Loading NetBSD kernel modules

Question

I want to start using npf on my NetBSD server, rather than relying solely on the external firewall for protection. However, I get:

$ npfctl show
npfctl: /dev/npf: No such file or directory

Alright, maybe I deleted a device node. No matter:

$ grep npf /dev/MAKEDEV
        makedev bpf npf
npf)
        mkdev npf        c 198 0
# mknod /dev/npf c 198 0
$ npfctl show
npfctl: /dev/npf: Device not configured

Oh, right, have to load the driver first:

$ modstat | grep npf; echo $?
1
$ find /stand -name 'npf.kmod'
/stand/sparc64/7.0/modules/npf/npf.kmod
$ uname -sr
NetBSD 7.0.2
# modload npf
modload: Operation not permitted

Why am I (even as root) not permitted to load modules?

Answer 1

NetBSD uses kernel secure levels to determine what operations can be performed on a running system. From the link:

-1 Permanently insecure mode

• Don't raise the securelevel on boot

0 Insecure mode

• The init process (PID 1) may not be traced or accessed by ptrace(2), systrace(4), or procfs.
• Immutable and append-only file flags may be changed
• All devices may be read or written subject to their permissions

Note: You can't run X11 above this securelevel

Try sysutils/aperture if you really need it.

1 Secure mode

• All effects of securelevel 0
• /dev/mem and /dev/kmem may not be written to
• Raw disk devices of mounted file systems are read-only
• Immutable and append-only file flags may not be removed
• Kernel modules may not be loaded or unloaded
• The net.inet.ip.sourceroute sysctl(8) variable may not be changed
• Adding or removing sysctl(9) nodes is denied
• The RTC offset may not be changed
• Set-id coredump settings may not be altered
• Attaching the IP-based kernel debugger, ipkdb(4), is not allowed
• Device pass-thru requests that may be used to perform raw disk and/or memory access are denied
• iopl and ioperm calls are denied
• Access to unmanaged memory is denied

2 Highly secure mode

• All effects of securelevel 1
• Raw disk devices are always read-only whether mounted or not
• New disks may not be mounted, and existing mounts may only be downgraded from read-write to read-only
• The system clock may not be set backwards or close to overflow
• Per-process coredump name may not be changed
• Packet filtering and NAT rules may not be altered

My system was running at securelevel 1, so "Kernel modules may not be loaded or unloaded". Further, setting npf=YES in rc.conf does not automatically load the associated kernel module. One cannot lower the kernel secure level at runtime, so the options are:

• Boot to a lower securelevel, then load the module and raise the securelevel, or
• Load the module during boot

Clearly the latter is the better option. To load a kernel module at boot, one must ensure that rc.conf contains:

modules=YES

Then, edit (or create) /etc/modules.conf to contain a list of modules to load, one per line. In this case:

# echo npf >> /etc/modules.conf