deraadt@ ok.

nobody.  While I do not like running things as nobody since the step
up is very small, we use this for other daemons in inetd.  And it is
still a small step.

From Dries Schellekens

active before /etc/pf.conf is loaded, just in case loading fails (and
leaves the inital set active). ok deraadt@

We could use skeyinfo(1) to check but this is much cheaper.

XXX libraries should not use atexit(3) from within, as program can terminate
with _exit.

suggested by deraadt@.

Tested by various people on various platforms, I'm willing to fix any
breakage this causes.
ok niels@ deraadt@ and mickey@ (after his comments were applied)

From Andr� Lucas <andre@ae-35.com>, fixes pr # 2658.
'Looks good' from miod@, millert@, and krw@.

where each user gets their own file, which is owned by that user.
An old S/Key database may be converted by running "skeyinit -C" as root.
Programs that need to access the S/Key database no longer need to be
setuid root.  They must now be setgid auth instead.

Job names are now "runtime.queue" where runtime is when the job will run
in Unix time format.  This is what SysV at does and allows us to nuke
the .SEQ file.
Historic BSD options for atq and atrm are now implemented;
atq and atrm get their own man pages.
At no longer does anything with the -v flag.  We print the execution
time when jobs are submitted so there is no need.
Most *scanf() usage is gone (one remains in atrun).
Better sanity checks in atrun.
Random style/cleanup.
With these changes we have the best of both worlds; POSIX compliance with
the traditional BSD features.

Also fix a typo; adapted from a patch by Moritz Jodeit

make -> ${MAKE}
add phony targets
remove unnecessary subshells
install kernel in a separate target from building.
some SUDO.
okay deraadt@
(checked bootstrap on i386, should be safe elsewhere, and trivial to fix
anyways)

make -> ${MAKE}
add exec at end of lines
sprinkle with SUDO where needed (not enough for a full release yet)
PHONY targets.
ok millert@, deraadt@

This means that /var/at/at.{allow,deny} must be readable by group
crontab, /var/at/jobs is mode 01770, and /var/at/.SEQ is mode 0660.

These changes were modelled after the Owl version of vixie-cron,
but developed independently.
Our crontab used to send cron SIGUSR1 to tell cron to reread the
spool dir.  Now that crontab is not setuid root this doesn't work.
Instead, crontab pokes cron via a Unix domain socket located in the
tabs dir.
Please note, after these changes, the owner on user crontab files
will have to be changed manually from root to the uid of the
corresponding user for crontab to be usable.  cron itself will accept
tab files owned by either root or the user.
Also, any /var/cron/{allow,deny} files must be readable by group crontab.

Consider this a head-up...

Fixes this for lex and binutils' bfd.
Also, do not install ansidecl.h, we don't really need it, bfd.h uses it,
and we installed it so that bfd worked, so let bfd.h include it directly.
prompted by mickey@

--
From: Sebastian Stark

o) always close .Bl tags;
o) fix usage of .Xr;
millert@ ok

o) remove extra space in the end of line;
o) remove extra blank lines in the end of file;
o) remove .Pp before .Ss;
o) CAVEAT -> CAVEATS;
o) fix usage of .Fa;
o) <blank-line> -> .Pp;
o) wrap long lines;
millert@ ok