intro.1, locale.1, _exit.2, access.2, bpf.2, brk.2, capget.2, chmod.2, chroot.2, clock_getres.2, clone.2, eventfd.2, fallocate.2, fork.2, getgroups.2, gethostname.2, getpid.2, getpriority.2, getrlimit.2, getrusage.2, gettid.2, iopl.2, ioprio_set.2, killpg.2, mlock.2, mprotect.2, perf_event_open.2, poll.2, posix_fadvise.2, pread.2, ptrace.2, read.2, readv.2, recv.2, rename.2, sched_setaffinity.2, sched_setattr.2, seccomp.2, select.2, send.2, seteuid.2, setgid.2, setresuid.2, setreuid.2, setuid.2, sigaltstack.2, signalfd.2, sigpending.2, sigprocmask.2, sigreturn.2, sigsuspend.2, sigwaitinfo.2, socket.2, stat.2, timer_create.2, uname.2, utimensat.2, wait.2, wait4.2, write.2, MB_LEN_MAX.3, __ppc_get_timebase.3, clearenv.3, dl_iterate_phdr.3, error.3, fexecve.3, fpurge.3, fread.3, fts.3, getaddrinfo.3, getaddrinfo_a.3, getauxval.3, getgrent_r.3, gethostbyname.3, getifaddrs.3, getnameinfo.3, getnetent_r.3, getprotoent.3, getprotoent_r.3, getpw.3, getpwent_r.3, getrpcent.3, getrpcent_r.3, getrpcport.3, getservent.3, getservent_r.3, gsignal.3, key_setsecret.3, malloc_get_state.3, malloc_info.3, malloc_stats.3, malloc_trim.3, memcpy.3, mq_notify.3, mq_open.3, perror.3, profil.3, psignal.3, pthread_attr_init.3, pthread_attr_setaffinity_np.3, pthread_cancel.3, pthread_cleanup_push.3, pthread_create.3, pthread_detach.3, pthread_getattr_np.3, pthread_join.3, pthread_setname_np.3, pthread_tryjoin_np.3, putgrent.3, rcmd.3, rpc.3, rpmatch.3, sem_close.3, sem_open.3, setaliasent.3, shm_open.3, sigqueue.3, strfmon.3, xcrypt.3, xdr.3, console_codes.4, null.4, core.5, host.conf.5, hosts.equiv.5, locale.5, repertoiremap.5, locale.7, man-pages.7, pty.7, rtld-audit.7, sched.7, vdso.7: tstamp

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

Changes: Ready for 4.01

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

proc.5: Refer to bpf(2) for explanation of /proc/sys/net/core/bpf_jit_enable

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Daniel Borkmann

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: SEE ALSO: add bpf(2)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Fixes after comments by Daniel Borkmann

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Alexei Starovoitov

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments by Alexei Starovoitov

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Minor tweaks

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Alexei Starovoitov

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Impreovements aftercomments from Daniel Borkmann

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Daniel Borkmann and Alexei Starovoitov

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Alexei Starovoitov

Plus various other improvements of my own.

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements after comments from Alexei Starovoitov

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Improvements from Alexei Starovoitov

Reported-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Minor fixes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Use cBPF/eBPF consistently in the text

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Minor fixes

Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Various reworking + added FIXMEs

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Add CONFORMING TO section

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Add VERSIONS section

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: Minor fixes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: wfix (multiple)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: ffix (multiple)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: srcfix: wrap source lines at sentence breaks

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

bpf.2: New page documenting bpf(2)

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

socket.7: SEE ALSO: add bpf(2)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

socket.7: srcfix: FIXME

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

capabilities.7: CAP_SYS_ADMIN allows calling bpf(2)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched_setaffinity.2: Improvements after comments by Florian Weimer

Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched_setaffinity.2: Rework text about dealing with systems with more than 1024 CPUs

After comments from Florian Weimer, who pointed out various
confusions in the earlier text.

Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched_setaffinity.2: Explain how to deal with 1024-CPU limitation of glibc's cpu_set_t type

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched_setattr.2: Remove a const attribute

The attr argument of sched_setattr was documented as const but the
kernel will modify the size field of this struct if it contains an
invalid value. See the documentation of the size field for details.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

perf_event_open.2: Exclude_host/exclude_guest clarification

This patch relates to the exclude_host and exclude_guest bits added
by the following commit:

   exclude_host, exclude_guest; Linux 3.2
        commit a240f76165e6255384d4bdb8139895fac7988799
        Author: Joerg Roedel <joerg.roedel@amd.com>
        Date:   Wed Oct 5 14:01:16 2011 +0200

            perf, core: Introduce attrs to count in either host or guest mode

The updated manpage text clarifies that the "exclude_host" and
"exclude_guest" perf_event_open() attr bits only apply in the
context of a KVM environment and are currently x86 only.

Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
Acked-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

perf_event_open.2: Document PERF_SAMPLE_REGS_INTR

This patch relates to the addition of PERF_SAMPLE_REGS_INTR
support added in the following commit:

    perf_sample_regs_intr; Linux 3.19
commit 60e2364e60e86e81bc6377f49779779e6120977f
Author: Stephane Eranian <eranian@google.com>

            perf: Add ability to sample machine state on interrupt

The primary difference between PERF_SAMPLE_REGS_INTR and the
existing PERF_SAMPLE_REGS_USER is that the new support will
return kernel register values.  Also if precise_ip is
set higher than 0 then the PEBS register state will be returned
rather than the saved interrupt state.

This patch incorporates feedback from Stephane Eranian and
Andi Kleen.

Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mprotect.2: Note ENOMEM error that can occur when we reach limit on maximum VMAs

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mmap.2: ERRORS: point out that ENOMEM can occur even for munmap()

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mmap.2: Minor wording fix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mmap.2: Minor wording fixes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mmap.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

epoll.7: wfix

Reported-by: Dilyan Palauzov <dilyan.palauzov@aegee.org>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mlock.2: Document another ENOME error case

ENOMEM can occur if locking/unlocking in the middle of a region
would increase the number of VMAs beyond the system limit (64k).

Reported-by: Mehdi Aqadjani Memar <m.aqadjanimemar@student.vu.nl>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

console_codes.4: Add kernel version for "Set the cursor blink interval" sequence

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

console_codes.4: Add CSI sequence for cursor blink interval

Add a Console Private CSI sequence to specify the current
console's cursor blink interval. The interval is specified
as a number of milliseconds until the next cursor display
state toggle, from 50 to 65535.

Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: Minor improvement to text

As discussed with Carlos O'Donell.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

fallocate.2: Since Linux 4.2, ext4 supports FALLOC_FL_INSERT_RANGE

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

error.3: Minor fixes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

error.3: ATTRIBUTES: Note functions that are/aren't thread-safe

The markings match glibc markings.
markings of functions in glibc are:
- error:         MT-Safe locale
- error_at_line: MT-Unsafe race:error_at_line/error_one_per_line locale

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

locale.5: Remove BUGS section saying man page is not complete

To some degree, this is true of many pages. And anyway, this
page is much better after recent work by Marko.

Reported-by: Marko Myllynen <myllynen@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

ldconfig.8: wsfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

man-pages-4.01.Announce: spfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

LIST_EMPTY.3, LIST_FIRST.3, LIST_FOREACH.3, LIST_HEAD_INITIALIZER.3, LIST_INSERT_BEFORE.3, LIST_NEXT.3, SLIST_EMPTY.3, SLIST_ENTRY.3, SLIST_FIRST.3, SLIST_FOREACH.3, SLIST_HEAD.3, SLIST_HEAD_INITIALIZER.3, SLIST_INIT.3, SLIST_INSERT_AFTER.3, SLIST_INSERT_HEAD.3, SLIST_NEXT.3, SLIST_REMOVE.3, SLIST_REMOVE_HEAD.3, STAILQ_CONCAT.3, STAILQ_EMPTY.3, STAILQ_ENTRY.3, STAILQ_FIRST.3, STAILQ_FOREACH.3, STAILQ_HEAD.3, STAILQ_HEAD_INITIALIZER.3, STAILQ_INIT.3, STAILQ_INSERT_AFTER.3, STAILQ_INSERT_HEAD.3, STAILQ_INSERT_TAIL.3, STAILQ_NEXT.3, STAILQ_REMOVE.3, STAILQ_REMOVE_HEAD.3, TAILQ_CONCAT.3, TAILQ_EMPTY.3, TAILQ_FIRST.3, TAILQ_FOREACH.3, TAILQ_FOREACH_REVERSE.3, TAILQ_HEAD_INITIALIZER.3, TAILQ_INSERT_BEFORE.3, TAILQ_LAST.3, TAILQ_NEXT.3, TAILQ_PREV.3, TAILQ_SWAP.3: New link to queue.3

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: srcfix: Add license marker tags

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Use real hyphens in code samples

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Update timestamp

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Replace HISTORY with CONFORMING TO

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Remove SEE ALSO reference to nonexistent tree(3)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Use subsections in DESCRIPTION

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Comment out text for functions not in glibc

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

queue.3: Reimport from latest FreeBSD page

Long ago, Doug Klima noted that many macros were not
documented in the queue(3) page. Fix by reimporting from
latest [1] FreeBSD man page.

[1] Revision 263142, Modified Fri Mar 14 03:07:51 2014 UTC

This also fixes https://sourceware.org/bugzilla/show_bug.cgi?id=1506

This time, I'll learn from past mistakes and not convert
from 'mdoc' to 'man' macros.

Reported-by: David Leppik <dleppik@vocalabs.com>
Reported-by: Doug Klima <cardoe@gentoo.org>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

locale.5: document era keywords

This patch completes the LC_TIME section - since these era
keywords are so tightly coupled, I'm providing them as a
single patch.

Based on
http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap07.html
http://www.open-std.org/jtc1/SC22/WG20/docs/n972-14652ft.pdf

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

xdr.3: ATTRIBUTES: Note functions that are thread-safe

After research, We think
xdr_array(), xdr_bool(),
xdr_bytes(), xdr_char(),
xdr_destroy(), xdr_double(),
xdr_enum(), xdr_float(),
xdr_free(), xdr_getpos(),
xdr_inline(), xdr_int(),
xdr_long(), xdrmem_create(),
xdr_opaque(), xdr_pointer(),
xdrrec_create(), xdrrec_eof(),
xdrrec_endofrecord(),
xdrrec_skiprecord(),
xdr_reference(), xdr_setpos(),
xdr_short(), xdrstdio_create(),
xdr_string(), xdr_u_char(),
xdr_u_int(), xdr_u_long(),
xdr_u_short(), xdr_union(),
xdr_vector(), xdr_void(),
xdr_wrapstring(),
are thread-safe. But, there are not
markings of them in glibc document.

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

rpc.3: ATTRIBUTES: Note functions that are thread-safe

After research, We think
auth_destroy(), authnone_create(),
authunix_create(), authunix_create_default(),
callrpc(), clnt_broadcast(),
clnt_call(), clnt_destroy(),
clnt_create(), clnt_control(),
clnt_freeres(), clnt_geterr(),
clnt_pcreateerror(), clnt_perrno(),
clnt_perror(), clnt_spcreateerror(),
clnt_sperrno(), clnt_sperror(),
clntraw_create(), clnttcp_create(),
clntudp_create(), clntudp_bufcreate(),
get_myaddress(), pmap_getmaps(),
pmap_getport(), pmap_rmtcall(),
pmap_set(), pmap_unset(),
registerrpc(), svc_destroy(),
svc_freeargs(), svc_getargs(),
svc_getcaller(), svc_getreqset(),
svc_getreq(), svc_register(),
svc_run(), svc_sendreply(),
svc_unregister(), svcerr_auth(),
svcerr_decode(), svcerr_noproc(),
svcerr_noprog(), svcerr_progvers(),
svcerr_systemerr(), svcerr_weakauth(),
svcfd_create(), svcraw_create(),
svctcp_create(), svcudp_bufcreate(),
svcudp_create(), xdr_accepted_reply(),
xdr_authunix_parms(), xdr_callhdr(),
xdr_callmsg(), xdr_opaque_auth(),
xdr_pmap(), xdr_pmaplist(),
xdr_rejected_reply(), xdr_replymsg(),
xprt_register(), xprt_unregister(),
are thread-safe. But, there are not
markings of them in glibc document.

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

getauxval.3: File capabilities also trigger AT_SECURE

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

uselib.2: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

getauxval.3: (Briefly) document AT_HWCAP2

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

memcpy.3: NOTES: describe the glibc 2.13 changes that revealed buggy applications

Adding a note on this point seems worthwhile as a way of
emphasizing the point that the buffers must not overlap.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

fcntl.2: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

prctl.2, seccomp.2: Clarify that SECCOMP_SET_MODE_STRICT disallows exit_group(2)

These days, glibc implements _exit() as a wrapper around
exit_group(2). (When seccomp was originally introduced, this was
not the case.) Give the reader a clue that, despite what glibc is
doing, what SECCOMP_SET_MODE_STRICT permits is the true _exit(2)
system call, and not exit_group(2).

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

seccomp.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

truncate.2: ERRORS: ftruncate() can fail if the file descriptor is not writable

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched.7: Remove ancient, wildly optimistic prediction about future of RT patches

It seems the patches were not merged by 2.6.30...

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

core.5: Mention 'coredump_filter' boot option

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

sched_setaffinity.2: Mention the use of the 'isolcpus' kernel boot option

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

getpriority.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: Improve explanation in EXAMPLE

Reported-by: Carlos O'Donell <carlos@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

gsignal.3: ATTRIBUTES: Note functions that are thread-safe

The markings match glibc markings.
markings of functions in glibc are:
- gsignal: MT-Safe
- ssignal: MT-Safe sigintr

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

getpwent_r.3: ATTRIBUTES: Note functions that are/aren't thread-safe

The markings match glibc markings.
markings of functions in glibc are:
- getpwent_r:  MT-Unsafe race:pwent locale
- fgetpwent_r: MT-Safe

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

getgrent_r.3: ATTRIBUTES: Note functions that are/aren't thread-safe

The markings match glibc markings.
markings of functions in glibc are:
- getgrent_r:  MT-Unsafe race:grent locale
- fgetgrent_r: MT-Safe

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clearenv.3: ATTRIBUTES: Note function that is not thread-safe

The marking matches glibc marking.
The marking of functions in glibc is:
- clearenv: MT-Unsafe const:env

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setsid.2: tfix

it -> its

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

packet.7: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

proc.5: Document /proc/sys/kernel/sysctl_writes_strict

Based on text in Documentation/sysctl/kernel.txt.

Cowritten-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: Improve explanation in EXAMPLE

Reported-by: Arjun Shankar <arjun@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: Tweak's to Carlos's patch

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

hosts.equiv.5: Fix format, clarify IdM needs, and provide examples.

In some recent work with a Red Hat customer I had the opportunity
to discuss the fine nuances of the ruserok() function and related
API which are used to implement rlogin and rsh.

It came to my attention after working with QE on some automated
internal testing that there were no good examples in the hosts.equiv
manual page showing how the format was supposed to work for this
file and for ~/.rhosts, worse the "format" line showed that there
should be spaces between arguments when that would clearly lead
to incorrect behaviour. In addition some things that the format
allows you to write are just wrong like "-host -user" which makes
no sense since the host is already rejected, and should be written
as "host -user" instead. I added notes in the example to make it
clear that "-host -user" is invalid.

I fixed three things:

(a) The format line.
- Either +, or [-]hostname, or +@netgrp or -@netgrp.
- Either +, or [-]username, or +@netgrp or -@netgrp.
- You must specify something in the hostname portion so remove
  optional brackets.

(b) Clarify language around credentials
- If the host is not trusted you must provide credentials to
  the login system and that could be anything really and it
  depends on your configuration e.g. PAM or whatever IdM you have.

(c) Provide real-world examples
- Provide several real world examples and some corner case
  examples for how you would write something. Hopefully others
  can add examples as they see fit.

Signed-off-by: Carlos O'Donell <carlos@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

host.conf.5: Wording fix: s/resolv+/the resolver library/

The term "resolv+" seems to be historical cruft.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

chroot.2: Minor fixes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

socket.2: Update documentation reference for AF_ALG

Signed-off-by: Stephan Mueller <stephan.mueller@atsec.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

chroot.2: chroot() is not intended for security; document attack

It is unfortunate that this discourages this use of chroot(2)
without pointing out alternative solutions - for example,
OpenSSH and vsftpd both still rely on chroot(2) for security.

Bind mounts should theoretically be usable as a replacement, but
currently, they have a similar problem (CVE-2015-2925) that hasn't
been fixed in ~6 months, so I'd rather not add it to the manpage
as a solution before a fix lands.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

fexecve.3: ATTRIBUTES: Note function that is thread-safe

After research, We think fexecve() is thread-safe. But, there
is not marking of fexecve() in glibc document.

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>