man-pages-3.15 is released

Gidday,

I've released man-pages-3.15.tar.gz - man pages for Linux

This release is now available for download at:

http://www.kernel.org/pub/linux/docs/man-pages
or ftp://ftp.kernel.org/pub/linux/docs/man-pages

man-pages nowadays also has a public git repository at

git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git

The online changelog is available at
http://www.kernel.org/doc/man-pages/changelog.html
(blogged at
http://linux-man-pages.blogspot.com/2008/12/man-pages-315-is-released.html)
and the current version of the pages is browsable at
http://www.kernel.org/doc/man-pages/
An abridges list of changes that may be of interest to readers of this list is given below.

Cheers,

Michael

==================== Changes in man-pages-3.15 ====================

Released: 2008-12-05, Bucaramanga

New and rewritten pages
-----------------------

makedev.3
Michael Kerrisk
New page for makedev(), major(), and minor() macros

pthread_cleanup_push_defer_np.3
Michael Kerrisk
New page for pthread_cleanup_push_defer_np(3) and pthread_cleanup_pop_restore_np(3)

Newly documented interfaces in existing pages
---------------------------------------------

accept.2
Michael Kerrisk
Document accept4() system call, new in Linux 2.6.28

fmemopen.3
Petr Baudis
Add description of open_wmemstream(3)

tcp.7
Michael Kerrisk
Document MSG_TRUNC flag for TCP sockets

Changes to individual pages
---------------------------

accept.2
Michael Kerrisk
Clarify details when returned address is truncated
If the returned address is truncated, the 'addrlen' argument indicates the actual size of the address, rather than a count of the number of bytes in the truncated buffer.

Also clarify that if 'addr' argument is NULL, then 'addrlen' should is unused, and should also be NULL.

mmap.2
Michael Kerrisk
Loosen language around how 'addr' hint is interpreted
Mel Gorman reported that in Linux 2.6.27, 'addr' is rounded down to a page boundary.

Before kernel 2.6.26, if 'addr' was taken as a hint, it was rounded up to the next page boundary. Since Linux 2.6.24, it is rounded down. Therefore, loosen the description of this point to say that the address is rounded to "a nearby page boundary".

recv.2
Michael Kerrisk
Clarify details when returned address is truncated
If the recvfrom() returned address is truncated, the 'fromlen' argument indicates the actual size of the address, rather than a count of the number of bytes in the truncated buffer.

Also clarify that the 'from' argument can be NULL, in which case 'fromlen' should is unused, and should also be NULL.
Michael Kerrisk
Internet datagram and netlink sockets support MSG_TRUNC for recv(2)
Internet datagram (since Linux 2.4.27/2.6.8),
and netlink (since Linux 2.6.22) sockets support the MSG_TRUNC flag for recv(2).

tcp.7
Michael Kerrisk
Note that MSG_PEEK can be used on out-of-band data

Hello.

The "man 5 nologin" says that:

If the file /etc/nologin *exists*, login (1) will allow access only to root. Other users will be shown the contents of this file and their logins will be refused.

But this description becomes inaccurate when MAC (e.g. SELinux) is enabled.

MAC can deny open("/etc/nologin", O_RDONLY) by root user. Thus,

  # ln /etc/shadow /etc/nologin

will create /etc/nologin which is *not readable* by login(1).
As a result, non-root user's logins are permitted while /etc/nologin *exists*.

I guess pam_nologin is using a code like

fp = fopen("/etc/nologin", "r");
if (fp)

     /* print the contents of /etc/nologin and reject login request. */

So, I think either one of below modifications is needed.

(1) Change the description of manpage like

If the file /etc/nologin *is readable*, login (1) will allow access only to root. Other users will be shown the contents of this file and their logins will be refused.

(2) Change the code of pam_nologin like

fd = open("/etc/nologin", O_RDONLY);
if (fd != EOF || errno != ENOENT)

     /* print the contents of /etc/nologin and reject login request. */

Which one is the better solution?

Regards.

On Sat, 06 Dec 2008 14:04:07 +0900, Tetsuo Handa said:

(Not really a LSM or kernel issue, and I think mtk.man does kernel manpages only. At least on my Fedora and RedHat systems, the 'login' manpage comes from util-linux, so any manpage fixes would go via that route).

Rather than guessing, maybe a check of what the source code actually *does* would be better?

(3) Recognize that a sysadmin who intentionally goes and creates a /etc/nologin via insane means deserves the insane results. You have to go out of your way to actually create a case where the distinction between "exists" and "is readable" matters.

Having said that, we probably *should* fix 'man login' to say 'is readable'.

Hello Tetsuo Handa,

I added the words "and is readable" to nologin.5.

Thanks,

Michael

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Author of "The Linux Programming Interface"; http://man7.org/tlpi/