Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Check the return error of set[ug]id. While this can never fail in the
current version of FreeBSD, this isn't guarenteed by the API. Custom
security modules, or future implementations of the setuid and setgid
may fail.

PR: bin/172289
PR: bin/172290
PR: bin/172291
Submittud by: Erik Cederstrand <erik@cederstrand.dk>
Discussed by: freebsd-security
Approved by: cperciva
MFC after: 1 week

Fix usr.bin/ and usr.sbin/ build with a 64-bit ino_t.

Original code by: Gleb Kurtsou

Relax security permissions on '.seq' file creation - the strict,
but odd permissions resulted in a security alert from 110.neggrpperm

PR: kern/165533
Submitted by: Anton Shterenlikht <mexas@bristol.ac.uk>
Submitted by: J B <jb.1234abcd@gmail.com>
Approved by: cperciva
MFC after: 1 week

Fix printing of files located on ZFS filesystem with an st_dev or
st_ino larger than 2**31.

From the PR:

Printing from a ZFS filesystem using 'lp' fails and returns an
email reporting "Your printer job was not printed because it was
not linked to the original file".

In order to protect against files being switched when files
are printed using 'lp' or 'lpr -s', the st_dev and st_ino
values for the original file are saved by lpr and verified
by lpd before the file is printed. Unfortunately, lpr prints
both values using '%d' (although both fields are unsigned)
and lpd(8) assumes a string of decimal digits.

ZFS (at least) generates st_dev values greater than 2^31-1,
resulting in negative values being printed - which lpd cannot
parse, leading it to report that the file has been switched.

A similar problem would occur with large inode numbers.

How-To-Repeat:

Find a file with either st_dev or st_ino greater than 2^31-1
(stat(1) will report both numbers) and print it with 'lpq -s'.
This should generate an email reporting that the file could
not be printed because it was not linked to the original file

PR: bin/151567
Submitted by: Peter Jeremy <Peter.Jeremy@alcatel-lucent.com>
MFC after: 1 week

More changes to use __FBSDID() for setting rcsids, and fix the
format of 'sccsid' lines so they consistently match style(9)
Also the 'sccsid' line is formatted to match style(9), and
a 'From:' is removed so the sccsid returns to what it was back
in the days of '-r CSRG' (1996).

Reviewed by: discussed with bde and obrien
MFC after: 15 days

Include <netinet/in.h> to squash one more compile-time warning.

MFC after: 3 days

Fix one more compile-time warning by renaming a local variable.

MFC after: 4 days

Fix a compile-time warning by declaring 'len' as size_t instead of int.

MFC after: 4 days

Rename the local variable 'person' to 'lpr_username', to avoid compile-time
warnings about conflict with a global variable used by 'lprm'.

MFC after: 4 days

Replace a call to 'alloca', thus avoiding an error when compiling on
freebsd/alpha with -ansi (and on some non-fbsd platforms). This change
can only affect the access checking of 'lpr -r'.

MFC after: 1 week

Rename a few global variables which hold hostname-related values to be
more sensible/understandable. 'from'->'from_host' 'host'->'local_host'
'fromb'->'frombuf' 'fromhost'->'origin_host' and a local-variable
named 'host'->'hostbuf'. This fixes some compile-time warnings about
local variables shadowing global variables.

Other than renaming variables, the only actual code changes are to call
strlcpy() instead of strncpy() when setting those (renamed) variables,
and that 'from_ip' is now a strdup()-created buffer instead of being a
static buffer compiled in as 1025 bytes.

Reviewed by: freebsd-print@bostonradio.org (an earlier version)
MFC after: 1 week

Rename global variable 'name' to 'progname', thus fixing a number of
warnings which come up for various routines that have a parameter which
is also called 'name'.

Reviewed by: freebsd-print@bostonradio.org
MFC after: 1 week

Fix about 90-100 warnings one gets when trying to compile lpr&friends
with BDECFLAGS on, mainly by adding 'const' to parameters in a number
of routine declarations. While I'm at it, ANSI-fy all of the routine
declarations. The resulting object code is exactly the same after
this update as before it, with the exception of one unavoidable
change to lpd.o on freebsd/alpha.

Also added $FreeBSD$ line to lpc/extern.h lpc/lpc.h lptest/lptest.c

Reviewed by: /sbin/md5, and no feedback from freebsd-audit

This update gets it so 'lpr -r' ("remove the file after printing") will
try to move the file from the source to the destination (spool) directory.
If that succeeds, much time and disk-space will be saved by doing that
instead of copying the entire file only to remove the original. This
could be a big win on machines doing samba-service or CAP-based printing.

Note that this is about the fourth or fifth iteration of the patch, after
trying to address all possible security implications of the change.

PR: 16124
Reviewed by: freebsd-current or freebsd-hackers (some time ago)

Change 'lpr' so -C (class) information is included in the control file
even for jobs or queues which will not print header (separator) pages.

Submitted by: "Steve O'Hara-Smith" <steveo@eircom.net>

Allow those of us who have to print through LPRng spoolers to send
spooler options using `Z' control-file lines and the `-Z' flag.

It's not been possible to configure a print server running lpd,
with remote hosts feeding it, so that some hosts have their header
pages supressed and some don't. This is because lpd doesn't know
how to rewrite a print job before forwarding it to a remote lpd.
In particular this causes problems with p rinters that contain
their own lpd, eg. HP jet direct cards, because they can't suppress
headers. It's not possible to have headers supressed by putting
'sh' in any printcap in the lpd chain, it is up to the originating
lpr to have a '-h' option specified at run time.

Lpr has been modified to allow _it_ to honour the 'sh' flag in the
local print cap. This allows the administrator to switch off
headers for a particular printer (on a particular host) irrespective
of whether that printer is local to the machine or remote.

This doesn't break anything, because in the case of a remote printer
the 'sh' flag would have had no meaning, in the case of the local
printer it would have been on anyway.

Submitted by: Scott James Remnant <scott@pavilion.net>

Add support for pr's locale

$Id$ -> $FreeBSD$

Sigh. Fix capitalization bogon. Who had the pointy hat?

Observe -U flag again, and use it in preference to getlogin(), if
the user is privileged.

I believe this should address both concerns in PR 9729, and may also
provide the desired behavior from PR 9485.

Change my mind on using base '0' for strtol for -i and -# operations
as this would change the meaning of -#050 in preexisting scripts.

Add sanity checking to argument for -# and -i. Require these
arguments to be numbers. Also use '0' base to allow hex, octal or
decimal numbers.

This was done by me based on ideas in pr 3556, submitted by Uwe
Laubenstein and commented upon by j@uriah.heep.sax.de (J Wunsch).

PR: 3556

Fix additional warnings. Remove -Werror, since some people have complained
about it.

PR: 7886
Submitted by: Stefan Eggers <seggers@semyam.dinoco.de> (partially)

Make ``-h'' follow the manpage, and suppress the burst page reguardless of
the number of ``-h'' given.

Fix incorrect format string in call to errx().

Mega lpd/lpd upgrade, part I:

- Get rid of a lot of the static variables which were shared by
many routines and programs in the suite.
- Create an abstract interface to the printcap database, so that
other retrieval and iteration mechanisms could be developed
(e.g., YP, Hesiod, or automatic retrieval from a trusted server).
- Give each capability a human-readable name in addition to the historic
two-character one.
- Otherwise generally clean up a lot of dark corners. Many still remain.
- When submitting jobs, use the official login name record (from getlogin())
if there is one, rather than reverse-mapping the uid.

More to come...

Use err(3). Add usage(). Various fixes in man pages.

Two minor, pedantic fixes from bde for my last pedantic fixes, plus
the following from recent OpenBSD changes. These changes (and all
I've made) should be merged back into 2.2 when they are vetted in
-current.

common.c:
OpenBSD 1.7: mickey: #if __STDC__ --> #ifdef __STDC__

displayq.c:
OpenBSD 1.8: deraadt: 1 byte oflows; millert

rmjob.c:
OpenBSD 1.8: deraadt: 1 byte oflows; millert

cmds.c:
OpenBSD 1.9: grr: restore traditional "all" keyword option - see lpc(8)
[[ This makes lpc status all work again -- imp ]]

printjob.c:
OpenBSD 1.17: deraadt: use sendmail -t
OpenBSD 1.16: mickey: #if __STDC__ --> #ifdef __STDC__
OpenBSD 1.15: deraadt: 1 byte oflow; Don.Lewis@tsc.tdk.com

recvjob.c:
OpenBSD 1.11: mickey: #if __STDC__ --> #ifdef __STDC__

lpr.c:
OpenBSD 1.19: mickey: #if __STDC__ --> #ifdef __STDC__

Obtained from: OpenBSD

Fix boatloads of buffer overflows from the OpenBSD tree.
Be pedantic about always using sizeof(blah) vs sizeof (blah) or sizeof blah.
Obtained from:OpenBSD

index -> strchr and rindex -> strrchr to reduce the number of gratuitous
diffes with NetBSD/OpenBSD. These changes seem to predate the NetBSD/OpenBSD
split, so it is hard to give proper credit for them.
Obtained from: OpenBSD.

Use setuid/seteuid around dangerous operations. Also a few buffer
overflow patches that were "near" to where these operations are taking
place. The buffer overflows are from OpenBSD. The setuid/seteuid patches
are from NetBSD by way of OpenBSD (they changed them a little), at least from
my read of the tree.

This is the first of a series of OpenBSD lpr/et al merges. It (and them)
should be merged back into 2.2 and/or 2.1 (if requested) branches when they
have been shaken out in -current.
Obtained from: OpenBSD

Fixed buffer overflow.

Reviewed by: Warner

Don't drop into the troff args after parsing -#.

Submitted by: Garance A Drosehn <gad@eclipse.its.rpi.edu>

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Fix an off by one error when determing the default job name for
the banner page.

Closes PR# 1986.

Submitted by: Mark Valentine <mark@linus.demon.co.uk>

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

lpc/cmds.c:
From NetBSD via OpenBSD to fix NetBSD PR #506
More descriptive message for printer status
(OpenBSD: 1.2)

Various warnings cleaned up (OpenBSD: 1.4)

lpc/lpc.c:
Various warnings cleaned up (OpenBSD: 1.3)

lpd/lpd.c:
Remove trailing blank lines (OpenBSD: 1.2)

Potential umask problem with creating /dev/printer
(OpenBSD: 1.4 and 1.5)

Ftp bounce attack (untested on FreeBSD)
(OpenBSD: 1.6, 1.8, 1.9)
Fencepost in strncpy
(OpenBSD: 1.6)

lpd/printjob.c:
Fix from freebsd for waiting for an exiting filter, that
appears not in the FreeBSD CVS tree.
(OpenBSD: 1.6)

lpd/recvjob.c:
Buffer overflow protection: use strncpy rather than strcpy.
(OpenBSD: 1.3)

lpr/lpr.c:
NetBSD change of return type for main()
(OpenBSD: 1.2)

Restrict time running as root
(OpenBSD: 1.7)

Use getcwd rather than getwd (from NetBSD)

Use snprintf rather than sprintf
(OpenBSD: 1.8)

Minor tweak to end of loop and buffer overflow sanity. card()
overflow already in FreeBSD
(OpenBSD: 1.9)

lptest/lptest.c:
void -> int return type of main, from NetBSD via OpenBSD
(OpenBSD: 1.2)

pac/pac.c:
void -> int return type of main, from NetBSD via OpenBSD
(OpenBSD: 1.3)

Obtained from: OpenBSD

Fix transcription error I introduced in last patch. This created a
fencepost error that would run one off the end of the buffer.

Noticed by: Bruce Evans

Fix a problem where the command line could be used to overflow a stack
buffer which could be made to lead to a root shell. This patch is
OpenBSD's solution to the problem, and will silently truncate the
output rather than overflow the buffer.

Obtained from: OpenBSD

Convert the option parser to use getopt(3). This makes it more
orthogonal with the rest of the system (you can now use either -PPS or
-P PS), and makes the parser more intelligible. The only drawback is
that the old semantics for the -i flag in case a non-numeric argument
is following are no longer fully supported (only if -i is the very
last arg at all), since getopt(3) doesn't support the discticnction
between numeric and non-numeric arguments.

Make lpr also understand dashes as input pseudo filenames. This
finally makes lp(1) fully comply with Posix.2.

Cleanup.

The removed files are no longer needed, they are actually labelled as
``Use only if you are not 4.4BSD''. (Yeah, the ol' crufty printcap.c
is really gone!)

Properly declare all external objects in files ending in .h, as
opposed to embed them into files ending in .c.

Pull a bunch of fixes from the 4.4BSD-Lite2 branch. It's really
surprising how many trivial errors there have been... :-)

Some more cleanup is needed, but i'd like to separate the Lite2 changes
from other work, that's why this goes into a different commit.

People with serial printers should see whether i have broken the stty-
style printcap options (i hope not).

Inspired by: Sergey Shkonda <serg@bcs1.bcs.zaporizhzhe.ua>

Fix a longstanding bug in `lpr -r'. I used alloca() instead of
malloc(), but the change is fundamentally Chris's.
Submitted by: Chris Stenton <jacs@gnome.co.uk>

lpr uses access(2) to determine if the parent directory of the file
is writeable (by the real uid). if it is, lpr assumes that the file
can be unlinked. lpr does not check for directories with S_ISVTX set

Reviewed by: dima

Remove trailing whitespace.

This commit was generated by cvs2svn to compensate for changes in r1553,
which included commits to RCS files with non-trunk default branches.

BSD 4.4 Lite usr.sbin Sources