remove support for syscall(2) -- the "indirection system call" because
it is a dangerous alternative entry point for all system calls, and thus
incompatible with the precision system call entry point scheme we are
heading towards. This has been a 3-year mission:
First perl needed a code-generated wrapper to fake syscall(2) as a giant
switch table, then all the ports were cleaned with relatively minor fixes,
except for "go". "go" required two fixes -- 1) a framework issue with
old library versions, and 2) like perl, a fake syscall(2) wrapper to
handle ioctl(2) and sysctl(2) because "syscall(SYS_ioctl" occurs all over
the place in the "go" ecosystem because the "go developers" are plan9-loving
unix-hating folk who tried to build an ecosystem without allowing "ioctl".
ok kettenis, jsing, afresh1, sthen

Add {get,set}thrname(2) for putting thread names in the kernel and
exposed in a new field returned by sysctl(KERN_PROC). Update
pthread_{get,set}_name_np(3) to use the syscalls. Show them, when
set, in ps -H and top -H output.

libc and libpthread minor bumps

ok mpi@, mvs@, deraadt@

Unveiling unveil(2).
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start using, but this
now allows for others to do more tweaking and experimentation.

Still needs to send the unveil's across forks and execs before
fully enabling.

Many thanks to robert@ and deraadt@ for extensive testing.
ok deraadt@

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of killing the
program ("error" may not be handed to a setuid/setgid program, which
may be missing/ignoring syscall return values and would continue with
inconsistant state)
Discussion with many
florian has used this to improve the strictness of a daemon

As per style.9, prototypes should not have variable names associated
with the types.

OK jca@

Don't declare select() in <unistd.h>

ok deraadt@ millert@

Move the 10 (!) defintions of NULL to their own mini header file and
update the NULL definition for C++11. OK deraadt@ guenther@ kettenis@

Remove iruserok(_sa)? and __ivaliduser(sa)?

ok millert@ deraadt@

tame -> pledge.

Move to next tame() API. The flags are now passed as a very simple string,
which results in tame() code placements being much more recognizeable.
tame() can be moved to unistd.h and does not need cpp symbols to turn the
bits on and off. The resulting API is a bit unexpected, but simplifies the
mapping to enabling bits in the kernel substantially.
vague ok's from various including guenther doug semarie

Hide many (194!) symbols that nothing should be using.
Delete exect(2); it wasn't portable across archs and nothing used it.

ports test build by naddy@
ok deraadt@ kettenis@

claim posix 2008 compat. apparently people look at this and get scared
when it's really old. but no actual ports fallout in espie's build.
ok deraadt

update swab() to match the current posix definition. "rationale: none."
rewrite the function to be simpler as well. the compiler can unroll the
loop for us if necessary.
ok schwarze

header changes for recent libc changes:
add siphash
delete setkey, encrypt, cfree

change prototype for crypt_newhash. the login_cap_t is a holdover from its
pwd_gensalt origins, but a string argument works equally work and is more
friendly to consumers beyond local user accounts.
ok deraadt

Our setpgrp() is the BSD version with two args and not the XSI
version with zero args, so it should only be visible if __BSD_VISIBLE
(and not also for __XPG_VISIBLE). Contrawise, readlink() has been
part of base POSIX since 1995, so move to proper #if area for that.
Move crypt_checkpass() to the pure-BSD section of the file.

setpgrp() issue noted by Matti Karnaattu (mkarnaattu (at) gmail.com)
ok millert@

Sync readlink(2) with IEEE Std 1003.1-2008.

discussion, help and ok guenther@

Declare and document getthrid()

indirectly prodded by krw@

Add additional kernel interfaces for setting close-on-exec on fds
when creating them: pipe2(), dup3(), accept4(), MSG_CMSG_CLOEXEC,
SOCK_CLOEXEC. Includes SOCK_NONBLOCK support.

ok matthew@

update _POSIX2_FORT_RUN, so that sysconf(_SC_2_FORT_RUN) remains correct.
because you care. reminded by matthew.

Change return value of getentropy() to int 0 for success. Maximum
buffersize is enforced strictly, this supplies sufficient entropy
payload to act as seed material. Discourage general use of this
API, but lock down this function name as the go-to for userland
PRNG seeding. Improve documentation.
ok miod matthew

Add new getentropy() system call. Code and pressure from matthew.
I accepted that he's right (again) to seperate this out from heavy
sysctl API and this will simply a variety of things. Functionname
is not used by anyone in the ports tree, so we guess we can use it.
Shocking that no application has a function called this.
ok matthew & others who pushed him to start this early on

add prototypes for new crypt functions

Use internal '__' names for __attributes__ in public headers

Define intptr_t in <unistd.h> as specified by POSIX

ok millert

Annotate a few more bounded functions: realpath(3) needs a buffer
of size at least PATH_MAX. pread(2), pwrite(2) and readlinkat(2)
also take the buffer and the bound. OK theo.

express final disapproval of the interfaces in libcompat, such as
them ftime(), gtty(), stty(), re_comp(), cuserid() and others.
Discussion and ongoing work to fix the ports tree from many, especially
naddy.
ok naddy
[There is a bit more cleanup possible after that, but this is considered
the current safe step]

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be in
stdlib.h. The non-standard suboptarg extern remains in the BSD-only
section of stdlib.h. Neither getsubopt() nor suboptarg belong in
unistd.h or getopt.h. They were only there to allow us to protect
all the getopt() bits from being multiply defined. OK guenther@

Align suseconds_t with POSIX: it's the type of the tv_usec member of timeval.
Use useconds_t in the ualarm() declaration.
Bump libstdc++ major to be sure there isn't ABI issues.

ok deraadt@ jca@ jmc@ millert@
ports testing by landry@

Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,
including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and
{clock,pthread}_getcpuclockid() functions.

Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@
ok matthew@

Enable the _POSIX_SHARED_MEMORY_OBJECTS option group now that we have shm_open / shm_unlink.

ok guenther@

Implement fdatasync() as a wrapper around fsync()

ok guenther, deraadt, jmc

getpgid() and getsid() were rolled into POSIX in 2008

ok millert@

Adds the (somewhat silly) _CS_V[67]_ENV and _CS_POSIX_V[67]_* defines
to <unistd.h> and confstr(3) per POSIX 1003.1-2008

Change confstr(_CS_PATH) to operate directly instead of calling sysctl(3)

ports build tested by espie@

Remove excessive sys/cdefs.h inclusion
ok guenther millert kettenis

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Move the _SC_* and _CS_* configurable system variables and strings
from sys/unistd.h to unistd.h.

From Brad; ok millert and me

More sysconf(3)-y and pathconf(3)-y goodness from Brad.
ok guenther, millert (and me); bulk build test by naddy

remove rfork(); ok guenther miod

prototype getdtablecount()

Implement execvpe(3) and posix_spawn(3) and family. Based on
FreeBSD's implementation via Frank Denis, with various cleanups and
tweaks by me.

ok deraadt@, guenther@; discussions and tweaks from many others
jmc@ promises to help me further with the man pages in tree

Replace _SELECT_DECLARED with _SELECT_DEFINED_

Ok sthen@, millert@, dcoppa@

getcwd() buffer's length can be smaller than 1024. In that case it will
fail with errno set to ERANGE if not enough room is provided. Similar for
getlogin_r() so remove minbytes enforcement attribute.
ok kettenis@ guenther@ deraadt@ on getcwd, deraadt@ on getlogin_r.

Expose a bunch of new functionality from POSIX 2008: openat(2),
fchmodat(2), fstatat(2), mkdirat(2), mkfifoat(2), mknodat(2),
faccessat(2), fchownat(2), linkat(2), readlinkat(2), renameat(2),
symlinkat(2), unlinkat(2), utimensat(2), futimens(2), and
fdopendir(3).

"Minor" libc bump.

Tested in a bulk build by naddy@
Much help from guenther@, thib@, tedu@, oga@, and others.
ok deraadt@, naddy@

As pointed out by Richard Guenther our definition
of NULL was incorrect for c++ compilers that aren't
gcc (or pretend to be gcc like clang).

ok miod@

Define NULL as a void * instead of a long integer, as required by Single Unix.
Kernel and bootblocks still use the old 0L value until all the NULL abuses
in the code are fixed.

Move _POSIX_THREAD_SAFE_FUNCTIONS into unistd.h and set it to 200112
now that we support all the _r functions required by POSIX 1003.1-2001.
Also define _POSIX_REENTRANT_FUNCTIONS. OK kurt@ deraadt@

Remove duplicate psignal(3) and sys_siglist definitions. signal.h
is the correct place for them and nothing gets them from here in
base/xenocara/ports. no objection millert@ okay kettenis@

- correct brk(2) prototype and man page to match implementation and POSIX.
brk(2) returns an int value not a void *. brk(2) returns 0 upon success not
a pointer to the new end of memory. okay millert@, kettenis@, deraadt@

zap bogus sentinel, as noticed by dasn.
okay theo

zap argument name, okay millert@

First step in include files overhaul. Use __FOO_VISIBLE (as defined
in sys/cdefs.h) instead of _FOO_SOURCE. Also fix several namespace
pollution issues, including the byte order defines. OK deraadt@

undelete died a while back; millert ok

Move contents of sys/select.h to sys/selinfo.h in preparation for a
userland-visible sys/select.h. Consistent with what Net and Free do.
OK deraadt@, tested with full ports build by naddy@.

brk() and sbrk() should use void *, not char *. Note that sbrk()
should take intptr_t, not int, but we don't presently have intptr_t
available from unistd.h. OK marco@

mktemp(3) et al. go in stdlib.h, not unistd.h. While there be more
explicit about mktemp(3) in the man page.

Prototype closefrom(); tedu@ OK

des_cipher 3rd param is int32_t not long

add __bounded__ attributes for userland headers; enabled with -Wbounded
ok deraadt@

backout the __bounded__ attributes for a while; requested by deraadt@

Mark various standard library functions with the __bounded__ attribute.
You must have an up-to-date gcc for this!
deraadt@ ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Do not let userland access the swapon system call anymore (nothing uses it
anyway).
ok deraadt@ weingart@

GNU-like getopt_long() from NetBSD with changes by me to support
getopt_long_only(). At some point this should replace the BSD
getopt(3) but we are not there yet.

While I am here add protection from the multiple getopt() definitions
due to conflicting standards.

Add [gs]etres[ug]id(2) syscall to libc and use it in emulating some 4.3BSD
functions.

NULL is now 0L so it is the same size as a pointer.
OK mickey@ and discussed with deraadt@

uncommit, since it breaks macppc libc. millert and miod have now said they
did NOT approve those for commit. why did mickey feel he was ok to go
commiting a set of diffs which had not been passed around and tested by people?
we don't know. mickey, have you got something to say for yourself?

move __syscall prototype into unistd.h (like everybody else) and avoid private protos for it everywhere; millert@ ok

Put sentinel back in.

Backout previous change. Since it requires people to upgrade gcc, we want
to give them a larger timeslot to do that.
Requested by deraadt@ and various people on icb or vocally.

Use attribute((sentinel)) on functions where it makes sense.
(this will warn if they are used without a terminating NULL pointer.
Note *pointer*, very useful for arches where 0 != (void *)0, in size)

okay millert@

Manual cleanup of remaining userland __P use (excluding packages maintained outside the tree)

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

remove redundant __noreturn__ attributes now that __dead is sane for modern gcc

use __x__ formats for __attribute__ arguments; guenther@gac.edu

o add missing getsid() prototype
o fix typo in getsid() that broke getsid(pid) where pid != 0
o cause getsid() and getpgid() to return EPERM if requesting the
id of a session/process group not in the current session
o check for NULL session in getsid() for exiting processes

from freebsd:
strtofflags/fflagstostr to convert file flags
to/from binary from/into a string as used in chflags(1).

use u_int32_t instead of u_long (as freebsd does).
increase libc minor.
millert@ ok.

prototyping for p{read,write}{,v}

swapctl 2nd arg is const

add IPv6-ready rcmd() friends.
rcmd(): IPv4 only
rcmd_af(): af independent
ruserok(): af independent
iruserok(): IPv4 only
iruserok_sa(): af independent

rresvport_af() and bindresvport_af()

Be thorough about NULL as __null for C++.

Define NULL to be __null for C++: better quality of implementation.
__null is a magic constant of integral type that converts to a null pointer
as should be, but warns for ambiguity when used to resolved an overload
between an integral type and a pointer type.

Add swapctl(2) prototype.

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

add getpgid() proto; form

add mkstemp(char *template, int suffixlen) interface

change size parameter to size_t

readlink() 3rd param is size_t; XPG

be more careful for _XOPEN_SOURCE

more explicit protos

move proto to unistd.h

Make usleep prototype match manual page and implementation

add XPG4.2 lockf; kleink

move proto to sys/stat.h; XPG4.2

Add mkdtemp(3)

Add lchown() declaration.

fix comments regarding {*path,sys}conf()

add quotactl

proto getgrouplist()

+issetugid

Adds rcmdsh() prototype.

iruserok() can finally safely use a u_int32_t for the ip addr

initgroups(3) 2nd argument should be gid_t

sethostid() actually do return a value

proto rfork()

from netbsd; profil() fixed for 64 bit

branches: 1.1.1;
Initial revision

Add {get,set}thrname(2) for putting thread names in the kernel and
exposed in a new field returned by sysctl(KERN_PROC). Update
pthread_{get,set}_name_np(3) to use the syscalls. Show them, when
set, in ps -H and top -H output.

libc and libpthread minor bumps

ok mpi@, mvs@, deraadt@

Unveiling unveil(2).
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start using, but this
now allows for others to do more tweaking and experimentation.

Still needs to send the unveil's across forks and execs before
fully enabling.

Many thanks to robert@ and deraadt@ for extensive testing.
ok deraadt@

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of killing the
program ("error" may not be handed to a setuid/setgid program, which
may be missing/ignoring syscall return values and would continue with
inconsistant state)
Discussion with many
florian has used this to improve the strictness of a daemon

As per style.9, prototypes should not have variable names associated
with the types.

OK jca@

Don't declare select() in <unistd.h>

ok deraadt@ millert@

Move the 10 (!) defintions of NULL to their own mini header file and
update the NULL definition for C++11. OK deraadt@ guenther@ kettenis@

Remove iruserok(_sa)? and __ivaliduser(sa)?

ok millert@ deraadt@

tame -> pledge.

Move to next tame() API. The flags are now passed as a very simple string,
which results in tame() code placements being much more recognizeable.
tame() can be moved to unistd.h and does not need cpp symbols to turn the
bits on and off. The resulting API is a bit unexpected, but simplifies the
mapping to enabling bits in the kernel substantially.
vague ok's from various including guenther doug semarie

Hide many (194!) symbols that nothing should be using.
Delete exect(2); it wasn't portable across archs and nothing used it.

ports test build by naddy@
ok deraadt@ kettenis@

claim posix 2008 compat. apparently people look at this and get scared
when it's really old. but no actual ports fallout in espie's build.
ok deraadt

update swab() to match the current posix definition. "rationale: none."
rewrite the function to be simpler as well. the compiler can unroll the
loop for us if necessary.
ok schwarze

header changes for recent libc changes:
add siphash
delete setkey, encrypt, cfree

change prototype for crypt_newhash. the login_cap_t is a holdover from its
pwd_gensalt origins, but a string argument works equally work and is more
friendly to consumers beyond local user accounts.
ok deraadt

Our setpgrp() is the BSD version with two args and not the XSI
version with zero args, so it should only be visible if __BSD_VISIBLE
(and not also for __XPG_VISIBLE). Contrawise, readlink() has been
part of base POSIX since 1995, so move to proper #if area for that.
Move crypt_checkpass() to the pure-BSD section of the file.

setpgrp() issue noted by Matti Karnaattu (mkarnaattu (at) gmail.com)
ok millert@

Sync readlink(2) with IEEE Std 1003.1-2008.

discussion, help and ok guenther@

Declare and document getthrid()

indirectly prodded by krw@

Add additional kernel interfaces for setting close-on-exec on fds
when creating them: pipe2(), dup3(), accept4(), MSG_CMSG_CLOEXEC,
SOCK_CLOEXEC. Includes SOCK_NONBLOCK support.

ok matthew@

update _POSIX2_FORT_RUN, so that sysconf(_SC_2_FORT_RUN) remains correct.
because you care. reminded by matthew.

Change return value of getentropy() to int 0 for success. Maximum
buffersize is enforced strictly, this supplies sufficient entropy
payload to act as seed material. Discourage general use of this
API, but lock down this function name as the go-to for userland
PRNG seeding. Improve documentation.
ok miod matthew

Add new getentropy() system call. Code and pressure from matthew.
I accepted that he's right (again) to seperate this out from heavy
sysctl API and this will simply a variety of things. Functionname
is not used by anyone in the ports tree, so we guess we can use it.
Shocking that no application has a function called this.
ok matthew & others who pushed him to start this early on

add prototypes for new crypt functions

Use internal '__' names for __attributes__ in public headers

Define intptr_t in <unistd.h> as specified by POSIX

ok millert

Annotate a few more bounded functions: realpath(3) needs a buffer
of size at least PATH_MAX. pread(2), pwrite(2) and readlinkat(2)
also take the buffer and the bound. OK theo.

express final disapproval of the interfaces in libcompat, such as
them ftime(), gtty(), stty(), re_comp(), cuserid() and others.
Discussion and ongoing work to fix the ports tree from many, especially
naddy.
ok naddy
[There is a bit more cleanup possible after that, but this is considered
the current safe step]

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be in
stdlib.h. The non-standard suboptarg extern remains in the BSD-only
section of stdlib.h. Neither getsubopt() nor suboptarg belong in
unistd.h or getopt.h. They were only there to allow us to protect
all the getopt() bits from being multiply defined. OK guenther@

Align suseconds_t with POSIX: it's the type of the tv_usec member of timeval.
Use useconds_t in the ualarm() declaration.
Bump libstdc++ major to be sure there isn't ABI issues.

ok deraadt@ jca@ jmc@ millert@
ports testing by landry@

Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,
including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and
{clock,pthread}_getcpuclockid() functions.

Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@
ok matthew@

Enable the _POSIX_SHARED_MEMORY_OBJECTS option group now that we have shm_open / shm_unlink.

ok guenther@

Implement fdatasync() as a wrapper around fsync()

ok guenther, deraadt, jmc

getpgid() and getsid() were rolled into POSIX in 2008

ok millert@

Adds the (somewhat silly) _CS_V[67]_ENV and _CS_POSIX_V[67]_* defines
to <unistd.h> and confstr(3) per POSIX 1003.1-2008

Change confstr(_CS_PATH) to operate directly instead of calling sysctl(3)

ports build tested by espie@

Remove excessive sys/cdefs.h inclusion
ok guenther millert kettenis

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Move the _SC_* and _CS_* configurable system variables and strings
from sys/unistd.h to unistd.h.

From Brad; ok millert and me

More sysconf(3)-y and pathconf(3)-y goodness from Brad.
ok guenther, millert (and me); bulk build test by naddy

remove rfork(); ok guenther miod

prototype getdtablecount()

Implement execvpe(3) and posix_spawn(3) and family. Based on
FreeBSD's implementation via Frank Denis, with various cleanups and
tweaks by me.

ok deraadt@, guenther@; discussions and tweaks from many others
jmc@ promises to help me further with the man pages in tree

Replace _SELECT_DECLARED with _SELECT_DEFINED_

Ok sthen@, millert@, dcoppa@

getcwd() buffer's length can be smaller than 1024. In that case it will
fail with errno set to ERANGE if not enough room is provided. Similar for
getlogin_r() so remove minbytes enforcement attribute.
ok kettenis@ guenther@ deraadt@ on getcwd, deraadt@ on getlogin_r.

Expose a bunch of new functionality from POSIX 2008: openat(2),
fchmodat(2), fstatat(2), mkdirat(2), mkfifoat(2), mknodat(2),
faccessat(2), fchownat(2), linkat(2), readlinkat(2), renameat(2),
symlinkat(2), unlinkat(2), utimensat(2), futimens(2), and
fdopendir(3).

"Minor" libc bump.

Tested in a bulk build by naddy@
Much help from guenther@, thib@, tedu@, oga@, and others.
ok deraadt@, naddy@

As pointed out by Richard Guenther our definition
of NULL was incorrect for c++ compilers that aren't
gcc (or pretend to be gcc like clang).

ok miod@

Define NULL as a void * instead of a long integer, as required by Single Unix.
Kernel and bootblocks still use the old 0L value until all the NULL abuses
in the code are fixed.

Move _POSIX_THREAD_SAFE_FUNCTIONS into unistd.h and set it to 200112
now that we support all the _r functions required by POSIX 1003.1-2001.
Also define _POSIX_REENTRANT_FUNCTIONS. OK kurt@ deraadt@

Remove duplicate psignal(3) and sys_siglist definitions. signal.h
is the correct place for them and nothing gets them from here in
base/xenocara/ports. no objection millert@ okay kettenis@

- correct brk(2) prototype and man page to match implementation and POSIX.
brk(2) returns an int value not a void *. brk(2) returns 0 upon success not
a pointer to the new end of memory. okay millert@, kettenis@, deraadt@

zap bogus sentinel, as noticed by dasn.
okay theo

zap argument name, okay millert@

First step in include files overhaul. Use __FOO_VISIBLE (as defined
in sys/cdefs.h) instead of _FOO_SOURCE. Also fix several namespace
pollution issues, including the byte order defines. OK deraadt@

undelete died a while back; millert ok

Move contents of sys/select.h to sys/selinfo.h in preparation for a
userland-visible sys/select.h. Consistent with what Net and Free do.
OK deraadt@, tested with full ports build by naddy@.

brk() and sbrk() should use void *, not char *. Note that sbrk()
should take intptr_t, not int, but we don't presently have intptr_t
available from unistd.h. OK marco@

mktemp(3) et al. go in stdlib.h, not unistd.h. While there be more
explicit about mktemp(3) in the man page.

Prototype closefrom(); tedu@ OK

des_cipher 3rd param is int32_t not long

add __bounded__ attributes for userland headers; enabled with -Wbounded
ok deraadt@

backout the __bounded__ attributes for a while; requested by deraadt@

Mark various standard library functions with the __bounded__ attribute.
You must have an up-to-date gcc for this!
deraadt@ ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Do not let userland access the swapon system call anymore (nothing uses it
anyway).
ok deraadt@ weingart@

GNU-like getopt_long() from NetBSD with changes by me to support
getopt_long_only(). At some point this should replace the BSD
getopt(3) but we are not there yet.

While I am here add protection from the multiple getopt() definitions
due to conflicting standards.

Add [gs]etres[ug]id(2) syscall to libc and use it in emulating some 4.3BSD
functions.

NULL is now 0L so it is the same size as a pointer.
OK mickey@ and discussed with deraadt@

uncommit, since it breaks macppc libc. millert and miod have now said they
did NOT approve those for commit. why did mickey feel he was ok to go
commiting a set of diffs which had not been passed around and tested by people?
we don't know. mickey, have you got something to say for yourself?

move __syscall prototype into unistd.h (like everybody else) and avoid private protos for it everywhere; millert@ ok

Put sentinel back in.

Backout previous change. Since it requires people to upgrade gcc, we want
to give them a larger timeslot to do that.
Requested by deraadt@ and various people on icb or vocally.

Use attribute((sentinel)) on functions where it makes sense.
(this will warn if they are used without a terminating NULL pointer.
Note *pointer*, very useful for arches where 0 != (void *)0, in size)

okay millert@

Manual cleanup of remaining userland __P use (excluding packages maintained outside the tree)

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

remove redundant __noreturn__ attributes now that __dead is sane for modern gcc

use __x__ formats for __attribute__ arguments; guenther@gac.edu

o add missing getsid() prototype
o fix typo in getsid() that broke getsid(pid) where pid != 0
o cause getsid() and getpgid() to return EPERM if requesting the
id of a session/process group not in the current session
o check for NULL session in getsid() for exiting processes

from freebsd:
strtofflags/fflagstostr to convert file flags
to/from binary from/into a string as used in chflags(1).

use u_int32_t instead of u_long (as freebsd does).
increase libc minor.
millert@ ok.

prototyping for p{read,write}{,v}

swapctl 2nd arg is const

add IPv6-ready rcmd() friends.
rcmd(): IPv4 only
rcmd_af(): af independent
ruserok(): af independent
iruserok(): IPv4 only
iruserok_sa(): af independent

rresvport_af() and bindresvport_af()

Be thorough about NULL as __null for C++.

Define NULL to be __null for C++: better quality of implementation.
__null is a magic constant of integral type that converts to a null pointer
as should be, but warns for ambiguity when used to resolved an overload
between an integral type and a pointer type.

Add swapctl(2) prototype.

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

add getpgid() proto; form

add mkstemp(char *template, int suffixlen) interface

change size parameter to size_t

readlink() 3rd param is size_t; XPG

be more careful for _XOPEN_SOURCE

more explicit protos

move proto to unistd.h

Make usleep prototype match manual page and implementation

add XPG4.2 lockf; kleink

move proto to sys/stat.h; XPG4.2

Add mkdtemp(3)

Add lchown() declaration.

fix comments regarding {*path,sys}conf()

add quotactl

proto getgrouplist()

+issetugid

Adds rcmdsh() prototype.

iruserok() can finally safely use a u_int32_t for the ip addr

initgroups(3) 2nd argument should be gid_t

sethostid() actually do return a value

proto rfork()

from netbsd; profil() fixed for 64 bit

branches: 1.1.1;
Initial revision

Unveiling unveil(2).
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start using, but this
now allows for others to do more tweaking and experimentation.

Still needs to send the unveil's across forks and execs before
fully enabling.

Many thanks to robert@ and deraadt@ for extensive testing.
ok deraadt@

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of killing the
program ("error" may not be handed to a setuid/setgid program, which
may be missing/ignoring syscall return values and would continue with
inconsistant state)
Discussion with many
florian has used this to improve the strictness of a daemon

As per style.9, prototypes should not have variable names associated
with the types.

OK jca@

Don't declare select() in <unistd.h>

ok deraadt@ millert@

Move the 10 (!) defintions of NULL to their own mini header file and
update the NULL definition for C++11. OK deraadt@ guenther@ kettenis@

Remove iruserok(_sa)? and __ivaliduser(sa)?

ok millert@ deraadt@

tame -> pledge.

Move to next tame() API. The flags are now passed as a very simple string,
which results in tame() code placements being much more recognizeable.
tame() can be moved to unistd.h and does not need cpp symbols to turn the
bits on and off. The resulting API is a bit unexpected, but simplifies the
mapping to enabling bits in the kernel substantially.
vague ok's from various including guenther doug semarie

Hide many (194!) symbols that nothing should be using.
Delete exect(2); it wasn't portable across archs and nothing used it.

ports test build by naddy@
ok deraadt@ kettenis@

claim posix 2008 compat. apparently people look at this and get scared
when it's really old. but no actual ports fallout in espie's build.
ok deraadt

update swab() to match the current posix definition. "rationale: none."
rewrite the function to be simpler as well. the compiler can unroll the
loop for us if necessary.
ok schwarze

header changes for recent libc changes:
add siphash
delete setkey, encrypt, cfree

change prototype for crypt_newhash. the login_cap_t is a holdover from its
pwd_gensalt origins, but a string argument works equally work and is more
friendly to consumers beyond local user accounts.
ok deraadt

Our setpgrp() is the BSD version with two args and not the XSI
version with zero args, so it should only be visible if __BSD_VISIBLE
(and not also for __XPG_VISIBLE). Contrawise, readlink() has been
part of base POSIX since 1995, so move to proper #if area for that.
Move crypt_checkpass() to the pure-BSD section of the file.

setpgrp() issue noted by Matti Karnaattu (mkarnaattu (at) gmail.com)
ok millert@

Sync readlink(2) with IEEE Std 1003.1-2008.

discussion, help and ok guenther@

Declare and document getthrid()

indirectly prodded by krw@

Add additional kernel interfaces for setting close-on-exec on fds
when creating them: pipe2(), dup3(), accept4(), MSG_CMSG_CLOEXEC,
SOCK_CLOEXEC. Includes SOCK_NONBLOCK support.

ok matthew@

update _POSIX2_FORT_RUN, so that sysconf(_SC_2_FORT_RUN) remains correct.
because you care. reminded by matthew.

Change return value of getentropy() to int 0 for success. Maximum
buffersize is enforced strictly, this supplies sufficient entropy
payload to act as seed material. Discourage general use of this
API, but lock down this function name as the go-to for userland
PRNG seeding. Improve documentation.
ok miod matthew

Add new getentropy() system call. Code and pressure from matthew.
I accepted that he's right (again) to seperate this out from heavy
sysctl API and this will simply a variety of things. Functionname
is not used by anyone in the ports tree, so we guess we can use it.
Shocking that no application has a function called this.
ok matthew & others who pushed him to start this early on

add prototypes for new crypt functions

Use internal '__' names for __attributes__ in public headers

Define intptr_t in <unistd.h> as specified by POSIX

ok millert

Annotate a few more bounded functions: realpath(3) needs a buffer
of size at least PATH_MAX. pread(2), pwrite(2) and readlinkat(2)
also take the buffer and the bound. OK theo.

express final disapproval of the interfaces in libcompat, such as
them ftime(), gtty(), stty(), re_comp(), cuserid() and others.
Discussion and ongoing work to fix the ports tree from many, especially
naddy.
ok naddy
[There is a bit more cleanup possible after that, but this is considered
the current safe step]

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be in
stdlib.h. The non-standard suboptarg extern remains in the BSD-only
section of stdlib.h. Neither getsubopt() nor suboptarg belong in
unistd.h or getopt.h. They were only there to allow us to protect
all the getopt() bits from being multiply defined. OK guenther@

Align suseconds_t with POSIX: it's the type of the tv_usec member of timeval.
Use useconds_t in the ualarm() declaration.
Bump libstdc++ major to be sure there isn't ABI issues.

ok deraadt@ jca@ jmc@ millert@
ports testing by landry@

Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,
including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and
{clock,pthread}_getcpuclockid() functions.

Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@
ok matthew@

Enable the _POSIX_SHARED_MEMORY_OBJECTS option group now that we have shm_open / shm_unlink.

ok guenther@

Implement fdatasync() as a wrapper around fsync()

ok guenther, deraadt, jmc

getpgid() and getsid() were rolled into POSIX in 2008

ok millert@

Adds the (somewhat silly) _CS_V[67]_ENV and _CS_POSIX_V[67]_* defines
to <unistd.h> and confstr(3) per POSIX 1003.1-2008

Change confstr(_CS_PATH) to operate directly instead of calling sysctl(3)

ports build tested by espie@

Remove excessive sys/cdefs.h inclusion
ok guenther millert kettenis

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Move the _SC_* and _CS_* configurable system variables and strings
from sys/unistd.h to unistd.h.

From Brad; ok millert and me

More sysconf(3)-y and pathconf(3)-y goodness from Brad.
ok guenther, millert (and me); bulk build test by naddy

remove rfork(); ok guenther miod

prototype getdtablecount()

Implement execvpe(3) and posix_spawn(3) and family. Based on
FreeBSD's implementation via Frank Denis, with various cleanups and
tweaks by me.

ok deraadt@, guenther@; discussions and tweaks from many others
jmc@ promises to help me further with the man pages in tree

Replace _SELECT_DECLARED with _SELECT_DEFINED_

Ok sthen@, millert@, dcoppa@

getcwd() buffer's length can be smaller than 1024. In that case it will
fail with errno set to ERANGE if not enough room is provided. Similar for
getlogin_r() so remove minbytes enforcement attribute.
ok kettenis@ guenther@ deraadt@ on getcwd, deraadt@ on getlogin_r.

Expose a bunch of new functionality from POSIX 2008: openat(2),
fchmodat(2), fstatat(2), mkdirat(2), mkfifoat(2), mknodat(2),
faccessat(2), fchownat(2), linkat(2), readlinkat(2), renameat(2),
symlinkat(2), unlinkat(2), utimensat(2), futimens(2), and
fdopendir(3).

"Minor" libc bump.

Tested in a bulk build by naddy@
Much help from guenther@, thib@, tedu@, oga@, and others.
ok deraadt@, naddy@

As pointed out by Richard Guenther our definition
of NULL was incorrect for c++ compilers that aren't
gcc (or pretend to be gcc like clang).

ok miod@

Define NULL as a void * instead of a long integer, as required by Single Unix.
Kernel and bootblocks still use the old 0L value until all the NULL abuses
in the code are fixed.

Move _POSIX_THREAD_SAFE_FUNCTIONS into unistd.h and set it to 200112
now that we support all the _r functions required by POSIX 1003.1-2001.
Also define _POSIX_REENTRANT_FUNCTIONS. OK kurt@ deraadt@

Remove duplicate psignal(3) and sys_siglist definitions. signal.h
is the correct place for them and nothing gets them from here in
base/xenocara/ports. no objection millert@ okay kettenis@

- correct brk(2) prototype and man page to match implementation and POSIX.
brk(2) returns an int value not a void *. brk(2) returns 0 upon success not
a pointer to the new end of memory. okay millert@, kettenis@, deraadt@

zap bogus sentinel, as noticed by dasn.
okay theo

zap argument name, okay millert@

First step in include files overhaul. Use __FOO_VISIBLE (as defined
in sys/cdefs.h) instead of _FOO_SOURCE. Also fix several namespace
pollution issues, including the byte order defines. OK deraadt@

undelete died a while back; millert ok

Move contents of sys/select.h to sys/selinfo.h in preparation for a
userland-visible sys/select.h. Consistent with what Net and Free do.
OK deraadt@, tested with full ports build by naddy@.

brk() and sbrk() should use void *, not char *. Note that sbrk()
should take intptr_t, not int, but we don't presently have intptr_t
available from unistd.h. OK marco@

mktemp(3) et al. go in stdlib.h, not unistd.h. While there be more
explicit about mktemp(3) in the man page.

Prototype closefrom(); tedu@ OK

des_cipher 3rd param is int32_t not long

add __bounded__ attributes for userland headers; enabled with -Wbounded
ok deraadt@

backout the __bounded__ attributes for a while; requested by deraadt@

Mark various standard library functions with the __bounded__ attribute.
You must have an up-to-date gcc for this!
deraadt@ ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Do not let userland access the swapon system call anymore (nothing uses it
anyway).
ok deraadt@ weingart@

GNU-like getopt_long() from NetBSD with changes by me to support
getopt_long_only(). At some point this should replace the BSD
getopt(3) but we are not there yet.

While I am here add protection from the multiple getopt() definitions
due to conflicting standards.

Add [gs]etres[ug]id(2) syscall to libc and use it in emulating some 4.3BSD
functions.

NULL is now 0L so it is the same size as a pointer.
OK mickey@ and discussed with deraadt@

uncommit, since it breaks macppc libc. millert and miod have now said they
did NOT approve those for commit. why did mickey feel he was ok to go
commiting a set of diffs which had not been passed around and tested by people?
we don't know. mickey, have you got something to say for yourself?

move __syscall prototype into unistd.h (like everybody else) and avoid private protos for it everywhere; millert@ ok

Put sentinel back in.

Backout previous change. Since it requires people to upgrade gcc, we want
to give them a larger timeslot to do that.
Requested by deraadt@ and various people on icb or vocally.

Use attribute((sentinel)) on functions where it makes sense.
(this will warn if they are used without a terminating NULL pointer.
Note *pointer*, very useful for arches where 0 != (void *)0, in size)

okay millert@

Manual cleanup of remaining userland __P use (excluding packages maintained outside the tree)

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

remove redundant __noreturn__ attributes now that __dead is sane for modern gcc

use __x__ formats for __attribute__ arguments; guenther@gac.edu

o add missing getsid() prototype
o fix typo in getsid() that broke getsid(pid) where pid != 0
o cause getsid() and getpgid() to return EPERM if requesting the
id of a session/process group not in the current session
o check for NULL session in getsid() for exiting processes

from freebsd:
strtofflags/fflagstostr to convert file flags
to/from binary from/into a string as used in chflags(1).

use u_int32_t instead of u_long (as freebsd does).
increase libc minor.
millert@ ok.

prototyping for p{read,write}{,v}

swapctl 2nd arg is const

add IPv6-ready rcmd() friends.
rcmd(): IPv4 only
rcmd_af(): af independent
ruserok(): af independent
iruserok(): IPv4 only
iruserok_sa(): af independent

rresvport_af() and bindresvport_af()

Be thorough about NULL as __null for C++.

Define NULL to be __null for C++: better quality of implementation.
__null is a magic constant of integral type that converts to a null pointer
as should be, but warns for ambiguity when used to resolved an overload
between an integral type and a pointer type.

Add swapctl(2) prototype.

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

add getpgid() proto; form

add mkstemp(char *template, int suffixlen) interface

change size parameter to size_t

readlink() 3rd param is size_t; XPG

be more careful for _XOPEN_SOURCE

more explicit protos

move proto to unistd.h

Make usleep prototype match manual page and implementation

add XPG4.2 lockf; kleink

move proto to sys/stat.h; XPG4.2

Add mkdtemp(3)

Add lchown() declaration.

fix comments regarding {*path,sys}conf()

add quotactl

proto getgrouplist()

+issetugid

Adds rcmdsh() prototype.

iruserok() can finally safely use a u_int32_t for the ip addr

initgroups(3) 2nd argument should be gid_t

sethostid() actually do return a value

proto rfork()

from netbsd; profil() fixed for 64 bit

branches: 1.1.1;
Initial revision

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of killing the
program ("error" may not be handed to a setuid/setgid program, which
may be missing/ignoring syscall return values and would continue with
inconsistant state)
Discussion with many
florian has used this to improve the strictness of a daemon

As per style.9, prototypes should not have variable names associated
with the types.

OK jca@

Don't declare select() in <unistd.h>

ok deraadt@ millert@

Move the 10 (!) defintions of NULL to their own mini header file and
update the NULL definition for C++11. OK deraadt@ guenther@ kettenis@

Remove iruserok(_sa)? and __ivaliduser(sa)?

ok millert@ deraadt@

tame -> pledge.

Move to next tame() API. The flags are now passed as a very simple string,
which results in tame() code placements being much more recognizeable.
tame() can be moved to unistd.h and does not need cpp symbols to turn the
bits on and off. The resulting API is a bit unexpected, but simplifies the
mapping to enabling bits in the kernel substantially.
vague ok's from various including guenther doug semarie

Hide many (194!) symbols that nothing should be using.
Delete exect(2); it wasn't portable across archs and nothing used it.

ports test build by naddy@
ok deraadt@ kettenis@

claim posix 2008 compat. apparently people look at this and get scared
when it's really old. but no actual ports fallout in espie's build.
ok deraadt

update swab() to match the current posix definition. "rationale: none."
rewrite the function to be simpler as well. the compiler can unroll the
loop for us if necessary.
ok schwarze

header changes for recent libc changes:
add siphash
delete setkey, encrypt, cfree

change prototype for crypt_newhash. the login_cap_t is a holdover from its
pwd_gensalt origins, but a string argument works equally work and is more
friendly to consumers beyond local user accounts.
ok deraadt

Our setpgrp() is the BSD version with two args and not the XSI
version with zero args, so it should only be visible if __BSD_VISIBLE
(and not also for __XPG_VISIBLE). Contrawise, readlink() has been
part of base POSIX since 1995, so move to proper #if area for that.
Move crypt_checkpass() to the pure-BSD section of the file.

setpgrp() issue noted by Matti Karnaattu (mkarnaattu (at) gmail.com)
ok millert@

Sync readlink(2) with IEEE Std 1003.1-2008.

discussion, help and ok guenther@

Declare and document getthrid()

indirectly prodded by krw@

Add additional kernel interfaces for setting close-on-exec on fds
when creating them: pipe2(), dup3(), accept4(), MSG_CMSG_CLOEXEC,
SOCK_CLOEXEC. Includes SOCK_NONBLOCK support.

ok matthew@

update _POSIX2_FORT_RUN, so that sysconf(_SC_2_FORT_RUN) remains correct.
because you care. reminded by matthew.

Change return value of getentropy() to int 0 for success. Maximum
buffersize is enforced strictly, this supplies sufficient entropy
payload to act as seed material. Discourage general use of this
API, but lock down this function name as the go-to for userland
PRNG seeding. Improve documentation.
ok miod matthew

Add new getentropy() system call. Code and pressure from matthew.
I accepted that he's right (again) to seperate this out from heavy
sysctl API and this will simply a variety of things. Functionname
is not used by anyone in the ports tree, so we guess we can use it.
Shocking that no application has a function called this.
ok matthew & others who pushed him to start this early on

add prototypes for new crypt functions

Use internal '__' names for __attributes__ in public headers

Define intptr_t in <unistd.h> as specified by POSIX

ok millert

Annotate a few more bounded functions: realpath(3) needs a buffer
of size at least PATH_MAX. pread(2), pwrite(2) and readlinkat(2)
also take the buffer and the bound. OK theo.

express final disapproval of the interfaces in libcompat, such as
them ftime(), gtty(), stty(), re_comp(), cuserid() and others.
Discussion and ongoing work to fix the ports tree from many, especially
naddy.
ok naddy
[There is a bit more cleanup possible after that, but this is considered
the current safe step]

The getopt() prototype and externs don't belong in stdlib.h. Berkeley
moved them to unistd.h to match POSIX in 1995 but we never did.
The exception to this is getsubopt() which POSIX says should be in
stdlib.h. The non-standard suboptarg extern remains in the BSD-only
section of stdlib.h. Neither getsubopt() nor suboptarg belong in
unistd.h or getopt.h. They were only there to allow us to protect
all the getopt() bits from being multiply defined. OK guenther@

Align suseconds_t with POSIX: it's the type of the tv_usec member of timeval.
Use useconds_t in the ualarm() declaration.
Bump libstdc++ major to be sure there isn't ABI issues.

ok deraadt@ jca@ jmc@ millert@
ports testing by landry@

Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,
including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and
{clock,pthread}_getcpuclockid() functions.

Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@
ok matthew@

Enable the _POSIX_SHARED_MEMORY_OBJECTS option group now that we have shm_open / shm_unlink.

ok guenther@

Implement fdatasync() as a wrapper around fsync()

ok guenther, deraadt, jmc

getpgid() and getsid() were rolled into POSIX in 2008

ok millert@

Adds the (somewhat silly) _CS_V[67]_ENV and _CS_POSIX_V[67]_* defines
to <unistd.h> and confstr(3) per POSIX 1003.1-2008

Change confstr(_CS_PATH) to operate directly instead of calling sysctl(3)

ports build tested by espie@

Remove excessive sys/cdefs.h inclusion
ok guenther millert kettenis

__tfork() needs to set the stack address of the new thread in the kernel,
so that it can't get a signal while still running on the parent thread's
stack. Also, pass in sizeof(struct __tfork) to provide forward compat
when more members are added. This is an ABI change, so switch syscall
numbers and bump lib majors this time.

ok deraadt@ matthew@

Move the _SC_* and _CS_* configurable system variables and strings
from sys/unistd.h to unistd.h.

From Brad; ok millert and me

More sysconf(3)-y and pathconf(3)-y goodness from Brad.
ok guenther, millert (and me); bulk build test by naddy

remove rfork(); ok guenther miod

prototype getdtablecount()

Implement execvpe(3) and posix_spawn(3) and family. Based on
FreeBSD's implementation via Frank Denis, with various cleanups and
tweaks by me.

ok deraadt@, guenther@; discussions and tweaks from many others
jmc@ promises to help me further with the man pages in tree

Replace _SELECT_DECLARED with _SELECT_DEFINED_

Ok sthen@, millert@, dcoppa@

getcwd() buffer's length can be smaller than 1024. In that case it will
fail with errno set to ERANGE if not enough room is provided. Similar for
getlogin_r() so remove minbytes enforcement attribute.
ok kettenis@ guenther@ deraadt@ on getcwd, deraadt@ on getlogin_r.

Expose a bunch of new functionality from POSIX 2008: openat(2),
fchmodat(2), fstatat(2), mkdirat(2), mkfifoat(2), mknodat(2),
faccessat(2), fchownat(2), linkat(2), readlinkat(2), renameat(2),
symlinkat(2), unlinkat(2), utimensat(2), futimens(2), and
fdopendir(3).

"Minor" libc bump.

Tested in a bulk build by naddy@
Much help from guenther@, thib@, tedu@, oga@, and others.
ok deraadt@, naddy@

As pointed out by Richard Guenther our definition
of NULL was incorrect for c++ compilers that aren't
gcc (or pretend to be gcc like clang).

ok miod@

Define NULL as a void * instead of a long integer, as required by Single Unix.
Kernel and bootblocks still use the old 0L value until all the NULL abuses
in the code are fixed.

Move _POSIX_THREAD_SAFE_FUNCTIONS into unistd.h and set it to 200112
now that we support all the _r functions required by POSIX 1003.1-2001.
Also define _POSIX_REENTRANT_FUNCTIONS. OK kurt@ deraadt@

Remove duplicate psignal(3) and sys_siglist definitions. signal.h
is the correct place for them and nothing gets them from here in
base/xenocara/ports. no objection millert@ okay kettenis@

- correct brk(2) prototype and man page to match implementation and POSIX.
brk(2) returns an int value not a void *. brk(2) returns 0 upon success not
a pointer to the new end of memory. okay millert@, kettenis@, deraadt@

zap bogus sentinel, as noticed by dasn.
okay theo

zap argument name, okay millert@

First step in include files overhaul. Use __FOO_VISIBLE (as defined
in sys/cdefs.h) instead of _FOO_SOURCE. Also fix several namespace
pollution issues, including the byte order defines. OK deraadt@

undelete died a while back; millert ok

Move contents of sys/select.h to sys/selinfo.h in preparation for a
userland-visible sys/select.h. Consistent with what Net and Free do.
OK deraadt@, tested with full ports build by naddy@.

brk() and sbrk() should use void *, not char *. Note that sbrk()
should take intptr_t, not int, but we don't presently have intptr_t
available from unistd.h. OK marco@

mktemp(3) et al. go in stdlib.h, not unistd.h. While there be more
explicit about mktemp(3) in the man page.

Prototype closefrom(); tedu@ OK

des_cipher 3rd param is int32_t not long

add __bounded__ attributes for userland headers; enabled with -Wbounded
ok deraadt@

backout the __bounded__ attributes for a while; requested by deraadt@

Mark various standard library functions with the __bounded__ attribute.
You must have an up-to-date gcc for this!
deraadt@ ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Do not let userland access the swapon system call anymore (nothing uses it
anyway).
ok deraadt@ weingart@

GNU-like getopt_long() from NetBSD with changes by me to support
getopt_long_only(). At some point this should replace the BSD
getopt(3) but we are not there yet.

While I am here add protection from the multiple getopt() definitions
due to conflicting standards.

Add [gs]etres[ug]id(2) syscall to libc and use it in emulating some 4.3BSD
functions.

NULL is now 0L so it is the same size as a pointer.
OK mickey@ and discussed with deraadt@

uncommit, since it breaks macppc libc. millert and miod have now said they
did NOT approve those for commit. why did mickey feel he was ok to go
commiting a set of diffs which had not been passed around and tested by people?
we don't know. mickey, have you got something to say for yourself?

move __syscall prototype into unistd.h (like everybody else) and avoid private protos for it everywhere; millert@ ok

Put sentinel back in.

Backout previous change. Since it requires people to upgrade gcc, we want
to give them a larger timeslot to do that.
Requested by deraadt@ and various people on icb or vocally.

Use attribute((sentinel)) on functions where it makes sense.
(this will warn if they are used without a terminating NULL pointer.
Note *pointer*, very useful for arches where 0 != (void *)0, in size)

okay millert@

Manual cleanup of remaining userland __P use (excluding packages maintained outside the tree)

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

remove redundant __noreturn__ attributes now that __dead is sane for modern gcc

use __x__ formats for __attribute__ arguments; guenther@gac.edu

o add missing getsid() prototype
o fix typo in getsid() that broke getsid(pid) where pid != 0
o cause getsid() and getpgid() to return EPERM if requesting the
id of a session/process group not in the current session
o check for NULL session in getsid() for exiting processes

from freebsd:
strtofflags/fflagstostr to convert file flags
to/from binary from/into a string as used in chflags(1).

use u_int32_t instead of u_long (as freebsd does).
increase libc minor.
millert@ ok.

prototyping for p{read,write}{,v}

swapctl 2nd arg is const

add IPv6-ready rcmd() friends.
rcmd(): IPv4 only
rcmd_af(): af independent
ruserok(): af independent
iruserok(): IPv4 only
iruserok_sa(): af independent

rresvport_af() and bindresvport_af()

Be thorough about NULL as __null for C++.

Define NULL to be __null for C++: better quality of implementation.
__null is a magic constant of integral type that converts to a null pointer
as should be, but warns for ambiguity when used to resolved an overload
between an integral type and a pointer type.

Add swapctl(2) prototype.

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

add getpgid() proto; form

add mkstemp(char *template, int suffixlen) interface

change size parameter to size_t

readlink() 3rd param is size_t; XPG

be more careful for _XOPEN_SOURCE

more explicit protos

move proto to unistd.h

Make usleep prototype match manual page and implementation

add XPG4.2 lockf; kleink

move proto to sys/stat.h; XPG4.2

Add mkdtemp(3)

Add lchown() declaration.

fix comments regarding {*path,sys}conf()

add quotactl

proto getgrouplist()

+issetugid

Adds rcmdsh() prototype.

iruserok() can finally safely use a u_int32_t for the ip addr

initgroups(3) 2nd argument should be gid_t

sethostid() actually do return a value

proto rfork()

from netbsd; profil() fixed for 64 bit

branches: 1.1.1;
Initial revision