Index: share/man/man7/mitigations.7
===================================================================
--- share/man/man7/mitigations.7
+++ share/man/man7/mitigations.7
@@ -50,10 +50,10 @@
 Write XOR Execute page protection policy
 .It
 .Dv PROT_MAX
-".It
-"Read-Only Relocation (RELRO)
-.\".It
-.\"Bind Now
+.It
+Relocation Read-Only (RELRO)
+.It
+Bind Now
 .\".It
 .\"Stack Smashing Protection (SSP)
 .\".It
@@ -192,8 +192,25 @@
 .Xr mprotect
 call, but may not be made executable.
 .\"
-.\".Ss Read-Only Relocation (RELRO)
-.\"
+.Ss Relocation Read-Only (RELRO)
+Relocation Read-Only (RELRO) is a mitigation tool that makes certain portions
+of a program's address space read-only, after relocation processing by
+.Xr rtld 1 .
+In isolation the RELRO option provides
+.Em partial RELRO
+support, where the
+.Xr elf 5
+Procedure Linkage Table (PLT) Global Offset Table (GOT) remains writable to
+support
+.Xr rtld 1
+lazy binding.
+.Pp
+RELRO is is enabled by default.
+The
+.Xr src.conf 5
+build-time option
+.Va WITHOUT_RELRO
+may be used to disable it.
 .Ss BIND_NOW
 The
 .Va WITH_BIND_NOW
@@ -205,11 +222,12 @@
 .Xr rtld 1
 will then perform all relocation processing when the process starts, instead of
 on demand (on the first access to each symbol).
+.Pp
 When enabled in combination with
 .Dv RELRO
 (which is enabled by default) this provides
-.Qt full
-RELRO, the entire GOT (.got and .got.plt) are made read-only at program startup,
+.Em full RELRO .
+The entire GOT (.got and .got.plt) are made read-only at program startup,
 preventing attacks on the relocation table.
 Note that this results in a nonstandard Application Binary Interface (ABI),
 and it is possible that some applications may not function correctly.