Enable WARNS=4 by default, except for:
cpuctl dumplfs hprop ipf iprop-log kadmin kcm kdc kdigest
kimpersonate kstash ktutil makefs ndbootd ntp pppd quot
racoon racoonctl rtadvd sntp sup tcpdchk tcpdmatch tcpdump
traceroute traceroute6 user veriexecgen wsmoused zic
(Mostly third-party applications)

branches: 1.5.6;
try to handle different byte orders.

branches: 1.4.12;
revert previouses

Add a comment indicating why this program is installed 0550, as suggested
by christos@. The comment reads:

# This program is set 0550 because, as security(8) states, it has
# the potential to deplete kernel memory, under certain conditions.

Install paxctl(8) as 0550.

branches: 1.1.2;
Move paxctl from usr.bin/paxctl to usr.sbin/paxctl, and make it an admin
tool (man-page moved from section 1 to section 8).

paxctl(8): it is not a bug that paxctl settings are persistent.

Nor is it a bug that they're applied to the file rather than stored in
some magic secret database where they survive reinstalls, which the
prior wording seems to suggest was the eventual intention.

It is worth noting that they change the target file, so still say that.

paxctl.8: minor grammar/style corrections

paxctl(8): brush up

Tell the user how to list flags right away, not at the very end.

Do not repeat "for the program" 6 times for each flag letter, it's a
noise by itself already and the italics of .Ar program exacerbates it.

Make the list of flags compact but manually add breaks between the
pairs of enable/disable flags.

paxctl(8): fix markup

Use Fl for options.

paxctl(8): Introduce -0 option to clear all PaX flag bits in ELF note.
Part of PR toolchain/52675

branches: 1.16.24;
New sentence, new line.

Merge changes from David H. Gutteridge in PR misc/51612

Thanks!

branches: 1.14.4; 1.14.8; 1.14.10;
Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.12.4; 1.12.10; 1.12.14;
security(7), not (8).

offer some actual information about what PaX might be, and provide
tips for further reading.

try to handle different byte orders.

branches: 1.9.6;
Add Christos to the AUTHORS section.

There's no use for the '-l' flag, so don't document it. Viewing PaX flags
is done by issuing "paxctl file" with no flags, so note that it the
man-page instead.

From Michal Spacek, thanks!

Document ASLR

We should be able to operate on more than one file, like other unix tools.

branches: 1.5.2;
Never use "utilize". It means exactly the same thing as "use", but it
is longer and more cumbersome. It can always be replaced with "use"
without any change in meaning.

Sort sections. Use Po/Pc to avoid weird Xr arguments.

it is segvguard.

Say that Servguard will use fileassoc in the future. From Elad.

branches: 1.1.2;
Move paxctl from usr.bin/paxctl to usr.sbin/paxctl, and make it an admin
tool (man-page moved from section 1 to section 8).

paxctl(8): Introduce -0 option to clear all PaX flag bits in ELF note.
Part of PR toolchain/52675

branches: 1.12.56;
PR/42239: M. Levinson: paxctl(8) fails since binutils 2.19.1 upgrade
binutils-2.19.1 tries to create one note section for all adjacent loadable
note sections, instead of the old behavior where each note is in its own
section. The fix looks at the section headers instead of the program headers
for the note.

easier done with a goto instead of closing in each error.

PR/41332: Jason V. Miller: paxctl(8) leaks file descriptors

Always close(fd) before returning.

Thanks for the report!

branches: 1.9.2;
fix -Wsign-compare issues

try to handle different byte orders.

branches: 1.7.6;
Allow turning ASLR on and off.

Fix typos:

- Mprotect -> MPROTECT
- Servguard -> Segvguard

While here, pad values.

convert __attribute__s to applicable cdefs.h macros

fix usage to say we can take multiple files.

We should be able to operate on more than one file, like other unix tools.

branches: 1.2.4;
Use an elf note to handle pax arguments. This is a temporary solution to
avoid wasting OS flag bits. In the future we'll probably use fileassoc to
achieve this (once there is a way to make fileassoc persistent) or in the
shorter term libelf, so that we can add and remove the note on demand instead
of burning bits on each binary. Of course since this is a tool, this means
that we'll need to think about how to handle libelf...

branches: 1.1.2;
Move paxctl from usr.bin/paxctl to usr.sbin/paxctl, and make it an admin
tool (man-page moved from section 1 to section 8).