for ntpd(8), removing the pledge call is a first step: futher redesign will occurs later.
ok reyk@ benno@

On a real mailserver, it's too noisy and may be a privacy concern.
On a machine that's not a mailserver, it's pointless.
Besides, Theo points out that running subsystems that potentially
parse untrusted user data daily, at a predictable time, as root
is not a very good idea in the first place.
Suggested by millert@; gilles@ matthieu@ deraadt@ sthen@ agree

unused for now, but I plan to convert all programs in base to use it in
a future diff. /dev/bpf0 is for compatibility with existing binaries
and is to be removed after a transition period.
ok rpe krw, for the installer part
"Let's see it hit the tree." deraadt

additions and functionality changes.

portmap isn't happy with it as reported by naddy@

We'll see if something else breaks but it's the right thing to do.
discussed with robert@

chance to update the *default* configuration of the important daemons.
Factorize rc.firsttime into a run_upgrade_script() function which takes the
script suffix name as an argument.
i.e. run_upgrade_script sysmerge / run_upgrade_script firsttime
discussed with deraadt@
ok deraadt@ rpe@

does start as root but does not have a root master process and instead
changed its uid.
reported by deraadt@

Noted by zhuk@
OK deraadt@

It works by adding daemon_rtable=$id in /etc/rc.conf.local.
rcctl(8) support coming in a few and so are the man pages bits.
If you want multiple instances of the same daemon running in different
routing tables, just symlink the original rc.d script.
e.g.
# cd /etc/rc.d && ln -s dhcpd dhcpd42
Then enable your daemons as such in rc.conf.local:
dhcpd_flags=
dhcpd42_flags=
dhcpd42_rtable=42
most work done by Jiri B <jirib@devio.us>; with a few tweaks and simplifications
by yours truly
ok robert@
... should make henning happy ;-)

daemon_class, daemon_flags, daemon_timeout, daemon_user, pexp
Add "pexp" as a valid variable to _rc_parse_conf() and sort the list while here.
Besides having an easy way to see how a daemon was started exactly, it opens the
door to rdomain/rtable support in rc.d(8). We need to have as much information
on a daemon as possible if we want to target a specific rtable (using -T) and it
also makes it easier to start multiple instances of the same daemon with similar
flags as a different user...
Of course that only works with rc.d scripts *not* overwritting the default rc_*
functions.
Man page tweaks coming later.
discussed with and ok robert@

order.
with shell script assistance from rpe

The getenv(3) and unsetenv(3) functions already support this.
This will make it easier to emulate the glibc clearenv() function in ports.
Based on a diff from and OK jca@

CUPS wants it to be a symlink, and that is probably the most common
printing system.  Bad idea to constantly spam everybody about that!
Antoine already adjusted the file permissions in pkg/cupsd.rc rev. 1.24.
OK ajacoutot@  (print/cups MAINTAINER).

ok martijn@ semarie@ matthieu@ danj@ benno@

ok sthen@

Michael McConville

data isn't necessary.
ok mpi@, ok&tweak natano@

from ian@

prodded by matthieu@
ok millert@ jung@ sthen@

correctly - logically complete that now by removing MLINKS from base;
authors need only to ensure there is an entry in NAME for any function/
util being added. MLINKS will still work, and remain for perl to ease
upgrades;
ok nicm (curses) bcook (ssl)
ok schwarze, who provided a lot of feedback and assistance
ok tb natano jung

a -reject route can be added. Restores the ability to set an interface route
before daemons are started, lost during the previous simplification.
ok millert mpi

removing its second parameter and the enum() that provided the
values for said parameter.
The function was only called with the second parameter set to one
value (BM_NONBLOCKING) from the enum(). So just do the right thing.
Similar to changes made in smtpd.
While here remove the pointless third parameter from the fcntl(F_GETFL)
call.
No functional change.
ok guenther@ bcook@ deraadt@

ok robert@

that will be needed and make libpthread work when ld.so/libc.a provide an
initial TIB.

ok deraadt@ tb@ (who had the same diff)

ok otto@

ever used.
ok jsg

still specified snprintf() and vsnprintf() based on earlier drafts.
Allows snprintf() and vsnprintf() to be used when _XOPEN_SOURCE is
defined as 500.  OK guenther@

ok @stefan armani@

in libc's hidden/stdlib.h instead of in each .c file that needs one
ok deraadt@ gsoares@ mpi@

void return types 'return no value'. This is obvious and therefore
unneccessary to mention.
We spare rewind(3)'s sentence because espie@ pointed out that it's a
warning - the function masks a potential error.
This commit also adds a sentence to X509_free clarifying that it's
NULL-safe. This bit was discussed with doug@.
ok martijn@, sentiment supported by schwarze@