userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

Add -c option for passing LOG_CONS to syslog(3).
(Option choice matches NetBSD)

ok deraadt@ jmc@ benno@ kn@

remove unused variable

ok millert@

Change all tame callers to namechange to pledge(2).

During getopt(), an optional file may be opened. After that, tame "stdio"
works.

Time for some commentary! tame became possible because syslog(3) in
openbsd uses a system call -- sendsyslog(2) -- which does not require
an elaborate dance opening an AF_UNIX socket and using connect() or
send() to deliver to a "/dev/log" unix socket in the filesystem.
sendsyslog(2) was invented to ensure the stack-protector's
__stack_smash_handler() can gaurantee delivery of failure messages to
syslogd(8) in harsh conditions -- such as file descriptor exhaustion
or inside chroot(2). Now it also works in tame(2)'d proceses, since
sendsyslog(2) is always allowed. Our syslog(3) needs no elaborate
socket code, therefore piles of software does not have an inate need
for socket(2), connect(2), send(2), nor access to the filesystem.
syslog(3) remains fully compatible otherwise.

How does the stack protector report an error in fully capsicum'd
program? Or in some other Linux protection mechanism, if someone
protectes a program too far and takes sockets away, how do they see
the stack protector working?

You can have nice things when the underlying rules change.

Convert many atoi() calls to strtonum(), adding range checks and failure
handling along the way.
Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

spacing tweak in usage(); from Igor Sobrado

simplify synopsis/usage() and sort options;
from Igor Sobrado

Both strlen and sizeof return a size_t. This also fixes a signed/unsigned
comparison.

ok ray@ moritz@

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

branches: 1.1.1;
Initial revision

Add -c option for passing LOG_CONS to syslog(3).
(Option choice matches NetBSD)

ok deraadt@ jmc@ benno@ kn@

remove unused variable

ok millert@

Change all tame callers to namechange to pledge(2).

During getopt(), an optional file may be opened. After that, tame "stdio"
works.

Time for some commentary! tame became possible because syslog(3) in
openbsd uses a system call -- sendsyslog(2) -- which does not require
an elaborate dance opening an AF_UNIX socket and using connect() or
send() to deliver to a "/dev/log" unix socket in the filesystem.
sendsyslog(2) was invented to ensure the stack-protector's
__stack_smash_handler() can gaurantee delivery of failure messages to
syslogd(8) in harsh conditions -- such as file descriptor exhaustion
or inside chroot(2). Now it also works in tame(2)'d proceses, since
sendsyslog(2) is always allowed. Our syslog(3) needs no elaborate
socket code, therefore piles of software does not have an inate need
for socket(2), connect(2), send(2), nor access to the filesystem.
syslog(3) remains fully compatible otherwise.

How does the stack protector report an error in fully capsicum'd
program? Or in some other Linux protection mechanism, if someone
protectes a program too far and takes sockets away, how do they see
the stack protector working?

You can have nice things when the underlying rules change.

Convert many atoi() calls to strtonum(), adding range checks and failure
handling along the way.
Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

spacing tweak in usage(); from Igor Sobrado

simplify synopsis/usage() and sort options;
from Igor Sobrado

Both strlen and sizeof return a size_t. This also fixes a signed/unsigned
comparison.

ok ray@ moritz@

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

branches: 1.1.1;
Initial revision

remove unused variable

ok millert@

Change all tame callers to namechange to pledge(2).

During getopt(), an optional file may be opened. After that, tame "stdio"
works.

Time for some commentary! tame became possible because syslog(3) in
openbsd uses a system call -- sendsyslog(2) -- which does not require
an elaborate dance opening an AF_UNIX socket and using connect() or
send() to deliver to a "/dev/log" unix socket in the filesystem.
sendsyslog(2) was invented to ensure the stack-protector's
__stack_smash_handler() can gaurantee delivery of failure messages to
syslogd(8) in harsh conditions -- such as file descriptor exhaustion
or inside chroot(2). Now it also works in tame(2)'d proceses, since
sendsyslog(2) is always allowed. Our syslog(3) needs no elaborate
socket code, therefore piles of software does not have an inate need
for socket(2), connect(2), send(2), nor access to the filesystem.
syslog(3) remains fully compatible otherwise.

How does the stack protector report an error in fully capsicum'd
program? Or in some other Linux protection mechanism, if someone
protectes a program too far and takes sockets away, how do they see
the stack protector working?

You can have nice things when the underlying rules change.

Convert many atoi() calls to strtonum(), adding range checks and failure
handling along the way.
Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert

remove erroneous char cast to switch expression processing getopt(3);
not used in any cases.

ok deraadt@, guenther@, millert@

unsigned char casts for ctype
ok krw

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

spacing tweak in usage(); from Igor Sobrado

simplify synopsis/usage() and sort options;
from Igor Sobrado

Both strlen and sizeof return a size_t. This also fixes a signed/unsigned
comparison.

ok ray@ moritz@

mostly ansi cleanup; pval ok

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Part one of userland __P removal. Done with a simple regexp with some minor hand editing to make comments line up correctly. Another pass is forthcoming that handles the cases that could not be done automatically.

kill more registers

millert@ ok

getopt(3) returns -1 when out of args, not EOF, whee!

rcsid

branches: 1.1.1;
Initial revision