FreeBSD hostnamed — porting plan freebsd-launchd-mach (v2) effort

A clean-room daemon that picks a sensible default hostname from hardware identity at first boot, sets kern.hostname, and publishes Apple's three-name shape (ComputerName / LocalHostName / HostName) to configd's SCDynamicStore so mDNSResponder and other consumers can subscribe. Closest port we can do today of Apple's configd SetHostname plugin, kept as a standalone daemon because this repo's configd has no plugin loader (see configd plan's "deferred" list). Companion to launchd, configd, hwregd, mDNSResponder, IPConfiguration.

1. Goal & non-goals

1.1 Goal

Provide a working /usr/sbin/hostnamed on freebsd-launchd-mach so:

• The boot banner reads FreeBSD/amd64 (ThinkPad-T420-8AB123) instead of (Amnesiac).
• $(hostname) returns the synthesized name (not Amnesiac).
• mDNSResponder — on its next iter — can subscribe to State:/Network/HostNames and announce <name>.local over Bonjour without rolling its own gethostname-and-hope path.
• Two physically identical machines (two T420s, two Mac minis of the same model) end up with different names automatically, because the synthesis salt is a per-machine factory-unique identifier (serial number, NIC MAC, or kern.hostuuid).
• The name is predictable — standing in the room with the laptop, you can read the bottom-sticker serial and know the name before powering on. No "boot first, then look at the console to learn the name" required.

1.2 Non-goals (this iteration)

• No Setup Assistant. Apple's Setup Assistant pre-populates ComputerName from the iCloud account name during first boot — closed source, Apple-OOBE specific. Our synthesis fallback fills the same role; the closest user-facing knob is a kenv hostname.override set in /boot/loader.conf before imaging.
• No SCPreferences write-back in iter 1. Synthesis runs every boot until iter 2 wires the «if ComputerName is already in preferences.plist, skip synthesis» check. iter 1's synthesis is stable across reboots (inputs are persistent factory identity) so the user-visible name doesn't flap; iter 2 just adds the user-set-beats-synthesis precedence.
• No DHCP option 12 consumer in iter 1. Apple's set-hostname.c adopts the DHCP-server-provided hostname (RFC 2132 option 12) when the user hasn't manually set one. iter 3 vendors that file — brings DHCP option 12, reverse-DNS PTR fallback, and Apple's exact precedence logic in one port. iter 1 just does synthesis + write; iter 3 is the "decision engine" port.
• No reverse-DNS PTR fallback in iter 1. Apple's set-hostname.c falls back to a reverse-DNS PTR lookup on the primary IP if no preferences / DHCP name is available. iter 3 brings this with the rest of the vendored decision engine.
• No Bonjour-conflict feedback in iter 1. When mDNSResponder detects a .local name collision on the LAN and renames itself foo-2.local, it should push the new name back into SCPreferences so the next boot picks the conflict-free name. Apple does this; deferred to iter 4 (depends on iter 2's SCPreferences write surface).
• No HFS+ / APFS volume-name integration. Apple sometimes derives ComputerName from the boot-volume label. Not a real path for us (we mount UFS).

1.3 What Apple has open source vs. what we add

2. Repository layout

Monorepo. New directory src/hostnamed/ alongside the other Mach-track daemons:

freebsd-launchd-mach/
├── src/
│   ├── launchd/
│   ├── configd/
│   ├── hwregd/
│   ├── IPConfiguration/
│   ├── DiskArbitration/
│   ├── mDNSResponder/
│   ├── hostnamed/                                              <-- this plan
│   │   ├── hostnamed.c                ~400 LOC, the whole daemon
│   │   ├── Makefile                   BSD bsd.prog.mk
│   │   └── hostnametest.c             smoke-test client (read SCDynamicStore keys)
│   ├── libSystemConfiguration/        already shipped (SCDynamicStore client API)
│   └── ...
├── overlays/
│   └── System/Library/LaunchDaemons/
│       └── com.apple.hostnamed.plist                            <-- new
└── overlays/usr/tests/freebsd-launchd-mach/
    └── run.sh                                                    <-- new HOSTNAMED-OK marker

No new pkg deps. Builds against base FreeBSD libc + the in-tree libSystemConfiguration + libCoreFoundation.

3. Apple's three-name model

macOS tracks three related but distinct names, all owned by configd. We copy this shape verbatim because mDNSResponder is already coded to it:

For a synthesized name like ThinkPad-T420-8AB123 all three end up identical — the name is already DNS-safe so the LDH sanitization is a no-op. For a user-set name like John's MacBook Pro (spaces and apostrophe), ComputerName keeps them and the other two become Johns-MacBook-Pro.

4. Architecture

iter 1 is a one-shot because synthesis inputs are persistent (factory hardware identity), so re-running synthesis on every boot produces the same name. There's nothing to watch until iter 2 / 3 / 4 add SCPreferences, DHCP-option-12, and Bonjour-conflict event sources. iter 3 promotes hostnamed to KeepAlive=true when the vendored set-hostname.c decision engine arrives — it needs to subscribe to SCDynamicStore notifications for primary-service changes, DHCP-lease changes, and reverse-DNS query callbacks.

Two Apple-canonical syscalls on the publish path:

1. sethostname(2) — what Apple's set-hostname.c calls. On FreeBSD, sethostname(2) internally writes kern.hostname, so the visible effect is identical. We pick the syscall Apple uses for fidelity.
2. notify_post("com.apple.system.hostname") — the documented hostname-change broadcast. Goes through our notifyd (already shipped, Phase J2). Apple-canonical subscribers (mDNSResponder, anyone else) listen via notify_register_* for this key and re-fetch the new value.

5. Synthesis algorithm

Three precedence tiers, highest wins. Stops at the first tier that yields a non-empty name.

5.1 Tier 1 — kenv hostname.override

If kenv(2) returns a non-empty value for the key hostname.override, use it verbatim. This is the "Setup Assistant pre-populated the name" equivalent — set in /boot/loader.conf or /boot/loader.conf.d/local.conf at install time:

hostname.override="my-t420"

Bypasses synthesis entirely; LDH sanitization still applied for LocalHostName / HostName. Whitelist for characters allowed in the override: [A-Za-z0-9 _.\-]{1,253} (UTF-8 letters allowed in ComputerName only; sanitized out of the LDH names).

5.2 Tier 2 — SCPreferences ComputerName iter 2+

Not in iter 1. Once iter 2 lands, hostnamed opens preferences.plist via SCPreferences, checks System → System → ComputerName. If present, use it verbatim (sanitize for the other two names) and skip Tier 3. Matches Apple's user-set name beats synthesis behavior.

5.3 Tier 3 — synthesize slug-suffix

Default path. Compose ${slug}-${suffix} from hardware identity:

5.3.1 slug — the model part

First non-empty of:

1. kenv smbios.system.version — this is the human-readable model on most laptops. ThinkPad T420 shows "ThinkPad T420" here. Apple shows "MacBookPro16,1"; Dell shows "Latitude E7470"; ASUS shows "ROG STRIX G15 G513QY_G513QY".
2. kenv smbios.system.product — the SKU / MTM string. Lenovo's MTM is "4236AB1", Apple's is "Mac-mini". Used as fallback when .version is empty / placeholder.
3. literal "freebsd" — final fallback (no SMBIOS data at all; VMs or weird embedded boards).

Sanitization: trim whitespace, replace runs of whitespace with single -, strip anything not in [A-Za-z0-9-], collapse double-hyphens, trim leading / trailing -, truncate to 40 chars. The result: "ThinkPad T420" → "ThinkPad-T420".

5.3.2 suffix — the per-machine salt

First non-empty of:

1. Last 6 alphanumeric chars of kenv smbios.system.serial. Skip if value matches any of the well-known empty-firmware placeholders: "", "None", "To be filled by O.E.M.", "Default string", "0", "0123456789", "System Serial Number". Lenovo serials always pass (factory-set, 7-char alphanumerics like R8AB123; suffix = last 6 = 8AB123).
2. Last 6 hex chars of the primary NIC MAC. Picked by walking getifaddrs(AF_LINK) for the first non-loopback Ethernet (IFT_ETHER, MAC != 00:00:00:00:00:00). em0 / re0 / bge0 / etc.
3. 6 hex chars from the first segment of sysctl kern.hostuuid. Always exists (the kernel synthesizes a v4 UUID on first boot if absent and persists it). Final fallback.

5.3.3 Composition

Concatenate as "${slug}-${suffix}"; truncate composite to 63 chars (the RFC 1035 label cap that LocalHostName needs anyway). Empty slug + non-empty suffix → "freebsd-${suffix}". Both empty (impossible in practice) → literal "freebsd".

5.3.4 Worked examples

6. Predicting the name without booting

Three answers in order of effort — the user shouldn't need to plug in a monitor to find their machine on the LAN.

1. Read the sticker. Every Lenovo / Dell / HP enterprise laptop has a bottom-panel sticker with the factory serial. The synthesized name's suffix is the last 6 alphanumeric chars of that serial. For a T420 with S/N: R8AB123, the name is ThinkPad-T420-8AB123. Predictable standing in the room with the laptop.
2. Boot once, look at the console. The first boot prints:

   hostnamed 2026-MM-DDTHH:MM:SSZ ComputerName: ThinkPad-T420-8AB123
   hostnamed 2026-MM-DDTHH:MM:SSZ   source: smbios.system.version="ThinkPad T420" smbios.system.serial="R8AB123"
   hostnamed 2026-MM-DDTHH:MM:SSZ   override via: kenv hostname.override="<name>" in /boot/loader.conf

   and the getty login banner becomes FreeBSD/amd64 (ThinkPad-T420-8AB123). The synthesis is deterministic so the name is the same on subsequent boots.
3. Override before first boot. Mount the disk image, edit /boot/loader.conf.d/local.conf:

   hostname.override="my-t420"

   Tier 1 wins, synthesis doesn't run. Same effect as Apple's Setup-Assistant pre-fill.

7. SCDynamicStore key shape

iter 1 writes exactly two SCDynamicStore keys via SCDynamicStoreSetValue, plus the sethostname(2) + notify_post() pair. The key paths are constructed using Apple's own helpers from libSystemConfiguration (SCDynamicStoreKeyCreateComputerName, SCDynamicStoreKeyCreateHostNames), so they're guaranteed to match what mDNSResponder's subscriber code expects without us hard-coding paths.

{
  "ComputerName"         = "ThinkPad-T420-8AB123";
  "ComputerNameEncoding" = 134217984;  // kCFStringEncodingUTF8
}

{
  "HostName"      = "ThinkPad-T420-8AB123";
  "LocalHostName" = "ThinkPad-T420-8AB123";
}

Note: Apple uses the Setup: domain (not State:) for both these keys — double-checked against SCDHostName.c source. Setup: is the "intended / persistent configuration" domain that PreferencesMonitor normally writes after reading preferences.plist; we bypass PreferencesMonitor and write directly because the read-from-prefs path is iter 2, and iter 1 is solely the synthesis-fallback role.

Notification semantics: SCDynamicStoreSetValue on the existing configd session sends the standard SCDynamicStore notification on any key that's subscribed via SCDynamicStoreSetNotificationKeys. The notify_post is the Apple-canonical higher-level signal for the same event — both fire from iter 1 because Apple's set-hostname.c does both, and we want subscribers to be able to use whichever notification surface fits them.

8. Boot banner

The visible-on-the-console "I am <name>" banner has three layers:

• hostnamed's stderr log line. Always present in /var/log/hostnamed.stderr; dumped at the end of CI's run.sh like every other daemon's log.
• The login getty banner. Today: FreeBSD/amd64 (Amnesiac) (console). After iter 1: getty reads gethostname(3) which goes through kern.hostname — so as long as hostnamed runs before getty's plist is dispatched, the banner reads the new name automatically. launchd has no ordering guarantee (everything RunAtLoad=true starts in parallel), so the first banner print may race the kern.hostname write. Mitigation: hostnamed is a one-shot that exits quickly (<50ms typical), and getty respawns its prompt periodically; even if the very first prompt shows Amnesiac, the next one (and every subsequent connection) shows the right name.
• Console "I am …" line — we can additionally have hostnamed write a one-liner directly to /dev/console after setting kern.hostname, so the boot transcript shows the synthesized name regardless of getty's timing. Defer this to iter 1 if it ends up needed; the stderr log is the primary signal.

Deferring the "getty re-renders on hostname change" wiring is fine because synthesis is deterministic across reboots — the user sees the right name on the second boot regardless of any first-boot getty race.

9. Iteration plan

10. CI marker shape

QEMU/SLIRP has no SMBIOS-meaningful data — smbios.system.version = "Standard PC (Q35 + ICH9, 2009)", smbios.system.serial = "Not Specified" (skipped per the placeholder filter). So in CI the synthesis falls through to the MAC-suffix tier. The em0 MAC under QEMU SLIRP is the deterministic 52:54:00:12:34:56, so the expected CI name suffix is 123456.

Expected CI marker:

hostnamed 2026-MM-DDTHH:MM:SSZ ComputerName: Standard-PC-Q35--ICH9-2009-123456
hostnamed 2026-MM-DDTHH:MM:SSZ HOSTNAMED-OK

The CI test verifies the name matches the regex [A-Za-z0-9-]+-[0-9a-f]{6} rather than pinning the exact string — the slug derivation may evolve and we don't want CI to fight that. The regex enforces the load-bearing property: a non-empty slug, a hyphen separator, a 6-hex per-machine suffix.

Verifier checks in run.sh:

1. $(hostname) equals $(grep '^hostnamed.*ComputerName:' /var/log/hostnamed.stderr | sed 's/.*ComputerName: //')
2. A tiny client (hostnametest, reuses configd's MIG client patterns) reads State:/Network/HostNames and confirms LocalHostName + HostName are populated and DNS-safe.
3. Boot log shows FreeBSD/amd64 (<synthesized>) not (Amnesiac) on the second-and-later getty prompt.

11. Open questions for review before iter 1 lands