=== modified file 'TODO'
--- TODO	2008-08-27 01:18:25 +0000
+++ TODO	2008-08-29 05:53:59 +0000
@@ -59,26 +59,7 @@
    Must create in preinst if not pre-depending on cryptsetup
 
 * password-prompt
-** [#A] Man page: man8/password-prompt.8mandos
-*** SYNOPSIS
-    Document short options
-*** DESCRIPTION
-    Note that this is more or less a simple getpass(3) wrapper, even
-    though actual use of getpass(3) is not guaranteed.
-*** EXIT STATUS
-*** ENVIRONMENT
-    Document use of "cryptsource" and "crypttarget".
-*** FILES
-*** BUGS
-*** EXAMPLE
-    Examples of normal usage, debug usage, with a prefix, etc.
-*** SECURITY
-    Not much to do here but it is noteworthy to state the danger of
-    not having a fallback option.
-*** SEE ALSO
-    Refer to mandos-client(8mandos) and password-request(8mandos)
-    and also, perhaps, to cryptsetup(8)?
-** Use getpass(3)?
+** [#C] Use getpass(3)?
    Man page says "obsolete", but [[info:libc:getpass][GNU LibC Manual: Reading Passwords]]
    does not.  See also [[http://sources.redhat.com/ml/libc-alpha/2003-05/msg00251.html][Marcus Brinkmann: Re: getpass obsolete?]] and
    [[http://article.gmane.org/gmane.comp.lib.glibc.alpha/4906][Petter Reinholdtsen: Re: getpass obsolete?]], and especially also

=== modified file 'mandos.xml'
--- mandos.xml	2008-08-25 10:41:16 +0000
+++ mandos.xml	2008-08-29 05:53:59 +0000
@@ -448,7 +448,7 @@
 	Normal invocation needs no options:
       </para>
       <para>
-	<userinput>mandos</userinput>
+	<userinput>&COMMANDNAME;</userinput>
       </para>
     </informalexample>
     <informalexample>
@@ -461,7 +461,7 @@
       <para>
 
 <!-- do not wrap this line -->
-<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>
+<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>
 
       </para>
     </informalexample>
@@ -473,7 +473,7 @@
       <para>
 
 <!-- do not wrap this line -->
-<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>
+<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>
 
       </para>
     </informalexample>

=== modified file 'plugins.d/password-prompt.c'
--- plugins.d/password-prompt.c	2008-08-16 16:58:31 +0000
+++ plugins.d/password-prompt.c	2008-08-29 05:53:59 +0000
@@ -73,7 +73,7 @@
     struct argp_option options[] = {
       { .name = "prefix", .key = 'p',
 	.arg = "PREFIX", .flags = 0,
-	.doc = "Prefix used before the passprompt", .group = 2 },
+	.doc = "Prefix shown before the prompt", .group = 2 },
       { .name = "debug", .key = 128,
 	.doc = "Debug mode", .group = 3 },
       { .name = NULL }
@@ -102,7 +102,8 @@
   
     struct argp argp = { .options = options, .parser = parse_opt,
 			 .args_doc = "",
-			 .doc = "Mandos Passprompt -- Provides a passprompt" };
+			 .doc = "Mandos password-prompt -- Read and"
+			 " output a password" };
     ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
     if (ret == ARGP_ERR_UNKNOWN){
       fprintf(stderr, "Unknown error while parsing arguments\n");
@@ -118,6 +119,7 @@
   }
   
   if (tcgetattr(STDIN_FILENO, &t_old) != 0){
+    perror("tcgetattr");
     return EXIT_FAILURE;
   }
   
@@ -179,6 +181,9 @@
   }
   while(true){
     if (quit_now){
+      if(debug){
+	fprintf(stderr, "Interrupted by signal, exiting.\n");
+      }
       status = EXIT_FAILURE;
       break;
     }
@@ -208,8 +213,19 @@
     }
     ret = getline(&buffer, &n, stdin);
     if (ret > 0){
-      fprintf(stdout, "%s", buffer);
       status = EXIT_SUCCESS;
+      /* Make n = data size instead of allocated buffer size */
+      n = (size_t)ret;
+      size_t written = 0;
+      while(written < n){
+	ret = write(STDOUT_FILENO, buffer + written, n - written);
+	if(ret < 0){
+	  perror("write");
+	  status = EXIT_FAILURE;
+	  break;
+	}
+	written += (size_t)ret;
+      }
       break;
     }
     if (ret < 0){
@@ -222,6 +238,11 @@
     /* if(ret == 0), then the only sensible thing to do is to retry to
        read from stdin */
     fputc('\n', stderr);
+    if(debug and not quit_now){
+      /* If quit_now is true, we were interrupted by a signal, and
+	 will print that later, so no need to show this too. */
+      fprintf(stderr, "getline() returned 0, retrying.\n");
+    }
   }
   
   if (debug){
@@ -232,7 +253,8 @@
   }
   
   if (debug){
-    fprintf(stderr, "%s is exiting\n", argv[0]);
+    fprintf(stderr, "%s is exiting with status %d\n", argv[0],
+	    status);
   }
   
   return status;

=== modified file 'plugins.d/password-prompt.xml'
--- plugins.d/password-prompt.xml	2008-08-18 05:24:20 +0000
+++ plugins.d/password-prompt.xml	2008-08-29 05:53:59 +0000
@@ -1,18 +1,18 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<?xml-stylesheet type="text/xsl"
-	href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY VERSION "1.0">
 <!ENTITY COMMANDNAME "password-prompt">
+<!ENTITY TIMESTAMP "2008-08-29">
 ]>
 
 <refentry>
   <refentryinfo>
-    <title>&COMMANDNAME;</title>
-    <!-- NWalsh's docbook scripts use this to generate the footer: -->
-    <productname>&COMMANDNAME;</productname>
+    <title>Mandos Manual</title>
+    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
+    <productname>Mandos</productname>
     <productnumber>&VERSION;</productnumber>
+    <date>&TIMESTAMP;</date>
     <authorgroup>
       <author>
 	<firstname>Björn</firstname>
@@ -31,7 +31,8 @@
     </authorgroup>
     <copyright>
       <year>2008</year>
-      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
+      <holder>Teddy Hogeborn</holder>
+      <holder>Björn Påhlsson</holder>
     </copyright>
     <legalnotice>
       <para>
@@ -41,7 +42,7 @@
 	either version 3 of the License, or (at your option) any
 	later version.
       </para>
-
+      
       <para>
 	This manual page is distributed in the hope that it will
 	be useful, but WITHOUT ANY WARRANTY; without even the
@@ -49,7 +50,7 @@
 	PARTICULAR PURPOSE.  See the GNU General Public License
 	for more details.
       </para>
-
+      
       <para>
 	You should have received a copy of the GNU General Public
 	License along with this program; If not, see
@@ -57,7 +58,7 @@
       </para>
     </legalnotice>
   </refentryinfo>
-
+  
   <refmeta>
     <refentrytitle>&COMMANDNAME;</refentrytitle>
     <manvolnum>8mandos</manvolnum>
@@ -65,146 +66,260 @@
   
   <refnamediv>
     <refname><command>&COMMANDNAME;</command></refname>
-    <refpurpose>
-      Passprompt for luks during boot sequence
-    </refpurpose>
+    <refpurpose>Prompt for a password and output it.</refpurpose>
   </refnamediv>
   
   <refsynopsisdiv>
     <cmdsynopsis>
       <command>&COMMANDNAME;</command>
-      <arg choice='opt'>--prefix<arg choice='plain'>PREFIX</arg></arg>
-      <arg choice='opt'>--debug</arg>
-    </cmdsynopsis>
-    <cmdsynopsis>
-      <command>&COMMANDNAME;</command>
-      <arg choice='plain'>--help</arg>
-    </cmdsynopsis>
-    <cmdsynopsis>
-      <command>&COMMANDNAME;</command>
-      <arg choice='plain'>--usage</arg>
-    </cmdsynopsis>
-    <cmdsynopsis>
-      <command>&COMMANDNAME;</command>
-      <arg choice='plain'>--version</arg>
+      <group choice="opt">
+	<arg choice="plain"><option>-p <replaceable
+	>PREFIX</replaceable></option></arg>
+	<arg choice="plain"><option>--prefix </option><replaceable
+	>PREFIX</replaceable></arg>
+      </group>
+      <arg choice="opt"><option>--debug</option></arg>
+    </cmdsynopsis>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+      <group choice="req">
+	<arg choice="plain"><option>-?</option></arg>
+	<arg choice="plain"><option>--help</option></arg>
+      </group>
+    </cmdsynopsis>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+      <arg choice="plain"><option>--usage</option></arg>
+    </cmdsynopsis>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+      <group choice="req">
+	<arg choice="plain"><option>-V</option></arg>
+	<arg choice="plain"><option>--version</option></arg>
+      </group>
     </cmdsynopsis>    
   </refsynopsisdiv>
-
+  
   <refsect1 id="description">
     <title>DESCRIPTION</title>
     <para>
-      <command>&COMMANDNAME;</command> is a terminal program that ask for
-      passwords during boot sequence. It is a plugin to
-      <firstterm>mandos</firstterm>, and is used as a fallback and
-      alternative to retriving passwords from a mandos server. During
-      boot sequence the user is prompted for the disk password, and
-      when a password is given it then gets forwarded to
-      <acronym>LUKS</acronym>.
+      All <command>&COMMANDNAME;</command> does is prompt for a
+      password and output any given password to standard output.  This
+      is not very useful on its own.  This program is really meant to
+      run as a plugin in the <application>Mandos</application>
+      client-side system, where it is used as a fallback and
+      alternative to retriving passwords from a <application
+      >Mandos</application> server.
+    </para>
+    <para>
+      This program is little more than a <citerefentry><refentrytitle
+      >getpass</refentrytitle><manvolnum>3</manvolnum></citerefentry>
+      wrapper, although actual use of that function is not guaranteed
+      or implied.
     </para>
   </refsect1>
   
   <refsect1 id="options">
     <title>OPTIONS</title>
     <para>
-      Commonly not invoked as command lines but from configuration
-      file of plugin runner.
+      This program is commonly not invoked from the command line; it
+      is normally started by the <application>Mandos</application>
+      plugin runner, see <citerefentry><refentrytitle
+      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
+      </citerefentry>.  Any command line options this program accepts
+      are therefore normally provided by the plugin runner, and not
+      directly.
     </para>
-
+    
     <variablelist>
       <varlistentry>
-	<term><literal>-p</literal>, <literal>--prefix=<replaceable>PREFIX
-	</replaceable></literal></term>
-	<listitem>
-	  <para>
-	    Prefix used before the passprompt
-	  </para>
-	</listitem>
-      </varlistentry>
-      
-      <varlistentry>
-	<term><literal>--debug</literal></term>
-	<listitem>
-	  <para>
-	    Debug mode
-	  </para>
-	</listitem>
-      </varlistentry>
-      
-      <varlistentry>
-	<term><literal>-?</literal>, <literal>--help</literal></term>
-	<listitem>
-	  <para>
-	    Gives a help message
-	  </para>
-	</listitem>
-      </varlistentry>
-      
-      <varlistentry>
-	<term><literal>--usage</literal></term>
-	<listitem>
-	  <para>
-	    Gives a short usage message
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term><literal>-V</literal>, <literal>--version</literal></term>
-	<listitem>
-	  <para>
-	    Prints the program version
+	<term><option>-p</option> <replaceable>PREFIX</replaceable
+	></term>
+	<term><option>--prefix=</option><replaceable
+	>PREFIX</replaceable></term>
+	<listitem>
+	  <para>
+	    Prefix string shown before the password prompt.
+	  </para>
+	</listitem>
+      </varlistentry>
+      
+      <varlistentry>
+	<term><option>--debug</option></term>
+	<listitem>
+	  <para>
+	    Enable debug mode.  This will enable a lot of output to
+	    standard error about what the program is doing.  The
+	    program will still perform all other functions normally.
+	  </para>
+	</listitem>
+      </varlistentry>
+      
+      <varlistentry>
+	<term><option>-?</option></term>
+	<term><option>--help</option></term>
+	<listitem>
+	  <para>
+	    Gives a help message about options and their meanings.
+	  </para>
+	</listitem>
+      </varlistentry>
+      
+      <varlistentry>
+	<term><option>--usage</option></term>
+	<listitem>
+	  <para>
+	    Gives a short usage message.
+	  </para>
+	</listitem>
+      </varlistentry>
+      
+      <varlistentry>
+	<term><option>-V</option></term>
+	<term><option>--version</option></term>
+	<listitem>
+	  <para>
+	    Prints the program version.
 	  </para>
 	</listitem>
       </varlistentry>            
     </variablelist>
   </refsect1>
-
+  
   <refsect1 id="exit_status">
     <title>EXIT STATUS</title>
     <para>
+      If exit status is 0, the output from the program is the password
+      as it was read.  Otherwise, if exit status is other than 0, the
+      program has encountered an error, and any output so far could be
+      corrupt and/or truncated, and should therefore be ignored.
     </para>
   </refsect1>
-
+  
   <refsect1 id="environment">
     <title>ENVIRONMENT</title>
-    <para>
-    </para>
-  </refsect1>
-
-  <refsect1 id="files">
-    <title>FILES</title>
-    <para>
-    </para>
+    <variablelist>
+      <varlistentry>
+	<term><envar>cryptsource</envar></term>
+	<term><envar>crypttarget</envar></term>
+	<listitem>
+	  <para>
+	    If set, these environment variables will be assumed to
+	    contain the source device name and the target device
+	    mapper name, respectively, and will be shown as part of
+	    the prompt.
+	</para>
+	<para>
+	  These variables will normally be inherited from
+	  <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+	  <manvolnum>8mandos</manvolnum></citerefentry>, which will
+	  normally have inherited them from
+	  <filename>/scripts/local-top/cryptroot</filename> in the
+	  initial RAM disk environment, which will have set them from
+	  parsing kernel arguments and
+	  <filename>/conf/conf.d/cryptroot</filename> (also in the
+	  initial RAM disk environment), which in turn will have been
+	  created when the initial RAM disk image was created by
+	  <filename
+	  >/usr/share/initramfs-tools/hooks/cryptroot</filename>, by
+	  extracting the information of the root file system from
+	  <filename >/etc/crypttab</filename>.
+	</para>
+	<para>
+	  This behavior is meant to exactly mirror the behavior of
+	  <command>askpass</command>, the default password prompter.
+	</para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
   </refsect1>
   
   <refsect1 id="bugs">
     <title>BUGS</title>
     <para>
+      None are known at this time.
     </para>
   </refsect1>  
-
+  
   <refsect1 id="example">
     <title>EXAMPLE</title>
     <para>
+      Note that normally, command line options will not be given
+      directly, but via options for the Mandos <citerefentry
+      ><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>.
     </para>
+    <informalexample>
+      <para>
+	Normal invocation needs no options:
+      </para>
+      <para>
+	<userinput>&COMMANDNAME;</userinput>
+      </para>
+    </informalexample>
+    <informalexample>
+      <para>
+	Show a prefix before the prompt; in this case, a host name.
+	It might be useful to be reminded of which host needs a
+	password, in case of KVM switches, etc.
+      </para>
+      <para>
+
+<!-- do not wrap this line -->
+<userinput>&COMMANDNAME; --prefix=host.example.org:</userinput>
+
+      </para>
+    </informalexample>
+    <informalexample>
+      <para>
+	Run in debug mode.
+      </para>
+      <para>
+	<!-- do not wrap this line -->
+	<userinput>&COMMANDNAME; --debug</userinput>
+      </para>
+    </informalexample>
   </refsect1>
-
+  
   <refsect1 id="security">
     <title>SECURITY</title>
     <para>
+      On its own, this program is very simple, and does not exactly
+      present any security risks.  The one thing that could be
+      considered worthy of note is this: This program is meant to be
+      run by <citerefentry><refentrytitle
+      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
+      </citerefentry>, and will, when run standalone, outside, in a
+      normal environment, immediately output on its standard output
+      any presumably secret password it just recieved.  Therefore,
+      when running this program standalone (which should never
+      normally be done), take care not to type in any real secret
+      password by force of habit, since it would then immediately be
+      shown as output.
+    </para>
+    <para>
+      To further alleviate any risk of being locked out of a system,
+      the <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry> has a fallback
+      mode which does the same thing as this program, only with less
+      features.
     </para>
   </refsect1>
-
+  
   <refsect1 id="see_also">
     <title>SEE ALSO</title>
     <para>
-      <citerefentry><refentrytitle>mandos</refentrytitle>
-      <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
-      <refentrytitle>plugin-runner</refentrytitle>
-      <manvolnum>8mandos</manvolnum></citerefentry> and <citerefentry>
-      <refentrytitle>password-request</refentrytitle>
+      <citerefentry><refentrytitle>crypttab</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>
+      <citerefentry><refentrytitle>password-request</refentrytitle>
       <manvolnum>8mandos</manvolnum></citerefentry>
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>,
     </para>
-  </refsect1>  
-  
+  </refsect1>
 </refentry>
+<!-- Local Variables: -->
+<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
+<!-- time-stamp-end: "[\"']>" -->
+<!-- time-stamp-format: "%:y-%02m-%02d" -->
+<!-- End: -->