...
+- Fix #378: warn on console if run/task times out during bootstrap
+- Fix #378: add run/task support for `<!>` to allow transition from
+  bootstrap to multi-user runlevel even though task has not run yet.
+- Fix #382: do not clear `<service/foo/STATE>` conditions on reload.  
+  Introduced back in v4.3-rc2, 82cc10be8, the support for automatic
+  service conditions have had a weird and unintended behavior.  Any
+  change in state (see `doc/svc-machine.png`) caused Finit to clear
+  out *all* previously acquired service conditions.
+
+  However, when moving between RUNNING and PAUSED states, a service
+  should not have its conditions cleared.  The PAUSED state, seen
+  also by all conditions moving to FLUX, is only temporary while an
+  `initctl reload` is processed.  If a service has no changes to be
+  applied it will move back to RUNNING.
+
+  Also, we cannot clear the service conditions because other run/task
+  or services may depend on it and clearing them would cause Finit to
+  `SIGTERM` these processes (since they are no longer eligible to run).


 [4.4][] - 2023-05-15
@@ -1549,7 +1655,9 @@ Major bug fix release.

 * Initial release

-[UNRELEASED]: https://github.com/troglobit/finit/compare/4.5...HEAD
+[UNRELEASED]: https://github.com/troglobit/finit/compare/4.7...HEAD
+[4.7]: https://github.com/troglobit/finit/compare/4.6...4.7
+[4.6]: https://github.com/troglobit/finit/compare/4.5...4.6
 [4.5]: https://github.com/troglobit/finit/compare/4.4...4.5
 [4.4]: https://github.com/troglobit/finit/compare/4.3...4.4
 [4.3]: https://github.com/troglobit/finit/compare/4.2...4.3
@@ -1,5 +1,5 @@
 Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
-Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -10,6 +10,10 @@ if DOC
 SUBDIRS           += doc
 endif

+if BASH
+bashdir            = $(BASH_DIR)
+dist_bash_DATA     = initctl
+endif
 # Compat hook
 install-dev:
 	@make -C src install-pkgincludeHEADERS
@@ -30,6 +34,7 @@ release: distcheck
 		printf "$$file.sha256\t"; cat ../$$file.sha256 | cut -f1 -d' ';	\
 	done

-DISTCHECK_CONFIGURE_FLAGS = --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
-			    --enable-testserv-plugin --enable-x11-common-plugin  \
-			    --with-watchdog --with-keventd --with-fstab=/etc/fstab
+DISTCHECK_CONFIGURE_FLAGS = --prefix=/usr --sysconfdir=/etc --localstatedir=/var   \
+			    --enable-testserv-plugin --enable-x11-common-plugin    \
+			    --with-watchdog --with-keventd --with-fstab=/etc/fstab \
+			    --with-bash-completion-dir=no
@@ -3,7 +3,6 @@

 * [Introduction](#introduction)
 * [Features](#features)
-* [Bootstrap](doc/bootstrap.md#bootstrap)
 * [Runlevels](#runlevels)
 * [Syntax](doc/config.md#syntax)
  * [Runparts & /etc/rc.local](#runparts--etcrclocal)
@@ -23,11 +22,10 @@ Introduction
 ------------

 Fast init for Linux systems.  Reverse engineered from the [EeePC
-fastinit][] over ten years ago by [Claudio Matsuoka][] — "gaps filled
-with frog DNA …"
+fastinit][] by [Claudio Matsuoka][] — "gaps filled with frog DNA …"

-![Alpine screenshot](img/finit4-screenshot.png)  
-*Figure 1: Screenshot showing Finit booting [Alpine Linux](https://www.alpinelinux.org/).*
+![Alpine screenshot](img/alpine-screenshot2.png)  
+*Figure 1: Screenshot of Finit booting [Alpine Linux (HowTo)](https://github.com/troglobit/finit/tree/master/contrib/alpine).*

 Features include:

@@ -66,7 +64,9 @@ distributions:
 > **Note:** support for various Linux distributions does not mean Finit
 > installs easily on all architectures.  The bundled install scripts are
 > examples for standard installations, tested on amd64 (x86_64) systems.
-> Custom setups, for embedded systems, can be found in [myLinux][].
+> Custom setups, e.g., for embedded systems, can be found in any of the
+> following [Buildroot][] based examples: [myLinux][], [Infix][], or the
+> plain [br2-finit-demo](https://github.com/troglobit/br2-finit-demo).


 Example
@@ -391,8 +391,7 @@ Right after the runlevel change when all services have started properly,
 No configuration stanza in `/etc/finit.conf` is required for `rc.local`.
 If it exists and is an executable shell script Finit calls it at the very
 end of the boot, before calling the `HOOK_SYSTEM_UP`.  See more on hooks
-in [doc/plugins.md](doc/plugins.md#hooks), and about the system bootstrap
-in [doc/bootstrap.md](doc/bootstrap.md).
+in [doc/plugins.md](doc/plugins.md#hooks).


 ### Limitations
@@ -707,6 +706,8 @@ and proposed extensions.
 [EeePC fastinit]:   https://web.archive.org/web/20071208212450/http://wiki.eeeuser.com/boot_process:the_boot_process
 [Claudio Matsuoka]: https://github.com/cmatsuoka
 [Joachim Wiberg]:   https://troglobit.com
+[Buildroot]:        https://buildroot.org
+[Infix]:            https://kernelkit.github.io
 [finit.conf(5)]:    https://man.troglobit.com/man5/finit.conf.5.html
 [License]:          https://en.wikipedia.org/wiki/MIT_License
 [License Badge]:    https://img.shields.io/badge/License-MIT-teal.svg
@@ -1,4 +1,5 @@
-AC_INIT([Finit],[4.5-rc1],[https://github.com/troglobit/finit/issues],[finit],[https://troglobit.com/projects/finit/])
+AC_INIT([Finit], [4.7], [https://github.com/troglobit/finit/issues],
+	[finit], [https://troglobit.com/projects/finit/])
 AC_CONFIG_AUX_DIR(aux)
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz subdir-objects])
 AM_SILENT_RULES([yes])
@@ -14,10 +15,10 @@ AC_CONFIG_FILES([Makefile
 	man/Makefile
 	plugins/Makefile
 	src/Makefile
-	system/Makefile
-	tmpfiles.d/Makefile
+	system/Makefile system/10-hotplug.conf
 	test/test.env test/Makefile
-	test/lib/Makefile test/src/Makefile])
+	test/lib/Makefile test/src/Makefile
+	tmpfiles.d/Makefile])

 # Older versions of autoconf (<2.58) do not have AC_CONFIG_MACRO_DIR()
 #m4_include([m4/plugin.m4])
@@ -93,18 +94,22 @@ AC_ARG_ENABLE(all_plugins,
 AC_PLUGIN([alsa-utils],    [no],  [Save and restore ALSA sound settings using alsactl])
 AC_PLUGIN([dbus],          [no],  [Setup and start system message bus, D-Bus])
 AC_PLUGIN([modules-load],  [no],  [Scans /etc/modules-load.d for modules to load])
-AC_PLUGIN([modprobe],      [yes], [Coldplug modules using modalias magic])
+AC_PLUGIN([modprobe],      [no],  [Coldplug modules using modalias magic])
 AC_PLUGIN([resolvconf],    [no],  [Setup necessary files for resolvconf])
 AC_PLUGIN([x11-common],    [no],  [Console setup (for X)])
 AC_PLUGIN([netlink],       [yes], [Basic netlink plugin for IFUP/IFDN and GW events. Can be replaced with externally built plugin that links with libnl or similar.])
 AC_PLUGIN([hook-scripts],  [no],  [Trigger script execution from hook points])
-AC_PLUGIN([hotplug],       [yes], [Setup and start udev or mdev hotplug daemon])
+AC_PLUGIN([hotplug],       [yes], [Start udevd or mdev kernel event datamon])
 AC_PLUGIN([rtc],           [yes], [Save and restore RTC using hwclock])
 AC_PLUGIN([tty],           [yes], [Automatically activate new TTYs, e.g. USB-to-serial])
 AC_PLUGIN([urandom],       [yes], [Setup and save random seed at boot/shutdown])
 AC_PLUGIN([testserv],      [no],  [Test plugin to start test serv daemon])

 # Check for extra arguments or packages
+AC_ARG_WITH([bash-completion-dir],
+	AS_HELP_STRING([--with-bash-completion-dir[=PATH]], [Directory to install Bash completion, default: auto]),
+	[bash_dir=$withval], [bash_dir=yes])
+
 AC_ARG_WITH(fstab,
        AS_HELP_STRING([--with-fstab=FILE], [System default fstab, default $sysconfdir/fstab]),
 	[fstab=$withval], [fstab=yes])
@@ -195,6 +200,12 @@ AS_IF([test "x$enable_rescue" != "xno"], [
 AM_CONDITIONAL(LOGROTATE, [test "x$enable_logrotate" = "xyes"])

 ### With features ##############################################################################
+AS_IF([test "x$bash_dir" = "xyes"], [
+	PKG_CHECK_MODULES([BASH_COMPLETION], [bash-completion >= 2.0],
+		[BASH_DIR="$(pkg-config --variable=completionsdir bash-completion)"],
+		[BASH_DIR="$datadir/bash-completion/completions"])], [
+	BASH_DIR="$bash_dir"])
+
 AS_IF([test "x$with_fstab" != "xno"], [
 	AS_IF([test "x$fstab" = "xyes"], [fstab=$sysconfdir/fstab])
 	AC_EXPAND_DIR(fstab_path, "$fstab")
@@ -284,19 +295,27 @@ AS_IF([test "x$with_plugin_path" != "xno"], [
 	AC_DEFINE_UNQUOTED(EXTERNAL_PLUGIN_PATH, "$plugin_path", [Built-in default: /usr/lib/finit/plugins:/usr/local/lib/finit/plugins])])

 # Control build with automake flags
-AM_CONDITIONAL(STATIC,    [test "x$enable_static" = "xyes"])
+AM_CONDITIONAL(BASH,      [test "x$bash_dir"      != "xno"])
+AM_CONDITIONAL(STATIC,    [test "x$enable_static"  = "xyes"])
 AM_CONDITIONAL(KEVENTD,   [test "x$with_keventd"  != "xno"])
 AM_CONDITIONAL(SULOGIN,   [test "x$with_sulogin"  != "xno"])
 AM_CONDITIONAL(WATCHDOGD, [test "x$with_watchdog" != "xno"])
-AM_CONDITIONAL(DOC,       [test "x$enable_doc" = "xyes"])
+AM_CONDITIONAL(DOC,       [test "x$enable_doc"     = "xyes"])
 AM_CONDITIONAL(CONTRIB,   [test "x$enable_contrib" = "xyes"])
 AM_CONDITIONAL(TESTSERV,  [test "x$enable_testserv_plugin" = "xyes"])

+# Workaround for as-of-yet unreleased runstatedir support, planned for
+# autoconf 2.70, which some major distros have backported.
+AS_IF([test -z "$runstatedir"], runstatedir="$localstatedir/run")
+AC_SUBST(runstatedir)
+
 # Override default libdir, used for plugins and rescue.conf
 pkglibdir=$libdir/finit
 AC_SUBST(pkglibexecdir)
 AC_EXPAND_DIR(pkglibexecdir, "$libexecdir/finit")
 AC_DEFINE_UNQUOTED(FINIT_EXECPATH_, "$pkglibexecdir", [Finit libexec path])
+AC_EXPAND_DIR(finit_runpath, "$runstatedir/finit/system")
+AC_DEFINE_UNQUOTED(FINIT_RUNPATH_, "$finit_runpath", [Finit runtime dynamic system services])

 AC_EXPAND_DIR(plugin_path, "$pkglibdir/plugins")
 AC_SUBST(plugin_path)
@@ -304,7 +323,7 @@ AC_DEFINE_UNQUOTED(PLUGIN_PATH, "$plugin_path", [Finit plugin path])

 AC_EXPAND_DIR(tmpfiles_path, "$libdir/tmpfiles.d")
 AC_SUBST(tmpfiles_path)
-AC_DEFINE_UNQUOTED(TMPFILES_PATH, "$tmpfiles_path", [Main tmpfiles.d/, override in /etc])
+AC_DEFINE_UNQUOTED(TMPFILES_PATH_, "$tmpfiles_path", [Main tmpfiles.d/, override in /etc])

 AC_EXPAND_DIR(finit_tmpfiles, "$pkglibdir/tmpfiles.d")
 AC_SUBST(finit_tmpfiles)
@@ -312,13 +331,16 @@ AC_DEFINE_UNQUOTED(FINIT_TMPFILES, "$finit_tmpfiles", [Finit tmpfiles.d/ .conf p

 AC_EXPAND_DIR(system_path, "$pkglibdir/system")
 AC_SUBST(system_path)
-AC_DEFINE_UNQUOTED(FINIT_SYSPATH, "$system_path", [Static services, previously generated at runtime by plugins])
+AC_DEFINE_UNQUOTED(FINIT_SYSPATH_, "$system_path", [Static services, previously generated at runtime by plugins])

 AC_EXPAND_DIR(rescue_conf, "$pkglibdir/rescue.conf")
 AC_DEFINE_UNQUOTED(RESCUE_CONF, "$rescue_conf", [Finit rescue mode .conf])
 AC_EXPAND_DIR(sample_conf, "$pkglibdir/sample.conf")
 AC_DEFINE_UNQUOTED(SAMPLE_CONF, "$sample_conf", [Finit sameple.conf for initctl create])

+AC_EXPAND_DIR(bash_completion_dir, "$BASH_DIR")
+AC_SUBST(BASH_DIR, "$bash_completion_dir")
+
 AS_IF([test "$heading" = ""],   [heading="<DEFAULT>"])
 AS_IF([test "$heading" = "no"], [heading="<NONE>"])

@@ -355,6 +377,7 @@ Behavior:
 Optional features:
  Install doc/..........: $enable_doc
  Install contrib/......: $enable_contrib
+  Bash completion.......: $bash_completion_dir
  Built-in keventd......: $with_keventd
  Built-in sulogin......: $with_sulogin $sulogin
  Built-in watchdogd....: $with_watchdog $watchdog
@@ -1,5 +1,5 @@
-HowTo: Finit on Alpine Linux 3.4-3.6
-====================================
+HowTo: Finit on Alpine Linux 3.4...3.19
+=======================================

 HowTo use Finit to boot an [Alpine Linux][] system.  It is assumed that
 the user has already installed make, a compiler, C library header files,
@@ -17,7 +17,7 @@ PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig:/usr/local/lib/pkgconfig ./configure	\
 		 --prefix=/usr			--exec-prefix=			\
 		 --sysconfdir=/etc		--localstatedir=/var		\
 		 --enable-dbus-plugin		--enable-x11-common-plugin	\
-		 --enable-alsa-utils-plugin	--with-watchdog			\
+		 --enable-alsa-utils-plugin	--without-watchdog		\
 		 --with-keventd			--with-sulogin

 echo
@@ -1,8 +1,7 @@
 SUBDIRS    = available
 docsdir   := @docdir@/contrib/alpine/finit.d
 d_LINKS    = acpid.conf crond.conf dropbear.conf getty.conf	\
-	     keymap.conf modules.conf ntpd.conf			\
-	     klogd.conf syslogd.conf
+	     keymap.conf modules.conf ntpd.conf syslogd.conf

 install-exec-hook:
 	@$(MKDIR_P) $(DESTDIR)$(docsdir)/available
@@ -1,4 +1,4 @@
 docsdir   := @docdir@/contrib/alpine/finit.d/available
 docs_DATA  = acpid.conf crond.conf dropbear.conf getty.conf keymap.conf	\
-             lxdm.conf modules.conf ntpd.conf syslog.conf watchdog.conf
+             lxdm.conf modules.conf ntpd.conf syslogd.conf watchdog.conf
 EXTRA_DIST = $(docs_DATA)
@@ -4,4 +4,4 @@
 #module evdev
 #module mousedev
 #module 8139cp
-module softdog
+#module softdog
@@ -1,45 +1,53 @@
 #!/bin/sh

-if [ "x`id -u`" != "x0" ]; then
-    echo
-    echo "*** This script must run as root"
-    echo
+if [ "$(id -u)" != "0" ]; then
+    printf "\n\e[1m*** This script must run as root\e[0m\n\n"
    exit 1
 fi

+# shellcheck disable=SC3037,SC3045,SC2154
+yorn()
+{
+    printf "\e[1m> %s (y/N)?\e[0m " "$*"
+    read -rn1 yorn
+    echo
+
+    if [ "$yorn" = "y" ] || [ "$yorn" = "Y" ]; then
+	return 0
+    fi
+
+    return 1
+}
+
 # Adjust base directory
-grep -q alpine Makefile 2>/dev/null
-if [ $? -eq 0 ]; then
+if grep -q contrib/alpine Makefile 2>/dev/null; then
    cd ../..
-elif [ ! -e configure.ac ]; then
-    echo "*** Please run this script from the Finit base directory."
+fi
+
+if [ ! -e configure.ac ]; then
+    printf "\n\e[1m*** Please run this script from the Finit base directory.\e[0m\n"
    exit 1
 fi

-echo
-echo "*** Install Finit on Alpine Linux"
-echo "========================================================================"
-echo "/sbin/finit           - PID 1"
-echo "/lib/finit/plugins/*  - All enabled Finit plugins"
-echo "/etc/finit.conf       - Finit configuration file"
-echo "/etc/finit.d/         - Finit services"
-echo
-read -p "Do you want to continue (y/N)? " yorn
+printf "\n\e[1mInstall Finit on Alpine Linux\n"
+printf "========================================================================\e[0m\n"
+printf "/sbin/finit           - PID 1\n"
+printf "/lib/finit/plugins/*  - All enabled Finit plugins\n"
+printf "/etc/finit.conf       - Finit configuration file\n"
+printf "/etc/finit.d/         - Finit services\n"

-if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
-    echo
-    echo "*** Installing Finit files ..."
+if yorn "Do you want to continue"; then
+    printf "\n\e[1m*** Installing Finit files ...\e[0m\n"
    make install
-    cd /usr/share/doc/finit/contrib/alpine
+    cd /usr/share/doc/finit/contrib/alpine || exit 1
    for file in finit.conf rc.local; do
 	install -vbD $file /etc/$file
    done
    cp -va finit.d /etc/

-    read -p "*** Install Finit as the system default Init (y/N)? " yorn
-    if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
-	echo "*** Updating /sbin/init symlink --> finit ..."
-	cd /sbin
+    if yorn "Install Finit as the system default Init"; then
+	printf "\e[1m*** Updating /sbin/init symlink --> finit ...\e[0m\n"
+	cd /sbin || exit 1
 	rm init
 	ln -s finit init

@@ -48,10 +56,8 @@ if [ "x$yorn" = "xy" -o "x$yorn" = "xY" ]; then
 	ln -s reboot shutdown
 	ln -s reboot suspend
    fi
-    echo "*** Done"
+    printf "\n\e[1m*** Done\e[0m\n"
    echo
 else
-    echo
-    echo "*** Aborting install."
-    echo
+    printf "\n\e[1m*** Aborting install.\e[0m\n\n"
 fi
@@ -9,16 +9,6 @@ value in the project turned out to be:
 > systems, container, and dedicated server applications.


-Before Next Release
-------------------
-
-* When did runparts +arg break?
-* Should we update the =runparts DIR= syntax to =runparts [progress] [debug] DIR=?
-* Add SNN-only option top runparts, for Buildroot
-* Calling `initctl runlevel` at bootstrap => N 10, what should it be?
-* Reindent all shell scripts in true emacs shell-script-mode (4 chars)
-
-
 Misc TODOs
 ----------

@@ -1,59 +0,0 @@
-Bootstrap
-=========
-
-0. Get bearings, disable kernel logs, initialize TTY and print banner,
-   unless `HOOK_BANNER` is defined, then call that instead
-1. Prepare emergency shell, if enabled
-2. Set up initial signal handlers
-3. Set up default $PATH early
-4. Mount `/proc` and `/sys`
-5. Check kernel command line for `debug` to figure out log level
-6. Load all `.so` plugins
-7. Call `fsck` on file systems listed in `/etc/fstab`
-8. Populate `/dev` using either udev or mdev, depending on system type
-9. Parse `/etc/finit.conf`
-10. Start built-in watchdog, if enabled and `WDT_DEVNODE` exists.  This
-    means any WDT that requires a kernel module need to be either
-    compiled into the kernel, or insmod'ed in `/etc/finit.conf`
-11. Load all `/etc/finit.d/*.conf` files and set hostname
-12. Remount `/` read-write if `/` is listed in `/etc/fstab` without `ro`
-13. Call 1st level hooks, `HOOK_ROOTFS_UP`
-14. Mount all file systems listed in `/etc/fstab` and swap, if available.
-    On mount error `HOOK_MOUNT_ERROR` is called.  After mount, regardless
-    of error, `HOOK_MOUNT_POST` is called
-15. Enable SysV init signals
-16. Call 2nd level hooks, `HOOK_BASEFS_UP`
-17. Cleanup stale files from `/tmp/*` et al, handled by `bootmisc` plugin
-18. Load kernel params from `/etc/sysctl.d/*.conf`, `/etc/sysctl.conf`
-    et al. (Supports all locations that SysV init does.), handled by
-    `procps` plugin
-19. Start all 'S' runlevel tasks and services
-20. Bring up loopback interface and all `/etc/network/interfaces`, if
-    the `.conf` setting `network <SCRIPT>` is set, it is called instead
-21. Call 3rd level hooks, `HOOK_NETWORK_UP`
-22. If `runparts <DIR>` is set, [run-parts(8)][] is called on `<DIR>`
-23. Switch to the configured runlevel from `/etc/finit.conf`, default 2.
-    At every runlevel change all `*.conf` files in `/etc/finit.d/` are
-    (re)loaded and new services, tasks, and blocking run commands are
-    started.  Provided they are allowed in the new runlevel and all of
-    their conditions, if any, are set.
-24. Call 4th level hooks, `HOOK_SVC_UP`
-25. Call `/etc/rc.local`, if it exists and is an executable shell script
-26. Call 5th level (last) hooks, `HOOK_SYSTEM_UP`
-27. Start all configured TTYs
-
-In (19) and (23) tasks and services defined in `/etc/finit.conf` and
-`/etc/finit.d/*.conf` are started.
-
-Notice the seven hook points that are called at various point in the
-bootstrap process.  This is where plugins can extend the boot in any
-way they please.  There are other hook points available, for more on
-this, see [plugins.md](plugins.md).
-
-For instance, at `HOOK_BASEFS_UP` a plugin could read an XML file from a
-USB stick, convert/copy its contents to the system's `/etc/` directory,
-well before all 'S' runlevel tasks are started.  This could be used with
-system images that are created read-only and all configuration is stored
-on external media.
-
-[run-parts(8)]: http://manpages.debian.org/cgi-bin/man.cgi?query=run-parts
@@ -12,6 +12,15 @@ The `bool` setting is one of `on, off, true false, 1, 0`.
 * `debug`: Enable kernel debug.  Debug messages are printed to the
   console until Finit starts up, unless `loglevel=7` (below) is used.

+* `fsck.mode=<auto,force,skip>`, default: `auto`, unless built with
+  `configure --enable-fastboot`, in which case the default is `skip`
+
+* `fsck.repair=<preen,yes,no>`, default: `preen`, unless built with
+  `configure --enable-fsckfix`, in which case the default is `yes`.
+  This configure option also sets `fsck.mode=force`, unless fastboot
+  is selected at the same time.  I.e., the `--enable-fastboot` build
+  option overrides the `fsck.mode` default value.
+
 * `finit.cond=foo[,bar[,baz]]`: set `<boot/foo>` condition, optionally
  multiple conditions can be set using the same option, separated with a
  comma.  Alternatively, multiple `foo.cond=arg` can be given.  Each will
@@ -27,6 +27,16 @@ specified separated by comma.  Multiple conditions are logically AND'ed
 during evaluation, i.e. all conditions must be satisfied in order for a
 service to run.

+A special syntax, using a leading `!` in run/task/service conditions,
+denote if a:
+
+ - service does not support `SIGHUP`
+ - run/task should not block runlevel changes (i.e., bootstrap)
+
+Finit guarantees by default that all run/tasks run (at least) once
+per runlevel.  For most tasks this is a good default, for example
+checking SSH host keys or loading keymap.  However, for conditions
+that are unlikely to happen it is not. (See example below.)

 ### Example

@@ -41,6 +51,19 @@ being created, i.e., the service's default readiness notification.
  asserted.  I.e., if the Zebra process above stops or restarts, netd
  will also stop or restart.

+Another example is `dropbear`, it does not support `SIGHUP`, but we can
+also see optional sourcing of arguments from an environment file:
+
+    service [2345789] <!> env:-/etc/default/dropbear dropbear -F -R $DROPBEAR_ARGS -- Dropbear SSH daemon
+
+Finally, the weird "block runlevel changes" example.  Here we see what
+happens when Finit receives `SIGPWR`, sent from a power daemon like
+[powstatd(8)][].  A condition is asserted and a user can set up their
+own task to act on it.  We do not want this task to block Finit from
+moving to the next runlevel after bootstrap, so we set `<!>`:
+
+    task [S0123456789] <!sys/pwr/fail> name:pwrfail initctl poweroff -- Power failure, shutting down
+

 Triggering
 ----------
@@ -260,3 +283,5 @@ Therefore, any plugin that supplies Finit with conditions must ensure
 that their state is updated after each reconfiguration.  This can be
 done by binding to the `HOOK_SVC_RECONF` hook.  For an example of how
 to do this, see `plugins/pidfile.c`.
+
+[powstatd(8)]: https://manpages.ubuntu.com/manpages/trusty/en/man8/powstatd.8.html
@@ -52,21 +52,51 @@ PID file monitoring, or [conditions](conditions.md).

 ### Configuration Files

-Originally Finit was configured using a single file, `/etc/finit.conf`.
-Although still possible to use this single configuration file, today the
-following familiar layout is recommended:
+Originally Finit was configured using a single file, `/etc/finit.conf`,
+and although still possible to use a single configuration file, today
+the following layout is recommended:

-    /etc/
-      |- finit.d/
-      |   |- available/
-      |   |   `- my-service.conf
-      :   |- enabled/
-      :   |   `- my-service.conf -> ../available/my-service.conf
-      :   :
-      :   |- static-service.conf
-      :   `- another-static.conf
-      :
-      `- finit.conf
+    /
+    |- etc/
+    |  |- finit.d/
+    |  |   |- available/
+    |  |   |  `- my-service.conf
+    |  :   |- enabled/
+    |  :   |  `- my-service.conf -> ../available/my-service.conf
+    |  :   :
+    |  :   |- static-service.conf
+    |  :   `- another-static.conf
+    |  :
+    |  `- finit.conf
+    |- lib
+    |   `- finit/
+    |       `- system/
+    |           |- 10-hotplug.conf
+    |           `- ...
+    `- run/
+        `- finit/
+            `- system/
+                |- dbus.conf
+                |- keventd.conf
+                |- runparts.conf
+                |- watchdogd.conf
+                `- ...
+
+Configuration files in `/etc` are provided by the user, or projects like
+[finit-skel](https://github.com/troglobit/finit-skel) and extended by
+the user.
+
+The files in `/lib/finit/system/*.conf` are system critical services and
+setup provided by Finit, e.g. udev/mdev that must run very early at system
+bootstrap.  This system directory was introduced in Finit v4.4 to replace
+the hard-coded services provided by plugins before.  All .conf files in this
+directory be either replaced by a system administrator or overridden by a
+file with the same name in `/etc/finit.d/`.
+
+The files in `/run/finit/system/*.conf` are created by plugins and Finit
+bundled services like runparts, the [watchdog](#watchdog), and `keventd`
+if they are enabled.  Like `/lib/finit/system/*.conf`, these files can
+ be overridden by file with the same name in `/etc/finit.d/`.

 Services in the `available/` and `enabled/` sub-directories are called
 dynamic services, in contrast to static services -- the only difference
@@ -75,9 +105,27 @@ with the `enable` and `disable` commands.  An administrator can always
 create files and symlinks manually.

 At bootstrap, and `initctl reload`, all .conf files are read, starting
-with `finit.conf`, then, in alphabetical order, all `finit.d/*.conf`
-files, and finally (still in alphabetical order) all `enabled/*.conf`
-files.
+with `finit.conf`, then `/lib/finit/system/*.conf`, `finit.d/*.conf`,
+and finally all `finit.d/enabled/*.conf` files.  Each directory is a
+unique group, where files within each group are sorted alphabetically.
+
+**Example:**
+
+    /lib/finit/system/10-hotplug.conf
+    /lib/finit/system/90-testserv.conf
+    /run/finit/system/dbus.conf
+    /run/finit/system/runparts.conf
+    /etc/finit.d/10-abc.conf
+    /etc/finit.d/20-abc.conf
+    /etc/finit.d/enabled/1-aaa.conf
+    /etc/finit.d/enabled/1-abc.conf
+
+The resulting combined configuration is read line by line, each `run`,
+`task`, and `service` added to an ordered list that ensures they are
+started in the same order.  This is important because of the blocking
+properties of the `run` statement.  For an example on the relation of
+`service` and `run` statements, and dependency handling between them,
+see [Conditional Loading](#conditional-loading), below.

 > **Note:** the `finit.conf` and `finit.d/` names are only defaults.
 > They can be changed at compile-time with two `configure` options:
@@ -126,18 +174,22 @@ layout, as specified in the [FHS][]:
         |- spool/
         `- tmp/

-Finit starts (very early) by mounting `/dev`, `/proc/`, and `/sys`,
-unless they (i.e., `/dev`) are already mounted.  When all plugins and
-other, core Finit functions, have been set up, all relevant filesystems
-(`PASS > 0`) are checked and mounted from the selected `fstab`, either
+Finit starts by mounting the critical file systems `/dev`, `/proc/`, and
+`/sys`, unless they are already mounted.  When all plugins and other,
+core Finit functions, have been set up, all relevant filesystems (where
+`PASS > 0`) are checked and mounted from the selected `fstab`, either
 the default `/etc/fstab`, or any custom one selected from the command
 line, or at build time.

-Any file system not listed `fstab` are automatically mounted by Finit,
-as listed above, provided their respective mount point exists.
+To provide a smooth ride, file system not listed in the given `fstab`,
+e.g. `/tmp` and `/run`, are automatically mounted by Finit, as listed
+above, provided their respective mount point exists.

 With all filesystems mounted, Finit calls `swapon`.

+> **Tip:** to see what happens when all filesystems are mounted, have a
+> look at the [`bootmisc.so` plugin](plugins.md).
+
 At shutdown, and after having stopped all services and other lingering
 processes have been killed, filesystems are unmounted in the reverse
 order, and `swapoff` is called.
@@ -154,24 +206,30 @@ order, and `swapoff` is called.
 - `  0`: shutdown

 Runlevels are declared per service/run/task/sysv command.  Starting in
-runlevel S ([bootStrap](bootstrap.md)), usually only for tasks supposed
-to run once at boot, and services like `syslogd`, which you need to
-start and run throughout the whole time your system is up.  Before `S`
-is started, however, Finit performs a lot of housekeeping tasks like
-mounting all filesystems, calling `fsck` if needed, and making sure the
-everything is OK.
+runlevel S (bootStrap), usually only for tasks supposed to run once at
+boot, and services like `syslogd`, which you need to start and run
+throughout the whole time your system is up.
+
+Before `S` is started, however, Finit performs a lot of housekeeping
+tasks like mounting all filesystems, calling `fsck` if needed, and
+making sure the everything is OK.

    task [S] /lib/console-setup/console-setup.sh
    service [S12345] env:-/etc/default/rsyslog rsyslogd -n $RSYSLOGD_ARGS

-After runlevel S, Finit proceeds to runlevel 2.  (This can be changed in
-`/etc/finit.conf` using the `runlevel N` directive.)  Before starting
-the services in runlevel 2, Finit first stops everything that is not
-allowed to run in 2, and then brings up networking.  Networking is
-expected to be available in all runlevels except: S, 1 (single user
-level), 6, and 0.  Networking is enabled either by the `network script`
-directive, or if you have an `/etc/network/interfaces` file, Finit calls
-`ifup -a` -- at the very least the loopback interface is brought up.
+After runlevel S, Finit proceeds to runlevel 2.  This can be changed in
+`/etc/finit.conf` using the `runlevel N` directive, or by a script
+running in runlevel S that calls, e.g., `initctl runlevel 9`.  The
+latter is useful if startup scripts detect problems outside of Finit's
+control, e.g., critical services/devices missing or hardware problems.
+
+Before starting the services in runlevel 2, Finit first stops everything
+that is not allowed to run in 2, and then brings up networking.
+Networking is expected to be available in all runlevels except: S, 1
+(single user level), 6, and 0.  Networking is enabled either by the
+`network script` directive, or if you have an `/etc/network/interfaces`
+file, Finit calls `ifup -a` -- at the very least the loopback interface
+is brought up.

 > **Note:** when moving from runlevel S to 2, all run/task/services that
 > were constrained to runlevel S only are dropped from bookkeeping.  So
@@ -298,17 +356,31 @@ most notably systemd and s6, other methods for signaling "readiness"
 arrived and daemons were adapted to these new schemes to a larger
 extent.

-As of Finit v4.4 partial support for systemd and s6 is available.  The
-native PID file mode of operation is still default, the other's can be
-defined per service, like this:
+As of Finit v4.4 partial support for systemd and s6 style readiness
+notification is available, and the native PID file mode of operation is,
+as of Finit v4.6 optional, by default it is still enabled, but this can
+be changed in `finit.conf`:

+    readiness none
+
+This will be made the default in Finit 5.0.  In this mode of operation,
+every service needs to explicitly declare their readiness notification,
+like this:
+
+    service notify:pid     watchdogd
    service notify:systemd foo
    service notify:s6      bar
+    service notify:none    qux
+
+The `notify:none` syntax is for completeness in systems which run in
+`readiness pid` mode (default).  Services declared with `notify:none`
+will assert ready condition as soon as Finit has started them, e.g.,
+`service/qux/ready`.

 To synchronize two services the following condition can be used:

-    service notify:systemd    A
-    service <service/A/ready> B
+    service notify:pid                 watchdogd
+    service <service/watchdogd/ready>  stress-ng --cpu 8

 For details on the syntax and options, see below.

@@ -387,7 +459,7 @@ Cgroups

 There are three major cgroup configuration directives:

- 1. Global top-level group: init, system, user, or a custom group
+ 1. Global top-level group: `init`, `system`, `user`, or a custom group
 2. Selecting a top-level group for a set of run/task/services
 3. Per run/task/service limits

@@ -438,6 +510,10 @@ except for expanding the shorthand `mem.` to `memory.`, if the file is
 not available, either the cgroup controller is not available in your
 Linux kernel, or the name is misspelled.

+A daemon using `SCHED_RR` currently need to run outside the default cgroups.
+
+    service [...] <...> cgroup.root /path/to/daemon arg -- Real-Time process
+
 > Linux cgroups and details surrounding values are not explained in the
 > Finit documentation.  The Linux admin-guide cover this well:
 > <https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html>
@@ -467,7 +543,7 @@ following directives:


 > **Note:** not all directives are available in `/etc/finit.d/*.conf`
-> and some directives are only available at [bootstrap][], runlevel `S`,
+> and some directives are only available at bootstrap, runlevel `S`,
 > see [Limitations](#limitations) below for details.


@@ -480,7 +556,7 @@ the contents of that file is used.

 Deprecated.  We recommend using `/etc/hostname` instead.

-> **Note:** only read and executed in runlevel S ([bootstrap][]).
+> **Note:** only read and executed in runlevel S (bootstrap).


 ### Kernel Modules
@@ -498,7 +574,7 @@ BusyBox mdev tool, add to `/etc/mdev.conf`:

    $MODALIAS=.*  root:root       0660    @modprobe -b "$MODALIAS"

-> **Note:** only read and executed in runlevel S ([bootstrap][]).
+> **Note:** only read and executed in runlevel S (bootstrap).


 ### Networking
@@ -511,7 +587,7 @@ Deprecated.  We recommend using dedicated task/run stanzas per runlevel,
 or `/etc/network/interfaces` if you have a system with `ifupdown`, like
 Debian, Ubuntu, Linux Mint, or an embedded BusyBox system.

-> **Note:** only read and executed in runlevel S ([bootstrap][]).
+> **Note:** only read and executed in runlevel S (bootstrap).


 ### Alternate finit.d/
@@ -566,7 +642,7 @@ stanzas can share the same rlimits if they are in the same .conf.

 **Syntax:** `runlevel <N>`

-The system runlevel to go to after [bootstrap][] (S) has completed.  `N`
+The system runlevel to go to after bootstrap (S) has completed.  `N`
 is the runlevel number 0-9, where 6 is reserved for reboot and 0 for
 halt.

@@ -575,7 +651,7 @@ Finit disables networking in this mode.

 *Default:* 2

-> **Note:** only read and executed in runlevel S ([bootstrap][]).
+> **Note:** only read and executed in runlevel S (bootstrap).


 ### One-shot Commands (sequence)
@@ -615,11 +691,14 @@ also the `--quiet` and `--batch` options.

 One-shot like 'run', but starts in parallel with the next command.
  
-Both `run` and `task` commands are run in a shell, so pipes and
-redirects can be freely used:
+Both `run` and `task` commands are run in a shell, so basic pipes and
+redirects can be used:

    task [s] echo "foo" | cat >/tmp/bar

+Please note, `;`, `&&`, `||`, and similar are *not supported*.  Any
+non-trivial constructs are better placed in a separate shell script.
+

 ### SysV Init Scripts

@@ -839,45 +918,106 @@ These script actions *must terminate*, so they have a default execution
 time of 3 seconds before they are SIGKILLed, this can be adjusted using
 the above `kill:SEC` syntax.

+#### Conditional Loading
+
+Finit support conditional loading of stanzas.  The following example is
+take from the `system/hotplug.conf` file in the Finit distribution.
+Here we only show a simplified subset.
+
+Starting with the `nowarn` option.
+
+    service nowarn name:udevd pid:udevd /lib/systemd/systemd-udevd
+    service nowarn name:udevd pid:udevd udevd
+
+When loading the .conf file Finit looks for `/lib/systemd/systemd-udevd`
+if that is not found Finit automatically logs a warning.  The `nowarn`
+option disables this warning so that the second line can be evaluated,
+which also provides a service named `udevd`.
+
+    run nowarn if:udevd <pid/udevd> :1 udevadm settle -t 0
+
+This line is only loaded if we know of a service named `udevd`.  Again,
+we do not warn if `udevadm` is not found, Execution will also stop here
+until the PID condition is asserted, i.e., Finit detecting udevd has
+started.
+
+    run nowarn conflict:udevd [S] mdev -s -- Populating device tree
+
+If `udevd` is not available, we try to run `mdev`, but if that is not
+found, again we do not warn.
+
+Conditional loading statements can also be negated, so the previous stanza
+can also be written as:
+
+    run nowarn if:!udevd [S] mdev -s -- Populating device tree
+
+The reason for using `confict` in this example is that a conflict can be
+resolved.  Stanzas marked with `conflict:foo` are rechecked at runtime.
+
+#### Conditional Execution
+
+Similar to conditional loading of stanzas there is conditional runtime
+execution.  This can be confusing at first, since Finit already has a
+condition subsystem, but this is more akin to the qualification to a
+runlevel.  E.g., a `task [123]` is qualified to run only in runlevel 1,
+2, and 3.  It is not considered for other runlevels.
+
+Conditional execution qualify a run/task/service based on a condition.
+Consider this (simplified) example from the Infix operating system:
+
+    run [S]                       name:startup <pid/sysrepo> confd -b --load startup-config
+    run [S] if:<usr/fail-startup> name:failure <pid/sysrepo> confd    --load failure-config
+
+The two run statements reside in the same .conf file so Finit runs them
+in true sequence.  If loading the file `startup-config` fails confd sets
+the condition `usr/fail-startup`, thus allowing the next run statement
+to load `failure-config`.
+
+Notice critical the difference between `<pid/sysrepo>` condition and
+`if:<usr/fail-startup>`.  The former is a condition for starting and the
+latter is a condition to check if a run/task/service is qualified to
+even be considered.
+
+Conditional execution statements can also be negated, so provided the
+file loaded did the opposite, i.e., set a condition on success, the
+previous stanza can also be written as:
+
+    run [S] if:<!usr/startup-ok> name:failure <pid/sysrepo> confd ...

 ### Run-parts Scripts

-**Syntax:** `runparts <DIR>`
+**Syntax:** `runparts [progress] [sysv] <DIR>`

 Call [run-parts(8)][] on `DIR` to run start scripts.  All executable
-files, or scripts, in the directory are called, in alphabetic order.
-The scripts in this directory are executed at the very end of runlevel
-`S`, [bootstrap][].
+files in the directory are called, in alphabetic order.  The scripts in
+this directory are executed at the very end of runlevel `S`.

 A common use-case for runparts scripts is to create and enable/disable
 services, which Finit will then apply when changing runlevel from S to
 whatever the next runlevel is set to be (default 2).  E.g., generate a
 `/etc/chrony.conf` and call `initctl enable chronyd`.

+**Options:**
+
+ - `progress`: display the progress of each script being executed
+ - `sysv`: run only SysV style scripts, i.e., `SNNfoo`, or `KNNbar`,
+   where `NN` is a number (0-99).
+
+If global debug mode is enabled, the `runparts` program is also called
+with the debug flag.
+
 **Limitations:**

 Scripts called from `runparts`, or hook scripts (see below), are limited
-in what they can do and expect from Finit:
+in their interaction with Finit.  Like the standalone `run` stanza and
+the `/etc/rc.local` shell script, Finit waits for their completion
+before continuing.  None of them can issue commands to start, stop, or
+restart other services.  Also, ensure all your services and programs
+either terminate or start in the background or you will block Finit.

-  1. Finit is single threaded and all scripts executed from these two
-     mechanisms are limited to file system operations (early or late
-	 hooks may not have write access!) and standard UNIX programs.
-  2. Thus, it is *not possible* to call `initctl` to query status of
-     services since that calls Finit over the `/run/finit/socket`.
-  3. Confusingly enough, there are some commands to `initctl` that are
-     available; `ls`, `enable`, `disable`, `touch`, `create`, `delete`,
-     and all the `cond` commands.  Because all these are basically just
-     wrappers for manipulating files (again, write access for early/late
-     hooks may not be available).
-
-Also, similar to the `/etc/rc.local` shell script, make sure that all
-your services and programs either terminate or start in the background
-or you will block Finit.
-
-> **Note:** `runparts` scrips are only read and executed in runlevel S
-> ([bootstrap][]).  See [hook scripts](plugins.md#hooks) for other ways
-> to run scripts at certain points during the complete lifetime of the
-> system.
+> **Note:** `runparts` scrips are only read and executed in runlevel S.
+> See [hook scripts](plugins.md#hooks) for other ways to run scripts at
+> certain points during the complete lifetime of the system.

 **Recommendations:**

@@ -990,8 +1130,8 @@ can be omitted to keep the kernel default.
    tty [12345] @console noclear vt220

 On really bare bones systems, or for board bringup, Finit can give you a
-shell prompt as soon as [bootstrap][] is done, without opening any
-device node:
+shell prompt as soon as bootstrap is done, without opening any device
+node:

    tty [12345789] notty

@@ -1073,8 +1213,10 @@ sync(2) has been called, twice.
 SysV Init Compatibility
 -----------------------

-Finit comes with a few SysV Init compatibility features to ease the
-transition from a serialized boot process.
+It is not possible to run unmodified SysV init systems with Finit.  This
+was never the intention and is not the strength of Finit.  However, it
+comes with a few SysV Init compatibility features to ease the transition
+from a serialized boot process.

 ### `runparts DIRECTORY`

@@ -1224,12 +1366,11 @@ Watchdog
 When built `--with-watchdog` a separate service is built and installed
 in `/libexec/finit/watchdogd`.  If this exists at runtime, and the WDT
 device node exists, Finit will start it and treat it as the elected
-watchdog service to delegate its reboot to.  See [bootstrap][] for
-details.  This delegation is to ensure that the system is rebooted by a
-hardware watchdog timer -- on many embedded systems this is crucial to
-ensure all circuits on the board are properly reset for the next boot,
-in effect ensuring the system works the same after both a power-on and
-reboot event.
+watchdog service to delegate its reboot to.  This delegation is to
+ensure that the system is rebooted by a hardware watchdog timer -- on
+many embedded systems this is crucial to ensure all circuits on the
+board are properly reset for the next boot, in effect ensuring the
+system works the same after both a power-on and reboot event.

 The delegation is performed at the very last steps of system shutdown,
 if reboot has been selected and an elected watchdog is known, first a
@@ -1251,8 +1392,6 @@ device descriptor.  If the kernel driver has been built without this,
 the only option is to remove `/libexec/finit/watchdogd` or build without
 it at configure time.

-[bootstrap]: bootstrap.md
-

 keventd
 -------
@@ -28,9 +28,16 @@ For your convenience a set of *optional* plugins are available:
  system and runs at `HOOK_BASEFS_UP`.  The `/var`, `/run`, and `/dev`
  file systems must be writable for this plugin to work.

-  Note: On an embedded system both `/var` and `/run` can be `tmpfs` RAM
-  disks and `/dev` is usually a `devtmpfs`.  This must be defined in the
-  `/etc/fstab` file and in the Linux kernel config.
+  This plugin is a wrapper for the [tmpfiles.d(5)][] implementation that
+  Finit has.  Capable but limited: no aging, attributes, or subvolumes.
+
+  By default, `/lib/finit/tmpfiles.d` carries all the default .conf
+  files distributed with Finit.  It is read first but can be overridden
+  by any of the standard tmpfiles.d directories, e.g. `/etc/tmpfiles.d`.
+
+  > **Note:** On an embedded system both `/var` and `/run` can be `tmpfs`
+  > RAM disks and `/dev` is usually a `devtmpfs`.  This must be defined
+  > in the `/etc/fstab` file and in the Linux kernel config.

 * *dbus.so*: Setup and start system message bus, D-Bus, at boot.
  _Optional plugin._
@@ -50,8 +57,11 @@ For your convenience a set of *optional* plugins are available:
  customized at build-time using the `--with-hook-scripts-path=PATH`
  argument to `configure`.

-* *hotplug.so*: Setup and start either udev or mdev hotplug daemon, if
-  available.  Enabled by default.
+* *hotplug.so*: Replaced with `/lib/finit/system/10-hotplug.conf`, which
+  checks for `udevd` and `mdev` at boot.  This file can be overridden by a
+  file in `/etc/finit.d/10-hotplug.conf`.
+
+  Enabled by default.
  
  > See the [Services](config.md#services) section in the configuration
  > guide for an example how to run `mdevd`, alternative to plain mdev.
@@ -217,3 +227,5 @@ Plugins like `tty.so` extend finit by acting on events, they are called
 I/O plugins and are called from the finit main loop when `poll()`
 detects an event.  See the source code for `plugins/*.c` for more help
 and ideas.
+
+[tmpfiles.d(5)]: https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html
@@ -275,7 +275,7 @@ The following condition families are available today:
 Linux netlink events, e.g. net/route/default, net/eth0/up, and
 net/et0/running
 .It Cm pid
-PID files basd on the service declaration
+PID files based on the service declaration
 .Cm name:id ,
 gives the condition pid/name:id
 .It Cm service
@@ -240,6 +240,11 @@ Show top-like listing based on cgroups.
 List installed plugins.
 .It Nm Ar runlevel Op Ar 0-9
 Show or set runlevel: 0 halt, 6 reboot.
+.Pp
+If called at boot (runlevel S) to set the runlevel, Finit only schedules
+the change, effectively overriding the configured runlevel from
+.Pa /etc/finit.conf .
+Useful to trigger a fail-safe mode, or similar.
 .It Nm Ar reboot
 Reboot system, default if
 .Cm reboot
@@ -1,6 +1,6 @@
 /* Save and restore ALSA sound settings using alsactl
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Setup necessary system files for, e.g. UTMP (tracking logins)
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Setup and start system message bus, D-Bus
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -83,6 +83,7 @@ static char *dbus_pidfn(void)
 				break;
 			}
 			*pos = 0;
+			break;
 		}

 		fclose(fp);
@@ -142,23 +143,21 @@ static void setup(void *arg)

 	/* Generate machine id for dbus */
 	if (whichp("dbus-uuidgen"))
-		run_interactive("dbus-uuidgen --ensure", "Creating machine UUID for D-Bus");
+		run_interactive("dbus-uuidgen --ensure", "Verifying D-Bus machine UUID");

 	/*
 	 * Register service with Finit
 	 * Note: dbus drops privs after starting up.
 	 */
 	if (pidfn) {
-		snprintf(line, sizeof(line), "[S123456789] cgroup.system name:dbus pid:!%s %s %s -- %s",
+		snprintf(line, sizeof(line), "[S123456789] cgroup.system notify:none name:dbus pid:!%s %s %s -- %s",
 			 pidfn, cmd, DBUS_ARGS, DBUS_DESC);
 		free(pidfn);
 	} else
-		snprintf(line, sizeof(line), "[S123456789] cgroup.system name:dbus %s %s -- %s",
+		snprintf(line, sizeof(line), "[S123456789] cgroup.system notify:none name:dbus %s %s -- %s",
 			 cmd, DBUS_ARGS, DBUS_DESC);

-	if (service_register(SVC_TYPE_SERVICE, line, global_rlimit, NULL))
-		err(1, "Failed registering %s", DBUS_DAEMON);
-
+	conf_save_service(SVC_TYPE_SERVICE, line, "dbus.conf");
 	free(cmd);
 }

@@ -1,6 +1,6 @@
 /* Coldplug modules using modalias magic
 *
- * Copyright (c) 2021-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -132,11 +132,10 @@ static FILE *maybe_fopen_alias(const char *file, const char *path)
 {
 	const char *basename;

-	basename = rindex(path, '/');
-	if (!basename)
+	basename = basenm(path);
+	if (!strcmp(basename, path))
 		return NULL;

-	basename++;
 	if (strcmp(file, basename))
 		return NULL;

@@ -101,7 +101,7 @@ static int modules_load(const char *file, int index)
 	}

 	while ((line = fparseln(fp, NULL, NULL, NULL, 0))) {
-		char cmd[CMD_SIZE * 2], *mod, *args, *set;
+		char cmd[CMD_SIZE], *mod, *args, *set;

 		/*
 		 * fparseln() skips regular UNIX comments only.
@@ -2,7 +2,7 @@
 /* Netlink plugin for IFUP/IFDN and GW events
 *
 * Copyright (C) 2009-2011  Mårten Wikström <marten.wikstrom@keystream.se>
- * Copyright (C) 2009-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (C) 2009-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -1,7 +1,7 @@
 /* Simple pidfile event monitor for the Finit condition engine
 *
 * Copyright (c) 2015-2016  Tobias Waldekranz <tobias@waldekranz.com>
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -79,7 +79,7 @@ static void pidfile_update_conds(char *dir, char *name, uint32_t mask)
 		return;
 	}

-	dbg("Found svc %s for %s with pid %d", svc->name, fn, svc->pid);
+	dbg("Found svc %s for %s with pid %d", svc_ident(svc, NULL, 0), fn, svc->pid);
 	mkcond(svc, cond, sizeof(cond));

 	if (mask & (IN_CLOSE_WRITE | IN_ATTRIB | IN_MODIFY | IN_MOVED_TO)) {
@@ -88,7 +88,7 @@ static void pidfile_update_conds(char *dir, char *name, uint32_t mask)
 		 * systemd style services rely on their respective
 		 * readiness notification.  Issue #343
 		 */
-		if (!svc->notify)
+		if (svc->notify == SVC_NOTIFY_PID)
 			svc_started(svc);

 		if (!svc_has_pidfile(svc)) {
@@ -120,13 +120,14 @@ static void pidfile_update_conds(char *dir, char *name, uint32_t mask)
 			}
 		}

-		cond_set(cond);
-		if (!svc->notify)
-			service_ready(svc);
+		if (svc->notify == SVC_NOTIFY_PID)
+			cond_set(cond);
+		if (svc->notify == SVC_NOTIFY_PID || svc->notify == SVC_NOTIFY_NONE)
+			service_ready(svc, 1);
 	} else if (mask & IN_DELETE) {
 		cond_clear(cond);
-		if (!svc->notify)
-			service_ready(svc);
+		if (svc->notify == SVC_NOTIFY_PID)
+			service_ready(svc, 0);
 	}
 }

@@ -240,8 +241,8 @@ static void pidfile_reconf(void *arg)
 		if (svc_is_changed(svc) || svc_is_starting(svc))
 			continue;

-		if (!svc->notify)
-			service_ready(svc);
+		if (svc->notify == SVC_NOTIFY_PID)
+			service_ready(svc, 1);

 		mkcond(svc, cond, sizeof(cond));
 		if (cond_get(cond) == COND_ON)
@@ -1,6 +1,6 @@
 /* Set kernel variables from /etc/sysctl.conf et al
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Setup necessary files for resolvconf
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -45,7 +45,7 @@ static void setup(void *arg)

 	touch("/etc/resolvconf/run/enable-updates");
 	chdir("/etc/resolvconf/run/interface");
-	run_parts("/etc/resolvconf/update.d", "-i", NULL, 0);
+	run_parts("/etc/resolvconf/update.d", "-i", NULL, 0, 0);
 	chdir("/");
 }

@@ -1,6 +1,6 @@
 /* Save and restore RTC using hwclock
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* System condition event monitor for the Finit condition engine
 *
- * Copyright (c) 2021-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Optional TTY Watcher, used to catch new TTYs that are discovered, e.g., USB
 *
 * Copyright (c) 2013  Mattias Walström <lazzer@gmail.com>
- * Copyright (c) 2013-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2013-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Setup and save random seed at boot/shutdown
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* User-defined condition event monitor for the Finit condition engine
 *
- * Copyright (c) 2021-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Console setup (for X)
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -19,6 +19,8 @@ if WATCHDOGD
 pkglibexec_PROGRAMS += watchdogd
 endif

+dist_pkglibexec_SCRIPTS = coldplug
+
 finit_pkglibdir      = $(pkglibdir)
 finit_pkglib_SCRIPTS = rescue.conf sample.conf

@@ -1,6 +1,6 @@
 /* External client API, using UNIX domain socket.
 *
- * Copyright (c) 2015-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2015-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -367,7 +367,6 @@ static void api_cb(uev_t *w, void *arg, int events)
 		}

 		switch (rq.cmd) {
-		case INIT_CMD_RUNLVL:
 		case INIT_CMD_RELOAD:
 		case INIT_CMD_START_SVC:
 		case INIT_CMD_RESTART_SVC:
@@ -378,7 +377,7 @@ static void api_cb(uev_t *w, void *arg, int events)
 		case INIT_CMD_POWEROFF:
 		case INIT_CMD_SUSPEND:
 			if (IS_RESERVED_RUNLEVEL(runlevel)) {
-				warnx("Unsupported command in runlevel S and 6.");
+				warnx("Unsupported command in runlevel S and 6/0.");
 				goto leave;
 			}
 		default:
@@ -387,6 +386,14 @@ static void api_cb(uev_t *w, void *arg, int events)

 		switch (rq.cmd) {
 		case INIT_CMD_RUNLVL:
+			/* Allow changing cfglevel in runlevel S */
+			if (IS_RESERVED_RUNLEVEL(runlevel)) {
+				if (runlevel != INIT_LEVEL) {
+					warnx("Cannot abort runlevel 6/0.");
+					break;
+				}
+			}
+
 			switch (rq.runlevel) {
 			case 's':
 			case 'S':
@@ -400,7 +407,12 @@ static void api_cb(uev_t *w, void *arg, int events)
 					halt = SHUT_OFF;
 				if (lvl == 6)
 					halt = SHUT_REBOOT;
-				service_runlevel(lvl);
+
+				/* User requested change in next runlevel */
+				if (runlevel == INIT_LEVEL)
+					cfglevel = lvl;
+				else
+					service_runlevel(lvl);
 				break;

 			default:
@@ -1,6 +1,6 @@
 /* Finit control group support functions
 *
- * Copyright (c) 2019-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2019-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Finit control group support functions
 *
- * Copyright (c) 2019-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2019-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* New client tool, replaces old /dev/initctl API and telinit tool
 *
- * Copyright (c) 2019-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2019-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Cgroup utility functions for initctl
 *
- * Copyright (c) 2019-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2019-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* External client API, using UNIX domain socket.
 *
- * Copyright (c) 2015-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2015-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* External client API, using UNIX domain socket.
 *
- * Copyright (c) 2015-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2015-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# With the daemon mode ('mdev -df') we no longer need the hotplug helper
+echo "" > /proc/sys/kernel/hotplug
+
+# Wait for 'mdev -df' to set up its event queue.
+sleep 1
+
+# Trigger 'add' event for all devices and subsystems to load all modules
+# and any firmware needed by the hardware.
+find /sys/devices -name uevent -print | while IFS='' read X; do echo add > $X; done
@@ -222,8 +222,16 @@ static int do_delete(const char *fpath, const struct stat *sb, int tflag, struct
 static void cond_delpath(const char *path)
 {
 	nftw(path, do_delete, 20, FTW_DEPTH);
-	if (remove(path) && errno != ENOENT)
-		err(1, "Failed removing condition path %s", path);
+	if (remove(path)) {
+		switch (errno) {
+		case ENOENT:	/* Ignore */
+		case ENOTEMPTY:	/* Only at shutdown and for directories */
+			break;
+		default:
+			err(1, "Failed removing condition path %s", path);
+			break;
+		}
+	}
 }

 int cond_set_path(const char *path, enum cond_state next)
@@ -1,6 +1,6 @@
 /* Parser for /etc/finit.conf and /etc/finit.d/<SVC>.conf
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -62,8 +62,29 @@ static TAILQ_HEAD(, env_entry) env_list = TAILQ_HEAD_INITIALIZER(env_list);
 struct rlimit initial_rlimit[RLIMIT_NLIMITS];
 struct rlimit global_rlimit[RLIMIT_NLIMITS];

+/*
+ * --enable-fastboot => fsck_mode: NULL => no fsck by default
+ * --enable-fsckfix  => fsck_mode: "-f" + fsck_repair: "y"
+ */
+#ifdef FSCK_FIX
+# ifdef FAST_BOOT
+char *fsck_mode = NULL;
+# else
+char *fsck_mode = "-f";
+# endif
+char *fsck_repair = "-y";
+#else
+# ifdef FAST_BOOT
+char *fsck_mode = NULL;
+# else
 char *fsck_mode = "";
+# endif
 char *fsck_repair = "-p";
+#endif
+
+char *runparts = NULL;
+int   runparts_progress;
+int   runparts_sysv;

 char cgroup_current[16]; /* cgroup.NAME sets current cgroup for a set of services */

@@ -393,6 +414,79 @@ void conf_saverc(void)
 	fclose(fp);
 }

+/*
+ * Called at bootstrap to log execution order (for debug)
+ */
+void conf_save_exec_order(svc_t *svc, char *cmdline, int result)
+{
+	const char *fn = _PATH_VARRUN "finit/exec.order";
+	const char *ststr = !result ? "[ OK ]" : "[FAIL]";
+	static char *prepared = NULL;
+	int first = !fexist(fn);
+	FILE *fp;
+
+	fp = fopen(fn, "a+");
+	if (!fp) {
+		err(1, "failed writing to %s", fn);
+		return;
+	}
+
+	if (first) {
+		fprintf(fp, "# Execution order of run/task/services at bootstrap\n");
+		fprintf(fp, "# ST    TYPE     COMMAND LINE (DESC)\n");
+	}
+
+	if (result == -1) {
+		int len;
+
+		len = snprintf(NULL, 0, "        %-7s  %-64s (%s)", svc_typestr(svc), cmdline, svc->desc);
+		if (len > 0) {
+			if (prepared)
+				free(prepared);
+			prepared = malloc(++len);
+			if (!prepared)
+				goto done;
+			snprintf(prepared, len, "        %-7s  %-64s (%s)", svc_typestr(svc), cmdline, svc->desc);
+		}
+	} else {
+		if (prepared) {
+			memcpy(prepared, ststr, strlen(ststr));
+			fprintf(fp, "%s\n", prepared);
+			free(prepared);
+			prepared = NULL;
+		} else {
+			fprintf(fp, "%s  %-7s  %-64s (%s)\n", ststr, svc_typestr(svc), cmdline, svc->desc);
+		}
+	}
+done:
+	fclose(fp);
+}
+
+/*
+ * Called by plugins and similar that dynamically generate system services
+ */
+void conf_save_service(int type, char *cfg, char *file)
+{
+	char fn[256];
+	svc_t foo;
+	FILE *fp;
+
+	mkpath(FINIT_RUNPATH_, 0755);
+	snprintf(fn, sizeof(fn), "%s/%s", FINIT_RUNPATH_, file);
+	if (fexist(fn))
+		warnx("File %s already exists, overwriting.", fn);
+	fp = fopen(fn, "w");
+	if (!fp) {
+		err(1, "Failed creating %s", fn);
+		return;
+	}
+
+	foo.type = type;
+	fprintf(fp, "# Generated by finit:%s()\n", __func__);
+	fprintf(fp, "%s %s\n", svc_typestr(&foo), cfg);
+	fclose(fp);
+}
+
 /*
 * Sets, and makes a note of, all KEY=VALUE lines in a given .conf line
 * from finit.conf, or other .conf file.  Note, PATH is always reset in
@@ -451,6 +545,23 @@ static void parse_env(char *line)
 			*end-- = 0;
 	}

+	/* strip any leading 'set ' */
+	end = key;
+	if (!strncmp(key, "set", 3))
+		end += 3;
+
+	/* check key, no spaces allowed */
+	while (*end && isspace(*end))
+		end++;
+	key = end;
+	while (*end && !isspace(*end))
+		end++;
+	if (*end != 0) {
+		warnx("'%s=%s': not a valid identifier", key, val);
+		return;	/* invalid key */
+	}
+
+	dbg("Global env '%s'='%s'", key, val);
 	setenv(key, val, 1);

 	node = malloc(sizeof(*node));
@@ -562,11 +673,22 @@ void conf_parse_cond(svc_t *svc, char *cond)
 		return;
 	}

-	/* First character must be '!' if SIGHUP is not supported. */
+	/*
+	 * First character must be '!' if:
+	 *   - service:  SIGHUP is not supported
+	 *   - run/task: Do not block bootstrap
+	 */
 	ptr = cond;
 	if (ptr[i] == '!') {
-		svc->sighup = 0;
 		ptr++;
+
+		if (svc_is_runtask(svc)) {
+			/* see service_runtask_clean() */
+			svc->sighup = 1;
+			svc->once = 1;
+		} else {
+			svc->sighup = 0;
+		}
 	}

 	while (ptr[i] != '>' && ptr[i] != 0)
@@ -778,6 +900,15 @@ static int parse_static(char *line, int is_rcsd)

 	if (BOOTSTRAP && MATCH_CMD(line, "runparts ", x)) {
 		if (runparts) free(runparts);
+		runparts_progress = runparts_sysv = 0;
+		while (x) {
+			if (MATCH_CMD(x, "progress", x))
+				runparts_progress = 1;
+			else if (MATCH_CMD(x, "sysv", x))
+				runparts_sysv = 1;
+			else
+				break;
+		}
 		runparts = strdup(strip_line(x));
 		return 0;
 	}
@@ -844,6 +975,18 @@ static int parse_static(char *line, int is_rcsd)
 		return 0;
 	}

+	/*
+	 * Before Finit 5 the default readiness notification is PID.
+	 * This default can be changed by setting 'readiness none' in
+	 * the file /etc/finit.conf, only read once at bootstrap.
+	 */
+	if (BOOTSTRAP && MATCH_CMD(line, "readiness ", x)) {
+		char *token = strip_line(x);
+
+		if (!strcmp(token, "none"))
+			readiness = SVC_NOTIFY_NONE;
+	}
+
 	if (MATCH_CMD(line, "reboot-delay ", x)) {
 		syncsec = strtonum(strip_line(x), 0, 60, NULL);
 		return 0;
@@ -1122,22 +1265,53 @@ int conf_reload(void)
 	 * but are now regular files that can be overridden by files in
 	 * /etc/finit.d -- similar to how tmfiles.d(5) work.  E.g., add
 	 * an override .conf, or an ignore by symlinking to /dev/null
+	 *
+	 * The .conf files (and run/task/service stanzas) are parsed and
+	 * started in order.  Each directory is sorted alphanumerically
+	 * and then the result is appended to the overall order:
+	 *
+	 *     /lib/finit/system/10-hotplug.conf
+	 *     /lib/finit/system/90-testserv.conf
+	 *     /run/finit/system/dbus.conf
+	 *     /run/finit/system/tty.conf
+	 *     /etc/finit.d/10-abc.conf
+	 *     /etc/finit.d/20-abc.conf
+	 *     /etc/finit.d/enabled/1-aaa.conf
+	 *     /etc/finit.d/enabled/1-abc.conf
+	 *     /etc/finit.d/enabled/2-aaa.conf
 	 */
-	glob_append(&gl, 0, "%s/*.conf", finit_rcsd);
-	glob_append(&gl, 1, "%s/*.conf", FINIT_SYSPATH);
+	glob_append(&gl, 0, "%s/*.conf", FINIT_SYSPATH_);
+	glob_append(&gl, 1, "%s/*.conf", FINIT_RUNPATH_);
+	glob_append(&gl, 1, "%s/*.conf", finit_rcsd);
 	glob_append(&gl, 1, "%s/enabled/*.conf", finit_rcsd);

+	if (bootstrap) {
+		const char *fn = _PATH_VARRUN "finit/conf.order";
+		FILE *fp;
+
+		fp = fopen(fn, "w");
+		if (!fp) {
+			err(1, "failed creating %s", fn);
+		} else {
+			fprintf(fp, "# Evaluation & execution order of .conf files\n");
+			for (i = 0; i < gl.gl_pathc; i++)
+				fprintf(fp, "%s\n", gl.gl_pathv[i]);
+			fclose(fp);
+		}
+	}
+
 	for (i = 0; i < gl.gl_pathc; i++) {
 		char *path = gl.gl_pathv[i];
 		char *rp = NULL;
 		struct stat st;
 		size_t j, len;

-		/* check for FINIT_SYSPATH overrides */
+		/* check for FINIT_SYSPATH_ or FINIT_RUNPATH_ overrides */
 		for (j = i + 1; j < gl.gl_pathc; j++) {
-			if (strncmp(path, FINIT_SYSPATH, strlen(FINIT_SYSPATH)))
+			if (strncmp(path, FINIT_SYSPATH_, strlen(FINIT_SYSPATH_)) &&
+			    strncmp(path, FINIT_RUNPATH_, strlen(FINIT_RUNPATH_)))
 				continue;
-			if (strcmp(basename(path), basename(gl.gl_pathv[j])))
+			if (strcmp(basenm(path), basenm(gl.gl_pathv[j])))
 				continue;
 			path = NULL; /* replacement later in list, skip this */
 			break;
@@ -1195,6 +1369,9 @@ done:
 	/* Drop record of all .conf changes */
 	drop_changes();

+	if (bootstrap)
+		wdog = svc_find("watchdog", "finit");
+
 	/* Override configured runlevel, user said 'S' on /proc/cmdline */
 	if (BOOTSTRAP && single)
 		cfglevel = 1;
@@ -1245,7 +1422,8 @@ static int conf_change_act(char *dir, char *name, uint32_t mask)
 	struct conf_change *node;
 	char *rp = NULL;

-	if (name[0])
+	/* Check for actual printable characters, sometimes STX */
+	if (name[0] && name[0] >= ' ')
 		paste(fn, sizeof(fn), dir, name);
 	else
 		strlcpy(fn, dir, sizeof(fn));
@@ -1431,15 +1609,16 @@ int conf_init(uev_ctx_t *ctx)
 	 */
 #ifdef WDT_DEVNODE
 	if (whichp(FINIT_EXECPATH_ "/watchdogd") && fexist(WDT_DEVNODE)) {
-		service_register(SVC_TYPE_SERVICE, "[S0123456789] cgroup.init name:watchdog :finit " FINIT_EXECPATH_ "/watchdogd -- Finit watchdog daemon", global_rlimit, NULL);
-		wdog = svc_find("watchdog", "finit");
+		conf_save_service(SVC_TYPE_SERVICE, "[S0123456789] cgroup.init notify:none name:watchdog :finit "
+				  FINIT_EXECPATH_ "/watchdogd -- Finit watchdog daemon", "watchdogd.conf");
 	}
 #endif
 	/*
 	 * Start kernel event daemon as soon as possible, if enabled
 	 */
 	if (whichp(FINIT_EXECPATH_ "/keventd"))
-		service_register(SVC_TYPE_SERVICE, "[S0123456789] cgroup.init " FINIT_EXECPATH_ "/keventd -- Finit kernel event daemon", global_rlimit, NULL);
+		conf_save_service(SVC_TYPE_SERVICE, "[S12345789] cgroup.init notify:none "
+				  FINIT_EXECPATH_ "/keventd -- Finit kernel event daemon", "keventd.conf");

 	dbg("Allow plugins to register early runlevel 1 run/task/services ...");
 	plugin_run_hooks(HOOK_SVC_PLUGIN);
@@ -1463,12 +1642,19 @@ int conf_init(uev_ctx_t *ctx)
 	 */
 	if (runparts && fisdir(runparts) && !rescue) {
 		char conf[sizeof(_PATH_RUNPARTS) + strlen(runparts) + 100];
-		char *args = debug ? "-d" : "-p";
+		char args[10] = { 0 };

-		snprintf(conf, sizeof(conf), "[S] <int/bootstrap> log:console %s %s %s"
+		if (debug)
+			strlcat(args, "-d ", sizeof(args));
+		if (runparts_progress)
+			strlcat(args, "-p ", sizeof(args));
+		if (runparts_sysv)
+			strlcat(args, "-s ", sizeof(args));
+
+		snprintf(conf, sizeof(conf), "[S] <int/bootstrap> notify:none log:console %s %s %s"
 			 " -- Calling runparts %s in the background",
 			 _PATH_RUNPARTS, args, runparts, runparts);
-		service_register(SVC_TYPE_TASK, conf, global_rlimit, NULL);
+		conf_save_service(SVC_TYPE_TASK, conf, "runparts.conf");
 	}

 	return 0;
@@ -1,6 +1,6 @@
 /* Parser for /etc/finit.conf and /etc/finit.d/<SVC>.conf
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -44,6 +44,8 @@ int  conf_monitor         (void);

 void conf_reset_env       (void);
 void conf_saverc          (void);
+void conf_save_exec_order (svc_t *svc, char *cmdline, int result);
+void conf_save_service    (int type, char *cfg, char *file);
 void conf_parse_cmdline   (int argc, char *argv[]);
 int  conf_parse_runlevels (char *runlevels);
 void conf_parse_cond      (svc_t *svc, char *cond);
@@ -1,6 +1,6 @@
 /* Device node monitor for the Finit condition engine
 *
- * Copyright (c) 2022-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2022-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -237,7 +237,7 @@ static void devmon_cb(uev_t *w, void *arg, int events)
 			continue;
 		}

-		dbg("Got %s", ev->name);
+//		dbg("Got %s", ev->name);
 		if (ev->mask & (IN_CREATE | IN_DELETE))
 			devmon_update_conds(iwp->path, ev->name, ev->mask);
 	}
@@ -1,6 +1,6 @@
 /* Device node monitor for the Finit condition engine
 *
- * Copyright (c) 2022-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2022-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Functions for exec'ing processes
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Finit - Fast /sbin/init replacement w/ I/O, hook & service plugins
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -69,13 +69,13 @@ int   single    = 0;		/* single user mode from kernel cmdline */
 int   bootstrap = 1;		/* set while bootrapping (for TTYs) */
 int   kerndebug = 0;		/* set if /proc/sys/kernel/printk > 7 */
 int   syncsec   = 0;		/* reboot delay */
+int   readiness = SVC_NOTIFY_PID;
 char *finit_conf= NULL;
 char *finit_rcsd= NULL;
 char *fstab     = NULL;
 char *sdown     = NULL;
 char *network   = NULL;
 char *hostname  = NULL;
-char *runparts  = NULL;
 char *osheading = NULL;

 uev_ctx_t *ctx  = NULL;		/* Main loop context */
@@ -205,7 +205,7 @@ static int fsck(int pass)

 	fp = setmntent(fstab, "r");
 	if (!fp) {
-		err(1, "Failed opening fstab: %s", fstab);
+		logit(LOG_CONSOLE | LOG_ALERT, "Failed opening fstab: %s", fstab);
 		sulogin(1);
 	}
 	dbg("Opened %s, pass %d", fstab, pass);
@@ -255,11 +255,7 @@ static int fsck(int pass)
 			continue;
 		}

-#ifdef FSCK_FIX
-		snprintf(cmd, sizeof(cmd), "fsck -yf %s", dev);
-#else
 		snprintf(cmd, sizeof(cmd), "fsck %s %s %s", fsck_mode, fsck_repair, dev);
-#endif
 		dbg("Running pass %d fsck command %s", pass, cmd);
 		fsck_rc = run_interactive(cmd, "Checking filesystem %s", dev);
 		/*
@@ -282,7 +278,6 @@ static int fsck(int pass)
 static int fsck_all(void)
 {
 	int rc = 0;
-#ifndef FAST_BOOT
 	int pass;

 	if (!fsck_mode)
@@ -293,7 +288,7 @@ static int fsck_all(void)
 		if (rc)
 			break;
 	}
-#endif
+
 	return rc;
 }

@@ -360,6 +355,8 @@ static void fs_remount_root(int fsckerr)
 */
 static void fs_finalize(void)
 {
+	int flags = MS_NOEXEC | MS_NOSUID;
+
 	/*
 	 * Some systems rely on us to both create /dev/shm and, to mount
 	 * a tmpfs there.  Any system with dbus needs shared memory, so
@@ -367,8 +364,8 @@ static void fs_finalize(void)
 	 * the /etc/fstab file already.
 	 */
 	if (!fismnt("/dev/shm")) {
-		makedir("/dev/shm", 0777);
-		fs_mount("shm", "/dev/shm", "tmpfs", 0, "mode=0777");
+		makedir("/dev/shm", 1777);
+		fs_mount("shm", "/dev/shm", "tmpfs", flags | MS_NODEV, "mode=1777");
 	}

 	/* Modern systems use /dev/pts */
@@ -386,7 +383,13 @@ static void fs_finalize(void)
 		snprintf(opts, sizeof(opts), "gid=%d,mode=%d,ptmxmode=0666", gid, mode);

 		makedir("/dev/pts", 0755);
-		fs_mount("devpts", "/dev/pts", "devpts", MS_NOSUID | MS_NOEXEC, opts);
+		fs_mount("devpts", "/dev/pts", "devpts", flags, opts);
+	}
+
+	/* Needed on systems like Alpine Linux */
+	if (!fismnt("/dev/mqueue")) {
+		makedir("/dev/mqueue", 1777);
+		fs_mount("mqueue", "/dev/mqueue", "tmpfs", flags | MS_NODEV, NULL);
 	}

 	/*
@@ -701,6 +704,10 @@ int main(int argc, char *argv[])
 	cond_set_oneshot(plugin_hook_str(HOOK_BANNER));
 	cond_set_oneshot(plugin_hook_str(HOOK_ROOTFS_UP));

+	/* Some bootstrap tasks may need to know if we're in a container. */
+	if (in_container())
+		cond_set_oneshot("int/container");
+
 	/*
 	 * Initialize .conf system and load static /etc/finit.conf then
 	 * tell the world what we used.
@@ -1,7 +1,7 @@
 /* Finit - Fast /sbin/init replacement w/ I/O, hook & service plugins
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -60,7 +60,7 @@
 #define _PATH_SULOGIN           FINIT_EXECPATH_ "/sulogin"
 #define _PATH_GETTY             FINIT_EXECPATH_ "/getty"

-#define CMD_SIZE                256
+#define CMD_SIZE                1024
 #define LINE_SIZE               1024
 #define BUF_SIZE                4096

@@ -121,6 +121,7 @@ extern int    single;
 extern int    bootstrap;
 extern int    kerndebug;
 extern int    syncsec;
+extern int    readiness;
 extern char  *fstab;
 extern char  *sdown;
 extern char  *network;
@@ -1,6 +1,6 @@
 /* Initialize and serve a login terminal
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Misc. utility functions for finit and its plugins
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Misc. utility functions and C-library extensions for finit and its plugins
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -89,7 +89,7 @@ int     exec_runtask    (char *cmd, char *args[]);
 pid_t   run_getty       (char *tty, char *cmd, char *args[], int noclear, int nowait, struct rlimit rlimit[]);
 pid_t   run_sh          (char *tty, int noclear, int nowait, struct rlimit rlimit[]);
 pid_t   run_bg          (char *cmd, char *args[]);
-int     run_parts       (char *dir, char *cmd, const char *env[], int progress);
+int     run_parts       (char *dir, char *cmd, const char *env[], int progress, int sysv);

 /*
 * Defaults to user "root" and group "wheel" (root) if:
@@ -1,6 +1,6 @@
 /* New client tool, replaces old /dev/initctl API and telinit tool
 *
- * Copyright (c) 2015-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2015-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* New client tool, replaces old /dev/initctl API and telinit tool
 *
- * Copyright (c) 2015-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2015-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* inotify watcher for files or directories
 *
 * Copyright (c) 2015-2016  Tobias Waldekranz <tobias@waldekranz.com>
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* inotify watcher for files or directories
 *
 * Copyright (c) 2015-2016  Tobias Waldekranz <tobias@waldekranz.com>
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Listens to kernel events like AC power status and manages sys/ conditions
 *
- * Copyright (c) 2021-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Finit daemon log functions
 *
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Finit daemon log functions
 *
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2018-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2018-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Handle MD arrays
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -28,6 +28,7 @@
 #include <string.h>

 #include "helpers.h"
+#include "util.h"


 static glob_t *get_arrays(void)
@@ -48,17 +49,18 @@ static glob_t *get_arrays(void)
 */
 void mdadm_wait(void)
 {
-	size_t i;
 	glob_t *gl;
-	char cmd[160];

 	/* Setup kernel specific settings, e.g. allow broadcast ping, etc. */
 	gl = get_arrays();
 	if (gl) {
-		for (i = 0; i < gl->gl_pathc; i++) {
-			char *array;
+		size_t i;

-			array = basename(gl->gl_pathv[i]);
+		for (i = 0; i < gl->gl_pathc; i++) {
+			const char *array;
+			char cmd[160];
+
+			array = basenm(gl->gl_pathv[i]);
 			snprintf(cmd, sizeof(cmd), "mdadm --wait-clean /dev/%s >/dev/null", array);
 			run_interactive(cmd, "Marking MD array %s as clean", array);
 		}
@@ -1,6 +1,6 @@
 /* Mount and unmount helpers
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* PID and PID file helpers
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* PID and PID file helpers
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Plugin based services architecture for finit
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -43,6 +43,7 @@
 #include "private.h"
 #include "service.h"
 #include "sig.h"
+#include "util.h"

 #define is_io_plugin(p) ((p)->io.cb && (p)->io.fd > 0)
 #define SEARCH_PLUGIN(str)						\
@@ -77,23 +78,26 @@ static char *trim_ext(char *name)

 int plugin_register(plugin_t *plugin)
 {
+	const char *nm;
+
 	if (!plugin) {
 		errno = EINVAL;
 		return 1;
 	}

 	/* Setup default name if none is provided */
-	if (!plugin->name) {
+	nm = plugin->name;
+	if (!nm) {
 #ifndef ENABLE_STATIC
 		Dl_info info;

 		if (dladdr(plugin, &info) && info.dli_fname)
-			plugin->name = basename(info.dli_fname);
+			nm = basenm(info.dli_fname);
 #endif
-		if (!plugin->name)
-			plugin->name = "unknown";
+		if (!nm)
+			nm = "unknown";
 	}
-	plugin->name = trim_ext(strdup(plugin->name));
+	plugin->name = trim_ext(strdup(nm));

 	/* Already registered? */
 	if (plugin_find(plugin->name)) {
@@ -230,7 +234,7 @@ void plugin_script_run(hook_point_t no)
 	} else
 		env[2] = NULL;

-	run_parts(path, NULL, env, 0);
+	run_parts(path, NULL, env, 0, 0);
 }
 #else
 void plugin_script_run(hook_point_t no)
@@ -253,7 +257,7 @@ void plugin_run_hook(hook_point_t no, void *arg)

 	PLUGIN_ITERATOR(p, tmp) {
 		if (p->hook[no].cb) {
-			dbg("Calling %s hook n:o %d (arg: %p) ...", basename(p->name), no, arg ?: "NIL");
+			dbg("Calling %s hook n:o %d (arg: %p) ...", basenm(p->name), no, arg ?: "NIL");
 			p->hook[no].cb(arg ? arg : p->hook[no].arg);
 		}
 	}
@@ -288,7 +292,7 @@ static void generic_io_cb(uev_t *w, void *arg, int events)
 		/* Stop watcher, callback may close descriptor on us ... */
 		uev_io_stop(w);

-		dbg("Calling I/O %s from runloop...", basename(p->name));
+//		dbg("Calling I/O %s from runloop...", basename(p->name));
 		p->io.cb(p->io.arg, w->fd, events);

 		/* Update fd, may be changed by plugin callback, e.g., if FIFO */
@@ -301,9 +305,9 @@ int plugin_io_init(plugin_t *p)
 	if (!is_io_plugin(p))
 		return 0;

-	dbg("Initializing plugin %s for I/O", basename(p->name));
+	dbg("Initializing plugin %s for I/O", basenm(p->name));
 	if (uev_io_init(ctx, &p->watcher, generic_io_cb, p, p->io.fd, p->io.flags)) {
-		warn("Failed setting up I/O plugin %s", basename(p->name));
+		warn("Failed setting up I/O plugin %s", basenm(p->name));
 		return 1;
 	}

@@ -1,6 +1,6 @@
 /* Plugin based services architecture for finit
 *
- * Copyright (c) 2012-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2012-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Private header file for main finit daemon, not for plugins
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* reboot, halt, poweroff, shutdown, suspend for finit
 *
- * Copyright (c) 2009-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2009-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -83,7 +83,7 @@ static void run_env(const char *env[])
 	}
 }

-int run_parts(char *dir, char *cmd, const char *env[], int progress)
+int run_parts(char *dir, char *cmd, const char *env[], int progress, int sysv)
 {
 	size_t cmdlen = cmd ? strlen(cmd) : strlen("start");
 	struct dirent **d;
@@ -127,6 +127,11 @@ int run_parts(char *dir, char *cmd, const char *env[], int progress)
 			continue;
 		}

+		if (sysv && name[0] != 'S' && name[0] != 'K') {
+			dbg("S-only flag set, skipping non-SysV script: %s", name);
+			continue;
+		}
+
 		/* If the callee didn't supply a run_parts() argument */
 		if (!cmd) {
 			/* Check if S<NUM>service or K<NUM>service notation is used */
@@ -179,16 +184,16 @@ int run_parts(char *dir, char *cmd, const char *env[], int progress)
 #ifndef __FINIT__
 static int usage(int rc)
 {
-	warnx("usage: runparts [-dh?] DIRECTORY");
+	warnx("usage: runparts [-dhps?] DIRECTORY");
 	return rc;
 }

 int main(int argc, char *argv[])
 {
-	int rc, c, progress = 0;
+	int rc, c, progress = 0, sysv = 0;
 	char *dir;

-	while ((c = getopt(argc, argv, "dh?p")) != EOF) {
+	while ((c = getopt(argc, argv, "dh?ps")) != EOF) {
 		switch(c) {
 		case 'd':
 			debug = 1;
@@ -199,6 +204,9 @@ int main(int argc, char *argv[])
 		case 'p':
 			progress = 1;
 			break;
+		case 's':
+			sysv = 1;
+			break;
 		default:
 			return usage(1);
 		}
@@ -213,7 +221,7 @@ int main(int argc, char *argv[])

 	prctl(PR_SET_CHILD_SUBREAPER, 1);

-	rc = run_parts(dir, NULL, NULL, progress);
+	rc = run_parts(dir, NULL, NULL, progress, sysv);
 	if (rc == -1)
 		err(1, "failed run-parts %s", dir);

@@ -1,6 +1,6 @@
 /* Work queue helper functions
 *
- * Copyright (c) 2018-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2018-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Work queue helper functions
 *
- * Copyright (c) 2018-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2018-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* List and enable/disable service configurations
 *
- * Copyright (c) 2017-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2017-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* List and enable/disable service configurations
 *
- * Copyright (c) 2017-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2017-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Finit service monitor, task starter and generic API for managing svc_t
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -330,14 +330,15 @@ static int lredirect(svc_t *svc)

 				snprintf(rot, sizeof(rot), "%d:%d", logfile_size_max, logfile_count_max);
 				snprintf(pid, sizeof(pid), "%d", svc_pid);
-				execlp("logger", "logger", "-f", svc->log.file, "-b", "-t", tag, "-p", prio, "-I", pid, "-r", rot, NULL);
+				execlp("logger", "logger", "-f", svc->log.file, "-b", "-t", tag, "-p", prio, "-I", pid, "-r", rot, debug ? "-s" : NULL, NULL);
 			} else {
 				char sz[20], num[3];

 				snprintf(sz, sizeof(sz), "%d", logfile_size_max);
 				snprintf(num, sizeof(num), "%d", logfile_count_max);

-				execlp(_PATH_LOGIT, "logit", "-f", svc->log.file, "-n", sz, "-r", num, NULL);
+				execlp(_PATH_LOGIT, "logit", "-f", svc->log.file, "-n", sz, "-r", num, debug ? "-s" : NULL, NULL);
+
 			}
 			_exit(1);
 		}
@@ -351,9 +352,9 @@ static int lredirect(svc_t *svc)
 			char pid[16];

 			snprintf(pid, sizeof(pid), "%d", svc_pid);
-			execlp("logger", "logger", "-t", tag, "-p", prio, "-I", pid, NULL);
+			execlp("logger", "logger", "-t", tag, "-p", prio, "-I", pid, debug ? "-s" : NULL, NULL);
 		} else {
-			execlp(_PATH_LOGIT, "logit", "-t", tag, "-p", prio, NULL);
+			execlp(_PATH_LOGIT, "logit", "-t", tag, "-p", prio, debug ? "-s" : NULL, NULL);
 		}
 		_exit(1);
 	}
@@ -394,11 +395,8 @@ static int redirect(svc_t *svc)
 */
 static void source_env(svc_t *svc)
 {
-	char buf[LINE_SIZE];
-	char *line;
-	size_t len;
+	char *buf, *val, *line, *fn;
 	FILE *fp;
-	char *fn;

 	fn = svc_getenv(svc);
 	if (!fn)
@@ -409,11 +407,19 @@ static void source_env(svc_t *svc)
 	if (!fp)
 		return;

+	buf = alloca(LINE_SIZE);
+	val = alloca(LINE_SIZE);
+	if (!buf || !val) {
+		warn("Failed allocating temporary env buffer");
+		return;
+	}
+
 	line = buf;
-	len = sizeof(buf);
-	while (fgets(line, len, fp)) {
+	while (fgets(line, LINE_SIZE, fp)) {
 		char *key = chomp(line);
+		wordexp_t we = { 0 };
 		char *value, *end;
+		size_t i;

 		/* skip any leading whitespace */
 		while (isspace(*key))
@@ -466,7 +472,40 @@ static void source_env(svc_t *svc)
 				*end-- = 0;
 		}

-		setenv(key, value, 1);
+		/* strip any leading 'set ' */
+		end = key;
+		if (!strncmp(key, "set", 3))
+			end += 3;
+
+		/* check key, no spaces allowed */
+		while (*end && isspace(*end))
+			end++;
+		key = end;
+		while (*end && !isspace(*end))
+			end++;
+		if (*end != 0) {
+			warnx("'%s=%s': not a valid identifier", key, val);
+			continue;	/* invalid key */
+		}
+
+		switch (wordexp(value, &we, 0)) {
+		case 0:
+			for (i = 0, *val = 0; i < we.we_wordc; i++) {
+				if (i > 0)
+					strlcat(val, " ", LINE_SIZE);
+				strlcat(val, we.we_wordv[i], LINE_SIZE);
+			}
+			setenv(key, val, 1);
+			wordfree(&we);
+			break;
+
+		case WRDE_NOSPACE:
+			wordfree(&we);
+			/* fallthrough */
+		default:
+			setenv(key, value, 1);
+			break;
+		}
 	}

 	fclose(fp);
@@ -629,6 +668,9 @@ static int service_start(svc_t *svc)
 	}

 	compose_cmdline(svc, cmdline, sizeof(cmdline));
+	if (bootstrap)
+		conf_save_exec_order(svc, cmdline, -1);
+
 	if (svc_is_sysv(svc))
 		logit(LOG_CONSOLE | LOG_NOTICE, "Calling '%s start' ...", cmdline);

@@ -676,11 +718,12 @@ static int service_start(svc_t *svc)
 			wordexp_t we = { 0 };
 			int rc;

-			if (svc->notify) {
+			if (svc->notify == SVC_NOTIFY_SYSTEMD || svc->notify == SVC_NOTIFY_S6) {
 				if (client_command(INIT_CMD_NOTIFY_SOCKET)) {
 					err(1, "%s: failed creating notify socket", svc_ident(svc, NULL, 0));
 					client_disconnect();
-					svc->notify = 0; /* does not change parent, restarting may work. */
+					/* does not change parent, restarting may work. */
+					svc->notify = SVC_NOTIFY_NONE;
 				} else {
 					char val[20];

@@ -705,7 +748,7 @@ static int service_start(svc_t *svc)
 				if (len == 0)
 					break;

-				if (svc->notify) {
+				if (svc->notify == SVC_NOTIFY_SYSTEMD || svc->notify == SVC_NOTIFY_S6) {
 					char *ptr = strstr(arg, "%n");

 					if (ptr) {
@@ -836,8 +879,10 @@ static int service_start(svc_t *svc)

 fail:
 	sigprocmask(SIG_SETMASK, &omask, NULL);
-	if (do_progress)
+	if (do_progress && !run_block_pid)
 		print_result(result);
+	if (bootstrap && !run_block_pid)
+		conf_save_exec_order(svc, NULL, result);

 	return result;
 }
@@ -880,6 +925,19 @@ static void service_kill(svc_t *svc)
 		print(2, NULL);
 }

+/* Ensure we don't have any notify socket lingering */
+static void service_notify_stop(svc_t *svc)
+{
+	if (svc->notify != SVC_NOTIFY_SYSTEMD && svc->notify != SVC_NOTIFY_S6)
+		return;
+
+	uev_io_stop(&svc->notify_watcher);
+	if (svc->notify_watcher.fd > 0) {
+		close(svc->notify_watcher.fd);
+		svc->notify_watcher.fd = 0;
+	}
+}
+
 /*
 * Clean up any lingering state from dead/killed services
 */
@@ -895,12 +953,7 @@ static void service_cleanup(svc_t *svc)
 		logit(LOG_CRIT, "Failed removing service %s pidfile %s",
 		      svc_ident(svc, NULL, 0), fn);

-	/* Ensure we don't have any notify socket lingering */
-	if (svc->notify && svc->notify_watcher.fd > 0) {
-		uev_io_stop(&svc->notify_watcher);
-		close(svc->notify_watcher.fd);
-		svc->notify_watcher.fd = 0;
-	}
+	service_notify_stop(svc);

 	/* No longer running, update books. */
 	if (svc_is_tty(svc) && svc->pid > 1)
@@ -950,7 +1003,7 @@ int service_stop(svc_t *svc)
 			return 0;
 		}

-		dbg("Sending %s to pid:%d name:%s", sig, svc->pid, nm);
+		dbg("Sending %s to pid:%d name:%s(%s)", sig, svc->pid, id, nm);
 		logit(LOG_CONSOLE | LOG_NOTICE, "Stopping %s[%d], sending %s ...", id, svc->pid, sig);
 	} else {
 		logit(LOG_CONSOLE | LOG_NOTICE, "Calling '%s stop' ...", cmdline);
@@ -974,7 +1027,11 @@ int service_stop(svc_t *svc)
 	if (!svc->desc[0])
 		do_progress = 0;

-	if (runlevel != 1 && do_progress)
+	/*
+	 * Skip run/tasks in progress, would otherwise print silly stuff
+	 * like: "Stopping Shutting down" ...
+	 */
+	if (runlevel != 1 && do_progress && (svc_is_daemon(svc) || svc_is_sysv(svc)))
 		print_desc("Stopping ", svc->desc);

 	if (!svc_is_sysv(svc)) {
@@ -1030,7 +1087,7 @@ int service_stop(svc_t *svc)
 		}
 	}

-	if (runlevel != 1 && do_progress)
+	if (runlevel != 1 && do_progress && (svc_is_daemon(svc) || svc_is_sysv(svc)))
 		print_result(rc);

 	return rc;
@@ -1157,13 +1214,15 @@ static void parse_log(svc_t *svc, char *arg)
 	}
 }

-static int parse_notify(char *arg)
+static svc_notify_t parse_notify(char *arg)
 {
 	if (!strcmp(arg, "systemd"))
-		return 1;
+		return SVC_NOTIFY_SYSTEMD;
 	if (!strcmp(arg, "s6"))
-		return 2;
-	return 0;		/* unsupported/disabled */
+		return SVC_NOTIFY_S6;
+	if (!strcmp(arg, "pid"))
+		return SVC_NOTIFY_PID;
+	return SVC_NOTIFY_NONE;	/* unsupported/none */
 }

 static void parse_env(svc_t *svc, char *env)
@@ -1396,7 +1455,11 @@ static void parse_cmdline_args(svc_t *svc, char *cmd, char **args)
 * before they are started.  Or restarted, or even SIGHUP'ed, when the
 * gateway changes or interfaces come and go.  The special case when a
 * service is declared with <!> means it does not support SIGHUP but
- * must be STOP/START'ed at system reconfiguration.
+ * must be STOP/START'ed at system reconfiguration.  For run/task a <!>
+ * means Finit can relax its promise to run at least once per runlevel.
+ * I.e., for run/task conditions that would otherwise block bootstrap:
+ *
+ *     task [S0123456789] <!sys/pwr/fail> name:pwrfail initctl poweroff -- Power failure, shutting down
 *
 * Conditions can for example be: pid/NAME:ID for process dependencies,
 * net/<IFNAME>/up or net/<IFNAME>/exists.  The condition handling is
@@ -1425,6 +1488,7 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
 	char *id = NULL, *env = NULL, *cgroup = NULL;
 	char *pre_script = NULL, *post_script = NULL;
 	char *ready_script = NULL, *conflict = NULL;
+	char ident[MAX_IDENT_LEN];
 	char *ifstmt = NULL;
 	char *notify = NULL;
 	struct tty tty = { 0 };
@@ -1549,8 +1613,16 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
 	}

 	name = parse_name(cmd, name);
-	if (!id)
+	strlcpy(ident, name, sizeof(ident));
+	if (!id) {
 		id = "";
+	} else {
+		strlcat(ident, ":", sizeof(ident));
+		strlcat(ident, id, sizeof(ident));
+	}
+
+	if (ifstmt && !svc_ifthen(1, ident, ifstmt, nowarn))
+		return 0;

 	levels = conf_parse_runlevels(runlevels);
 	if (runlevel != INIT_LEVEL && !ISOTHER(levels, INIT_LEVEL)) {
@@ -1715,17 +1787,12 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
 		else
 			svc->log.enabled = 0;
 	}
-	if (notify) {
-		int type = parse_notify(notify);

-		if (type <= 0)
-			goto disable_notify;
-		svc->notify = type;
-	} else if (svc->notify) {
-	disable_notify:
-		/* XXX: close existing socket */
-		svc->notify = 0;
-	}
+	if (notify)
+		svc->notify = parse_notify(notify);
+	  else
+		svc->notify = readiness;
+
 	if (desc)
 		strlcpy(svc->desc, desc, sizeof(svc->desc));
 	else if (type == SVC_TYPE_TTY)
@@ -1847,11 +1914,6 @@ void service_monitor(pid_t lost, int status)
 		return;
 	}

-	if (lost == run_block_pid) {
-		svc_mark_clean(svc); /* done, regardless of exit status */
-		run_block_pid = 0;
-	}
-
 	switch (svc->state) {
 	case SVC_CLEANUP_STATE:
 	case SVC_SETUP_STATE:
@@ -1900,6 +1962,17 @@ done:
 	/* No longer running, update books. */
 	svc->start_time = svc->pid = 0;
 cont:
+	if (lost == run_block_pid) {
+		int result = WIFEXITED(status) ? WEXITSTATUS(status) : 1;
+
+		svc_mark_clean(svc); /* done, regardless of exit status */
+		run_block_pid = 0;
+		if (svc->desc[0])
+			print_result(result);
+		if (bootstrap)
+			conf_save_exec_order(svc, NULL, result);
+	}
+
 	if (!service_step(svc)) {
 		/* Clean out any bootstrap tasks, they've had their time in the sun. */
 		if (svc_clean_bootstrap(svc))
@@ -1955,7 +2028,7 @@ void service_mark_unavail(void)
 		if (!svc->ifstmt[0])
 			continue;

-		if (!svc_ifthen(svc_ident(svc, buf, sizeof(buf)), svc->ifstmt))
+		if (!svc_ifthen(1, svc_ident(svc, buf, sizeof(buf)), svc->ifstmt, svc->nowarn))
 			svc_mark(svc);
 	}
 }
@@ -2183,6 +2256,7 @@ static void service_retry(svc_t *svc)
 static void svc_set_state(svc_t *svc, svc_state_t new_state)
 {
 	svc_state_t *state = (svc_state_t *)&svc->state;
+	const svc_state_t old_state = svc->state;

 	/* if PID isn't collected within SVC_TERM_TIMEOUT msec, kill it! */
 	if (new_state == SVC_STOPPING_STATE) {
@@ -2203,7 +2277,7 @@ static void svc_set_state(svc_t *svc, svc_state_t new_state)
 		snprintf(failure, sizeof(failure), "%s/%s/failure", svc_typestr(svc), svc_ident(svc, NULL, 0));

 		/* create success/failure condition when entering SVC_DONE_STATE. */
-		if (*state == SVC_DONE_STATE) {
+		if (new_state == SVC_DONE_STATE) {
 			if (svc->started && !WEXITSTATUS(svc->status))
 				cond_set_oneshot(success);
 			else
@@ -2211,7 +2285,7 @@ static void svc_set_state(svc_t *svc, svc_state_t new_state)
 		}

 		/* clear all conditions when entering SVC_HALTED_STATE. */
-		if (*state == SVC_HALTED_STATE) {
+		if (new_state == SVC_HALTED_STATE) {
 			cond_clear(success);
 			cond_clear(failure);
 		}
@@ -2221,9 +2295,14 @@ static void svc_set_state(svc_t *svc, svc_state_t new_state)
 		char cond[MAX_COND_LEN];

 		snprintf(cond, sizeof(cond), "service/%s/", svc_ident(svc, NULL, 0));
-		cond_clear(cond);

-		switch (svc->state) {
+		if ((old_state == SVC_RUNNING_STATE && new_state == SVC_PAUSED_STATE) ||
+		    (old_state == SVC_PAUSED_STATE  && new_state == SVC_RUNNING_STATE))
+			; 	/* only paused during reload, don't clear conds. */
+		else
+			cond_clear(cond);
+
+		switch (new_state) {
 		case SVC_HALTED_STATE:
 		case SVC_RUNNING_STATE:
 			strlcat(cond, svc_status(svc), sizeof(cond));
@@ -2251,8 +2330,8 @@ void service_forked(svc_t *svc)
 	svc_set_state(svc, SVC_RUNNING_STATE);
 }

-/* Set service/foo/ready condition for services and call optional ready:script */
-void service_ready(svc_t *svc)
+/* Set or clear service/foo/ready condition for services and call optional ready:script */
+void service_ready(svc_t *svc, int ready)
 {
 	char buf[MAX_COND_LEN];

@@ -2260,10 +2339,13 @@ void service_ready(svc_t *svc)
 		return;

 	snprintf(buf, sizeof(buf), "service/%s/ready", svc_ident(svc, NULL, 0));
-	cond_set(buf);
+	if (ready) {
+		cond_set(buf);

-	if (svc_has_ready(svc))
-		service_ready_script(svc);
+		if (svc_has_ready(svc))
+			service_ready_script(svc);
+	} else
+		cond_clear(buf);
 }

 /*
@@ -2294,9 +2376,11 @@ restart:
 			svc_set_state(svc, SVC_WAITING_STATE);
 		else {
 			if (svc_is_conflict(svc)) {
+#if 0
 				logit(svc->nowarn ? LOG_DEBUG : LOG_INFO,
 				      "%s in conflict with %s, checking again ...",
 				      svc_ident(svc, NULL, 0), svc->conflict);
+#endif
 				if (!svc_conflicts(svc))
 					svc_unblock(svc);
 			}
@@ -2315,11 +2399,7 @@ restart:
 			char condstr[MAX_COND_LEN];

 			dbg("%s: stopped, cleaning up timers and conditions ...", svc_ident(svc, NULL, 0));
-			if (svc->notify && svc->notify_watcher.fd > 0) {
-				uev_io_stop(&svc->notify_watcher);
-				close(svc->notify_watcher.fd);
-				svc->notify_watcher.fd = 0;
-			}
+			service_notify_stop(svc);

 			service_timeout_cancel(svc);
 			cond_clear(mkcond(svc, condstr, sizeof(condstr)));
@@ -2459,7 +2539,7 @@ restart:

 		case COND_ON:
 			if (svc_is_changed(svc)) {
-				if (svc_nohup(svc))
+				if (svc_nohup(svc) || !svc_is_daemon(svc))
 					service_stop(svc);
 				else {
 					/*
@@ -2473,6 +2553,8 @@ restart:

 				svc_mark_clean(svc);
 			}
+			if (svc->notify == SVC_NOTIFY_NONE)
+				service_ready(svc, 1);
 			break;
 		}
 		break;
@@ -2497,16 +2579,21 @@ restart:
 			svc_set_state(svc, SVC_RUNNING_STATE);
 			/* Reassert condition if we go from waiting and no change */
 			if (!svc_is_changed(svc)) {
-				char name[MAX_COND_LEN];
+				if (svc->notify == SVC_NOTIFY_PID) {
+					char name[MAX_COND_LEN];

-				mkcond(svc, name, sizeof(name));
-				dbg("Reassert condition %s", name);
-				cond_set_path(cond_path(name), COND_ON);
+					mkcond(svc, name, sizeof(name));
+					dbg("Reassert condition %s", name);
+					cond_set_path(cond_path(name), COND_ON);
+				}
+
+				dbg("Reassert %s ready condition", svc_ident(svc, NULL, 0));
+				service_ready(svc, 1);
 			}
 			break;

 		case COND_OFF:
-			dbg("Condition for %s is off, sending SIGCONT + SIGTERM", svc->name);
+			dbg("Condition for %s is off, sending SIGCONT + SIGTERM", svc_ident(svc, NULL, 0));
 			kill(svc->pid, SIGCONT);
 			service_stop(svc);
 			break;
@@ -2560,7 +2647,12 @@ void service_runtask_clean(void)
 		if (!svc_is_runtask(svc))
 			continue;

-		svc->once = 0;
+		/* run/task declared with <!> */
+		if (svc->sighup)
+			svc->once = 1;
+		else
+			svc->once = 0;
+
 		if (svc->state == SVC_DONE_STATE)
 			svc_set_state(svc, SVC_HALTED_STATE);
 	}
@@ -2568,6 +2660,7 @@ void service_runtask_clean(void)

 /**
 * service_completed - Have run/task completed in current runlevel
+ * @svcp: On %FALSE return, this points to the first incomplete svc
 *
 * This function checks if all run/task have run once in the current
 * runlevel.  E.g., at bootstrap we must wait for these scripts or
@@ -2580,7 +2673,7 @@ void service_runtask_clean(void)
 * Returns:
 * %TRUE(1) or %FALSE(0)
 */
-int service_completed(void)
+int service_completed(svc_t **svcp)
 {
 	svc_t *svc, *iter = NULL;

@@ -2602,6 +2695,8 @@ int service_completed(void)

 		if (!svc->once) {
 			dbg("%s has not yet completed ...", svc_ident(svc, NULL, 0));
+			if (svcp)
+				*svcp = svc;
 			return 0;
 		}
 		dbg("%s has completed ...", svc_ident(svc, NULL, 0));
@@ -2620,16 +2715,16 @@ void service_notify_reconf(void)
 	svc_t *svc, *iter = NULL;

 	for (svc = svc_iterator(&iter, 1); svc; svc = svc_iterator(&iter, 0)) {
-		if (!svc->notify)
+		if (svc->notify == SVC_NOTIFY_PID)
 			continue; /* managed by pidfile plugin */

 		if (svc->state != SVC_RUNNING_STATE)
 			continue;

-		if (svc_is_changed(svc) || svc_is_starting(svc))
+		if (svc->notify != SVC_NOTIFY_NONE && (svc_is_changed(svc) || svc_is_starting(svc)))
 			continue;

-		service_ready(svc);
+		service_ready(svc, 1);
 	}
 }

@@ -2670,10 +2765,10 @@ void service_notify_cb(uev_t *w, void *arg, int events)
 		 * the service_notify_reconf() function to step the
 		 * generation of the READY condition.
 		 */
-		service_ready(svc);
+		service_ready(svc, 1);

 		/* s6 applications close their socket after notification */
-		if (svc->notify == 2) {
+		if (svc->notify == SVC_NOTIFY_S6) {
 			uev_io_stop(w);
 			close(w->fd);
 			w->fd = 0;
@@ -1,7 +1,7 @@
 /* Finit service monitor, task starter and generic API for managing svc_t
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -42,14 +42,14 @@ int       service_timeout_after  (svc_t *svc, int timeout, void (*cb)(svc_t *svc
 int       service_timeout_cancel (svc_t *svc);

 void      service_forked         (svc_t *svc);
-void      service_ready          (svc_t *svc);
+void      service_ready          (svc_t *svc, int ready);

 int       service_stop           (svc_t *svc);
 int       service_step           (svc_t *svc);
 void      service_step_all       (int types);
 void      service_worker         (void *unused);

-int       service_completed      (void);
+int       service_completed      (svc_t **svc);
 void      service_notify_reconf  (void);

 void      service_init           (uev_ctx_t *ctx);
@@ -1,7 +1,7 @@
 /* Signal management - Be conservative with what finit responds to!
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Signal management - Be conservative with what finit responds to!
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -52,22 +52,30 @@ sm_t sm;
 */
 static void sm_check_bootstrap(void *work)
 {
-	static int cnt = 120 * 10;	/* We run with 100ms period */
-        int level = cfglevel;
+	static int timeout = 120;
+	int bootstrap_done;
+	int level = cfglevel;
+	svc_t *svc = NULL;

 	dbg("Step all services ...");
 	service_step_all(SVC_TYPE_ANY);

-	if (cnt-- > 0 && !service_completed()) {
-		dbg("Not all bootstrap run/tasks have completed yet ... %d", cnt);
+	bootstrap_done = service_completed(&svc);
+	if (timeout-- > 0 && !bootstrap_done) {
+		dbg("Not all bootstrap run/tasks have completed yet ... %d", timeout);
 		schedule_work(work);
 		return;
 	}

-	if (cnt > 0)
+	if (timeout > 0) {
 		dbg("All run/task have completed, resuming bootstrap.");
-	else
+	} else {
 		dbg("Timeout, resuming bootstrap.");
+		if (svc)
+			print(2, "Timeout waiting for %s to run, resuming bootstrap", svc_ident(svc, NULL, 0));
+		else
+			print(2, "Timeout waiting for unknown run/task, resuming bootstrap");
+	}

 	dbg("Flushing pending .conf file events ...");
 	conf_flush_events();
@@ -208,7 +216,7 @@ restart:
 		service_step_all(SVC_TYPE_ANY);

 		/* Allow runparts to start */
-		cond_set("int/bootstrap");
+		cond_set_oneshot("int/bootstrap");

 		if (sm->newlevel == -1)
 			break;
@@ -1,6 +1,6 @@
 /* Reset terminal line settings (stty sane)
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* poor man's sulogin, may be statically linked
 *
- * Copyright (c) 2021-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2021-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Low-level service primitives and generic API for managing svc_t structures
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -634,17 +634,30 @@ int svc_enabled(svc_t *svc)
 	if (!svc)
 		return 0;

-	if (!svc_in_runlevel(svc, runlevel))
+	if (!svc_in_runlevel(svc, runlevel)) {
+//		dbg("Not in runlevel");
 		return 0;
+	}

-	if (svc_is_removed(svc) || svc_is_blocked(svc))
+	if (svc_is_removed(svc) || svc_is_blocked(svc)) {
+//		dbg("removed (%d) / blocked (%d)", svc->removed, svc->block);
 		return 0;
+	}

-	if (svc_is_missing(svc))
+	if (svc_is_missing(svc)) {
+//		dbg("missing");
 		return 0;
+	}

-	if (svc_is_tty(svc) && bootstrap)
+	if (!svc_ifthen(0, NULL, svc->ifstmt, svc->nowarn)) {
+//		dbg("ifthen:%s>", svc->ifstmt[0] ? svc->ifstmt : "<");
 		return 0;
+	}
+
+	if (svc_is_tty(svc) && bootstrap) {
+//		dbg("is tty in bootstrap");
+		return 0;
+	}

 	return 1;
 }
@@ -688,14 +701,17 @@ int svc_conflicts(svc_t *svc)

 /**
 * svc_ifthen - Check if: statement in declaration
+ * @is_conf: Set when called by service_mark_unavail()
 * @ident:   svc_t identififcation (name:id)
 * @stmt:    if: statement from .conf file
+ * @quiet:   If non-zero, do not warn in syslog
 *
 * Returns:
 * %TRUE(1) yes, use this svc_t, %FALSE(0) prune
 */
-int svc_ifthen(const char *ident, char *stmt)
+int svc_ifthen(int is_conf, const char *ident, char *stmt, int quiet)
 {
+	char stmts[MAX_IDENT_LEN];
 	int not = 0;
 	svc_t *svc;

@@ -707,40 +723,51 @@ int svc_ifthen(const char *ident, char *stmt)
 		char *ptr = ++stmt;
 		int i = 0;

-		if (stmt[0] == '!') {
-			stmt++;
-			not++;
-		}
+		if (is_conf)
+			return 1;

 		while (ptr[i] != '>' && ptr[i] != 0)
 			i++;
 		ptr[i] = 0;

-		cond = cond_get(stmt);
-		if (not && cond == COND_ON) {
-			logit(LOG_NOTICE, "skipping %s, cond %s is on.", ident, stmt);
-			return 0;
-		}
-		if (!not && cond == COND_OFF) {
-			logit(LOG_NOTICE, "skipping %s, cond %s is off.", ident, stmt);
-			return 0;
+		strlcpy(stmts, stmt, sizeof(stmts));
+		for (stmt = strtok(stmts, ","); stmt; stmt = strtok(NULL, ","), not = 0) {
+			if (stmt[0] == '!') {
+				stmt++;
+				not++;
+			}
+
+			cond = cond_get(stmt);
+			if (not && cond == COND_ON)
+				return 0;
+			if (!not && cond == COND_OFF)
+				return 0;
 		}
+
 		return 1;
 	}

-	if (stmt[0] == '!') {
-		stmt++;
-		not++;
-	}
+	if (!is_conf)
+		return 1;

-	svc = svc_find_by_str(stmt);
-	if (not && svc) {
-		logit(LOG_NOTICE, "skipping %s, %s already loaded.", ident, svc_ident(svc, NULL, 0));
-		return 0;
-	}
-	if (!not && !svc) {
-		logit(LOG_NOTICE, "skipping %s, %s not available.", ident, stmt);
-		return 0;
+	strlcpy(stmts, stmt, sizeof(stmts));
+	for (stmt = strtok(stmts, ","); stmt; stmt = strtok(NULL, ","), not = 0) {
+		if (stmt[0] == '!') {
+			stmt++;
+			not++;
+		}
+
+		svc = svc_find_by_str(stmt);
+		if (not && svc) {
+			if (!quiet)
+				logit(LOG_NOTICE, "skipping %s, %s already loaded.", ident, svc_ident(svc, NULL, 0));
+			return 0;
+		}
+		if (!not && !svc) {
+			if (!quiet)
+				logit(LOG_NOTICE, "skipping %s, %s not available.", ident, stmt);
+			return 0;
+		}
 	}

 	return 1;
@@ -1,7 +1,7 @@
 /* Low-level service primitives and generic API for managing svc_t structures
 *
 * Copyright (c) 2008-2010  Claudio Matsuoka <cmatsuoka@gmail.com>
- * Copyright (c) 2008-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2008-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -83,8 +83,17 @@ typedef enum {
 	SVC_ONCRASH_SCRIPT,
 } svc_oncrash_action_t;

+/* 0: none, 1: systemd, 2: s6 */
+typedef enum {
+	SVC_NOTIFY_NONE = 0,
+	SVC_NOTIFY_PID,
+	SVC_NOTIFY_SYSTEMD,
+	SVC_NOTIFY_S6,
+} svc_notify_t;
+
 #define MAX_ID_LEN       16
 #define MAX_ARG_LEN      64
+#define MAX_CMD_LEN      256
 #define MAX_IDENT_LEN    (MAX_ARG_LEN + MAX_ID_LEN + 1)
 #define MAX_STR_LEN      64
 #define MAX_COND_LEN     (MAX_ARG_LEN * 3)
@@ -118,7 +127,7 @@ typedef struct svc {
 	int            sighalt;        /* Signal to stop process, default: SIGTERM */
 	int            killdelay;      /* Delay in msec before sending SIGKILL */
 	pid_t          oldpid, pid;
-	char           pidfile[256];
+	char           pidfile[MAX_CMD_LEN];
 	long           start_time;     /* Start time, as seconds since boot, from sysinfo() */
 	int            started;	       /* Set for run/task/sysv to track if started */
 	int            status;	       /* From waitpid() when process is collected */
@@ -181,15 +190,15 @@ typedef struct svc {
 	char	       group[MAX_USER_LEN];

 	/* Command, arguments and service description */
-	char	       cmd[MAX_ARG_LEN];
-	char	       args[MAX_NUM_SVC_ARGS][MAX_ARG_LEN];
+	char	       cmd[MAX_CMD_LEN];
+	char	       args[MAX_NUM_SVC_ARGS][MAX_CMD_LEN];
 	int            args_dirty;
 	char           conflict[MAX_ARG_LEN];
 	char	       desc[MAX_STR_LEN];
-	char	       env[MAX_ARG_LEN];
-	char	       pre_script[MAX_ARG_LEN];
-	char	       post_script[MAX_ARG_LEN];
-	char	       ready_script[MAX_ARG_LEN];
+	char	       env[MAX_CMD_LEN];
+	char	       pre_script[MAX_CMD_LEN];
+	char	       post_script[MAX_CMD_LEN];
+	char	       ready_script[MAX_CMD_LEN];

 	/*
 	 * Used to forcefully kill services that won't shutdown on
@@ -201,7 +210,7 @@ typedef struct svc {
 	/*
 	 * Readiness notification socket: systemd, s6
 	 */
-	int	       notify;	       /* 0: none, 1: systemd, 2: s6 */
+	svc_notify_t   notify;
 	uev_t	       notify_watcher; /* i/o watcher */

 	/* time at svc_del(), used by gc timer */
@@ -240,7 +249,7 @@ void	    svc_prune_bootstrap	   (void);
 void        svc_enable             (svc_t *svc);
 int         svc_enabled            (svc_t *svc);
 int         svc_conflicts          (svc_t *svc);
-int         svc_ifthen             (const char *ident, char *ifstm);
+int         svc_ifthen             (int is_conf, const char *ident, char *stmt, int quiet);

 int         svc_parse_jobstr       (char *str, size_t len, void *user_data, int (*found)(svc_t *, void *), int (not_found)(char *, char *, void *));

@@ -1,6 +1,6 @@
 /* Limited tmpfiles.d implementation
 *
- * Copyright (c) 2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -78,8 +78,8 @@ static int do_delete(const char *fpath, const struct stat *sb, int tflag, struct
 	if (ftw->level == 0)
 		return 1;

-	if (remove(fpath))
-		warn("Failed removing condition %s", fpath);
+	if (remove(fpath) && errno != EBUSY)
+		warn("Failed removing %s", fpath);

 	return 0;

@@ -471,7 +471,7 @@ void tmpfilesd(void)
 	/* in priority order */
 	char *dir[] = {
 		FINIT_TMPFILES "/*.conf",
-		TMPFILES_PATH "/*.conf",
+		TMPFILES_PATH_ "/*.conf",
 		"/usr/lib/tmpfiles.d/*.conf",
 		"/run/tmpfiles.d/*.conf",
 		"/etc/tmpfiles.d/*.conf", /* local admin overrides */
@@ -492,7 +492,7 @@ void tmpfilesd(void)

 		/* check for overrides */
 		for (j = i + 1; j < gl.gl_pathc; j++) {
-			if (strcmp(basename(fn), basename(gl.gl_pathv[j])))
+			if (strcmp(basenm(fn), basenm(gl.gl_pathv[j])))
 				continue;
 			fn = NULL;
 			break;
@@ -1,6 +1,6 @@
 /* Limited tmpfiles.d implementation
 *
- * Copyright (c) 2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Finit TTY handling
 *
 * Copyright (c) 2013       Mattias Walström <lazzer@gmail.com>
- * Copyright (c) 2013-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2013-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,7 +1,7 @@
 /* Finit TTY handling
 *
 * Copyright (c) 2013       Mattias Walström <lazzer@gmail.com>
- * Copyright (c) 2013-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2013-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1,6 +1,6 @@
 /* Misc. shared utility functions for initctl, reboot and finit
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -151,6 +151,19 @@ char *progname(char *arg0)
       return prognm;
 }

+/* basename(3) replacement that does not modify its argument */
+const char *basenm(const char *path)
+{
+	const char *basename;
+
+	basename = rindex(path, '/');
+	if (!basename)
+		return path;
+
+	basename++;
+	return basename;
+}
+
 char *str(char *fmt, ...)
 {
 	static char buf[32];
@@ -1,6 +1,6 @@
 /* Misc. shared utility functions for initctl, reboot and finit
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -55,6 +55,7 @@ extern char *prognm;
 #endif

 char *progname     (char *arg0);
+const char *basenm (const char *path);

 char *str          (char *fmt, ...)                        __attribute__ ((format (printf, 1, 2)));
 int   fnread       (char *buf, size_t len, char *fmt, ...) __attribute__ ((format (printf, 3, 4)));
@@ -1,6 +1,6 @@
 /* UTMP API
 *
- * Copyright (c) 2016-2023  Joachim Wiberg <troglobit@gmail.com>
+ * Copyright (c) 2016-2024  Joachim Wiberg <troglobit@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
--- a/Show More
+++ b/Show More