ctime(3) and ctime_r(3) can fail when timestamps are way off.
Add missing error checks to all calls under sbin/

Input kettenis, millert
OK millert

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument.

userspace: remove vestigial '?' cases from top-level getopt(3) loops

getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.

Prompted by dlg@. With help from dlg@ and millert@.

Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2

ok naddy@ millert@ dlg@

show more ...

Savecore uses its own private copy of compress, so it should
not include <zlib.h>

discussed with deraadt

For open/openat, if the flags parameter does not contain O_CREAT, the
3rd (variadic) mode_t parameter is irrelevant. Many developers in the past
have passed mode_t (0, 044, 0644, or such), which mig

For open/openat, if the flags parameter does not contain O_CREAT, the
3rd (variadic) mode_t parameter is irrelevant. Many developers in the past
have passed mode_t (0, 044, 0644, or such), which might lead future people
to copy this broken idiom, and perhaps even believe this parameter has some
meaning or implication or application. Delete them all.
This comes out of a conversation where tb@ noticed that a strange (but
intentional) pledge behaviour is to always knock-out high-bits from
mode_t on a number of system calls as a safety factor, and his bewilderment
that this appeared to be happening against valid modes (at least visually),
but no sorry, they are all irrelevant junk. They could all be 0xdeafbeef.
ok millert

show more ...

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

show more ...

dev_t is signed to permit passing -1 as an invalid condition, but the
decomposition into major and minor is unsigned, so we should print them
with %u instead of %d.
ok guenther

Unbreak "savecore -c". Also add missing unveil(2) for the raw device.

ok mestre

add missing unveil(2) of an arbitrary kernel (when -N is used), or _PATH_UNIX by
default, with read permissions.

report and fix provided by semarie@
OK deraadt@

After opening required descriptors, savecore only plays in one directory
so use unveil(2).

make the version symbol a fixed size (512) to reduce the potential for
bad effects when savecore reads beyond it
ok deraadt (and thanks to bluhm for remembering that this happens)

Drop support for the undocumented second argument (same as -N option)

ok deraadt@

after kmem is open and setup, pledge "stdio rpath wpath cpath"
seems to be working. commiting to get feedback from people who crash.

Collapse some strange programmer style with too much abstraction.

Fix glitches in previous commit: strip the \n and only complain on failure

ok deraadt@

Convert many atoi() calls to strtonum(), adding range checks and failure
handling along the way.
Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes

tzfile.h is an internal header that should never have been installed.
What's worse, the tzfile.h that gets installed is over 20 years old
and doesn't match the real tzfile.h in libc/time. This makes the
tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE
define has been moved to time.h temporarily until its usage is
replaced by 1900 in the tree. Actual removal of tzfile.h is pending
a ports build. Based on a diff from deraadt@

show more ...

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_N

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

show more ...

dependent clause requires a subject (comment grammar)

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(th

rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and
unmaintainable). these days, people use source. these id's do not provide
any benefit, and do hurt the small install media
(the 33,000 line diff is essentially mechanical)
ok with the idea millert, ok dms

show more ...

If the user didn't specify a kernel, pass in NULL to kvm_openfiles()
so it can try /dev/ksyms. The first call to kvm_openfiles()
was already correct.

Use different variables for the dump offset in blocks and the dump offset
in bytes; this allows us to get rid of many off_t casts, and ensures
proper operation on very large swap partitions on 32 bit

Use different variables for the dump offset in blocks and the dump offset
in bytes; this allows us to get rid of many off_t casts, and ensures
proper operation on very large swap partitions on 32 bit machines.

From Pierre Riteau.

show more ...

Handle kernel core files larger than 2GB; ok dlg@

remove some warnings:
unused variable `variable'
`variable' might be used uninitialized in this function

ok gilles@ ray@

use strcspn to properly overwrite '\n' in fgets returned buffer

ok pyr@, ray@, millert@, moritz@, chl@

Use fstatfs(), not statfs() to determine free space so if /var/crash
is a link we follow it. OK deraadt@ jcs@