/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
 
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
 
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
22
 
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
 
        -fsanitize=return -fsanitize=signed-integer-overflow \
24
 
        -fsanitize=bounds -fsanitize=alignment \
25
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
 
13
#DEBUG=-ggdb3
30
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-fstack-protector-all -fPIC
33
 
CPPFLAGS+=-D_FORTIFY_SOURCE=3
34
 
LINK_FORTIFY_LD:=-z relro -z now
35
 
LINK_FORTIFY:=
 
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
LINK_FORTIFY_LD=-z relro -z now
 
18
LINK_FORTIFY=
36
19
 
37
20
# If BROKEN_PIE is set, do not build with -pie
38
21
ifndef BROKEN_PIE
40
23
LINK_FORTIFY += -pie
41
24
endif
42
25
#COVERAGE=--coverage
43
 
OPTIMIZE:=-Os -fno-strict-aliasing
44
 
LANGUAGE:=-std=gnu11
45
 
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
46
 
htmldir:=man
47
 
version:=1.8.17
48
 
SED:=sed
49
 
PKG_CONFIG?=pkg-config
50
 
 
51
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
52
 
        || getent passwd nobody || echo 65534)))
53
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
54
 
        || getent group nogroup || echo 65534)))
55
 
 
56
 
LINUXVERSION:=$(shell uname --kernel-release)
 
26
OPTIMIZE=-Os -fno-strict-aliasing
 
27
LANGUAGE=-std=gnu99
 
28
htmldir=man
 
29
version=1.6.9
 
30
SED=sed
 
31
 
 
32
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
33
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
57
34
 
58
35
## Use these settings for a traditional /usr/local install
59
 
# PREFIX:=$(DESTDIR)/usr/local
60
 
# BINDIR:=$(PREFIX)/sbin
61
 
# CONFDIR:=$(DESTDIR)/etc/mandos
62
 
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
63
 
# MANDIR:=$(PREFIX)/man
64
 
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
65
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
66
 
# STATEDIR:=$(DESTDIR)/var/lib/mandos
67
 
# LIBDIR:=$(PREFIX)/lib
68
 
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
 
36
# PREFIX=$(DESTDIR)/usr/local
 
37
# CONFDIR=$(DESTDIR)/etc/mandos
 
38
# KEYDIR=$(DESTDIR)/etc/mandos/keys
 
39
# MANDIR=$(PREFIX)/man
 
40
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
41
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
42
# LIBDIR=$(PREFIX)/lib
69
43
##
70
44
 
71
45
## These settings are for a package-type install
72
 
PREFIX:=$(DESTDIR)/usr
73
 
BINDIR:=$(PREFIX)/sbin
74
 
CONFDIR:=$(DESTDIR)/etc/mandos
75
 
KEYDIR:=$(DESTDIR)/etc/keys/mandos
76
 
MANDIR:=$(PREFIX)/share/man
77
 
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
78
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
79
 
STATEDIR:=$(DESTDIR)/var/lib/mandos
80
 
LIBDIR:=$(shell \
 
46
PREFIX=$(DESTDIR)/usr
 
47
CONFDIR=$(DESTDIR)/etc/mandos
 
48
KEYDIR=$(DESTDIR)/etc/keys/mandos
 
49
MANDIR=$(PREFIX)/share/man
 
50
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
51
STATEDIR=$(DESTDIR)/var/lib/mandos
 
52
LIBDIR=$(shell \
81
53
        for d in \
82
 
        "/usr/lib/`dpkg-architecture \
83
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
54
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
84
55
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
85
56
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
86
57
                        echo "$(DESTDIR)$$d"; \
87
58
                        break; \
88
59
                fi; \
89
60
        done)
90
 
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
91
61
##
92
62
 
93
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
94
 
                        --variable=systemdsystemunitdir)
95
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
96
 
                        --variable=tmpfilesdir)
97
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
98
 
                        --variable=sysusersdir)
 
63
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
99
64
 
100
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
101
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
102
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
103
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
104
 
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
105
 
        || gpgme-config --cflags; getconf LFS_CFLAGS)
106
 
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
107
 
        || gpgme-config --libs; getconf LFS_LIBS; \
 
65
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
 
66
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
 
67
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
 
68
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
 
69
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
70
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
108
71
        getconf LFS_LDFLAGS)
109
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
110
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
111
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
112
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
113
72
 
114
73
# Do not change these two
115
74
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
116
 
        $(LANGUAGE) -DVERSION='"$(version)"'
117
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
118
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
75
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 
76
        -DVERSION='"$(version)"'
 
77
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
119
78
 
120
79
# Commands to format a DocBook <refentry> document into a manual page
121
80
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
127
86
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
128
87
        $(notdir $<); \
129
88
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
130
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
131
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
132
 
        $(notdir $@); fi >/dev/null)
 
89
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
90
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
91
        fi >/dev/null)
133
92
 
134
93
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
135
94
        --param make.year.ranges                1 \
141
100
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
142
101
        $<; $(HTMLPOST) $@)
143
102
# Fix citerefentry links
144
 
HTMLPOST:=$(SED) --in-place \
 
103
HTMLPOST=$(SED) --in-place \
145
104
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
146
105
 
147
 
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
106
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
148
107
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
149
108
        plugins.d/plymouth
150
 
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
151
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
152
 
        $(PLUGIN_HELPERS)
153
 
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
154
 
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
109
CPROGS=plugin-runner $(PLUGINS)
 
110
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
111
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
155
112
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
156
 
        dracut-module/password-agent.8mandos \
157
113
        plugins.d/mandos-client.8mandos \
158
114
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
159
115
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
160
116
        plugins.d/plymouth.8mandos intro.8mandos
161
117
 
162
 
htmldocs:=$(addsuffix .xhtml,$(DOCS))
163
 
 
164
 
objects:=$(addsuffix .o,$(CPROGS))
165
 
 
166
 
.PHONY: all
 
118
htmldocs=$(addsuffix .xhtml,$(DOCS))
 
119
 
 
120
objects=$(addsuffix .o,$(CPROGS))
 
121
 
167
122
all: $(PROGS) mandos.lsm
168
123
 
169
 
.PHONY: doc
170
124
doc: $(DOCS)
171
125
 
172
 
.PHONY: html
173
126
html: $(htmldocs)
174
127
 
175
128
%.5: %.xml common.ent legalnotice.xml
234
187
                overview.xml legalnotice.xml
235
188
        $(DOCBOOKTOHTML)
236
189
 
237
 
dracut-module/password-agent.8mandos: \
238
 
                dracut-module/password-agent.xml common.ent \
239
 
                overview.xml legalnotice.xml
240
 
        $(DOCBOOKTOMAN)
241
 
dracut-module/password-agent.8mandos.xhtml: \
242
 
                dracut-module/password-agent.xml common.ent \
243
 
                overview.xml legalnotice.xml
244
 
        $(DOCBOOKTOHTML)
245
 
 
246
190
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
247
191
                                        common.ent \
248
192
                                        mandos-options.xml \
291
235
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
292
236
                $@)
293
237
 
294
 
# Does the linker support the --no-warn-execstack option?
295
 
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
296
 
# These programs use nested functions, which uses an executable stack
297
 
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
298
 
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
299
 
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
300
 
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
301
 
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
302
 
endif
303
 
 
304
 
# Need to add the GnuTLS, Avahi and GPGME libraries
305
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
306
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
307
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
308
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
309
 
 
310
 
# Need to add the libnl-route library
311
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
312
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
313
 
 
314
 
# Need to add the GLib and pthread libraries
315
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
316
 
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
317
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
318
 
 
319
 
.PHONY: clean
 
238
plugins.d/mandos-client: plugins.d/mandos-client.c
 
239
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
240
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
241
 
 
242
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
243
        check run-client run-server install install-html \
 
244
        install-server install-client-nokey install-client uninstall \
 
245
        uninstall-server uninstall-client purge purge-server \
 
246
        purge-client
 
247
 
320
248
clean:
321
249
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
322
250
 
323
 
.PHONY: distclean
324
251
distclean: clean
325
 
.PHONY: mostlyclean
326
252
mostlyclean: clean
327
 
.PHONY: maintainer-clean
328
253
maintainer-clean: clean
329
254
        -rm --force --recursive keydir confdir statedir
330
255
 
331
 
.PHONY: check
332
 
check: all
 
256
check:  all
333
257
        ./mandos --check
334
258
        ./mandos-ctl --check
335
 
        ./mandos-keygen --version
336
 
        ./plugin-runner --version
337
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
338
 
        ./dracut-module/password-agent --test
339
259
 
340
260
# Run the client with a local config and key
341
 
.PHONY: run-client
342
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
343
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
344
 
        @echo '######################################################'
345
 
        @echo '# The following error messages are harmless and can  #'
346
 
        @echo '#  be safely ignored:                                #'
347
 
        @echo '## From plugin-runner:                               #'
348
 
        @echo '# setgid: Operation not permitted                    #'
349
 
        @echo '# setuid: Operation not permitted                    #'
350
 
        @echo '## From askpass-fifo:                                #'
351
 
        @echo '# mkfifo: Permission denied                          #'
352
 
        @echo '## From mandos-client:                               #'
353
 
        @echo '# Failed to raise privileges: Operation not permi... #'
354
 
        @echo '# Warning: network hook "*" exited with status *     #'
355
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
356
 
        @echo '# Failed to bring up interface "*": Operation not... #'
357
 
        @echo '#                                                    #'
358
 
        @echo '# (The messages are caused by not running as root,   #'
359
 
        @echo '# but you should NOT run "make run-client" as root   #'
360
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
361
 
        @echo '# root, which is also NOT recommended.)              #'
362
 
        @echo '######################################################'
 
261
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
262
        @echo "###################################################################"
 
263
        @echo "# The following error messages are harmless and can be safely     #"
 
264
        @echo "# ignored.  The messages are caused by not running as root, but   #"
 
265
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
 
266
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
 
267
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
268
        @echo "#                     setuid: Operation not permitted             #"
 
269
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
270
        @echo "# From mandos-client:                                             #"
 
271
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
272
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
273
        @echo "###################################################################"
363
274
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
364
275
        ./plugin-runner --plugin-dir=plugins.d \
365
 
                --plugin-helper-dir=plugin-helpers \
366
276
                --config-file=plugin-runner.conf \
367
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
277
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
368
278
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
369
279
                $(CLIENTARGS)
370
280
 
371
281
# Used by run-client
372
 
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
282
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
373
283
        install --directory keydir
374
284
        ./mandos-keygen --dir keydir --force
375
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
376
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
377
 
        fi
378
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
379
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
380
 
        fi
381
285
 
382
286
# Run the server with a local config
383
 
.PHONY: run-server
384
287
run-server: confdir/mandos.conf confdir/clients.conf statedir
385
288
        ./mandos --debug --no-dbus --configdir=confdir \
386
289
                --statedir=statedir $(SERVERARGS)
387
290
 
388
291
# Used by run-server
389
292
confdir/mandos.conf: mandos.conf
390
 
        install -D --mode=u=rw,go=r $^ $@
391
 
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
392
 
        install -D --mode=u=rw $< $@
 
293
        install --directory confdir
 
294
        install --mode=u=rw,go=r $^ $@
 
295
confdir/clients.conf: clients.conf keydir/seckey.txt
 
296
        install --directory confdir
 
297
        install --mode=u=rw $< $@
393
298
# Add a client password
394
299
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
395
300
statedir:
396
301
        install --directory statedir
397
302
 
398
 
.PHONY: install
399
303
install: install-server install-client-nokey
400
304
 
401
 
.PHONY: install-html
402
305
install-html: html
403
 
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
 
306
        install --directory $(htmldir)
 
307
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
404
308
                $(htmldocs)
405
309
 
406
 
.PHONY: install-server
407
310
install-server: doc
 
311
        install --directory $(CONFDIR)
408
312
        if install --directory --mode=u=rwx --owner=$(USER) \
409
313
                --group=$(GROUP) $(STATEDIR); then \
410
314
                :; \
411
315
        elif install --directory --mode=u=rwx $(STATEDIR); then \
412
316
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
413
317
        fi
414
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
415
 
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
416
 
                        $(TMPFILES)/mandos.conf; \
417
 
        fi
418
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
419
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
420
 
                        $(SYSUSERS)/mandos.conf; \
421
 
        fi
422
 
        install --directory $(BINDIR)
423
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
424
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
318
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
319
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
425
320
                mandos-ctl
426
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
321
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
427
322
                mandos-monitor
428
 
        install --directory $(CONFDIR)
429
323
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
430
324
                mandos.conf
431
325
        install --mode=u=rw --target-directory=$(CONFDIR) \
432
326
                clients.conf
433
 
        install -D --mode=u=rw,go=r dbus-mandos.conf \
434
 
                $(DBUSPOLICYDIR)/mandos.conf
435
 
        install -D --mode=u=rwx,go=rx init.d-mandos \
 
327
        install --mode=u=rw,go=r dbus-mandos.conf \
 
328
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
329
        install --mode=u=rwx,go=rx init.d-mandos \
436
330
                $(DESTDIR)/etc/init.d/mandos
437
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
438
 
                install -D --mode=u=rw,go=r mandos.service \
439
 
                        $(SYSTEMD); \
 
331
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
332
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
440
333
        fi
441
 
        install -D --mode=u=rw,go=r default-mandos \
 
334
        install --mode=u=rw,go=r default-mandos \
442
335
                $(DESTDIR)/etc/default/mandos
443
336
        if [ -z $(DESTDIR) ]; then \
444
337
                update-rc.d mandos defaults 25 15;\
445
338
        fi
446
 
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
447
339
        gzip --best --to-stdout mandos.8 \
448
340
                > $(MANDIR)/man8/mandos.8.gz
449
341
        gzip --best --to-stdout mandos-monitor.8 \
457
349
        gzip --best --to-stdout intro.8mandos \
458
350
                > $(MANDIR)/man8/intro.8mandos.gz
459
351
 
460
 
.PHONY: install-client-nokey
461
352
install-client-nokey: all doc
 
353
        install --directory $(LIBDIR)/mandos $(CONFDIR)
462
354
        install --directory --mode=u=rwx $(KEYDIR) \
463
 
                $(LIBDIR)/mandos/plugins.d \
464
 
                $(LIBDIR)/mandos/plugin-helpers
465
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
466
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
467
 
                        $(SYSUSERS)/mandos-client.conf; \
468
 
        fi
 
355
                $(LIBDIR)/mandos/plugins.d
469
356
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
470
 
                install --directory \
471
 
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
472
 
                        "$(CONFDIR)/plugin-helpers"; \
 
357
                install --mode=u=rwx \
 
358
                        --directory "$(CONFDIR)/plugins.d"; \
473
359
        fi
474
 
        install --directory --mode=u=rwx,go=rx \
 
360
        install --mode=u=rwx,go=rx --directory \
475
361
                "$(CONFDIR)/network-hooks.d"
476
362
        install --mode=u=rwx,go=rx \
477
363
                --target-directory=$(LIBDIR)/mandos plugin-runner
478
 
        install --mode=u=rwx,go=rx \
479
 
                --target-directory=$(LIBDIR)/mandos \
480
 
                mandos-to-cryptroot-unlock
481
 
        install --directory $(BINDIR)
482
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
364
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
483
365
                mandos-keygen
484
366
        install --mode=u=rwx,go=rx \
485
367
                --target-directory=$(LIBDIR)/mandos/plugins.d \
499
381
        install --mode=u=rwxs,go=rx \
500
382
                --target-directory=$(LIBDIR)/mandos/plugins.d \
501
383
                plugins.d/plymouth
502
 
        install --mode=u=rwx,go=rx \
503
 
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
504
 
                plugin-helpers/mandos-client-iprouteadddel
505
 
        install -D initramfs-tools-hook \
 
384
        install initramfs-tools-hook \
506
385
                $(INITRAMFSTOOLS)/hooks/mandos
507
 
        install -D --mode=u=rw,go=r initramfs-tools-conf \
508
 
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
509
 
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
510
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
511
 
        install -D initramfs-tools-script \
 
386
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
 
387
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
388
        install initramfs-tools-script \
512
389
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
513
 
        install -D initramfs-tools-script-stop \
514
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
515
 
        install -D --mode=u=rw,go=r \
516
 
                --target-directory=$(DRACUTMODULE) \
517
 
                dracut-module/ask-password-mandos.path \
518
 
                dracut-module/ask-password-mandos.service
519
 
        install --mode=u=rwxs,go=rx \
520
 
                --target-directory=$(DRACUTMODULE) \
521
 
                dracut-module/module-setup.sh \
522
 
                dracut-module/cmdline-mandos.sh \
523
 
                dracut-module/password-agent
524
390
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
525
 
        install --directory $(MANDIR)/man8
526
391
        gzip --best --to-stdout mandos-keygen.8 \
527
392
                > $(MANDIR)/man8/mandos-keygen.8.gz
528
393
        gzip --best --to-stdout plugin-runner.8mandos \
539
404
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
540
405
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
541
406
                > $(MANDIR)/man8/plymouth.8mandos.gz
542
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
543
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
544
407
 
545
 
.PHONY: install-client
546
408
install-client: install-client-nokey
547
409
# Post-installation stuff
548
 
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
549
 
        if command -v update-initramfs >/dev/null; then \
550
 
            update-initramfs -k all -u; \
551
 
        elif command -v dracut >/dev/null; then \
552
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
553
 
                if [ -w "$$initrd" ]; then \
554
 
                    chmod go-r "$$initrd"; \
555
 
                    dracut --force "$$initrd"; \
556
 
                fi; \
557
 
            done; \
558
 
        fi
 
410
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 
411
        update-initramfs -k all -u
559
412
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
560
413
 
561
 
.PHONY: uninstall
562
414
uninstall: uninstall-server uninstall-client
563
415
 
564
 
.PHONY: uninstall-server
565
416
uninstall-server:
566
 
        -rm --force $(BINDIR)/mandos \
567
 
                $(BINDIR)/mandos-ctl \
568
 
                $(BINDIR)/mandos-monitor \
 
417
        -rm --force $(PREFIX)/sbin/mandos \
 
418
                $(PREFIX)/sbin/mandos-ctl \
 
419
                $(PREFIX)/sbin/mandos-monitor \
569
420
                $(MANDIR)/man8/mandos.8.gz \
570
421
                $(MANDIR)/man8/mandos-monitor.8.gz \
571
422
                $(MANDIR)/man8/mandos-ctl.8.gz \
574
425
        update-rc.d -f mandos remove
575
426
        -rmdir $(CONFDIR)
576
427
 
577
 
.PHONY: uninstall-client
578
428
uninstall-client:
579
429
# Refuse to uninstall client if /etc/crypttab is explicitly configured
580
430
# to use it.
581
431
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
582
432
                $(DESTDIR)/etc/crypttab
583
 
        -rm --force $(BINDIR)/mandos-keygen \
 
433
        -rm --force $(PREFIX)/sbin/mandos-keygen \
584
434
                $(LIBDIR)/mandos/plugin-runner \
585
435
                $(LIBDIR)/mandos/plugins.d/password-prompt \
586
436
                $(LIBDIR)/mandos/plugins.d/mandos-client \
591
441
                $(INITRAMFSTOOLS)/hooks/mandos \
592
442
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
593
443
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
594
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
595
 
                $(DRACUTMODULE)/ask-password-mandos.path \
596
 
                $(DRACUTMODULE)/ask-password-mandos.service \
597
 
                $(DRACUTMODULE)/module-setup.sh \
598
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
599
 
                $(DRACUTMODULE)/password-agent \
600
444
                $(MANDIR)/man8/mandos-keygen.8.gz \
601
445
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
602
446
                $(MANDIR)/man8/mandos-client.8mandos.gz
605
449
                $(MANDIR)/man8/splashy.8mandos.gz \
606
450
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
607
451
                $(MANDIR)/man8/plymouth.8mandos.gz \
608
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
609
452
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
610
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
611
 
        if command -v update-initramfs >/dev/null; then \
612
 
            update-initramfs -k all -u; \
613
 
        elif command -v dracut >/dev/null; then \
614
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
615
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
616
 
            done; \
617
 
        fi
 
453
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
454
        update-initramfs -k all -u
618
455
 
619
 
.PHONY: purge
620
456
purge: purge-server purge-client
621
457
 
622
 
.PHONY: purge-server
623
458
purge-server: uninstall-server
624
459
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
625
460
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
626
461
                $(DESTDIR)/etc/default/mandos \
627
462
                $(DESTDIR)/etc/init.d/mandos \
 
463
                $(SYSTEMD)/mandos.service \
628
464
                $(DESTDIR)/run/mandos.pid \
629
465
                $(DESTDIR)/var/run/mandos.pid
630
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
631
 
                -rm --force -- $(SYSTEMD)/mandos.service; \
632
 
        fi
633
466
        -rmdir $(CONFDIR)
634
467
 
635
 
.PHONY: purge-client
636
468
purge-client: uninstall-client
637
 
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
469
        -shred --remove $(KEYDIR)/seckey.txt
638
470
        -rm --force $(CONFDIR)/plugin-runner.conf \
639
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
640
 
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
471
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
641
472
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)