src.conf + make.conf => hardened/12-stable => 12.1

kernel-config

# ServeD:

cpu HAMMER
ident VerKnowSys
makeoptions DEBUG=-g                        # Build kernel with gdb(1) debug symbols
makeoptions WITH_CTF=1                      # Run ctfconvert(1) for DTrace support

options     SCHED_ULE                       # ULE scheduler
options     NUMA                            # Non-Uniform Memory Architecture support
options     PREEMPTION                      # Enable kernel thread preemption
options     INET                            # InterNETworking
options     INET6                           # IPv6 communications protocols
options     IPSEC                           # IP (v4/v6) security
options     IPSEC_SUPPORT                   # Allow kldload of ipsec and tcpmd5
options     TCP_BLACKBOX                    # Enhanced TCP event logging
options     TCP_HHOOK                       # hhook(9) framework for TCP
options     TCP_RFC7413                     # TCP Fast Open
options     TCP_OFFLOAD                     # TCP offload
options     TCP_SIGNATURE
options     SCTP                            # Stream Control Transmission Protocol

#options     FFS                             # Berkeley Fast Filesystem
#options     SOFTUPDATES                    # Enable FFS soft updates support
#options     UFS_ACL                        # Support for access control lists
#options     UFS_DIRHASH                    # Improve performance on big directories
#options     UFS_GJOURNAL                   # Enable gjournal-based UFS journaling
#options     UFS_EXTATTR                    # Extended attributes
#options     UFS_EXTATTR_AUTOSTART
#options     QUOTA                          # Enable disk quotas for UFS

options     MD_ROOT                         # MD is a potential root device
options     SYSVSHM                         # SYSV-style shared memory
options     SYSVMSG                         # SYSV-style message queues
options     SYSVSEM                         # SYSV-style semaphores

options     SHMMAXPGS=262144                # PostgreSQL
options     SEMMNI=256
options     SEMMNS=512
options     SEMMNU=256
options     SEMUME=256

# Enable virtual network for jails:
options     VIMAGE

#
# ABI Emulation

options     MSDOSFS                         # MSDOS Filesystem
options     CD9660                          # ISO 9660 Filesystem
options     PROCFS                          # Process filesystem (requires PSEUDOFS)
options     PSEUDOFS                        # Pseudo-filesystem framework

#
# Enable 64-bit runtime support for CloudABI binaries.
options     COMPAT_CLOUDABI64


# Debugging support.  Always need this:
options     KDB                             # Enable kernel debugger support.
options     KDB_TRACE                       # Print a stack trace for a panic.

# For full debugger support use (turn off in stable branch):
# options     DDB                             # Support DDB.
options     DDB_CTF                         # Kernel ELF linker loads CTF data
options     KDTRACE_FRAME                   # Ensure frames are compiled in
options     KDTRACE_HOOKS                   # Kernel DTrace hooks

# options     DEADLKRES                     # Enable the deadlock resolver
# options     GDB                            # Support remote GDB.
# options     WITNESS                        # Enable checks to detect deadlocks and cycles
# options     WITNESS_SKIPSPIN               # Don't run witness on spinlocks for speed
# options     MALLOC_DEBUG_MAXZONES=8        # Separate malloc(9) zones

# Make an SMP-capable kernel by default
options     SMP                             # Symmetric MultiProcessor Kernel
options     IMAGACT_BINMISC                 # enables app exec through emulators, such as QEMU via binmiscctl(8). [r266531]
options     EARLY_AP_STARTUP

#
# DEVICE_POLLING adds support for mixed interrupt-polling handling
# of network device drivers, which has significant benefits in terms
# of robustness to overloads and responsivity, as well as permitting
# accurate scheduling of the CPU time between kernel network processing
# and other activities.  The drawback is a moderate (up to 1/HZ seconds)
# potential increase in response times.
# It is strongly recommended to use HZ=1000 or 2000 with DEVICE_POLLING
# to achieve smoother behaviour.
# Additionally, you can enable/disable polling at runtime with help of
# the ifconfig(8) utility, and select the CPU fraction reserved to
# userland with the sysctl variable kern.polling.user_frac
# (default 50, range 0..100).
#
# Not all device drivers support this mode of operation at the time of
# this writing.  See polling(4) for more details.

options     DEVICE_POLLING

device      epair
device      pf
# device      pflog
# device      pfsync                          # Synchronization interface for PF
device      gre                             # IP over IP tunneling
device      if_bridge                       # Bridge interface
device      carp                            # Common Address Redundancy Protocol
device      enc                             # IPsec interface
device      lagg                            # Link aggregation interface
device      stf                             # IPv4-IPv6 port
device      coretemp
device      cpuctl
device      nvram
device      nmdm                            # Null modem

# BUSes:
device      iicbus
device      iicbb
device      iic
device      ic
device      iicsmb
device      smb
device      smbus
device      bktr

#
# Intel integrated Memory Controller (iMC) SMBus controller
# Sandybridge-Xeon, Ivybridge-Xeon, Haswell-Xeon, Broadwell-Xeon
device      imcsmb

device      ipmi
device      pbio
device      smbios
device      vpd
device      asmc
device      tpm
device      aesni                           # AES-NI OpenCrypto module
device      ioat                            # Intel I/OAT DMA engine


# NFS support
options     NFSCL                           # Network Filesystem Client
options     NFSD                            # Network Filesystem Server
options     NFSLOCKD                        # Network Lock Manager
options     NFS_ROOT                        # NFS usable as /, requires NFSCL

# GEOM support
options     GEOM_PART_GPT                   # GUID Partition Tables.
options     GEOM_RAID                       # Soft RAID functionality.
options     GEOM_LABEL                      # Provides labelization
options     GEOM_ELI                        # Disk encryption.
options     EFIRT                           # EFI Runtime Services support
options     SCSI_DELAY=5000                 # Delay (in ms) before probing SCSI

#options    COMPAT_FREEBSD32                # Compatible with i386 binaries
#options    COMPAT_FREEBSD4                 # Compatible with FreeBSD4
#options    COMPAT_FREEBSD5                 # Compatible with FreeBSD5
#options    COMPAT_FREEBSD6                 # Compatible with FreeBSD6
#options    COMPAT_FREEBSD7                 # Compatible with FreeBSD7
#options    COMPAT_FREEBSD9                 # Compatible with FreeBSD9
#options    COMPAT_FREEBSD10                # Compatible with FreeBSD10
options     COMPAT_FREEBSD11                # Compatible with FreeBSD11

options     KTRACE                          # ktrace(1) support
options     STACK                           # stack(9) support
options     _KPOSIX_PRIORITY_SCHEDULING     # POSIX P1003_1B real-time extensions
options     PRINTF_BUFR_SIZE=128            # Prevent printf output being interspersed.
options     KBD_INSTALL_CDEV                # install a CDEV entry in /dev
options     HWPMC_HOOKS                     # Necessary kernel hooks for hwpmc(4)
options     AUDIT                           # Security event auditing
options     CAPABILITY_MODE                 # Capsicum capability mode
options     CAPABILITIES                    # Capsicum capabilities

# MAC:
options     MAC                             # TrustedBSD MAC Framework
options     MAC_BSDEXTENDED
options     MAC_PORTACL
options     MAC_SEEOTHERUIDS
options     INCLUDE_CONFIG_FILE             # Include this file in kernel
options     RACCT                           # Resource accounting framework
options     RCTL                            # Resource limits


# HardenedBSD hardening options
options     PAX                             # PaX framework
options     PAX_SYSCTLS                     # sysctls for run-time options
options     PAX_ASLR                        # Address Space Layout Randomization
options     PAX_NOEXEC                      # Remove WX pages from user-space and enforce W^X
options     PAX_HARDENING                   # Various hardening options
options     PAX_SEGVGUARD                   # prevent brute-force attacks
options     PAX_CONTROL_ACL                 # PaX MAC framework, required for secadm
options     PAX_CONTROL_ACL_OVERRIDE_SUPPORT # Allow to override hbsdcontrol settings with ACLs
options     PAX_CONTROL_EXTATTR             # extattr based control framework for hbsdcontrol
options     PAX_JAIL_SUPPORT                # Allow to override PAX settings per jail
options     INVARIANTS                      # Enable calls of extra sanity checking
options     INVARIANT_SUPPORT               # Extra sanity checks of internal structures,

#options    PAX_PTRACE_HARDENING
#options    PAX_PTRACE_HARDENING_GRP=50000

#options     PAX_INSECURE_MODE             # it's required if disabled INVARIANTS

# Bus support.
device      acpi
options     ACPI_DMAR
device      pci
options     PCI_HP                          # PCI-Express native HotPlug
options     PCI_IOV                         # PCI SR-IOV support

# CPU frequency control
device      cpufreq

device      hyperv                          # HyperV drivers

# Floppy drives
#device      fdc

# ATA controllers
device      ahci                            # AHCI-compatible SATA controllers
device      ata                             # Legacy ATA/SATA controllers
options     ATA_STATIC_ID                   # Static device numbering
device      mvs                             # Marvell 88SX50XX/88SX60XX/88SX70XX/SoC SATA
device      siis                            # SiliconImage SiI3124/SiI3132/SiI3531 SATA

# SCSI Controllers
device      ahc                             # AHA2940 and onboard AIC7xxx devices
#options     AHC_REG_PRETTY_PRINT           # Print register bitfields in debug
                                            # output.  Adds ~128k to driver.
device      ahd                             # AHA39320/29320 and onboard AIC79xx devices
#options     AHD_REG_PRETTY_PRINT           # Print register bitfields in debug
                                            # output.  Adds ~215k to driver.
device      esp                             # AMD Am53C974 (Tekram DC-390(T))
device      hptiop                          # Highpoint RocketRaid 3xxx series
device      isp                             # Qlogic family
#device     ispfw                           # Firmware for QLogic HBAs- normally a module
device      mpt                             # LSI-Logic MPT-Fusion
device      mps                             # LSI-Logic MPT-Fusion 2
device      mpr                             # LSI-Logic MPT-Fusion 3
#device     ncr                             # NCR/Symbios Logic
device      sym                             # NCR/Symbios Logic (newer chipsets + ncr)
device      trm                             # Tekram DC395U/UW/F DC315U adapters
device      adv                             # Advansys SCSI adapters
device      adw                             # Advansys wide SCSI adapters
device      aic                             # Adaptec 15[012]x SCSI adapters, AIC-6[23]60.
device      bt                              # Buslogic/Mylex MultiMaster SCSI adapters
device      isci                            # Intel C600 SAS controller

# ATA/SCSI peripherals
device      scbus                           # SCSI bus (required for ATA/SCSI)
device      ch                              # SCSI media changers
device      da                              # Direct Access (disks)
device      sa                              # Sequential Access (tape etc)
device      cd                              # CD
device      pass                            # Passthrough device (direct ATA/SCSI access)
device      ses                             # Enclosure Services (SES and SAF-TE)
device      ctl                             # CAM Target Layer

# RAID controllers interfaced to the SCSI subsystem
device      amr                             # AMI MegaRAID
device      arcmsr                          # Areca SATA II RAID
device      ciss                            # Compaq Smart RAID 5*
device      dpt                             # DPT Smartcache III, IV - See NOTES for options
device      hptmv                           # Highpoint RocketRAID 182x
device      hptnr                           # Highpoint DC7280, R750
device      hptrr                           # Highpoint RocketRAID 17xx, 22xx, 23xx, 25xx
device      hpt27xx                         # Highpoint RocketRAID 27xx
device      iir                             # Intel Integrated RAID
device      ips                             # IBM (Adaptec) ServeRAID
device      mly                             # Mylex AcceleRAID/eXtremeRAID
device      twa                             # 3ware 9000 series PATA/SATA RAID
device      smartpqi                        # Microsemi smartpqi drive
device      tws                             # LSI 3ware 9750 SATA+SAS 6Gb/s RAID controller

# RAID controllers
device      aac                             # Adaptec FSA RAID
device      aacp                            # SCSI passthrough for aac (requires CAM)
device      aacraid                         # Adaptec by PMC RAID
device      ida                             # Compaq Smart RAID
device      mfi                             # LSI MegaRAID SAS
device      mlx                             # Mylex DAC960 family
device      mrsas                           # LSI/Avago MegaRAID SAS/SATA, 6Gb/s and 12Gb/s
device      pmspcv                          # PMC-Sierra SAS/SATA Controller driver
#device      pst                            # Promise Supertrak SX6000
device      twe                             # 3ware ATA RAID

# NVM Express (NVMe) support
device      nvme                            # base NVMe driver
device      nvd                             # expose NVMe namespaces as disks, depends on nvme

# atkbdc0 controls both the keyboard and the PS/2 mouse
device      atkbdc                          # AT keyboard controller
device      atkbd                           # AT keyboard
device      psm                             # PS/2 mouse

device      kbdmux                          # keyboard multiplexer

device      vga                             # VGA video card driver

device      splash                          # Splash screen and screen saver support

# vt is the new video console driver
options     TERMINAL_KERN_ATTR=(FG_LIGHTCYAN|BG_BLACK)
options     TERMINAL_NORM_ATTR=(FG_LIGHTGREY|BG_BLACK)
device      vt
device      vt_vga
device      vt_efifb
device      agp                             # support several AGP chipsets

# PCCARD (PCMCIA) support
# PCMCIA and cardbus bridge support
device      cbb                             # cardbus (yenta) bridge
device      pccard                          # PC Card (16-bit) bus
device      cardbus                         # CardBus (32-bit) bus

# Serial (COM) ports
device      uart                            # Generic UART driver

# Parallel port
#device      ppc
#device      ppbus                          # Parallel port bus (required)
#device      lpt                            # Printer
#device      ppi                            # Parallel port interface device
#device     vpo                             # Requires scbus and da
#device      puc                            # Multi I/O cards and multi-channel UARTs

# PCI/PCI-X/PCIe Ethernet NICs that use iflib infrastructure
device      iflib
device      em                              # Intel PRO/1000 Gigabit Ethernet Family
device      ix                              # Intel PRO/10GbE PCIE PF Ethernet
device      ixv                             # Intel PRO/10GbE PCIE VF Ethernet
device      ixl                             # Intel 700 Series Physical Function
device      iavf                            # Intel Adaptive Virtual Function
device      vmx                             # VMware VMXNET3 Ethernet

# PCI Ethernet NICs.
device    bxe     # Broadcom NetXtreme II BCM5771X/BCM578XX 10GbE
device    de      # DEC/Intel DC21x4x (``Tulip'')
device    le      # AMD Am7900 LANCE and Am79C9xx PCnet
device    ti      # Alteon Networks Tigon I/II gigabit Ethernet
device    txp     # 3Com 3cR990 (``Typhoon'')
device    vx      # 3Com 3c590, 3c595 (``Vortex'')


# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device      miibus                          # MII bus support
device      ae                              # Attansic/Atheros L2 FastEthernet
device      age                             # Attansic/Atheros L1 Gigabit Ethernet
device      alc                             # Atheros AR8131/AR8132 Ethernet
device      ale                             # Atheros AR8121/AR8113/AR8114 Ethernet
device      bce                             # Broadcom BCM5706/BCM5708 Gigabit Ethernet
device      bfe                             # Broadcom BCM440x 10/100 Ethernet
device      bge                             # Broadcom BCM570xx Gigabit Ethernet
device      cas                             # Sun Cassini/Cassini+ and NS DP83065 Saturn
device      dc                              # DEC/Intel 21143 and various workalikes
device      et                              # Agere ET1310 10/100/Gigabit Ethernet
device      fxp                             # Intel EtherExpress PRO/100B (82557, 82558)
device      gem                             # Sun GEM/Sun ERI/Apple GMAC
device      hme                             # Sun HME (Happy Meal Ethernet)
device      jme                             # JMicron JMC250 Gigabit/JMC260 Fast Ethernet
device      lge                             # Level 1 LXT1001 gigabit Ethernet
device      msk                             # Marvell/SysKonnect Yukon II Gigabit Ethernet
device      nfe                             # nVidia nForce MCP on-board Ethernet
device      nge                             # NatSemi DP83820 gigabit Ethernet
device      pcn                             # AMD Am79C97x PCI 10/100 (precedence over 'le')
device      re                              # RealTek 8139C+/8169/8169S/8110S
device      rl                              # RealTek 8129/8139
device      sf                              # Adaptec AIC-6915 (``Starfire'')
device      sge                             # Silicon Integrated Systems SiS190/191
device      sis                             # Silicon Integrated Systems SiS 900/SiS 7016
device      sk                              # SysKonnect SK-984x & SK-982x gigabit Ethernet
device      ste                             # Sundance ST201 (D-Link DFE-550TX)
device      stge                            # Sundance/Tamarack TC9021 gigabit Ethernet
device      tl                              # Texas Instruments ThunderLAN
device      tx                              # SMC EtherPower II (83c170 ``EPIC'')
device      vge                             # VIA VT612x gigabit Ethernet
device      vr                              # VIA Rhine, Rhine II
device      wb                              # Winbond W89C840F
device      xl                              # 3Com 3c90x (``Boomerang'', ``Cyclone'')

# Wireless NIC cards
# device      wlan                            # 802.11 support
# options     IEEE80211_DEBUG                # enable debug msgs
# options     IEEE80211_AMPDU_AGE             # age frames in AMPDU reorder q's
# options     IEEE80211_SUPPORT_MESH          # enable 802.11s draft support
# device      wlan_wep                        # 802.11 WEP support
# device      wlan_ccmp                       # 802.11 CCMP support
# device      wlan_tkip                       # 802.11 TKIP support
# device      wlan_amrr                       # AMRR transmit rate control algorithm
# device      an                              # Aironet 4500/4800 802.11 wireless NICs.
# device      ath                             # Atheros NICs
# device      ath_pci                         # Atheros pci/cardbus glue
# device      ath_hal                         # pci/cardbus chip support
# options     AH_SUPPORT_AR5416               # enable AR5416 tx/rx descriptors
# options     AH_AR5416_INTERRUPT_MITIGATION  # AR5416 interrupt mitigation
# options     ATH_ENABLE_11N                  # Enable 802.11n support for AR5416 and later
# device      ath_rate_sample                 # SampleRate tx rate control for ath
# #device     bwi                             # Broadcom BCM430x/BCM431x wireless NICs.
# #device     bwn                             # Broadcom BCM43xx wireless NICs.
# device      ipw                             # Intel 2100 wireless NICs.
# device      iwi                             # Intel 2200BG/2225BG/2915ABG wireless NICs.
# device      iwn                             # Intel 4965/1000/5000/6000 wireless NICs.
# device      malo                            # Marvell Libertas wireless NICs.
# device      mwl                             # Marvell 88W8363 802.11n wireless NICs.
# device      ral                             # Ralink Technology RT2500 wireless NICs.
# device      wi                              # WaveLAN/Intersil/Symbol 802.11 wireless # NICs.
# device      wpi                             # Intel 3945ABG wireless NICs.

# Pseudo devices.
device      loop                            # Network loopback
device      random                          # Entropy device
device      padlock_rng                     # VIA Padlock RNG
device      rdrand_rng                      # Intel Bull Mountain RNG
device      ether                           # Ethernet support
device      vlan                            # 802.1Q VLAN support
device      tuntap                          # Packet tunnel + Virtual Ethernet driver
device      md                              # Memory "disks"
device      gif                             # IPv6 and IPv4 tunneling
device      firmware                        # firmware assist module

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device      bpf                             # Berkeley packet filter

# USB support
#options     USB_DEBUG                      # enable debug msgs
device      uhci                            # UHCI PCI->USB interface
device      ohci                            # OHCI PCI->USB interface
device      ehci                            # EHCI PCI->USB interface (USB 2.0)
device      xhci                            # XHCI PCI->USB interface (USB 3.0)
device      usb                             # USB Bus (required)
device      ukbd                            # Keyboard
device      umass                           # Disks/Mass storage - Requires scbus and da

# Sound support
# device      sound                           # Generic sound driver (required)
# device      snd_cmi                         # CMedia CMI8338/CMI8738
# device      snd_csa                         # Crystal Semiconductor CS461x/428x
# device      snd_emu10kx                     # Creative SoundBlaster Live! and Audigy
# device      snd_es137x                      # Ensoniq AudioPCI ES137x
# device      snd_hda                         # Intel High Definition Audio
# device      snd_ich                         # Intel, NVidia and other ICH AC'97 Audio
# device      snd_via8233                     # VIA VT8233x Audio

# MMC/SD
device      mmc                             # MMC/SD bus
device      mmcsd                           # MMC/SD memory card
device      sdhci                           # Generic PCI SD Host Controller

# VirtIO support
device      virtio                          # Generic VirtIO bus (required)
device      virtio_pci                      # VirtIO PCI device
device      vtnet                           # VirtIO Ethernet device
device      virtio_blk                      # VirtIO Block device
device      virtio_scsi                     # VirtIO SCSI device
device      virtio_balloon                  # VirtIO Memory Balloon device
device      virtio_random                   # VirtIO Entropy device
device      virtio_console                  # VirtIO Console device

# Netmap provides direct access to TX/RX rings on supported NICs
device      netmap                          # netmap(4) support

# Additonal devices
device      crypto                          # core crypto support
device      cryptodev                       # /dev/crypto for access to h/w

# zpty
device      pty

# nullfs
options     NULLFS
options     FDESCFS
options     TMPFS

# routes setfib
# options     ROUTETABLES=8

make.conf

# share/mk/bsd.cpu.mk for list of supported values:
# NOTE: these values might be replaced by build-all for cross compiling:
CPUTYPE?=ivybridge
CFLAGS+=-O2 -w -pipe -funroll-loops -fno-omit-frame-pointer -fno-strict-aliasing
CXXFLAGS+=-O2 -w -pipe -funroll-loops -fno-omit-frame-pointer -fno-strict-aliasing
COPTFLAGS+=-O2 -pipe -funroll-loops -fno-strict-aliasing

# wrap compiler with ccache
# CC=/Services/Sofin/exports/ccache /usr/bin/cc
# CXX=/Services/Sofin/exports/ccache /usr/bin/c++
# CPP=/Services/Sofin/exports/ccache /usr/bin/cpp

CC=/usr/bin/cc
CXX=/usr/bin/c++
CPP=/usr/bin/cpp

KERNCONF=VerKnowSys
SYSTEM_COMPILER=cc
COMPILER_TYPE=clang
MAKE_SHELL=sh
MALLOC_PRODUCTION=1

LOADER_TFTP_SUPPORT=1

NO_MANCOMPRESS=1
NO_DOCUPDATE=1
NO_PORTSUPDATE=1
NO_CLEAN=1
NO_CLEANDIR=1
NO_KERNELCLEAN=1
NO_FSCHG=1
NO_WERROR=
NO_SHARE=1
WERROR=

# Ports options:
OPTIONS_UNSET+=X11
OPTIONS_UNSET+=HAL
OPTIONS_UNSET+=ARTSWRAPPER
OPTIONS_UNSET+=CJK
OPTIONS_UNSET+=ESOUND
OPTIONS_UNSET+=GNOME
OPTIONS_UNSET+=ISPELL
OPTIONS_UNSET+=ASPELL
OPTIONS_UNSET+=NAS
OPTIONS_UNSET+=NLS
OPTIONS_UNSET+=PULSEAUDIO
OPTIONS_UNSET+=AIGLX
OPTIONS_UNSET+=CUPS
OPTIONS_UNSET+=GNOME
OPTIONS_UNSET+=GNOMEVFS
OPTIONS_UNSET+=GNOMEVFS2
OPTIONS_UNSET+=GVFS
OPTIONS_UNSET+=XXXXMLDOC
OPTIONS_UNSET+=DOCS
OPTIONS_UNSET+=DO
OPTIONS_UNSET+=EXAMPLES
OPTIONS_UNSET+=TEST
OPTIONS_UNSET+=TESTS
OPTIONS_UNSET+=DEBUG
OPTIONS_UNSET+=MANPAGES
OPTIONS_UNSET+=ASIO
OPTIONS_UNSET+=TZUPDATE
OPTIONS_UNSET+=AVAHI
OPTIONS_UNSET+=DBUS
OPTIONS_UNSET+=GNUTLS
OPTIONS_UNSET+=LIBPAPER
OPTIONS_UNSET+=HELP
OPTIONS_UNSET+=LIBSIGSEGV
OPTIONS_UNSET+=ICONV
OPTIONS_UNSET+=CHINESE
OPTIONS_UNSET+=KOREAN
OPTIONS_UNSET+=RUSSIAN
OPTIONS_UNSET+=LIBFFI
OPTIONS_UNSET+=IPPTOOL
OPTIONS_UNSET+=STATIC
OPTIONS_UNSET+=SYSLOG
OPTIONS_UNSET+=IMPORTFUNCTIONS

OPTIONS_SET+=PIE
OPTIONS_SET+=RELRO
OPTIONS_SET+=BIND_NOW
OPTIONS_SET+=MULTIPLICITY
OPTIONS_SET+=PERL_64BITINT
OPTIONS_SET+=PTHREAD
OPTIONS_SET+=COLONBREAKSWORDS
OPTIONS_SET+=IMPLICITCD
OPTIONS_SET+=SEM
OPTIONS_SET+=TERMCAP
OPTIONS_SET+=IPV6
OPTIONS_SET+=IDN
OPTIONS_SET+=HTTP2
OPTIONS_SET+=HPACK
OPTIONS_SET+=OPENSSL
OPTIONS_SET+=THREADS
OPTIONS_SET+=SCHEMA
OPTIONS_SET+=VALID
OPTIONS_SET+=RELEASE
OPTIONS_SET+=POLICY

src.conf

WITH_REPRODUCIBLE_BUILD=1
WITH_CLANG=1
WITH_CLANG_IS_CC=1
WITH_LLD=1
WITH_LLD_BOOTSTRAP=1
WITH_LLD_IS_LD=1
WITH_LLVM_LIBUNWIND=1

WITH_CDDL=1
WITH_CTF=1
WITH_PIE=1
WITH_SAFESTACK=1
WITH_SHLIBRANDOM=1
WITH_SSP=1
WITH_RELRO=1
WITH_BINDNOW=1

WITH_KVM_SUPPORT=1
WITH_NVME=1
WITH_OPENMP=1
WITH_EFI=1
WITH_LOADER_GELI=1

WITH_ZFS=1
WITH_PF=1
WITH_NTP=1
WITH_TFTP=1
WITH_BHYVE=1
WITH_ICONV=1
WITH_PMC=1
WITH_MAN=1
WITH_LOCALES=1
WITH_SYMVER=1
WITH_BSD_GREP=1
WITH_AUTHPF=1
WITH_SORT_THREADS=1
WITH_EE=1
WITH_USB=1
WITH_ZONEINFO=1
WITH_HYPERV=1
WITH_PKGBOOTSTRAP=1
WITH_UTMPX=1
WITH_HBSDCONTROL=1
WITH_PAM_SUPPORT=1

WITH_CRYPTO=1
WITH_OPENSSL=1
WITH_OPENSSH=1
WITH_LDNS=1

WITHOUT_CFI=1

WITHOUT_GNU=1
WITHOUT_GNU_SUPPORT=1
WITHOUT_GNUCXX=1
WITHOUT_LLDB=1

WITH_LLVM_TARGET_X86=1

WITHOUT_LLVM_TARGET_AARCH64=1
WITHOUT_LLVM_TARGET_ARM=1
WITHOUT_LLVM_TARGET_MIPS=1
WITHOUT_LLVM_TARGET_POWERPC=1
WITHOUT_LLVM_TARGET_SPARC=1

WITHOUT_CCACHE_BUILD=1
WITHOUT_SPECTREV1_FIX=1
WITHOUT_KERNEL_RETPOLINE=1
WITHOUT_LIBRESSL=1
WITHOUT_NAND=1
WITHOUT_BLACKLIST=1
WITHOUT_BLACKLIST_SUPPORT=1
WITHOUT_CXGBETOOL=1
WITHOUT_DOCCOMPRESS=1
WITHOUT_LINT=1
WITHOUT_TESTS_SUPPORT=1
WITHOUT_TESTS=1
WITHOUT_DTRACE_TESTS=1
WITHOUT_SYSCONS=1
WITHOUT_TEXTPROC=1
WITHOUT_GROFF=1
WITHOUT_UNBOUND=1
WITHOUT_SHAREDOCS=1
WITHOUT_NLS=1
WITHOUT_NLS_CATALOGS=1
WITHOUT_WARNS=1
WITHOUT_KERNEL_SYMBOLS=1
WITHOUT_GPL_DTC=1
WITHOUT_GNU_GREP_COMPAT=1
WITHOUT_LEGACY_CONSOLE=1
WITHOUT_HESIOD=1
WITHOUT_FONTCONFIG=1
WITHOUT_MANDOCDB=1
WITHOUT_MANCOMPRESS=1
WITHOUT_DEBUG_FILES=1
WITHOUT_LIB32=1
WITHOUT_FDT=1
WITHOUT_PDF=1
WITHOUT_BOOTPARAMD=1
WITHOUT_BOOTPD=1
WITHOUT_GCOV=1
WITHOUT_GPIB=1
WITHOUT_NETGRAPH=1
WITHOUT_NETGRAPH_SUPPORT=1
WITHOUT_NMTREE=1
WITHOUT_KERBEROS=1
WITHOUT_KERBEROS_SUPPORT=1
WITHOUT_GSSAPI=1
WITHOUT_PKGTOOLS=1
WITHOUT_GCC=1
WITHOUT_GDB=1
WITHOUT_PORTSNAP=1
WITHOUT_ASSERT_DEBUG=1
WITHOUT_EXAMPLES=1
WITHOUT_USB_GADGET_EXAMPLES=1
WITHOUT_FLOPPY=1
WITHOUT_FREEBSD_UPDATE=1
WITHOUT_GAMES=1
WITHOUT_HAST=1
WITHOUT_HTML=1
WITHOUT_INFO=1
WITHOUT_IPX=1
WITHOUT_IPX_SUPPORT=1
WITHOUT_IPFW=1
WITHOUT_IPFILTER=1
WITHOUT_KERBEROS=1
WITHOUT_LOCATE=1
WITHOUT_MAIL=1
WITHOUT_MAILWRAPPER=1
WITHOUT_DMAGENT=1
WITHOUT_SENDMAIL=1
WITHOUT_PPP=1
WITHOUT_PROFILE=1
WITHOUT_QUOTAS=1
WITHOUT_RESCUE=1
WITHOUT_SVN=1
WITHOUT_SVNLITE=1
WITHOUT_SYSINSTALL=1
WITHOUT_BSDINSTALL=1
WITHOUT_TALK=1
WITHOUT_TCP_WRAPPERS=1
WITHOUT_TCSH=1
WITHOUT_BLUETOOTH=1
WITHOUT_FINGER=1
WITHOUT_RADIUS_SUPPORT=1
WITHOUT_RBOOTD=1
WITHOUT_RCS=1
WITHOUT_RCMDS=1
WITHOUT_TELNET=1
WITHOUT_TIMED=1
WITHOUT_WIRELESS=1
WITHOUT_WIRELESS_SUPPORT=1
WITHOUT_WPA_SUPPLICANT_EAPOL=1
WITHOUT_PC_SYSINSTALL=1
WITHOUT_NDIS=1
WITHOUT_CTM=1
WITHOUT_DICT=1
WITHOUT_BSNMP=1
WITHOUT_CALENDAR=1
WITHOUT_LPR=1
WITHOUT_NIS=1