3
* [[http://www.undeadly.org/cgi?action=article&sid=20110530221728][OpenBSD]]
8
** TODO [#A] Wireless network hook
9
** TODO [#B] Use capabilities instead of seteuid().
10
** TODO [#B] Use struct sockaddr_storage instead of a union
11
** TODO [#B] Use getaddrinfo(hints=AI_NUMERICHOST) instead of inet_pton()
12
** TODO [#B] Use getnameinfo(serv=NULL, NI_NUMERICHOST) instead of inet_ntop()
13
** TODO [#B] Prefer /run/tmp over /tmp, if it exists
14
** TODO [#B] Use in_port_t instead of uint16_t for port numbers.
17
** TODO [#B] use scandir(3) instead of readdir(3)
19
* usplash (Deprecated)
20
** TODO [#A] Make it work again
21
** TODO [#B] use scandir(3) instead of readdir(3)
22
** TODO Use [[info:libc:Argz%20Functions][argz_extract]]
25
** TODO [#B] Drop privileges after opening FIFO.
28
** TODO [#B] lock stdin (with flock()?)
6
** [#B] Temporarily lower kernel log level
7
for less printouts during sucessfull boot.
9
** use strsep instead of strtok?
10
** Do not depend on GnuPG key rings on disk
11
This would mean creating new GnuPG key rings with GPGME by
12
importing the key files from scratch on every program start.
13
** Keydir move: /etc/mandos -> /etc/keys/mandos
14
Must create in preinst if not pre-depending on cryptsetup
35
** TODO handle printing for errors for plugins
36
*** Hook up stderr of plugins, buffer them, and prepend mandos pluig [plugin name]
37
** TODO [#B] use scandir(3) instead of readdir(3)
38
** TODO [#C] use same file name rules as run-parts(8)
39
** kernel command line option for debug info
40
** TODO [#B] Use openat()
19
** [#A] /etc/init.d/mandos-server :teddy:
20
** [#B] Log level :bugs:
21
** /etc/mandos/clients.d/*.conf
22
Watch this directory and add/remove/update clients?
23
** config for TXT record
24
** [#B] Run-time communication with server :bugs:
26
See also [[*Mandos-tools]]
27
** Implement --foreground :bugs:
28
[[info:standards:Option%20Table][Table of Long Options]]
30
[[info:standards:Option%20Table][Table of Long Options]]
31
** Date+time on console log messages :bugs:
33
** delete hook when clients fall out by timeout
35
* Mandos-tools/utilities
36
All of this probably using D-Bus
43
** Use xinclude for common sections
49
*** Update initrd.img after installation
50
This seems to use some kind of "trigger" system
51
[[file:/usr/share/doc/dpkg/triggers.txt.gz]]
52
dpkg-trigger(1), deb-triggers(5)
53
*** Keydir move: /etc/mandos -> /etc/keys/mandos
54
Must create in preinst if not pre-depending on cryptsetup
56
**** "--passfile" option
57
Using the "secfile" option instead of "secret"
58
**** [#A] "--test" option
59
For testing decryption before rebooting.
61
*** [#A] Create mandos user and group for server
62
*** [#A] Create /var/run/mandos directory with perm and ownership
43
** TODO Document why we ignore sigint
44
** TODO [#B] Log level :BUGS:
45
*** TODO /etc/mandos/clients.d/*.conf
46
Watch this directory and add/remove/update clients?
47
** TODO [#C] config for TXT record
48
** TODO Log level dbus option
49
SetLogLevel D-Bus call
50
** TODO Implement --foreground :BUGS:
51
[[info:standards:Option%20Table][Table of Long Options]]
52
** TODO Implement --socket
53
[[info:standards:Option%20Table][Table of Long Options]]
54
** TODO [#C] DBusServiceObjectUsingSuper
55
** TODO [#B] Global enable/disable flag
56
** TODO [#B] By-client countdown on number of secrets given
57
** TODO [#B] Support RFC 3339 time duration syntax
59
*** NeedsPassword(50) - Timeout, default disapprove
60
+ SetPass(u"gazonk", True) -> Approval, persistent
61
+ Approve(False) -> Close client connection immediately
62
** TODO [#C] python-parsedatetime
63
** TODO [#C] systemd/launchd
64
http://0pointer.de/blog/projects/systemd.html
65
http://wiki.debian.org/systemd
66
** TODO Separate logging logic to own object
67
** TODO [#A] Limit approval_delay to max gnutls/tls timeout value
68
** TODO [#B] break the wait on approval_delay if connection dies
69
** TODO Generate Client.runtime_expansions from client options + extra
70
** TODO Allow %%(checker)s as a runtime expansion
71
** TODO Use python-tlslite?
72
** TODO D-Bus AddClient() method on server object
73
** TODO Use org.freedesktop.DBus.Method.NoReply annotation on async methods.
74
** TODO Emit [[http://dbus.freedesktop.org/doc/dbus-specification.html#standard-interfaces-properties][org.freedesktop.DBus.Properties.PropertiesChanged]] signal
75
TODO Deprecate se.recompile.Mandos.Client.PropertyChanged - annotate!
76
TODO Can use "invalidates" annotation to also emit on changed secret.
77
** TODO Support [[http://dbus.freedesktop.org/doc/dbus-specification.html#standard-interfaces-objectmanager][org.freedesktop.DBus.ObjectManager]] interface on server object
78
Deprecate methods GetAllClients(), GetAllClientsWithProperties()
79
and signals ClientAdded and ClientRemoved.
80
** TODO Save state periodically to recover better from hard shutdowns
81
** TODO CheckerCompleted method, deprecate CheckedOK
82
** TODO Secret Service API?
83
http://standards.freedesktop.org/secret-service/
86
** Add mandos contact info in manual pages
89
*** Handle "no D-Bus server" and/or "no Mandos server found" better
90
*** [#B] --dump option
91
** TODO Support RFC 3339 time duration syntax
93
* TODO mandos-dispatch
94
Listens for specified D-Bus signals and spawns shell commands with
98
** TODO help should be toggleable
99
** Urwid client data displayer
100
Better view of client data in the listing
102
** Print a nice "We are sorry" message, save stack trace to log.
103
** Show timeout countdown for approval
106
** TODO "--secfile" option
107
Using the "secfile" option instead of "secret"
108
** TODO [#B] "--test" option
109
For testing decryption before rebooting.
112
** TODO [#C] Implement DEB_BUILD_OPTIONS
113
http://www.debian.org/doc/debian-policy/ch-source.html#s-debianrules-options
65
116
** /usr/share/initramfs-tools/hooks/mandos
66
*** Do not install in initrd.img if configured not to.
67
Use "/etc/initramfs-tools/conf.d/mandos"? Definitely a debconf
69
** /etc/bash_completion.d/mandos
117
*** TODO [#C] use same file name rules as run-parts(8)
118
*** TODO [#C] Do not install in initrd.img if configured not to.
119
Use "/etc/initramfs-tools/hooksconf.d/mandos"?
120
** TODO [#C] /etc/bash_completion.d/mandos
70
121
From XML sources directly?
80
* Announce project on news
81
[[news:comp.os.linux.announce]]
124
** TODO Locate which package moves the other bin/sh when busybox is deactivated
125
** TODO contact owner of package, and ask them to have that shell static in position regardless of busybox
84
128
#+STARTUP: showall
added
removed
TODO
