=== modified file 'Makefile'
--- Makefile	2008-09-04 21:44:53 +0000
+++ Makefile	2008-09-05 18:19:52 +0000
@@ -17,6 +17,8 @@
 PREFIX=$(DESTDIR)/usr
 # CONFDIR=/usr/local/lib/mandos
 CONFDIR=$(DESTDIR)/etc/mandos
+# KEYDIR=/usr/local/lib/mandos/keys
+KEYDIR=$(DESTDIR)/etc/keys/mandos
 # MANDIR=/usr/local/man
 MANDIR=$(DESTDIR)/usr/share/man
 
@@ -121,22 +123,26 @@
 # Used by run-server
 confdir/mandos.conf: mandos.conf
 	install --directory confdir
-	install --mode=0644 $^ $@
+	install --mode=u=rw,go=r $^ $@
 confdir/clients.conf: clients.conf keydir/seckey.txt
 	install --directory confdir
-	install --mode=0640 $< $@
+	install --mode=u=rw,g=r $< $@
 # Add a client password
 	./mandos-keygen --dir keydir --password >> $@
 
 install: install-server install-client
 
 install-server: doc
-	install --directory --parents $(CONFDIR) $(MANDIR)/man5 \
+	install --directory $(CONFDIR) $(MANDIR)/man5 \
 		$(MANDIR)/man8
-	install --mode=0755 mandos $(PREFIX)/sbin/mandos
-	install --mode=0644 --target-directory=$(CONFDIR) mandos.conf
-	install --mode=0640 --target-directory=$(CONFDIR) \
+	install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
+	install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
+		mandos.conf
+	install --mode=u=rw,g=r --target-directory=$(CONFDIR) \
 		clients.conf
+	install --mode=u=rwx,go=rx init.d-mandos /etc/init.d/mandos
+	install --mode=u=rw,go=r default-mandos /etc/default/mandos
+	update-rc.d mandos defaults
 	gzip --best --to-stdout mandos.8 \
 		> $(MANDIR)/man8/mandos.8.gz
 	gzip --best --to-stdout mandos.conf.5 \
@@ -145,26 +151,35 @@
 		> $(MANDIR)/man5/mandos-clients.conf.5.gz
 
 install-client: all doc /usr/share/initramfs-tools/hooks/.
-	install --directory --parents $(PREFIX)/lib/mandos \
-		$(CONFDIR) $(MANDIR)/man8
-	install --directory --mode=0700 $(PREFIX)/lib/mandos/plugins.d
-	chmod u=rwx,g=,o= $(PREFIX)/lib/mandos/plugins.d
-	install --mode=0755 --target-directory=$(PREFIX)/lib/mandos \
-		plugin-runner
-	install --mode=0755 --target-directory=$(PREFIX)/sbin \
+	install --directory $(PREFIX)/lib/mandos $(CONFDIR) \
+		$(MANDIR)/man8
+	install --directory --mode=u=rwx $(KEYDIR)
+	install --directory --mode=u=rwx \
+		$(PREFIX)/lib/mandos/plugins.d
+	if [ "$(CONFDIR)/plugins.d" \
+			!= "$(PREFIX)/lib/mandos/plugins.d" ]; then \
+			install --directory "$(CONFDIR)/plugins.d"; \
+		fi
+	install --mode=u=rwx,go=rx \
+		--target-directory=$(PREFIX)/lib/mandos plugin-runner
+	install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 		mandos-keygen
-	install --mode=0755 \
+	install --mode=u=rwx,go=rx \
 		--target-directory=$(PREFIX)/lib/mandos/plugins.d \
 		plugins.d/password-prompt
-	install --mode=4755 \
+	install --mode=u=rwxs,go=rx \
 		--target-directory=$(PREFIX)/lib/mandos/plugins.d \
 		plugins.d/password-request
+	install --mode=u=rwx,go=rx \
+		--target-directory=$(PREFIX)/lib/mandos/plugins.d \
+		plugins.d/usplash
 	install initramfs-tools-hook \
 		/usr/share/initramfs-tools/hooks/mandos
 	install initramfs-tools-hook-conf \
 		/usr/share/initramfs-tools/conf-hooks.d/mandos
 	install initramfs-tools-script \
 		/usr/share/initramfs-tools/scripts/local-top/mandos
+	install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 	gzip --best --to-stdout mandos-keygen.8 \
 		> $(MANDIR)/man8/mandos-keygen.8.gz
 	gzip --best --to-stdout plugin-runner.8mandos \
@@ -173,16 +188,18 @@
 		> $(MANDIR)/man8/password-prompt.8mandos.gz
 	gzip --best --to-stdout plugins.d/password-request.8mandos \
 		> $(MANDIR)/man8/password-request.8mandos.gz
-	-$(PREFIX)/sbin/mandos-keygen
+	-$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 	update-initramfs -k all -u
+	echo "Now run mandos-keygen --password --dir $(KEYDIR)"
 
 uninstall: uninstall-server uninstall-client
 
-uninstall-server: $(PREFIX)/sbin/mandos
+uninstall-server:
 	-rm --force $(PREFIX)/sbin/mandos \
 		$(MANDIR)/man8/mandos.8.gz \
 		$(MANDIR)/man5/mandos.conf.5.gz \
 		$(MANDIR)/man5/mandos-clients.conf.5.gz
+	update-rc.d -f mandos remove
 	-rmdir $(CONFDIR)
 
 uninstall-client:
@@ -207,9 +224,12 @@
 purge: purge-server purge-client
 
 purge-server: uninstall-server
-	-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf
+	-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
+		/etc/default/mandos /etc/init.d/mandos
 	-rmdir $(CONFDIR)
 
 purge-client: uninstall-client
-	-rm --force $(CONFDIR)/seckey.txt $(CONFDIR)/pubkey.txt
-	-rmdir $(CONFDIR) $(CONFDIR)/plugins.d
+	-shred --remove $(KEYDIR)/seckey.txt
+	-rm --force $(CONFDIR)/plugin-runner.conf \
+		$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
+	-rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)

=== modified file 'README'
--- README	2008-09-04 12:38:35 +0000
+++ README	2008-09-05 07:11:24 +0000
@@ -77,10 +77,10 @@
    not likely.  If someone does that, the whole system *will* lock
    itself up completely, since Mandos servers are no longer running.
    
-   For sophisticated attackers who *could* do such a thing, *and* had
-   physical access to the server for enough time, it would be simpler
-   to get a key for an encrypted file system by using hardware memory
-   scanners and reading it right off the memory bus.
+   For sophisticated attackers who *could* do the clever thing, *and*
+   had physical access to the server for enough time, it would be
+   simpler to get a key for an encrypted file system by using hardware
+   memory scanners and reading it right off the memory bus.
 
 ** Replay attacks?
    Nope, the network stuff is all done over TLS, which provides

=== modified file 'TODO'
--- TODO	2008-09-04 07:30:58 +0000
+++ TODO	2008-09-05 07:11:24 +0000
@@ -50,8 +50,6 @@
     This seems to use some kind of "trigger" system
     [[file:/usr/share/doc/dpkg/triggers.txt.gz]]
     dpkg-trigger(1), deb-triggers(5)
-*** Keydir move: /etc/mandos -> /etc/keys/mandos
-    Must create in preinst if not pre-depending on cryptsetup
 *** mandos-keygen
 **** "--passfile" option
      Using the "secfile" option instead of "secret"
@@ -60,6 +58,9 @@
 ** Server-side
 *** [#A] Create mandos user and group for server
 *** [#A] Create /var/run/mandos directory with perm and ownership
+*** [#A] install rc.d script and do update-rc.d
+    between config files and man pages
+
 
 * [#A] Package
 ** /usr/share/initramfs-tools/hooks/mandos

=== added file 'default-mandos'
--- default-mandos	1970-01-01 00:00:00 +0000
+++ default-mandos	2008-09-05 08:38:30 +0000
@@ -0,0 +1,4 @@
+# Directory where configuration files are located.  Default is
+# "/etc/mandos".
+# 
+#CONFIGDIR=/etc/mandos

=== added file 'init.d-mandos'
--- init.d-mandos	1970-01-01 00:00:00 +0000
+++ init.d-mandos	2008-09-05 16:24:33 +0000
@@ -0,0 +1,159 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          mandos
+# Required-Start:    $remote_fs
+# Required-Stop:     $remote_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Mandos server
+# Description:       Gives encrypted passwords to Mandos clients
+### END INIT INFO
+
+# Author: Teddy Hogeborn <teddy@fukt.bsnet.se>
+# Author: Björn Påhlsson <belorn@fukt.bsnet.se>
+#
+# Please remove the "Author" lines above and replace them
+# with your own name if you copy and modify this script.
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="Mandos root file system password server"
+NAME=mandos
+DAEMON=/usr/sbin/$NAME
+DAEMON_ARGS=""
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+if [ -n "$CONFIGDIR" ]; then
+   DAEMON_ARGS="$DAEMON_ARGS --configdir $CONFIGDIR"
+fi
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+		$DAEMON_ARGS \
+		|| return 2
+	# Add code here, if necessary, that waits for the process to be ready
+	# to handle requests from services started subsequently which depend
+	# on this one.  As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	#
+	# If the daemon can reload its configuration without
+	# restarting (for example, when it is sent a SIGHUP),
+	# then implement that here.
+	#
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  #reload|force-reload)
+	#
+	# If do_reload() is not implemented then leave this commented out
+	# and leave 'force-reload' as an alias for 'restart'.
+	#
+	#log_daemon_msg "Reloading $DESC" "$NAME"
+	#do_reload
+	#log_end_msg $?
+	#;;
+  restart|force-reload)
+	#
+	# If the "reload" option is implemented then remove the
+	# 'force-reload' alias
+	#
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+	  	# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:

=== modified file 'initramfs-tools-hook'
--- initramfs-tools-hook	2008-09-04 12:38:35 +0000
+++ initramfs-tools-hook	2008-09-05 07:11:24 +0000
@@ -29,15 +29,28 @@
 
 . /usr/share/initramfs-tools/hook-functions
 
-if [ -d /usr/lib/mandos ]; then
-    prefix=/usr
-elif [ -d /usr/local/lib/mandos ]; then
-    prefix=/usr/local
-else
+for d in /usr /usr/local; do
+    if [ -d "$d"/lib/mandos ]; then
+	prefix="$d"
+	break
+    fi
+done
+if [ -z "$prefix" ]; then
     # Mandos not found
     exit 1
 fi
 
+for d in /etc/keys/mandos /usr/local/lib/mandos/keys; do
+    if [ -d "$d" ]; then
+	keydir="$d"
+	break
+    fi
+done
+if [ -z "$keydir" ]; then
+    # Mandos key directory not found
+    exit 1
+fi
+
 # The Mandos network client uses the network
 auto_add_modules net
 # The Mandos network client uses IPv6
@@ -53,7 +66,7 @@
 mkdir --parents "${DESTDIR}${PLUGINDIR}"
 
 # Copy the Mandos plugin runner
-copy_exec "$prefix"/lib/mandos/plugin-runner "${DESTDIR}${MANDOSDIR}"
+copy_exec "$prefix"/lib/mandos/plugin-runner "${MANDOSDIR}"
 
 # Copy the plugins
 
@@ -66,6 +79,7 @@
     fi
     case "$base" in
 	*~|.*|\#*\#|*.dpkg-old|*.dpkg-new|*.dpkg-divert) : ;;
+	"*") :;;
 	*) copy_exec "$file" "${PLUGINDIR}";;
     esac
 done
@@ -75,6 +89,7 @@
     base="`basename \"$file\"`"
     case "$base" in
 	*~|.*|\#*\#|*.dpkg-old|*.dpkg-new|*.dpkg-divert) : ;;
+	"*") :;;
 	*) copy_exec "$file" "${PLUGINDIR}";;
     esac
 done
@@ -85,8 +100,8 @@
     copy_exec /usr/bin/gpg
 fi
 
-# Key files and config files
-for file in /etc/mandos/*; do
+# Config files and key files 
+for file in /etc/mandos/* "$keydir"/*; do
     if [ -d "$file" ]; then
 	continue
     fi
@@ -115,9 +130,11 @@
 # Reset some other things to sane permissions which we have
 # inadvertently affected with our umask setting.
 for dir in / /bin /etc /keyscripts /sbin /scripts /usr /usr/bin; do
-    chmod a+rX "${DESTDIR}$dir"
+    if [ -d "${DESTDIR}$dir" ]; then
+	chmod a+rX "${DESTDIR}$dir"
+    fi
 done
 for dir in /lib /usr/lib; do
     find "${DESTDIR}$dir" \! -perm /u+rw,g+r -prune -o -print0 \
-	| xargs --null chmod a+rX
+	| xargs --null --no-run-if-empty chmod a+rX
 done

=== modified file 'mandos'
--- mandos	2008-08-27 01:18:25 +0000
+++ mandos	2008-09-05 18:37:28 +0000
@@ -55,6 +55,7 @@
 import stat
 import logging
 import logging.handlers
+import pwd
 
 import dbus
 import gobject
@@ -517,6 +518,7 @@
     Attributes:
         settings:       Server settings
         clients:        Set() of Client objects
+        enabled:        Boolean; whether this server is activated yet
     """
     address_family = socket.AF_INET6
     def __init__(self, *args, **kwargs):
@@ -526,6 +528,7 @@
         if "clients" in kwargs:
             self.clients = kwargs["clients"]
             del kwargs["clients"]
+        self.enabled = False
         return super(type(self), self).__init__(*args, **kwargs)
     def server_bind(self):
         """This overrides the normal server_bind() function
@@ -562,6 +565,11 @@
 #                                            (self.settings
 #                                             ["interface"]))
             return super(type(self), self).server_bind()
+    def server_activate(self):
+        if self.enabled:
+            return super(type(self), self).server_activate()
+    def enable(self):
+        self.enabled = True
 
 
 def string_to_delta(interval):
@@ -758,6 +766,41 @@
     client_config.read(os.path.join(server_settings["configdir"],
                                     "clients.conf"))
     
+    clients = Set()
+    tcp_server = IPv6_TCPServer((server_settings["address"],
+                                 server_settings["port"]),
+                                tcp_handler,
+                                settings=server_settings,
+                                clients=clients)
+    pidfilename = "/var/run/mandos.pid"
+    try:
+        pidfile = open(pidfilename, "w")
+    except IOError, error:
+        logger.error("Could not open file %r", pidfilename)
+    
+    uid = 65534
+    gid = 65534
+    try:
+        uid = pwd.getpwnam("mandos").pw_uid
+    except KeyError:
+        try:
+            uid = pwd.getpwnam("nobody").pw_uid
+        except KeyError:
+            pass
+    try:
+        gid = pwd.getpwnam("mandos").pw_gid
+    except KeyError:
+        try:
+            gid = pwd.getpwnam("nogroup").pw_gid
+        except KeyError:
+            pass
+    try:
+        os.setuid(uid)
+        os.setgid(gid)
+    except OSError, error:
+        if error[0] != errno.EPERM:
+            raise error
+    
     global service
     service = AvahiService(name = server_settings["servicename"],
                            type = "_mandos._tcp", );
@@ -777,7 +820,6 @@
                             avahi.DBUS_INTERFACE_SERVER)
     # End of Avahi example code
     
-    clients = Set()
     def remove_from_clients(client):
         clients.remove(client)
         if not clients:
@@ -805,16 +847,18 @@
         # Close all input and output, do double fork, etc.
         daemon()
     
-    pidfilename = "/var/run/mandos/mandos.pid"
-    pid = os.getpid()
     try:
-        pidfile = open(pidfilename, "w")
+        pid = os.getpid()
         pidfile.write(str(pid) + "\n")
         pidfile.close()
         del pidfile
     except IOError, err:
-        logger.error(u"Could not write %s file with PID %d",
-                     pidfilename, os.getpid())
+        logger.error(u"Could not write to file %r with PID %d",
+                     pidfilename, pid)
+    except NameError:
+        # "pidfile" was never created
+        pass
+    del pidfilename
     
     def cleanup():
         "Cleanup function; run on exit"
@@ -840,11 +884,9 @@
     for client in clients:
         client.start()
     
-    tcp_server = IPv6_TCPServer((server_settings["address"],
-                                 server_settings["port"]),
-                                tcp_handler,
-                                settings=server_settings,
-                                clients=clients)
+    tcp_server.enable()
+    tcp_server.server_activate()
+    
     # Find out what port we got
     service.port = tcp_server.socket.getsockname()[1]
     logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

=== modified file 'mandos-keygen'
--- mandos-keygen	2008-09-04 21:42:02 +0000
+++ mandos-keygen	2008-09-05 16:24:33 +0000
@@ -22,7 +22,7 @@
 
 VERSION="1.0"
 
-KEYDIR="/etc/mandos"
+KEYDIR="/etc/keys/mandos"
 KEYTYPE=DSA
 KEYLENGTH=2048
 SUBKEYTYPE=ELG-E

=== modified file 'mandos.xml'
--- mandos.xml	2008-09-04 13:36:59 +0000
+++ mandos.xml	2008-09-05 16:24:33 +0000
@@ -3,7 +3,7 @@
 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY VERSION "1.0">
 <!ENTITY COMMANDNAME "mandos">
-<!ENTITY TIMESTAMP "2008-09-04">
+<!ENTITY TIMESTAMP "2008-09-05">
 ]>
 
 <refentry xmlns:xi="http://www.w3.org/2001/XInclude">
@@ -379,7 +379,7 @@
 	</listitem>
       </varlistentry>
       <varlistentry>
-	<term><filename>/var/run/mandos/mandos.pid</filename></term>
+	<term><filename>/var/run/mandos.pid</filename></term>
 	<listitem>
 	  <para>
 	    The file containing the process id of
@@ -487,8 +487,8 @@
       <para>
 	Running this <command>&COMMANDNAME;</command> server program
 	should not in itself present any security risk to the host
-	computer running it.  The program does not need any special
-	privileges to run, and is designed to run as a non-root user.
+	computer running it.  The program switches to a non-root user
+	soon after startup.
       </para>
     </refsect2>
     <refsect2 id="CLIENTS">

=== added file 'plugin-runner.conf'
--- plugin-runner.conf	1970-01-01 00:00:00 +0000
+++ plugin-runner.conf	2008-09-05 07:11:24 +0000
@@ -0,0 +1,9 @@
+## This is the configuration file for plugin-runner.  It should be
+## installed as "/etc/mandos/plugin-runner.conf", which will be copied
+## to "/conf/conf.d/mandos/plugin-runner.conf" in the initrd.img file.
+## 
+## The default network interface for password-request(8mandos) is
+## "eth0".  Uncomment this line and change it if necessary.
+## 
+
+#--options-for=password-request:--interface=eth0

=== modified file 'plugin-runner.xml'
--- plugin-runner.xml	2008-09-04 14:04:09 +0000
+++ plugin-runner.xml	2008-09-05 18:19:52 +0000
@@ -3,7 +3,7 @@
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY VERSION "1.0">
 <!ENTITY COMMANDNAME "plugin-runner">
-<!ENTITY TIMESTAMP "2008-09-04">
+<!ENTITY TIMESTAMP "2008-09-05">
 ]>
 
 <refentry xmlns:xi="http://www.w3.org/2001/XInclude">
@@ -564,15 +564,15 @@
     </informalexample>
     <informalexample>
       <para>
-	Run plugins from a different directory and add two
-	options to the <citerefentry><refentrytitle
-	>password-request</refentrytitle>
+	Run plugins from a different directory, read a different
+	configuration file, and add two options to the
+	<citerefentry><refentrytitle >password-request</refentrytitle>
 	<manvolnum>8mandos</manvolnum></citerefentry> plugin:
       </para>
       <para>
 
 <!-- do not wrap this line -->
-<userinput>&COMMANDNAME;  --plugin-dir=plugins.d --options-for=password-request:--pubkey=keydir/pubkey.txt,--seckey=keydir/seckey.txt</userinput>
+<userinput>&COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=password-request:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt</userinput>
 
       </para>
     </informalexample>
@@ -586,7 +586,7 @@
       non-privileged.  This user and group is then what all plugins
       will be started as.  Therefore, the only way to run a plugin as
       a privileged user is to have the set-user-ID or set-group-ID bit
-      set on the plugin executable files (see <citerefentry>
+      set on the plugin executable file (see <citerefentry>
       <refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
       </citerefentry>).
     </para>