| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
ok guenther@ and deraadt
|
|
|
|
| |
ok millert@ deraadt@
|
|
|
|
| |
and drop NetBSD RCS tag apparently left over from copy & paste
|
|
|
|
|
|
|
| |
where libc.so's text segment is, thereby allowing invocation of system
calls from that region. An upcoming change will kill the process if a
system call is invoked from addresses not explicitly permitted.
ok guenther kettenis mortimer
|
|
|
|
|
|
|
| |
like mem{set,cpy,move} or __stack_smash_handler using asm() renaming. So
treat gcc3 like clang and mark such functions as protected instead.
ok ayoma@
|
|
|
|
|
|
| |
link it with -znow
ok kettenis@ deraadt@ jca@
|
|
|
|
|
|
|
|
|
| |
as well as those in arch/arm/gen/divsi3.S. This cleans up the PLTs on the
32bit archs.
luna88k testing by aoyama@
"looks good" kettenis@, testing and ok deraadt@
|
| |
|
| |
|
|
|
|
|
|
| |
PLT entries and prevent overriding
ok kettenis@ deraadt@
|
|
|
|
|
|
|
| |
by the ASM stub, which is also in libc. The compiler only generates
invocations of the latter.
ok mpi@ deraadt@ kettenis@
|
|
|
|
|
| |
Diff from eric@ and florian@, commiting on their behalf since they are absent
and we want to ride the minor shlib bump.
|
|
|
|
| |
ok deraadt@
|
|
|
|
| |
ok visa@
|
|
|
|
|
| |
and return an error instead. may prevent some unset/missing confusion.
ok deraadt millert
|
| |
|
| |
|
|
|
|
|
| |
2) say that the data comes from the random(4) subsystem, so that curious
people can go read up on how this works
|
|
|
|
|
|
| |
fix issue reported by Mikolaj Kucharski.
ok martijn@ deraadt@
|
|
|
|
| |
Prompted by guenther@
|
|
|
|
|
| |
source: https://minnie.tuhs.org/cgi-bin/utree.pl?file=V4/man/man2/break.2
pointed out by Sevan Janiyan <venture37 at geeklan dot co dot uk>
|
|
|
|
|
| |
a few cases that weren't altogether straightforward;
tweak and OK jmc@, OK sobrado@
|
|
|
|
|
|
| |
This became possible because copies of the original v1 manuals
have shown up on the Internet some time ago.
Reminded by Sevan Janiyan <venture37 at geeklan dot co dot uk>.
|
|
|
|
|
|
| |
in revision 1.30.
ok deraadt@ tb@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
For gettimeofday(2), always copy out an empty timezone struct. For
settimeofday(2), still copyin(9) the struct but ignore the contents.
In gettimeofday(2)'s case we have not changed the original BSD semantics:
the kernel only tracks UTC time without an offset for DST, so a zeroed
timezone struct is the correct thing to return to the caller.
Future work could move these out into libc as stubs for clock_gettime and
clock_settime(2). But, definitely a "later" thing, given that we are in
beta.
Update the manpage to de-emphasize the timezone parameters for these
syscalls.
Discussed with tedu@, deraadt@, millert@, kettenis@, yasuoka@, jca@, and
guenther@. Tested by job@. Ports input from jca@ and sthen@. Manpage
input from jca@.
ok jca@ deraadt@
|
|
|
|
|
| |
getcap->cgetent. pwcache->user_from_uid. And then repair references.
ok jmc
|
| |
|
| |
|
| |
|
|
|
|
|
| |
is no function called md5()
as discussed with jmc
|
| |
|
| |
|
| |
|
|
|
|
|
| |
name we want to Xr...
ok jmc
|
|
|
|
|
| |
and correct Xr.
ok jmc
|
|
|
|
|
| |
uuid_compare(3)
ok jmc
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The DST and TIMEZONE options(4) are incompatible with KARL, so we need
some other way to compensate for an RTC running with a known offset.
Enter kern.utc_offset, an offset in minutes East of UTC. TIMEZONE has
always been minutes West, but this is inconsistent with how everyone
else talks about timezones, hence the flip.
TIMEZONE has the advantage of being compiled into the binary. Our new
sysctl(2) has no such luck, so it needs to be set as early as possible
in boot, from sysctl.conf(5), so we can correct the kernel clock from
the RTC's local time to UTC before daemons like ntpd(8) and cron(8)
start. To encourage this, kern.utc_offset is made immutable after the
securelevel(7) is raised to 1.
Prompted by yasuoka@. Discussed with deraadt@, kettenis@, yasuoka@.
Additional testing by yasuoka@.
ok deraadt@, yasuoka@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
for IPv6 link local addresses.
Some hosting and VM providers route customer IPv6 prefixes to link
local addresses derived from ethernet MAC addresses (RFC 2464). This
leads to hard to debug IPv6 connectivity problems and is probably not
worth the effort.
RFC 7721 lists 4 weaknesses:
3.1. Correlation of Activities over Time & 3.2. Location Tracking
These are still possible with RFC 7217 addresses for an adversary
connected to the same layer 2 network (think conference wifi). Since
the link local prefix stays the same (fe80::/64) the link local
addresses do not change between different networks.
An adversary on the same layer 2 network can probably track ethernet
MAC addresses via different means, too.
3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation
These now become possible, however, as noted above a layer 2 adversary
was probably able to do this via different means.
People concerned with these weaknesses are advised to use
ifconfig lladdr random.
OK benno
input & OK kn
|
|
|
|
| |
ok deraadt@
|
|
|
|
|
|
|
|
| |
does exist -- execv(3). Still call this a family but without "Nm".
Adjust Xr in various pages to refer to the precise function used
rather than the family, in most cases the semantics of execve(2) are
being referenced, so change the Xr.
ok jmc
|
| |
|
|
|
|
| |
OK guenther@
|
|
|
|
| |
in section 2 and 3; bluhm@ drew my attention to this.
|
| |
|
|
|
|
| |
input Janne Johansson, schwarze@; OK deraadt@ millert@
|
| |
|
|
|
|
|
|
|
|
| |
can also be retrieved with getsockopt(3)
it looks like these will also be in the next issue of posix:
http://austingroupbugs.net/view.php?id=840#c2263
ok claudio@, sthen@
|
|
|
|
|
|
|
|
| |
conversion specifications that are extensions; issues reported by
Andras Farkas <deepbluemistake at gmail dot com> on misc@.
While here, note that alternative conversion modifiers have no effect
and that flags and field width specifications are not supported.
|
|
|
|
|
| |
blocked, POSIX requires EIDRM rather than EINVAL, and that's what our
implementation does and what the ERRORS section already says, too
|
|
|
|
| |
use .Vt for struct names and and .Fa for struct fields
|