kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restricti

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restrictions
are inherited by sub-processes recursively. Once set, restrictions cannot
be removed.

Basic restrictions that mimic an unadorned jail can be enabled without
creating a jail, but generally speaking real security also requires
creating a chrooted filesystem topology, and a jail is still needed
to really segregate processes from each other. If you do so, however,
you can (for example) disable mount/umount and most global root-only
features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
improve jailess security in the near future, and to optimize the
priv_check code.

show more ...

Remove obsolete dev_mkdb(8)

The devname(3) has long been updated to determine the device name via
the 'kern.devname' sysctl provided by devfs(5). The dev.db created by
dev_mkdb(8) is thus unused an

Remove obsolete dev_mkdb(8)

The devname(3) has long been updated to determine the device name via
the 'kern.devname' sysctl provided by devfs(5). The dev.db created by
dev_mkdb(8) is thus unused and obsolete. So remove dev_mkdb(8) as well
and update relevant parts.

show more ...

ps.1: Update FILES section a bit.

ps - Adjust STATUS formatting

* Remove the leading space for (%s) command display. The leading space
was causing indented output via -R to be incorrectly indented.

* Remove the 'L' STATUS flag,

ps - Adjust STATUS formatting

* Remove the leading space for (%s) command display. The leading space
was causing indented output via -R to be incorrectly indented.

* Remove the 'L' STATUS flag, it hasn't been meaningful for a long time.
The status is more likely to fit in its 6-char slot, which we need now
that many systems have >= 10 cpus.

show more ...

Add/fix some HISTORY sections in bin/ manual pages.

Submitted-by: Sevan Janiyan
Dragonfly-bugs: 2937-2945

ps(1): Add -A option, as specified by POSIX.

Still missing: -d, -G and -n.

Include alias "args" in /bin/ps.

* Include alias "args" required by SUSv3.

* Improve argument handling of aliases: allows specification
of different heading as in "ps -o args=MOM".
This will ma

Include alias "args" in /bin/ps.

* Include alias "args" required by SUSv3.

* Improve argument handling of aliases: allows specification
of different heading as in "ps -o args=MOM".
This will make some ports happier.

Changes obtained from OpenBSD.

show more ...

ps.1: Remove info about the no longer existing 'M' process state.

ps - Remove display of the 'M'P state

* Remove display of the 'M' flag, which used to mean that the process was
running MPSAFE w/regards to the kernel's mp_lock. Well, pretty much
all processes

ps - Remove display of the 'M'P state

* Remove display of the 'M' flag, which used to mean that the process was
running MPSAFE w/regards to the kernel's mp_lock. Well, pretty much
all processes are MPSAFE now, so the flag just clutters the output.

show more ...

ps - Allow a pid specification in combination with -R

* e.g. 'ps R23434' will output the specified process plus also output
all children (recursively) of that process.

Correct BSD License clause numbering from 1-2-4 to 1-2-3.

Apparently everyone's doing it:
http://svnweb.freebsd.org/base?view=revision&revision=251069

Submitted-by: "Eitan Adler" <lists at eitanadl

Correct BSD License clause numbering from 1-2-4 to 1-2-3.

Apparently everyone's doing it:
http://svnweb.freebsd.org/base?view=revision&revision=251069

Submitted-by: "Eitan Adler" <lists at eitanadler.com>

show more ...

Remove advertising header from man pages.

By: Eitan Adler <lists@eitanadler.com>

Merge branch 'master' of ssh://crater.dragonflybsd.org/repository/git/dragonfly

ps.1: Adjust info regarding SMP systems.

Initial import of binutils 2.22 on the new vendor branch

Future versions of binutils will also reside on this branch rather
than continuing to create new binutils branches for each new version.

Rename /kernel and /module to /boot/kernel and /boot/module where appropriate.

Renamed kern.ps_showallprocs to security.ps_showallprocs

Add '-H', 'nlwp', and 'tid' options to ps(1) to display some LWP data (inspired
from FreeBSD options). Clean up the kernel's initialization of the kl_tid
field.

Submitted-by: "Nicolas Thery" <nther

Add '-H', 'nlwp', and 'tid' options to ps(1) to display some LWP data (inspired
from FreeBSD options). Clean up the kernel's initialization of the kl_tid
field.

Submitted-by: "Nicolas Thery" <nthery@gmail.com>

show more ...

Update documentation.

Nudged in the back by: Sascha Wildner <saw@online.de>, Ouch!

The R state is followed by the CPU number.

Fix comments.

1:1 Userland threading stage 2.13/4:

Move P_SINTR and P_BREAKTSLEEP into lwp_flag.

Introduce proc_stop and proc_unstop to handle the transition of a complete proc
to and from stopped state. This i

1:1 Userland threading stage 2.13/4:

Move P_SINTR and P_BREAKTSLEEP into lwp_flag.

Introduce proc_stop and proc_unstop to handle the transition of a complete proc
to and from stopped state. This is influenced by NetBSD.

show more ...

Document and correctly name fields.

Sig now is the pending signals for a process, tsig the pending signals
for a lwp.

Remove non-existing fields from the documentation.

Prodded-by: swildner@

Get rid -y/-Y (sort by interactive measure). The interactive measure has
been removed.

Assorted .Xr fixes:

* Add section numbers and fix wrong ones.

* Use .Em, .Nm and .Pa instead of .Xr where appropriate.

* Fix obsolete references.

* Fix typos.