- Copy stable/10@296371 to releng/10.3 in preparation for 10.3-RC1
builds.
- Update newvers.sh to reflect RC1.
- Update __FreeBSD_version to reflect 10.3.
- Update default pkg(8) configuration to use the quarterly branch.

Approved by: re (implicit)

MFC: r285260
Since the case where secflavor < 0 indicates the security flavor is
to be negotiated, it could be a Kerberized mount. As such, filling
in the "principal" argument using the canonized host name makes sense.
If it is negotiated as AUTH_SYS, the "principal" argument is meaningless
but harmless.

MFC r273896:

Build mount_nfs(8) with WARNS=6.

Sponsored by: The FreeBSD Foundation

MFC r273848:

Get rid of obsolete code in mount_nfs(8).

MFC r273861:

Remove two functions unused after r273848. Would be nice if clang
or at least scan-build yelled about it.

Sponsored by: The FreeBSD Foundation

MFC r273849:

Add support for "timeo", "actimeo", "noac", and "proto" options
to mount_nfs(8). They are implemented on Linux, OS X, and Solaris,
and thus can be expected to appear in automounter maps.

Sponsored by: The FreeBSD Foundation

MFC r269583:

Provide -o vers= support for mount_nfs.

Our mount_nfs does use -o nfsv<2|3|4> or -2 or -3 to specify the version.
OSX (these days), Solaris, and Linux use -o vers=<2,3,4>.

With the upcoming autofs support we can make a lot of (entrerprisy) setups
getting mount options from LDAP just work by providing -o vers= compatibility.

Reviewed by: wblock, bjk (man page), rmacklem, emaste
Sponsored by: DARPA,AFRL
PR: 192379

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

GC unused variables. Prefer NULL over 0 for pointers.

Change checkpath() to not exit on error. This is a prerequisite for
fixing the mount(8) "failok" option.

PR: 163668
Reviewed by: Garrett Cooper, delphij (previous version)

Spelling fixes for sbin/

Finish making 'wcommitsize' an NFS client mount option.

Reviewed by: rmacklem
MFC after: 1 week

This patch changes head so that the default NFS client is now the new
NFS client (which I guess is no longer experimental). The fstype "newnfs"
is now "nfs" and the regular/old NFS client is now fstype "oldnfs".
Although mounts via fstype "nfs" will usually work without userland
changes, an updated mount_nfs(8) binary is needed for kernels built with
"options NFSCL" but not "options NFSCLIENT". Updated mount_nfs(8) and
mount(8) binaries are needed to do mounts for fstype "oldnfs".
The GENERIC kernel configs have been changed to use options
NFSCL and NFSD (the new client and server) instead of NFSCLIENT and NFSSERVER.
For kernels being used on diskless NFS root systems, "options NFSCL"
must be in the kernel config.
Discussed on freebsd-fs@.

Fix deprecated warning about -L which said -i was deprecated.

MFC after: 3 days

Correct a typo.

PR: 151321
Submitted by: Simon Walton
MFC after: 3 days

Shut the compiler up; initializes the sotype variable to zero in
nfs_tryproto().

Reviewed by: rmacklem

Introduce '[ipaddr]:path' notation.
Since the existing implementation searches ':' backward, a path which
includes ':' could not be mounted. You can now mount such path by
enclosing an IP address by '[]'.
Though we should change to search ':' forward, it will break
'ipv6addr:path' which is currently working. So, it still searches ':'
backward, at least for now.

MFC after: 2 weeks

static'ify function prototypes and convert K&R to ANSI.

MFC after: 1 month

Fix parsing of mount options specified with -o in case an option with
value is preceded by an option without value (for example -o
option1,option2=value). Options must be separated before searching for
'='. Also compare pnextopt explicitly against NULL.

PR: bin/134069
Approved by: trasz (mentor)

Change the default transport protocol for use by the Mount protocol
from UDP to TCP, so that it is consistent with TCP for NFS, which
became the default at r176198. Without this change, doing an NFS mount
against a server that only supports UDP would result in an unusable
mount point if a transport protocol option wasn't specified for the
mount.

Approved by: kib (mentor)
MFC after: 3 days

Don't use sys/nfs/rpcv2.h - it is part of the old kernel RPC implementation
and will be removed.

Code for parsing nmount options in kernel was merged
to stable/7 branch in r190315. So only resort to fallback_mount()
could which passes struct nfs_args to kernel in kernel versions
less than 702100.

Add support for the experimental nfs client to mount_nfs. The
experimental client is used when the fstype is "newnfs" or the "nfsv4"
option is specified. It includes the addition of the option:
gssname - to specify a client side initiator host based principal name
which is specific to NFSv4.
It also includes a change to mount.c, so that it knows about
mount_newnfs, but not mount_nfs4.

Reviewed by: dfr
Approved by: kib (mentor)

Remove the unmaintained University of Michigan NFSv4 client from 8.x
prior to 8.0-RELEASE. Rick Macklem's new and more feature-rich NFSv234
client and server are replacing it.

Discussed with: rmacklem

Set NFSMNT_ACDIRMAX flag in fallback_mount() function.

Set NFSMNT_ACREGMIN, NFSMNT_ACREGMAX, and NFSMNT_ACDIRMIN flags
in fallback_mount() function.
Add a comment to indicate that the fallback_mount() function
should eventually go away.

Submitted by: Jaakko Heinonen <jh saunalahti fi>

Fix parsing of acregmin, acregmax, acdirmin and acdirmax NFS mount options
when passed as strings via nmount().

Submitted by: Jaakko Heinonen <jh saunalahti fi>

Implement support for RPCSEC_GSS authentication to both the NFS client
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager. I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by: Isilon Systems
MFC after: 1 month

Use the version of the kernel returned by getosreldate()
to determine whether to call the fallback_mount() backwards
compatibility function or not.

Reviewed by: dfr

Instead of building up a "struct nfs_args" to pass to the kernel
via nmount(), build up an iovec where each iovec member is an NFS mount
option, and pass the iovec down to the kernel via nmount(). These options
are then parsed in the kernel.
This should make it easier to add new NFS mount options in future.

Many, many thanks to Doug Rabson for taking my initial patches,
and cleaning them up. In addition, Doug added a fallback_mount()
function so that the newer mount_nfs program will work against older
kernels, to facilitate upgrading/downgrading scenarios.
Doug also re-wrote the mount_nfs.8 man page.

Reviewed by: dfr

Fix -o mntudp after the conversion to default TCP mounts

Submitted by: danfe
MFC after: 1 week

Undo the damage I did in sys/kern/vfs_mount.c #1.274 and
sbin/mount_nfs/mount_nfs.c #1.76. Let the dragons sleep.

Requested by: rodrigc, des
PR: kern/120319 (welcome the bug back)

Add a work-around to make it possible again to remount
NFS root r/w.

The real solution would be to bring the whole nmount(2)
framework, including FS drivers and userland tools, into
a consistent state at last; but things should work in the
meantime, too.

Reported by: kris

Back out rev. 1.74 because the kernel isn't ready yet
to see NFS specific string options.

Don't forget to prepare string options for nmount(2).
Otherwise things won't work as intended, e.g., it'll
be impossible to upgrade NFS root mount to read-write.

Reported by: kris

Switch the default NFS mount mode from UDP to TCP. UDP mounts are a
historical relic, and are no longer appropriate for either LAN or WAN
mounting. At modern (gigabit and 10 gigabit) LAN speeds packet loss
from socket buffer fill events is common, and sequence numbers wrap
quickly enough that data corruption is possible. TCP solves both of
these problems without imposing significant overhead.

MFC after: 1 month

Add "fg" option as antonym to "bg"; add "hard" option as antonym to "soft".
This is for better compatibility with other environments (Linux, Solaris,
HP-UX, AIX and Tru64 support these options).

PR: bin/109924
MFC after: 1 week

Merge mount_nfs4.c and mount_nfs.c into one program.
If argv[0] == "mount_nfs4", then default to mounting NFSv4,
otherwise if argv[0] == "mount_nfs", default to the old mount_nfs behavior.

- Add a -4 option.
- Add the University of Michigan copyright from mount_nfs4.c, for the
code merged from mount_nfs4.c.

Reviewed by: rees

Pass a string buffer named "errmsg" to nmount().
This will allow the NFS mount code to return a string error message
in addition to returning an error integer value.

Reviewed by: mohans
MFC after: 1 month

Deduce the "fstype" parameter to pass to nmount() by looking at
the "_nfs" part of argv[0]. This should facilitate unifying mount_nfs
and mount_nfs4 into one binary.

MFC after: 1 month
Reviewed by: mohans

Fix last element of nc_protos[] array to appease GCC.

Convert mount_nfs from old mount(2) API to new nmount(2) API.

Reviewed by: mohans

Minor style(9) and KNF elimination as I prepare to fix a bug.

Use MOPT_END in favor of MOPT_NULL, which better describes the purporse
of the macro.

Add a handy macro to represent null mount option, MOPT_NULL, and make
use of the macro in sbin/mount*'s, by replacing:

mopts[] = {
MOPT_STDOPTS,
{ NULL }
}

With:
mopts[] = {
MOPT_STDOPTS,
MOPT_NULL
}

This change will help to reduce the situation that we don't explicitly
initialize "struct mntopt"'s. It should not contribute to any
functional/logical changes as far as I can tell.

Sync program's usage() with manpage's SYNOPSIS.

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp

Remove -p from getopt args.

PR: 37221
Submitted by: Joshua Goodall <joshua@roughtrade.net>
Reviewed by: rwatson
Approved by: re (jhb)

Use __FBSDID() to quiet GCC 3.3 warnings.

Add mount options 'noinet4' and 'noinet6' which prevent using those
address families.

This is useful for preventing NFS mounts from using IPv6 on hosts
that have both A and AAAA records for the same name.

- Silence warnings (casting, implicit decl., unused var.).
- WARNS=2

Removed a debugging printf() left here in peter's
last commit.

Spotted by: kris

Bandaid for mount_nfs segfaulting with the more obscure mount options
in /etc/fstab. This isn't a real fix though and I'm still not sure
why it started failing. mount(8) breaks up the nfs args into seperate
repeated '-o option=value' arguments. But, the altflags variable that
we use to track things is incrementally built up each time we see the
next option and shows us the cumulative set of flags, not just the
flag that we are currently looking at. As a result, the strstr hack
for looking up flags in a giant -o opt=val,opt=val, etc string was failing
and causing a segfault. I do not know what changed recently that caused
this to suddenly break, but the code has been rather bogus for some time.

Unbreak the -c option by not using connect(2) for mount_nfs's
communication with the remote NFS server if this flag is specified.

PR: bin/42003
Submitted by: Jean-Luc Richier <Jean-Luc.Richier@imag.fr>

s/filesystem/file system/g as discussed on -developers

Fix -o ac(reg|dir)(min|max) options. The appropriate flags weren't
translated from ALTF_* to NFSMNT_* thus these options weren't accepted
by kernel.

PR: bin/30334
MFC after: 1 week

Now that the kernel is able to load modules itself,
remove all the code which was trying to do so.
This code was nasty in several ways, it was hiding
the kernel bug where the kernel was unable to properly
load a module, and it was quitting if it wasn't able
to load the module. The consequence is that an ABI
breakage of the vfsconf API would have broken *every*
mount utility.

Convert old style (type foo *)0 casts to NULLs

PR: kern/40360
Requested by: Hiten PAndya via direct email

o __P removed
o main prototype removed

Remove 'register' keyword.
It does not help modern compilers, and some may take some hit from it.
(I also found several functions that listed *every* of its 10 local vars with
"register" -- just how many free registers do people think machines have?)

Allow users to use the 'nolockd' or -L options with mount_nfs in order
to avoid the need for rpc.lockd to perform client locks. Using
this option a user can revert back to using local locks for NFS mounts
like we did before we had rpc.lockd.

Userland part of nfs client/server split and cleanup.

Change the foreground mount behaviour so that we keep retrying
forever by default. This matches what mount_nfs did before revision
1.40, and it is the generally expected behaviour for NFS mounts.

Document the current defaults near the start of the man page and
mention the options that can be used to change them.

Discussed on: -hackers

Since revision 1.40/1.41, the default behaviour for mount_nfs is
to give up after one attempt unless a background mount is requested.
Background mounts would retry 10000 times (at least 7 days) before
giving up.

For some situations such as diskless terminals, an NFS filesystem
may be critical to the boot process, so neither the "try once" nor
background mounts are appropiate. To cater for this situation,
unbreak the -R (retry count) parameter so that it also works in
the non-background case. Interpret a zero retry count as "retry
forever".

The defaults are now "try once" for non-background mounts and "retry
forever" for background mounts; both can be overridden via -R.
Add a description of this behaviour to the manpage.

Use the new CLSET_CONNECT clnt_control() request on UDP clients to
ensure that we never proceed with the mount() syscall if the server
is replying from the wrong source address. Previously the userland
RPC call to the remote nfsd would succeed, but the kernel uses
connect() so it would not see the replies, resulting in a hung
mount.

- Split out the {family,socktype}->netid conversion into a separate
function; we now handle unknown protocols more gracefully.

- Cache the return from getnetconfigent() so that we don't have to
remember to call freenetconfigent() each time. This fixes a memory
leak that would cause retrying background mount_nfs processes to
slowly increase their memory usage.

Fix a typo relating to the "-U" (force UDP for mount protocol)
option. When specified, make sure to use the correct netid for the
getnetconfigent() call, and also in error messages.

Split out all the RPC code into a separate function and address a
number of issues:

- Fix background mounts; these were broken in revision 1.40.
- Don't give up before trying all addresses returned by getaddrinfo().
- Use protocol-independent routines where possible.
- Improve error reporting for RPC errors.
- In non-background mode, give up after trying all protocols once.
- Use daemon(3) instead of rolling our own version.
- Never go ahead with the mount() syscall until we have received
a reply from the remote nfsd; this is especially important with
non-interruptible mounts, as otherwise a mistyped command might
require a reboot to correct.

Reviewed by: alfred, Martin Blapp <mb@imp.ch>

- Back out the last (wrong) commit, and readd a modified version
of pingnfsserver(). The pingnfsport() function is now called everytime.
If we don't get RPC_SUCCESS or RPC_PROGVERSMISMATCH back, there's
something wrong with the NFS server and we just exit.

- Fix cfs mount on IPv4-only machines

- Fixed the looping when we did not run background mode.

- Fixed a getnameinfo() call with uninitialized adress.
This is a NetBSD bug I didn't notified :-( Thanks Ian !

- Added some #ifdef NFSKERB

- Removed some unused variables.

- Fixed idention

- Remove unnecessary ":" in openlog ident

Submitted by: Martin Blapp <mb@imp.ch>
Reviewed by: Ian Dowse <iedowse@maths.tcd.ie>

fix -o port=xxx

Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and
associated changes that had to happen to make this possible as well as
bugs fixed along the way.

Bring in required TLI library routines to support this.

Since we don't support TLI we've essentially copied what NetBSD
has done, adding a thin layer to emulate direct the TLI calls
into BSD socket calls.

This is mostly from Sun's tirpc release that was made in 1994,
however some fixes were backported from the 1999 release (supposedly
only made available after this porting effort was underway).

The submitter has agreed to continue on and bring us up to the
1999 release.

Several key features are introduced with this update:
Client calls are thread safe. (1999 code has server side thread
safe)
Updated, a more modern interface.

Many userland updates were done to bring the code up to par with
the recent RPC API.

There is an update to the pthreads library, a function
pthread_main_np() was added to emulate a function of Sun's threads
library.

While we're at it, bring in NetBSD's lockd, it's been far too
long of a wait.

New rpcbind(8) replaces portmap(8) (supporting communication over
an authenticated Unix-domain socket, and by default only allowing
set and unset requests over that channel). It's much more secure
than the old portmapper.

Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded
to support TI-RPC and to support IPV6.

Umount(8) is also fixed to unmount pathnames longer than 80 chars,
which are currently truncated by the Kernel statfs structure.

Submitted by: Martin Blapp <mb@imp.ch>
Manpage review: ru
Secure RPC implemented by: wpaul

Fix memory leak in mount_nfs's background (-b) mode which occurs when
the mount is not available.

Submitted-by: Jonathan Hanna <pangolin@home.com>

Changed setflags() to set_flags(). This fixes part of the world breakage
due to recently incremented namespace pollution in <unistd.h>.

Finish up umntall support. init now passed an argument to the
rundown script 'reboot' or 'single'. ISO support (which never
worked) has been removed from mount_nfs. mount_nfs and umount
now use mounttab, which allows umntall to work properly. The
rc scripts now call umntall as appropriate.

Submitted by: Martin Blapp <mb@imp.ch>

Fix an overflow or two and replace a while with a for.

Submitted by: Martin Blapp <mbr@imp.ch>

mount* fixes from Martin Blapp <mb@imp.ch>:

Made mount more userfriendly (bad slashes are now filtered out)
and we remove in mount_nfs trailing slashes if there are any.

Fixed mount_xxx binarys to resolve with realpath(3)
the mountpoint.

Translate the deprecated nfs-syntax with '@' to ':' .
The ':' syntax has now precedence, but '@' still works.
Notify the user that the '@' syntax should not be used.

PR: 7846
PR: 13692
Submitted by: Martin Blapp <mb@imp.ch>
Reviewed by: phk

Fix -Wall warnings

Submitted-By: Martin Blapp <mblapp@kassiopeja.lan.attic.ch>

Print a warning that includes the mount source when the foreground
mount fails prior to going into the background when a background NFS
mount is requested.

PR: misc/12376

$Id$ -> $FreeBSD$

Sync usage string and man page. Correct use of .Nm. Spelling. Remove
unused #includes.

Support changing the attribute cache limits per-mount. We don't have
many option letters left, I used long names only (like the previous
port= option)

Don't define KERNEL before including <nfs/nfs.h>. It is no longer
necessary. This fixes warnings about missing forward declarations
for structs in kernel-only prototypes.

style(9) corrections
Submitted by: bde

Be extra paranoid about trusting the length returned by gethostbyaddr.
Submitted by: Julian Assange

Introduce a -N option that disables the use of reserved ports, now
that -P is on by default. Remove do-nothing code in the -P case (but
leave the option itself for backward compatibility).

PR: bin/4500

Allow the 'async' mount flag.

Test both the NFS and MOUNT protocols for v3 support before allowing a v3
mount. It is possible to have v3 MOUNT but only v2 NFS, for instance for
a custom user-mode server like CFS.

Reviewed by: "Louis A. Mamakos" <louie@TransSys.COM>

Use v3 protocol by default if it is supported by the server. Allow the
user to force v2 protocol even if the server supports v3.

Obtained from: NetBSD but with a slightly different implementation

Make "-o noxxx" work properly, allowing the user to clean e.g. the resvport
flag (which is now set by default).

Make mount_nfs use reserved ports by default.. Mounts already use
a reserved port, so why not the nfs rpc's themselves?
With user allowed mounts, this perhaps needs a closer look, but
on the other hand, a user could already specify the flag.
If normal users should not be able to use resserved ports, the kernel
should check for the flag at mount time.

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Merge from Lite2 (use new getvfsbyname() and mount(2) interface)

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Don't use __dead or __pure in user code. They were obfuscations
for gcc >= 2.5 and no-ops for gcc >= 2.6. Converted to use __dead2
or __pure2 where it wasn't already done, except in math.h where use
of __pure was mostly wrong.

Get rid of the last vestiges of the old MOUNT_* constants in the
mount_* programs. While we're at it, collapse the four now-identical
mount programs for devfs, fdesc, kernfs, and procfs into links to
a new mount_std(8) which can mount any really generic filesystem
such as these when called with the appropriate argv[0].

Also, convert the mount programs to use sysexits.h.

#include <kerberosIV/des.h> -> #include <des.h>

Changes to support version 3 of the NFS protocol.
The version 2 support has been tested (client+server) against FreeBSD-2.0,
IRIX 5.3 and FreeBSD-current (using a loopback mount). The version 2 support
is stable AFAIK.
The version 3 support has been tested with a loopback mount and minimally
against an IRIX 5.3 server. It needs more testing and may have problems.
I have patched amd to support the new variable length filehandles although
it will still only use version 2 of the protocol.

Before booting a kernel with these changes, nfs clients will need to at least
build and install /usr/sbin/mount_nfs. Servers will need to build and
install /usr/sbin/mountd.

NFS diskless support is untested.

Obtained from: Rick Macklem <rick@snowhite.cis.uoguelph.ca>

Added -o port option. Use specified port number for NFS requests. The default
is to query the portmapper for the NFS port. This is useful for CFS users.

Fixed bug where UDP was required to mount a TCP NFS filesystem.

Submitted by: Ken Hornstein, Sept.'94

Add support for kerberised NQNFS.
Reviewed by:
Submitted by:
Obtained from:

Kill used "error" variable.

Fixed bogus error reporting when the failure is RPC related ("Address
already in use", instead of "Permission denied").

Correct a litle typo in an error message: PRC -> RPC.

Add support for filesystem-specific `-o' options, and re-implement the
most common cd9660 and nfs options like God intended them. (It is now
possible to say

mount -o ro,soft,bg,intr there:/foo/bar /foo/bar

again.) This whole getmntopt() business is an incredible botch;
it never should have been anything more than a wrapper around
getsubopt(3). Because if the way the current hackaround is implemented,
options which take arguments (like the old `rsize' and `wsize') are still
unavailable, and must be accessed the new, broken way.

(It's unimaginable how Berkeley managed to screw up one of the few things
about NFS that Sun actually got right to begin with!)

Automatically load NFS and a bevy of other filesystems.

Fixed a bug where mount_nfs would core-dump if used with IP# directly.
Also moved some KERBEROS related stuff inside the #ifdef.

Should we always try to do a reverse lookup (IP#->name) ?
It has som merit, but is probably against the tradition or huh ?

This commit was generated by cvs2svn to compensate for changes in r1558,
which included commits to RCS files with non-trunk default branches.

BSD 4.4 Lite sbin Sources

Note: XNSrouted and routed NOT imported here, they shall be imported with
usr.sbin.