the examples.
Diff from Juuso Lapinlampi < wub () partyvan ! eu >, thanks!
ok schwarze@

Work around this particular case by reseeding whenever pid=1, but as guenther@
notes, directly calling clone(2), and then forking to match another pid,
provides other ways to bypass new process detection on Linux.
Hopefully at some point Linux implements something like MAP_INHERIT_ZERO, and
does not invent a corresponding mechanism to subvert it.
Noted by Sebastian Krahmer and the opmsg team.
See http://stealth.openwall.net/crypto/randup.c for a test program.
ok beck@

to /usr/ports/pobj years ago.
OK millert@, ajacoutot@

validate_junk. from Michal Mazurek

OK halex@

OK halex@

OK halex@

Instead, check the return value of fprintf() and fflush()
and call clearerr() before returning on error.  OK jca@

ok and slight improvement, mmcco@
ok semarie@ and encouragement tedu@ krw@

ok and valuable input from millert@

if the data is needed.  Use O_CLOEXEC on the internal fd as MT paranoia.
Fix cast in offset calculation; delete register keyword;
prefer memset() over bzero()
ok millert@

ok visa

ok tedu@

behavior.

ok deraadt@

'file' backend, we no longer have to generate the .db files.
Ok gilles@

This patch adds a new driver for use of virtio-console devices as
ttys.  It's still in an early state and not compiled by default, yet.
Currently it is only wired into amd64. i386 is still missing.
Discussed with uebayasi@, deraadt@

Ok gilles@ jung@ millert@

ports using existing file descriptors.

OK bcook@

OK bcook@ jung@

the daemon is actually running (instead of only when using rc_bg).
This *may* trigger the following side effect: if a daemon starts then stops
right away (because of a config parsing issue for e.g.), then it will slow down
the boot process because rc will wait a bit before considering the start action
failed. But at least it will allow us to detect those daemons and fix them or
their rc.d(8) script.
At least as far as I can tell, all base daemons should cope with it just fine.
ok sthen@ robert@ on an earlier diff

and actually not a "logging" function.  No functional change.

tell you that the daemon succesfully started; prevent this by running a config
check first.
Note that we only do this for those particular daemons, not all that support a
config test mode.
ok benno@ phessler@

ok sthen@ robert@

This is slightly less robust, but RAND_MAX must be one below a power
of two in both variants anyway.
Based on a suggestion by Matthew Martin.
ok tedu@

prodded by tim@, ok mpi@

towards other YES|NO options and drop the error warning.
with and ok tim@, ok rpe@ on an earlier diff

ok deraadt

some time ago by phessler and IIRC also mikeb), and for qname-minimisation

ok jsing@, deraadt@, beck@

From Craig Rodrigues.
ok tedu@

1. Optionally add random "canaries" to the end of an allocation. This
requires increasing the internal size of the allocation slightly, which
probably results in a large effective increase with current power of two
sizing. Therefore, this option is only enabled via 'C'.
2. When writing junk (0xdf) to freed chunks (current default behavior),
check that the junk is still intact when finally freeing the delayed chunk
to catch some potential use after free. This should be pretty cheap so
there's no option to control it separately.
ok deraadt tb

Ok tb@ jung@