Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Fix a couple of typos.

PR: docs/148891
Submitted by: olgeni
MFC after: 1 week

Add some new options to mac_bsdestended. We can now match on:

subject: ranges of uid, ranges of gid, jail id
objects: ranges of uid, ranges of gid, filesystem,
object is suid, object is sgid, object matches subject uid/gid
object type

We can also negate individual conditions. The ruleset language is
a superset of the previous language, so old rules should continue
to work.

These changes require a change to the API between libugidfw and the
mac_bsdextended module. Add a version number, so we can tell if
we're running mismatched versions.

Update man pages to reflect changes, add extra test cases to
test_ugidfw.c and add a shell script that checks that the the
module seems to do what we expect.

Suggestions from: rwatson, trhodes
Reviewed by: trhodes
MFC after: 2 months

Wording nit.

Mechanically kill hard sentence breaks.

Add an 'add' command to ugidfw(8), which permits specifying a new
rule without explicitly specifying a new rule number.

Update copyrights, remove license clause three.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, McAfee Research

mdoc(7) police: markup overhaul.

Approved by: re

Stick .Os between .Dd and .Dt

Cosmetic line-wrapping change that has the side-effect of not producing
the (incorrectly-spaced) output "... Network Associates Inc. under ..."

Remove a superfluous line containing only `.'

Add a man page for ugidfw(8).

Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs