MFC r273109:

fget_unlocked currently reads 'fde' which is a structure consisting of
serveral fields. In effect the read is inatomic and may result in
obtaining file pointer with stale or incorrect capabilities.

Example race is with dup2.

Side effect is that capability checks can be circumvented.

Fix the problem with introduction of sequence counters.

MFC r269023,r272503,r272505,r272523,r272567,r272569,r272574:

Prepare fget_unlocked for reading fd table only once.

Some capsicum functions accept fdp + fd and lookup fde based on that.
Add variants which accept fde.

===============================

Add sequence counters with memory barriers.

Current implementation is somewhat simplistic and hackish,
will be improved later after possible memory barrier overhaul.

===============================

Plug capability races.

fp and appropriate capability lookups were not atomic, which could result in
improper capabilities being checked.

This could result either in protection bypass or in a spurious ENOTCAPABLE.

Make fp + capability check atomic with the help of sequence counters.

===============================

Put and #ifdef _KERNEL around the #include for opt_capsicum.h to
hopefully allow the build to finish after r272505.

===============================

filedesc: fix up breakage introduced in 272505

Include sequence counter supports incoditionally [1]. This fixes reprted build
problems with e.g. nvidia driver due to missing opt_capsicum.h.

Replace fishy looking sizeof with offsetof. Make fde_seq the last member in
order to simplify calculations.

===============================

Keep struct filedescent comments within 80-char limit.

===============================

seq_t needs to be visible to userspace

Approved by:	re (kib)
MFS10 r272883
MFC r272474
Fix ZFS ZVOL deadlock and rename issues

Approved by:	re@ (delphij)
Sponsored by:	Multiplay
Revert r270120 (partial), r270122:
  Restore ABI compatibility with 10.0-RELEASE.

Requested by:	many
Reviewed by:	delphij, ache
Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
MFH (r272830): change the hardcoded default back to DES
MFH (r272833): remove last vestige of MD5 password hashes

Approved by:	re (gjb)
MFS r272855, 266846:

  - Do not override sin6_scope_id in LLA when it is already set to non-zero.
    This fixes destination list in output of netstat -r.
  - Plug a memory leak.
  - Add RTM_VERSION check.
  - Fix a bug which can make sysctl() fail when -F is specified.
  - Increase WID_IF_DEFAULT() from 6 to 8 (the default for AF_INET6) because
    we have interfaces with longer names than 6 chars like epairN{a,b}.
  - Style fixes.

MFS r272847:

  - Add rwlock to struct dadq.  A panic could occur when a large number of
    addresses performed DAD at the same time.

MFS r272850:

  - Replace Sun RPC license in TI-RPC library with a 3-clause BSD license,
    with the explicit permission of Sun Microsystems in 2009.

  - Replace Sun Industry Standards Source License for Sun RPC code with a
    3-clause BSD license as specified by Oracle America, Inc. in 2010.
    This license change was approved by Wim Coekaerts, Senior Vice
    President, Linux and Virtualization at Oracle Corporation.

  - Replace Sun RPC license with a 3-clause BSD license.  This license change
    was approved in 2010 by Wim Coekaerts, Senior Vice President, Linux and
    Virtualization at Oracle Corporation.

  - Replace Sun RPC license for TI-RPC library with a 3-clause BSD license,
    with the explicit permission of Sun Microsystems in 2009.
    The code in question in this file was copied from
    lib/libc/rpc/pmap_getport.c.

MFS r272852,r272853:

  - Add relative specification in expiration time.
  - Add proto3 option for RTF_PROTO3.
  - Use %lu for members of struct rt_metrics.
  - Use long explicitly for the time difference.

MFS r272854:

  -  Return 0 if:

      1. "-u N" specified, no -f, and mdN found,
      2. no -u, "-f /pathname" specified, and mdN associated with
         /pathname found,
      3. "-u N" specified, "-f /pathname" specified, and both of them found,
      4. "-l" specified and no -f,
      5. "-l" specified, "-f /pathname" specified, and /pathname found.

    otherwise return -1.

MFS r272856:

  - Move configuration of IPv6 NDP flags to a point before handling ifconfig_IF.
    This fixes a race that a non-IPv4 interface can get an EUI64 LLA even if it
    has IFDISABLED nd6 flag at boot time.

MFS r272857:

  - Cancel DAD for an ifa when the ifp has ND6_IFF_IFDISABLED as early as
    possible and do not clear IN6_IFF_TENTATIVE.  If IFDISABLED was accidentally
    set after a DAD started, TENTATIVE could be cleared because no NA was
    received due to IFDISABLED, and as a result it could prevent DAD when
    manually clearing IFDISABLED after that.

MFS r272858:

  - Fix an issue in range specification handling when a "-foo" is specified in
    ifconfig_IF_aliasN.

MFS r272859:

  - Fix EtherIP.  TOS field must be initialized when the inner protocol is
    PF_LINK, and multicast/broadcast flag should always be dropped because
    the outer protocol uses unicast even when the inner address is not for
    unicast.  It had been broken since r236951 when gif_output() started to
    use IFQ_HANDOFF().

MFS r272860:

  - Recover sin6_scope_id of gateway addresses in riprecv() by using the
    if_index where a RIP packet was received.  This fixes a bug which
    prevented gateway addresses in fe80::/64 from being added.

MFS r272861:

  - Fix rc.d/gssd script to define the default values in a standard way.
  - Use a parameter argument in jls(8) instead of doing grep.

MFS r272862, r272870:

  - Restructure rc.d scripts for kerberos5 daemons.

MFS r272863:

  - Return false status only when adding a route is failed.  It could
    erroneously return false due to an afexists() check loop in routing_start().

MFS r272864:

  - Use ipv6_prefer when at least one ifconfig_IF_ipv6 is configured.

MFS r272865:

  - Fix a bug which prevented mount.fstab parameter from being converted
    when jail_JID_devfs_enable=NO.

MFS r272866:

  -  Fix header output when -P is specified and (ncpus - 1) != maxid.

MFS r272867:

  - Fix a bug which could break extended attributes in a dump output.
    This occurred when a file was >892kB long and had a large data (>1kB)
    in the extended attributes.

MFS r272868, r272869:

  - Make net.inet.ip.sourceroute, net.inet.ip.accept_sourceroute, and
    net.inet.ip.process_options vnet-aware.

MFS r272871:

  - Revert changes in r269180.  It could cause -c N option to enter an
    infinite loop if no reply packet is received.

MFS r272874:

  - Resurrect set_rcvar() as a function to define a rc.conf variable.
    It defines a variable and its default value in load_rc_config() just after
    rc.conf is loaded.  "rcvar" command shows the current and the default
    values.

MFS r272960:

  - Do not add late flag when file= is specified because it has a bad
    side-effect.  The specified file should exist before the fstab line.

Approved by:	re (gjb)
MFH (r272173): offer to enable local_unbound after installation

Approved by:	re (gjb)
MFS r273191: MFC r273060:

Use write_psize instead of write_asize when doing vdev_space_update.
Without this change the accounting of L2ARC usage would be wrong and
give 16EB free space because the number became negative and overflows.

Approved by:	re (gjb)
Merge r273184, r273185 from stable/10:
  - Use rn_detachhead() instead of direct free(9) for radix tables.
  - Free radix mask entries on main radix destroy.

PR:		194078
Approved by:	re (gjb)
MFstable10 r273198:
MFC r273093, r273096:

r273093:
  Merge the following from ^/projects/release-vmimage:
  r272436, r272437, r272792:

  r272436:
    Remove the first argument to panic(), which was initially
    intended to be the exit code, however when a non-zero exit
    code was returned to release/Makefile, this would prevent
    any remaining (and possibly successful) stages from being
    attempted.

  r272437:

    If the vm-base target fails, prevent the vm-image target
    from being run since it cannot possibly succeed.

  r272792:

    Add /usr/local/bin and /usr/local/sbin to PATH, needed
    if third-party software needs to use utilities outside
    of the base system during post-install stages (indexinfo
    is one culprit).

r273096:
  Merge the following from ^/projects/release-vmimage:
  r273076, r273077, r273079, r273095:

  r273076:
    Add a separate make(1) target to release/Makefile to
    build FreeBSD virtual machine disk images for use on
    the Microsoft Azure service.

    For now, this target is not directly connected to the
    build, however can be manually invoked.

    The 'vm-azure' target invokes {amd64,i386}/mk-azure.sh,
    which does the heavy lifting to produce proper VHDs.
    mk-azure.sh uses a configuration file, defaulting to
    tools/azure.conf if otherwise unset.

  r273077:
    Clear VM_RC_LIST.

  r273079:
    Fix signal list to trigger umount(8).

  r273095:
    Output an informational message when mkimg(1) runs, so it
    does not appear that the process has stopped while waiting
    for a 'y/n' response when waagent is deprovisioned.

Relnotes:	yes
Approved by:	re (delphij)
Sponsored by:	The FreeBSD Foundation
MFS10 r273161
MFC r273158
Prevent ZFS leaking pool free space

Approved by:	re@ (gjb)
Sponsored by:	Multiplay
MFS10 r273057
MFC r272324
Fix a missed merge introduced in r272883

Approved by:	re@ (gjb)
Sponsored by:	Multiplay
Document r272078, addition of /usr/lib32/compat to the default
ld-elf32.so.1 search path.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Add a section for periodic(8) scripts.
Document r272430, 110.clean-tmps: avoid crossing filesystem
mount boundaries when cleaning /tmp.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Document r272819, mkimg(1) QCOW and QCOW2 support.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Document r273098, options for displaying mkimg(1) internals

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Document r273101, support for building VM images as part of the
release process.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Document r273199, support for building VM images for the Microsoft
Azure platform.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Rewrap a paragraph to conform to FDP style.
Fix a wording nit while here.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Remove empty sections.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
Document the current version of pkg(8) for the release.

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation