Inform about system call memory write protection and stack mapping

violations in system accounting.  This will help to find missbehaving
programs and possible attacks.  The flags bit field is full, so
recycle the PDP-11 compatibility on VAX.  lastcomm(1) prints the
AMAP flag as 'M'.  daily(8) prints a list of affected processes.
OK deraadt@

1 files changed, 5 insertions, 5 deletions

diff --git a/usr.bin/lastcomm/lastcomm.1 b/usr.bin/lastcomm/lastcomm.1
index 02d4df415e1..bd297d6d686 100644
--- a/usr.bin/lastcomm/lastcomm.1
+++ b/usr.bin/lastcomm/lastcomm.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: lastcomm.1,v 1.23 2019/08/11 15:48:08 deraadt Exp $
+.\"	$OpenBSD: lastcomm.1,v 1.24 2019/09/09 20:02:26 bluhm Exp $
 .\"	$NetBSD: lastcomm.1,v 1.5 1995/10/22 01:43:41 ghudson Exp $
 .\"
 .\" Copyright (c) 1980, 1990, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"	@(#)lastcomm.1	8.1 (Berkeley) 6/6/93
 .\"
-.Dd $Mdocdate: August 11 2019 $
+.Dd $Mdocdate: September 9 2019 $
 .Dt LASTCOMM 1
 .Os
 .Sh NAME
@@ -101,9 +101,6 @@ Elapsed time of the process.
 The flags are encoded as follows:
 .Pp
 .Bl -tag -width 6n -compact -offset indent
-.It Li C
-The command was run in PDP-11 compatibility mode
-(VAX only).
 .It Li D
 The command terminated with the generation of a
 .Pa core
@@ -112,6 +109,9 @@ file.
 The command ran after
 a fork, but without a following
 .Xr execve 2 .
+.It Li M
+The command did a system call from writable memory or the stack
+pointer was not in stack memory.
 .It Li P
 The command was terminated due to a
 .Xr pledge 2