When using fixed-size buffers, use sizeof() to prevent lossage when
diff --git a/data/support.sgml b/data/support.sgml
index d3edb18cf3..6dea3b075d 100644
--- a/data/support.sgml
+++ b/data/support.sgml
@@ -1,9 +1,9 @@
+
%includes;
]>
-
+
&header;
@@ -96,7 +96,8 @@
- CVS (the Concurrent Version System) is the tool we use for
+
CVS
+ (the Concurrent Version System) is the tool we use for
keeping our sources under control. Every change (with
accompanying log message explaining its purpose) from
FreeBSD 2.0 to the present is stored here, and can be
diff --git a/en/releases/2.2R/notes.sgml b/en/releases/2.2R/notes.sgml
index d1a42d8a84..3c5508063f 100644
--- a/en/releases/2.2R/notes.sgml
+++ b/en/releases/2.2R/notes.sgml
@@ -1,10 +1,10 @@
-
+
%includes;
]>
-
+
&header;
@@ -42,7 +42,9 @@ in 2.2.
The number of EISA slots to probe is now a fully supported option,
including the ability to save the value from a UserConfig session
-with dset(8). This helps owners of HP NetServer LC machines to
+with
+dset(8).
+This helps owners of HP NetServer LC machines to
install the system on their hardware.
Support for the SDL RISCom N2pci sync serial card.
@@ -74,7 +76,8 @@ The syscons and psm drivers now have a new underlying shared keyboard
driver, eliminating many of the previously existing problems with
their mutual interaction.
-Syscons now supports cut & paste in textmode using the moused(8)
+Syscons now supports cut & paste in textmode using the
+moused(8)
utility.
2.2 is the first release that includes full CD-R support for the
@@ -151,8 +154,11 @@ The kernel configuration option handling has been largely moved away
from the old -D Makefile kludges, towards a system of "opt_foo.h"
kernel include files, allowing Makefile dependencies to work again.
We expect the old hack that blows the entire compile directory away
-on each run of config(8) to go away anytime soon. Unless you're changing
-weird options, you might now consider using the -n option to config(8),
+on each run of
+config(8)
+to go away anytime soon. Unless you're changing
+weird options, you might now consider using the -n option to
+config(8),
or setting the env variable NO_CONFIG_CLOBBER, if CPU time is costly for
you. See also the comments in the handbook about how it works.
diff --git a/en/security.sgml b/en/security.sgml
index 873e6d9222..b5bbd10803 100644
--- a/en/security.sgml
+++ b/en/security.sgml
@@ -1,9 +1,9 @@
+
%includes;
]>
-
+
@@ -15,7 +15,7 @@
FreeBSD Security Guide
-Last Updated: $Date: 1997-07-01 03:52:10 $
+Last Updated: $Date: 1997-07-05 23:02:47 $
This guide attempts to document some of the tips and tricks used by
many FreeBSD security experts for securing systems and writing secure
@@ -52,10 +52,22 @@ FreeBSD Security Officers if you have changes you'd like to see here.
security issues to watch for in this area are:
- - strcpy() and sprintf() calls from
- unbounded data. Use strncpy() and snprintf() when the length is known
+
-
+
+ strcpy(3) and
+ sprintf(3) calls from
+ unbounded data. Use
+
+ strncpy(3) and
+
+ snprintf(3) when the length is known
(or implement some other form of bounds-checking when it's not).
- In fact, never use gets(3) or sprintf(3), period.
+ In fact, never use
+ gets(3)
+ or
+
+ sprintf(3), period.
- Watch for strvis(3) and getenv(3) abuse.
strvis() is easy to get the destination string wrong for, and getenv()
@@ -65,18 +77,31 @@ FreeBSD Security Officers if you have changes you'd like to see here.
to unexpected values. If your program reads environment variables,
be paranoid!
-
- Every time you see an open(2) or stat(2) call, ask yourself, "What
+
- Every time you see an
+ open(2)
+ or
+ stat(2)
+ call, ask yourself, "What
if it's a symbolic link?"
-
- All uses of mktemp(), tempnam(), mkstemp(),
- etc.; make sure that they use mkstemp() instead. Also look for races in
+
- All uses of
+
+ mktemp(3),
+ tempnam,
+ mkstemp(3),
+ etc.; make sure that they use
+
+ mkstemp(3) instead. Also look for races in
/tmp in general, being aware that there are very few things can be atomic
in /tmp:
- Creating a directory. This will either succeed or fail.
- Opening a file O_CREAT | O_EXCL
- mkstemp(3) properly handles this for you, so all temp files should
+
+ mkstemp(3) properly handles this for you, so all temp files should
use mkstemp to guarantee there's no race and that the permissions
are right.
@@ -101,7 +126,9 @@ FreeBSD Security Officers if you have changes you'd like to see here.
- Don't just grep for the usual suspects
in programs which run at elevated privs. Look line by line for possible
- overflows in these cases since there are a lot more ways than strcpy()
+ overflows in these cases since there are a lot more ways than
+
+ strcpy(3)
and friends to cause buffer overflows.
- Just because you drop privs somewhere doesn't
@@ -111,7 +138,8 @@ FreeBSD Security Officers if you have changes you'd like to see here.
- Do uid management. So drop privs as soon as possible,
and really drop them. Switching between euid and uid is not enough. Use
- setuid() when you can.
+ setuid()
+ when you can.
- Never display configuration file contents on errors.
A line number and perhaps position count is enough. This is true for all
@@ -132,7 +160,8 @@ FreeBSD Security Officers if you have changes you'd like to see here.
you would like to have go into the tree.
- When sending changes around for review, always
- use context or unidiff format diffs which may be easily fed to patch(1).
+ use context or unidiff format diffs which may be easily fed to
+ patch(1).
Do not simply send whole files! Diffs are much easier to read and apply to
local sources (especially those in which multiple, simultaneous changes
may be taking place). All changes should be relative to 3.0-current
@@ -160,7 +189,9 @@ FreeBSD Security Officers if you have changes you'd like to see here.
signal handlers. Many routines in the various libraries are not
sufficiently reentrant to make this safe.
-
- Pay special attention to realloc() usage - more
+
- Pay special attention to
+
+ realloc(3) usage - more
often than not, it's not done correctly.
- When using fixed-size buffers, use sizeof() to prevent lossage when
diff --git a/en/support.sgml b/en/support.sgml
index d3edb18cf3..6dea3b075d 100644
--- a/en/support.sgml
+++ b/en/support.sgml
@@ -1,9 +1,9 @@
+
%includes;
]>
-
+
&header;
@@ -96,7 +96,8 @@
-
CVS (the Concurrent Version System) is the tool we use for
+
CVS
+ (the Concurrent Version System) is the tool we use for
keeping our sources under control. Every change (with
accompanying log message explaining its purpose) from
FreeBSD 2.0 to the present is stored here, and can be
diff --git a/en/usergroups.sgml b/en/usergroups.sgml
index 2e59573274..5c5a4c04f5 100644
--- a/en/usergroups.sgml
+++ b/en/usergroups.sgml
@@ -1,9 +1,9 @@
+
%includes;
]>
-
+
&header;
@@ -96,7 +96,8 @@
- CVS (the Concurrent Version System) is the tool we use for
+
CVS
+ (the Concurrent Version System) is the tool we use for
keeping our sources under control. Every change (with
accompanying log message explaining its purpose) from
FreeBSD 2.0 to the present is stored here, and can be