New accounting flag ABTCFI to indicate signal SIGILL + code ILL_BTCFI
has occurred in the process.
ok various people

pinsyscall(SYS_execve) will soon go away, so the sys/acct.h bit AEXECVE
can also be remove. Delete the code using it from the one program that
inspects it.

Report system call pinning violations.

for process kills due to execve from non-pinned syscall address, export
a new AEXECVE bit to acct(4), and print it in lastcomm(8)
ok bluhm

Print the pid in lastcomm(1) output for post mortem analysis. Put
it in brackets after the command name, like syslogd does it in log
files. A while ago the process id was added to process accounting
in the kernel, so no ABI break this time.
OK deraadt@

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

pinsyscall(SYS_execve) will soon go away, so the sys/acct.h bit AEXECVE
can also be remove. Delete the code using it from the one program that
inspects it.

Report system call pinning violations.

for process kills due to execve from non-pinned syscall address, export
a new AEXECVE bit to acct(4), and print it in lastcomm(8)
ok bluhm

Print the pid in lastcomm(1) output for post mortem analysis. Put
it in brackets after the command name, like syslogd does it in log
files. A while ago the process id was added to process accounting
in the kernel, so no ABI break this time.
OK deraadt@

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

Report system call pinning violations.

for process kills due to execve from non-pinned syscall address, export
a new AEXECVE bit to acct(4), and print it in lastcomm(8)
ok bluhm

Print the pid in lastcomm(1) output for post mortem analysis. Put
it in brackets after the command name, like syslogd does it in log
files. A while ago the process id was added to process accounting
in the kernel, so no ABI break this time.
OK deraadt@

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

for process kills due to execve from non-pinned syscall address, export
a new AEXECVE bit to acct(4), and print it in lastcomm(8)
ok bluhm

Print the pid in lastcomm(1) output for post mortem analysis. Put
it in brackets after the command name, like syslogd does it in log
files. A while ago the process id was added to process accounting
in the kernel, so no ABI break this time.
OK deraadt@

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

Print the pid in lastcomm(1) output for post mortem analysis. Put
it in brackets after the command name, like syslogd does it in log
files. A while ago the process id was added to process accounting
in the kernel, so no ABI break this time.
OK deraadt@

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

Inform about system call memory write protection and stack mapping
violations in system accounting. This will help to find missbehaving
programs and possible attacks. The flags bit field is full, so
recycle the PDP-11 compatibility on VAX. lastcomm(1) prints the
AMAP flag as 'M'. daily(8) prints a list of affected processes.
OK deraadt@

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

Show unveil(2) violators in lastcomm(1) output and daily mail.
input Janne Johansson, schwarze@; OK deraadt@ millert@

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

Stop mentionning/testing the for the ASU bit (S flag).

It is of no use since suser() no longer set this bit.

ok millert@, bluhm@

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision

ASLR, W^X, and guard pages trigger processor traps that result in
SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible
in lastcomm(1). This also works if a programm tries to hide them
with a signal handler. Manual kill -SEGV does not generate false
positives.
OK deraadt@

Add an acct(5) flag for pledge violations. Then lastcomm(1) shows
when something went wrong. This allows to monitor whether the
system is under attack and that the attack has been prevented by
OpenBSD pledge(2).
OK deraadt@ millert@ jmc@

Use sizeof directly instead of a macro from the scary <struct.h>

ok visa@ mpi@ millert@ kettenis@ deraadt@

Change all tame callers to namechange to pledge(2).

tame "stdio rpath getpw". getpw is for user_from_uid(), which is a libc
cache on top of the getpw* functions.
ok semarie, who didn't spot the getpw need :)

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

oops, missed a bit from tobias' diff - add "usage: " to usage();
from Tobias Stoeckmann

sync usage(); from Tobias Stoeckmann

lint begs for proactive casting, so we give it

more proto fixes

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

-Wall cleanup

first pass at a -Wall cleanup

mm, didn't quite get it the first time.
rearrange seek/test/print logic to avoid seeking to before
beginning of file. netbsd/PR #3634, John F. Woods <jfw@jfwhome.funhouse.com>

don't try to fseek to before the beginning of the file;
showed up after the fix to sys_lseek concerning negative offsets.
avoids '/var/account/acct: Invalid argument' messages.

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

from netbsd; also print elapsed time

branches: 1.1.1;
Initial revision