Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Remove fallback to fork(2) if pdfork(2) is not available. If the parent
process dies, the process descriptor will be closed and pdfork(2)ed child
will be killed, which is not the case when regular fork(2) is used.

The PROCDESC option is now part of the GENERIC kernel configuration, so we
can start depending on it.

Add UPDATING entry to inform that this option is now required and log
detailed instruction to syslog if pdfork(2) is not available:

The pdfork(2) system call is not available; recompile the kernel with options PROCDESC

Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013

Change the cap_rights_t type from uint64_t to a structure that we can extend
in the future in a backward compatible (API and ABI) way.

The cap_rights_t represents capability rights. We used to use one bit to
represent one right, but we are running out of spare bits. Currently the new
structure provides place for 114 rights (so 50 more than the previous
cap_rights_t), but it is possible to grow the structure to hold at least 285
rights, although we can make it even larger if 285 rights won't be enough.

The structure definition looks like this:

struct cap_rights {
uint64_t cr_rights[CAP_RIGHTS_VERSION + 2];
};

The initial CAP_RIGHTS_VERSION is 0.

The top two bits in the first element of the cr_rights[] array contain total
number of elements in the array - 2. This means if those two bits are equal to
0, we have 2 array elements.

The top two bits in all remaining array elements should be 0.
The next five bits in all array elements contain array index. Only one bit is
used and bit position in this five-bits range defines array index. This means
there can be at most five array elements in the future.

To define new right the CAPRIGHT() macro must be used. The macro takes two
arguments - an array index and a bit to set, eg.

#define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL)

We still support aliases that combine few rights, but the rights have to belong
to the same array element, eg:

#define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL)
#define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL)

#define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP)

There is new API to manage the new cap_rights_t structure:

cap_rights_t *cap_rights_init(cap_rights_t *rights, ...);
void cap_rights_set(cap_rights_t *rights, ...);
void cap_rights_clear(cap_rights_t *rights, ...);
bool cap_rights_is_set(const cap_rights_t *rights, ...);

bool cap_rights_is_valid(const cap_rights_t *rights);
void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);

Capability rights to the cap_rights_init(), cap_rights_set(),
cap_rights_clear() and cap_rights_is_set() functions are provided by
separating them with commas, eg:

cap_rights_t rights;

cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);

There is no need to terminate the list of rights, as those functions are
actually macros that take care of the termination, eg:

#define cap_rights_set(rights, ...) \
__cap_rights_set((rights), __VA_ARGS__, 0ULL)
void __cap_rights_set(cap_rights_t *rights, ...);

Thanks to using one bit as an array index we can assert in those functions that
there are no two rights belonging to different array elements provided
together. For example this is illegal and will be detected, because CAP_LOOKUP
belongs to element 0 and CAP_PDKILL to element 1:

cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);

Providing several rights that belongs to the same array's element this way is
correct, but is not advised. It should only be used for aliases definition.

This commit also breaks compatibility with some existing Capsicum system calls,
but I see no other way to do that. This should be fine as Capsicum is still
experimental and this change is not going to 9.x.

Sponsored by: The FreeBSD Foundation

Cast argument of is*() ctype functions to unsigned char.

Without the cast there is ambiguity between 0xFF and -1 (EOF).

Suggested by: jilles
Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013

Unbreak rwhod(8):

- It did not work with GENERIC kernel after r250603 because
options PROCDESC was required for pdfork(2). It now just uses fork(2)
instead when this syscall is not available.

- Fix verify(). This function was broken in r250602 because the outermost
"()" was removed from the condition !(isalnum() || ispunct()).
It prevented hostnames including "-", for example.

Sandbox rwhod(8) receiver process using capability mode and Capsicum
capabilities.

rwhod(8) receiver can now only receive packages, write to /var/rwho/ directory
and log to syslog.

Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013
Reviewed by: pjd
MFC after: 1 month

The whole sending functionality was implemented within signal handler,
which is very bad idea. Split sending and receiving in two processes,
which fixes this problem and will help to sandbox rwhod.

Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013
Reviewed by: pjd
MFC after: 1 month

Style cleanups.

Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013
Reviewed by: pjd
MFC after: 1 month

Bump date missed in r202756

PR: docs/171624
Submitted by: bdrewery
Approved by: gabor
MFC after: 3 days

Replace index() and rindex() calls with strchr() and strrchr().

The index() and rindex() functions were marked LEGACY in the 2001
revision of POSIX and were subsequently removed from the 2008 revision.
The strchr() and strrchr() functions are part of the C standard.

This makes the source code a lot more consistent, as most of these C
files also call into other str*() routines. In fact, about a dozen
already perform strchr() calls.

Check return code of setuid(), setgid(), and setgroups() in rwhod.

While they will not fail in normal circumstances, better safe than
sorry.

MFC after: 1 week

Remove stale references to utmp(5) and its corresponding filenames.

I removed utmp and its manpage, but not other manpages referring to it.

Port all applications in usr.sbin/ from libulog to utmpx.

The last big commit: let usr.sbin/ use WARNS=6 by default.

Let rwhod use libulog.

I am not planning on providing a mechanism tot stat() the database files
directly. The disadvantage of this, is that rwhod will now be a little
bit more heavy than it used to be. It normally used to fstat() the file
descriptor to see whether the file had changed, but this is now
impossible to implement, meaning we have to parse the entire utmp file
each 180 seconds.

This is probably not an issue on modern 16-way servers, but if it turns
out to be a problem, we'll think of something.

- Avoid a memory leak if realloc(3) fails by using reallocf(3)

Submitted by: Liam J. Foy <liamfoy@dragonflybsd.org>
Approved by: mdodd (in-lieu of mentor who is away)
MFC after: 1 week

Fix most cases where the address of an int is passed to a function expecting a
socklen_t * argument.

Expand *n't contractions.

Sort sections.

Per letter dated July 22, 1999 remove 3rd clause of Berkeley derived software
(with permission of addtional copyright holders where appropriate)

Mechanically kill hard sentence breaks.

Replace ROUNDUP/ADVANCE with SA_SIZE

use a list to enumerate options

de-__P
use port/proto to represent services (not proto/port).
add FBSDID

style.Makefile(5)

Comment out WARNS?=4 to unbreak the Alpha build.

The .Nm utility

WARNS=4, de-__P()

Replace /kernel with /boot/kernel/kernel.

PR: docs/37757
Submitted by: Hiten Pandya <hiten@uk.FreeBSD.org>

I've been meaning to do this for a while. Add an underscore to the
time_to_xxx() and xxx_to_time() functions. e.g. _time_to_xxx()
instead of time_to_xxx(), to make it more obvious that these are
stopgap functions & placemarkers and not meant to create a defacto
standard. They will eventually be replaced when a real standard
comes out of committee.

Convert time_t to/from 32 bit representations for transmission over
a network and storage.

Remove whitespace at EOL.

mdoc(7) police: removed HISTORY info from the .Os call.

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for usr.sbin/ to 8.

Ensure that received packets are at least as long as the rwho packet
header before trying to process them. Without this sanity check,
rwhod can attempt to byte-swap all of memory when a short packet
is received, and so dies with a SIGBUS.

While I'm here, change two other syslog messages to be more
informative: use dotted quad rather than hex notation for IP
addresses, and include the source IP in the 'bad from port' message.

PR: bin/14844
Reviewed by: dwmalone

mdoc(7) police: use the new features of the Nm macro.

Don't call syslog() without a format string.

Grammar fix: ``Different than'' should really be ``different from''.

Name of program and trailing \n will be added by syslog(3)

$Id$ -> $FreeBSD$

Add $Id$, to make it simpler for members of the translation teams to
track.

The Id line is normally at the bottom of the main comment block in the
man page, separated from the rest of the manpage by an empty comment,
like so;

.\" $Id$
.\"

If the immediately preceding comment is a @(#) format ID marker than the
the $Id$ will line up underneath it with no intervening blank lines.
Otherwise, an additional blank line is inserted.

Approved by: bde

Correct usage message

Add the -p switch - tells rwhod to ignore POINTOPOINT interfaces.

Mostly submitted by: Stefan Zehl <sec@42.org>
PR: 12216

Implement the -l commandline option which turns off broadcast of
information, but still allows you to monitor other machines.

PR: 9301
Submitted by: Matthew Fuller <fullermd@futuresouth.com>

Add an option for insecure mode, in which rwhod does not discard packets
from incorrect source ports.

There is no "rwho" service, it's "who"
PR: bin/6396
Submitted by: Ruslan Ermilov <ru@ucb.crimea.ua>

Use err(3). Add usage.
Use syslog instead of fprintf when being a daemon.
Change sprintf to snprintf obtained from OpenBSD.
Obtained from: OpenBSD

Sort cross references.

Fix minor buffer problems:
Off by one in verify allowed one to march one byte off the end of
wd.wd_hostname if wd.wd_hostname had no NUL characters in it.

strncpy of myname into mywd used the source buffer's length, rather
than the dest.

When looking for "group daemon" (since that's what's in mtree), make sure
we actually look for the *group* and not the user's gid. user daemon
has traditionally been group 31 (guest).

Also clear out the groups vector so that it doesn't inherit the groups
of the invoking user (ever run rwhod by hand before?) Unfortunately, we
can't empty the supplemental groups list because the !&@^#! egid is stored
in there! :-(

Run as daemon.daemon, not nobody.daemon

Fix buffer overrun, and run as nobody

Correct some man page cross references and file location references.

Here are patches to add full multicast support to rwhod, and an updated man
page. I tried all three modes (rwhod, rwhod -m, rwhod -m 32) on a machine
with 2 ethernet interfaces and they all worked.
Submitted by: Bill Fenner <fenner@parc.xerox.com>

Get rid of update. Make man page installation work with our scheme
(and rename a few in the process).

Converted 'vmunix' to 'kernel'.

This commit was generated by cvs2svn to compensate for changes in r1553,
which included commits to RCS files with non-trunk default branches.