How to test for FORTIFY_SOURCE?

classic Classic list List threaded Threaded
16 messages Options
Reply | Threaded
Open this post in threaded view
|

How to test for FORTIFY_SOURCE?

Jeffrey Walton-3
According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
OpenBSD implements glibc bounds checking on certain functions. I am
trying to detect FORTIFY_SOURCE without looking up operating system
names and versions.

The following code works for Linux, but fails under OpenBSD (it is
part of an autoconf test):

    #include <string.h>
    int main(int argc, char** argv)
    {
      [char msg[16];]
      #[strcpy(msg, argv[0]);]
      #[return (int)(msg[0] & ~msg[1]);]
      [memcpy(msg, argv[0], strlen(argv[0]));]
      [return msg[0] != msg[strlen(argv[0])-1];]
    }

I then compile it and scan for the fortified function call:

    if $CC -D_FORTIFY_SOURCE=2 $CPPFLAGS -O2 $CFLAGS fortify_test.c -o
fortify_test.exe;
    then
      count=`readelf --relocs fortify_test.exe | grep -i -c '_chk'`
      if test "$count" -ne 0; then
        AC_MSG_RESULT([yes]); NSD_CPPFLAGS="$NSD_CPPFLAGS -D_FORTIFY_SOURCE=2"
      else
        AC_MSG_RESULT([no])
      fi
    fi

The problem is, OpenBSD is not using the fortified function even
though the destination buffer size can be deduced:

$ readelf --relocs fortify_test.exe | grep -i -c '_chk'
0

And:

$ readelf --relocs fortify_test.exe

Relocation section '.rela.dyn' at offset 0x488 contains 2 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000002168  000000000008 R_X86_64_RELATIVE                    00000000000013e0
000000002160  000300000006 R_X86_64_GLOB_DAT 0000000000000000
_Jv_RegisterClasses + 0

Relocation section '.rela.plt' at offset 0x4b8 contains 7 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000002188  000100000007 R_X86_64_JUMP_SLO 0000000000000000 _csu_finish + 0
000000002190  000200000007 R_X86_64_JUMP_SLO 0000000000000000 exit + 0
000000002198  000300000007 R_X86_64_JUMP_SLO 0000000000000000
_Jv_RegisterClasses + 0
0000000021a0  000400000007 R_X86_64_JUMP_SLO 0000000000000000 atexit + 0
0000000021a8  000500000007 R_X86_64_JUMP_SLO 0000000000000000 strlen + 0
0000000021b0  000600000007 R_X86_64_JUMP_SLO 0000000000000000 memcpy + 0
0000000021b8  000700000007 R_X86_64_JUMP_SLO 0000000000000000
__stack_smash_handler + 0

I expect to see memcpy_chk or strcpy_chk.

Do I have a misunderstanding of OpenBSD's implementation?

If someone could point out what is wrong I would greatly appreciate it.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Stuart Henderson
On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> OpenBSD implements glibc bounds checking on certain functions. I am
> trying to detect FORTIFY_SOURCE without looking up operating system
> names and versions.

That is a NetBSD manual page, it does not apply to OpenBSD.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Jeffrey Walton-3
On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
>
> On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > OpenBSD implements glibc bounds checking on certain functions. I am
> > trying to detect FORTIFY_SOURCE without looking up operating system
> > names and versions.
>
> That is a NetBSD manual page, it does not apply to OpenBSD.

Thanks.

I may be splitting hairs, but the pages title clearly says it is an
OpenBSD man page.

What is the purpose of supplying man pages for the wrong operating
system? It wastes people's time and breaks search. This search does
not produce expected results:
https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org.

If you really want to confuse folks, maybe OpenSD can supply Windows man pages.

Jeff

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Theo de Raadt-2
Jeffrey Walton <[hidden email]> wrote:

> On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
> >
> > On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > > OpenBSD implements glibc bounds checking on certain functions. I am
> > > trying to detect FORTIFY_SOURCE without looking up operating system
> > > names and versions.
> >
> > That is a NetBSD manual page, it does not apply to OpenBSD.
>
> Thanks.
>
> I may be splitting hairs, but the pages title clearly says it is an
> OpenBSD man page.
>
> What is the purpose of supplying man pages for the wrong operating
> system? It wastes people's time and breaks search. This search does
> not produce expected results:
> https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org.
>
> If you really want to confuse folks, maybe OpenSD can supply Windows man pages.

I'm going to stand up and agree.

Ingo -- I think using man.openbsd.org as a "testbed for all possible man
page hierarchies" incorrect.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Martijn van Duren-6
In reply to this post by Jeffrey Walton-3
On 3/18/20 3:59 PM, Jeffrey Walton wrote:

> On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
>>
>> On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
>>> According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
>>> OpenBSD implements glibc bounds checking on certain functions. I am
>>> trying to detect FORTIFY_SOURCE without looking up operating system
>>> names and versions.
>>
>> That is a NetBSD manual page, it does not apply to OpenBSD.
>
> Thanks.
>
> I may be splitting hairs, but the pages title clearly says it is an
> OpenBSD man page.
>
> What is the purpose of supplying man pages for the wrong operating
> system? It wastes people's time and breaks search. This search does
> not produce expected results:
> https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org.
>
> If you really want to confuse folks, maybe OpenSD can supply Windows man pages.
>
> Jeff
>
What do you mean?
Do you mean "OpenBSD manual page server", which clearly states OpenBSD's
the just the server.
From the NAME section: "security — NetBSD security features"
From the DESCRIPTION section: "NetBSD supports a variety of security
    features"
From the footer: "May 21, 2016 NetBSD-8.1"

On the entire page OpenBSD is only mentioned once, NetBSD 16 times, not
including the drop down menu allowing you to select your operating
system + version of choice.

To me this feels similar to someone coming to the list and asking why
they can't find snmpctl on their OpenBSD 6.6 machine, because some
search engine send them to a 6.5 or older page.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Andreas Kusalananda Kähäri-4
In reply to this post by Jeffrey Walton-3
On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote:

> On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
> >
> > On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > > OpenBSD implements glibc bounds checking on certain functions. I am
> > > trying to detect FORTIFY_SOURCE without looking up operating system
> > > names and versions.
> >
> > That is a NetBSD manual page, it does not apply to OpenBSD.
>
> Thanks.
>
> I may be splitting hairs, but the pages title clearly says it is an
> OpenBSD man page.

I have no real connection to the OpenBSD project other than being a long
time user, and I have an interest in documentation.

It says, at the top of the page, it says "OpenBSD manual page server",
i.e. it's a manual page server hosted by the OpenBSD project.  The
link that you mention contains the string "NetBSD-8.1" and the name
of the manual that you're looking at is "security — NetBSD security
features".  Also, "NetBSD-8.1" is repeated in the page footer and the
string "NetBSD" occurs many times throughout the page while "OpenBSD"
really only occurs once.

>
> What is the purpose of supplying man pages for the wrong operating
> system? It wastes people's time and breaks search. This search does
> not produce expected results:
> https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org.
>
> If you really want to confuse folks, maybe OpenSD can supply Windows man pages.
>
> Jeff

It's debatable whether the manuals for systems other than OpenBSD should
be hosted at man.openbsd.org, but citing "confusion" is probably not a
reason to stop providing these.  If you want uptodate manuals for the
system that you're using, I hope that you're using the man(1) command on
the command line and taht you don't rely on the correctness of manuals
found on the web.

I don't think Windows has manuals in man or mandoc format that are free
to host.

--
Andreas (Kusalananda) Kähäri
SciLifeLab, NBIS, ICM
Uppsala University, Sweden

.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Jeffrey Walton-3
On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri
<[hidden email]> wrote:

>
> On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote:
> > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
> > >
> > > On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> > > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > > > OpenBSD implements glibc bounds checking on certain functions. I am
> > > > trying to detect FORTIFY_SOURCE without looking up operating system
> > > > names and versions.
> > >
> > > That is a NetBSD manual page, it does not apply to OpenBSD.
> >
> > Thanks.
> >
> > I may be splitting hairs, but the pages title clearly says it is an
> > OpenBSD man page.
>
> I have no real connection to the OpenBSD project other than being a long
> time user, and I have an interest in documentation.
>
> It says, at the top of the page, it says "OpenBSD manual page server",
> i.e. it's a manual page server hosted by the OpenBSD project.  The
> link that you mention contains the string "NetBSD-8.1" and the name
> of the manual that you're looking at is "security — NetBSD security
> features".  Also, "NetBSD-8.1" is repeated in the page footer and the
> string "NetBSD" occurs many times throughout the page while "OpenBSD"
> really only occurs once.

Hovering the mouse over the open tab says "security(7) - OpenBSD man
pages". I double checked it when I saw the references to NetBSD.

Regarding the references to NetBSD, I thought your sed went sideways.
I assumed OpenBSD and NetBSD were collaborating and shared code and
docs in some places.

Figuring out why the sed was broken was not my task at hand. I was on
the site to figure out why my test for FORTIFY_SOURCE was failing. The
admins can figure that out why the document conversion is not working
they notice it.

Jeff

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Stuart Henderson
On 2020/03/18 11:55, Jeffrey Walton wrote:

> On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri
> <[hidden email]> wrote:
> >
> > On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote:
> > > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:
> > > >
> > > > On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:
> > > > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > > > > OpenBSD implements glibc bounds checking on certain functions. I am
> > > > > trying to detect FORTIFY_SOURCE without looking up operating system
> > > > > names and versions.
> > > >
> > > > That is a NetBSD manual page, it does not apply to OpenBSD.
> > >
> > > Thanks.
> > >
> > > I may be splitting hairs, but the pages title clearly says it is an
> > > OpenBSD man page.
> >
> > I have no real connection to the OpenBSD project other than being a long
> > time user, and I have an interest in documentation.
> >
> > It says, at the top of the page, it says "OpenBSD manual page server",
> > i.e. it's a manual page server hosted by the OpenBSD project.  The
> > link that you mention contains the string "NetBSD-8.1" and the name
> > of the manual that you're looking at is "security — NetBSD security
> > features".  Also, "NetBSD-8.1" is repeated in the page footer and the
> > string "NetBSD" occurs many times throughout the page while "OpenBSD"
> > really only occurs once.
>
> Hovering the mouse over the open tab says "security(7) - OpenBSD man
> pages". I double checked it when I saw the references to NetBSD.
>
> Regarding the references to NetBSD, I thought your sed went sideways.
> I assumed OpenBSD and NetBSD were collaborating and shared code and
> docs in some places.
>
> Figuring out why the sed was broken was not my task at hand. I was on
> the site to figure out why my test for FORTIFY_SOURCE was failing. The
> admins can figure that out why the document conversion is not working
> they notice it.
>
> Jeff

Since OpenBSD does not have FORTIFY_SOURCE it is correct that your test
for it is failing on OpenBSD.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Ingo Schwarze
In reply to this post by Theo de Raadt-2
Hi Theo,

Theo de Raadt wrote on Wed, Mar 18, 2020 at 09:06:25AM -0600:
> Jeffrey Walton <[hidden email]> wrote:

>> What is the purpose of supplying man pages for the wrong operating
>> system?

The purpose is to make it simpler to compare how different systems
work without having to jump back and forth among different sites
using different URI schemes and running different software.  Also,
the man.cgi(8) from the mandoc toolset is way better than the software
running on netbsd.gw.com, leaf.dragonflybsd.org, illumos.org, and
man7.org, which provide neither semantic searching nor tagging/deep
linking of comparable quality.

Note that www.freebsd.org now also runs the man.cgi(8) from the
mandoc toolset - after several years hoping to switch to it, they
finally did it.

>> It wastes people's time and breaks search. This search does
>> not produce expected results:
>> https://www.google.com/search?q=FORTIFY_SOURCE+site%3Aopenbsd.org.

Do not search the web for software documentation.  That's a bad idea
in the first place.  You are likely to end up with documentation for
the wrong version of the software in question, which is exactly
what happened to you here.  Use autoritative documentation for the
system you are interested in, instead.

>> If you really want to confuse folks, maybe OpenSD can supply
>> Windows man pages.

> I'm going to stand up and agree.

You have a point that non-OpenBSD manual pages are better served
from the *portable* mandoc site than from man.openbsd.org.
So i just deleted the non-OpenBSD lines from manpath.conf
on man.openbsd.org.

For now, comparing different systems can be done here:

  https://mandoc.bsd.lv/cgi-bin/man.cgi/

That URI is quite ugly, i'll try to figure out whether i can move
that to simply man.bsd.lv.

> Ingo -- I think using man.openbsd.org as a "testbed for all possible
> man page hierarchies" incorrect.

It was never a testbed, but a production service with several parts
provided nowhere else (well, at least until FreeBSD followed our
lead and started providing something very similar).

For example, for DragonFly, Illumos, and NetBSD, semantic searching
is neither supported by their native apropos(1) on the command line
nor by their own websites.

But since you have a point that such services hardly belong
on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings
like the one witnessed above are unlikely to happen.

Yours,
  Ingo

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Ingo Schwarze
In reply to this post by Jeffrey Walton-3
Hi Jeffrey,

Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400:

> I assumed OpenBSD and NetBSD were collaborating and shared code and
> docs in some places.

To a limited extent, that is true.

For example, NetBSD includes mandoc(1) which is predominantly
developed on OpenBSD while OpenBSD includes editline(7) which
is predominantly developed on NetBSD.

But that doesn't mean either system slavishly copies changes
from the other, nor that components both contain work in
exactly the same way.  Developers of both systems use their
own judgement to decide what to merge from the other system,
and when.

So please do use the documentation from the right system even
for those components that are very similar on both, or you will
sooner or later stumble over some subtle difference.

Yours,
  Ingo

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Theo de Raadt-2
Ingo Schwarze <[hidden email]> wrote:

> Hi Jeffrey,
>
> Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400:
>
> > I assumed OpenBSD and NetBSD were collaborating and shared code and
> > docs in some places.
>
> To a limited extent, that is true.

To a limited extent, it is true that birds and fish are friends.

In other words, it is untrue.  There isn't collaboration.  And there
isn't sharing.  At best there is freely given stuff which is sometimes
taken.  I propose not using the word "share" since people may believe it
is one of the stronger meanings of the word.  At best it is the weakest
meaning.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Luke A. Call
In reply to this post by Ingo Schwarze
On 03-18 19:22, Ingo Schwarze wrote:

> > Ingo -- I think using man.openbsd.org as a "testbed for all possible
> > man page hierarchies" incorrect.
>
> It was never a testbed, but a production service with several parts
> provided nowhere else (well, at least until FreeBSD followed our
> lead and started providing something very similar).
>
> For example, for DragonFly, Illumos, and NetBSD, semantic searching
> is neither supported by their native apropos(1) on the command line
> nor by their own websites.
>
> But since you have a point that such services hardly belong
> on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings
> like the one witnessed above are unlikely to happen.

Providing a simple link from the man.openbsd.org page to the services
on *.bsd.lv might help those who are used to looking in the old
location, while avoiding possible "which bsd" confusion (maybe called
"Some other systems' manuals", or such).  Especially for those not
reading this thread.  Just a thought.


--
Luke Call
My thoughts:  http://lukecall.net  (updated 2020-03-13)

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Ingo Schwarze
In reply to this post by Theo de Raadt-2
Hi,

Theo de Raadt wrote on Wed, Mar 18, 2020 at 12:44:03PM -0600:
> Ingo Schwarze <[hidden email]> wrote:
>> Jeffrey Walton wrote on Wed, Mar 18, 2020 at 11:55:53AM -0400:

>>> I assumed OpenBSD and NetBSD were collaborating and shared code
>>> and docs in some places.

>> To a limited extent, that is true.

> To a limited extent, it is true that birds and fish are friends.
>
> In other words, it is untrue.  There isn't collaboration.

I have definitely collaborated with at least these NetBSD developers
in the past:

 * Joerg Sonnenberger (joerg@)
 * Thomas Klausner (wiz@)
 * Christos Zoulas (christos@)

"Collaboration" in the sense that there was consistent working
together on joint projects for months, with Joerg even for years.
Besides, Sevan Janiyan (sevan@) has been one of the most prolific
mandoc release testers for four years now, to the point that i might
call that collaboration.  Eight other NetBSD developers have provided
minor contributions over the years, the overall effect of which
also feels like systematic collaboration to me.

Similar effects exist for FreeBSD (bapt@) and Debian (stapelberg@)
and to a lesser degree for Illumos (Yuri Pankov) and Void Linux (Leah
Neukirchen).

I even attended a mini-hackathon organized by a NetBSD developer
in the past, and the code both the NetBSD developer and i wrote
there is still part of both OpenBSD and NetBSD.  That is certainly
worth being called collaboration.

> And there isn't sharing.  At best there is freely given stuff which
> is sometimes taken.  I propose not using the word "share" since people
> may believe it is one of the stronger meanings of the word.  At best
> it is the weakest meaning.

It seems true that "freely give" is not as easily misunderstood
as "share".

Yours,
  Ingo

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Luke A. Call
On 03-18 20:29, Ingo Schwarze wrote:
> I have definitely collaborated with at least these NetBSD developers
> in the past:

And a lame but sincere thanks to Ingo, Theo, and everyone else,
for the impressive work freely given, and for patiently tolerating
the rest of us.

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

lists-2
In reply to this post by Jeffrey Walton-3
Wed, 18 Mar 2020 11:55:53 -0400 Jeffrey Walton <[hidden email]>

> On Wed, Mar 18, 2020 at 11:25 AM Andreas Kusalananda Kähäri
> <[hidden email]> wrote:
> >
> > On Wed, Mar 18, 2020 at 10:59:21AM -0400, Jeffrey Walton wrote:  
> > > On Wed, Mar 18, 2020 at 4:26 AM Stuart Henderson <[hidden email]> wrote:  
> > > >
> > > > On 2020-03-18, Jeffrey Walton <[hidden email]> wrote:  
> > > > > According to https://man.openbsd.org/NetBSD-8.1/security.7#FORTIFY_SOURCE
> > > > > OpenBSD implements glibc bounds checking on certain functions. I am
> > > > > trying to detect FORTIFY_SOURCE without looking up operating system
> > > > > names and versions.  
> > > >
> > > > That is a NetBSD manual page, it does not apply to OpenBSD.  
> > >
> > > Thanks.
> > >
> > > I may be splitting hairs, but the pages title clearly says it is an
> > > OpenBSD man page.  
> >
> > I have no real connection to the OpenBSD project other than being a long
> > time user, and I have an interest in documentation.
> >
> > It says, at the top of the page, it says "OpenBSD manual page server",
> > i.e. it's a manual page server hosted by the OpenBSD project.  The
> > link that you mention contains the string "NetBSD-8.1" and the name
> > of the manual that you're looking at is "security — NetBSD security
> > features".  Also, "NetBSD-8.1" is repeated in the page footer and the
> > string "NetBSD" occurs many times throughout the page while "OpenBSD"
> > really only occurs once.  
>
> Hovering the mouse over the open tab says "security(7) - OpenBSD man
> pages". I double checked it when I saw the references to NetBSD.
>
> Regarding the references to NetBSD, I thought your sed went sideways.
> I assumed OpenBSD and NetBSD were collaborating and shared code and
> docs in some places.
>
> Figuring out why the sed was broken was not my task at hand. I was on
> the site to figure out why my test for FORTIFY_SOURCE was failing. The
> admins can figure that out why the document conversion is not working
> they notice it.
>
> Jeff
>

Hi Jeffrey,

I find the ability to check other manual pages so valuable.  People are aware
when they make a mistake, it's theirs for not checking what they are actually
looking at.  Instead of blaming the service available for confusing them like
it's so popular online these days.  The confusion is yours, just please don't
request service degradation for the rest of us because ot that.  These online
manual pages are useful, let's all keep our eyes open and honest about it ;-)

Kind regards,
Anton Lazarov
MScEng EECSIT

Reply | Threaded
Open this post in threaded view
|

Re: How to test for FORTIFY_SOURCE?

Ingo Schwarze
In reply to this post by Luke A. Call
Hi Luke,

Luke A. Call wrote on Wed, Mar 18, 2020 at 12:54:10PM -0600:
> On 03-18 19:22, Ingo Schwarze wrote:
>> Theo de Raadt wrote:

>>> Ingo -- I think using man.openbsd.org as a "testbed for all possible
>>> man page hierarchies" incorrect.

>> It was never a testbed, but a production service with several parts
>> provided nowhere else (well, at least until FreeBSD followed our
>> lead and started providing something very similar).
>>
>> For example, for DragonFly, Illumos, and NetBSD, semantic searching
>> is neither supported by their native apropos(1) on the command line
>> nor by their own websites.
>>
>> But since you have a point that such services hardly belong
>> on *.openbsd.org, they are now on *.bsd.lv, where misunderstandings
>> like the one witnessed above are unlikely to happen.

> Providing a simple link from the man.openbsd.org page to the services
> on *.bsd.lv might help those who are used to looking in the old
> location, while avoiding possible "which bsd" confusion (maybe called
> "Some other systems' manuals", or such).  Especially for those not
> reading this thread.  Just a thought.

Makes sense, done.

Note that in addition to man.openbsd.org, man.bsd.lv is now also
up and running, but the latter will only contain release manual
pages for a number of systems (including OpenBSD) but not
OpenBSD-current.

Yours,
  Ingo