/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
 
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
 
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
22
 
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
 
        -fsanitize=return -fsanitize=signed-integer-overflow \
24
 
        -fsanitize=bounds -fsanitize=alignment \
25
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
 
13
#DEBUG=-ggdb3
30
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
 
LINK_FORTIFY_LD:=-z relro -z now
34
 
LINK_FORTIFY:=
 
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
LINK_FORTIFY_LD=-z relro -z now
 
18
LINK_FORTIFY=
35
19
 
36
20
# If BROKEN_PIE is set, do not build with -pie
37
21
ifndef BROKEN_PIE
39
23
LINK_FORTIFY += -pie
40
24
endif
41
25
#COVERAGE=--coverage
42
 
OPTIMIZE:=-Os -fno-strict-aliasing
43
 
LANGUAGE:=-std=gnu11
44
 
FEATURES:=-D_FILE_OFFSET_BITS=64
45
 
htmldir:=man
46
 
version:=1.8.12
47
 
SED:=sed
48
 
PKG_CONFIG?=pkg-config
49
 
 
50
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
51
 
        || getent passwd nobody || echo 65534)))
52
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
53
 
        || getent group nogroup || echo 65534)))
54
 
 
55
 
LINUXVERSION:=$(shell uname --kernel-release)
 
26
OPTIMIZE=-Os -fno-strict-aliasing
 
27
LANGUAGE=-std=gnu11
 
28
htmldir=man
 
29
version=1.6.9
 
30
SED=sed
 
31
 
 
32
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
33
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
56
34
 
57
35
## Use these settings for a traditional /usr/local install
58
 
# PREFIX:=$(DESTDIR)/usr/local
59
 
# CONFDIR:=$(DESTDIR)/etc/mandos
60
 
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
61
 
# MANDIR:=$(PREFIX)/man
62
 
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
63
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
64
 
# STATEDIR:=$(DESTDIR)/var/lib/mandos
65
 
# LIBDIR:=$(PREFIX)/lib
 
36
# PREFIX=$(DESTDIR)/usr/local
 
37
# CONFDIR=$(DESTDIR)/etc/mandos
 
38
# KEYDIR=$(DESTDIR)/etc/mandos/keys
 
39
# MANDIR=$(PREFIX)/man
 
40
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
41
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
42
# LIBDIR=$(PREFIX)/lib
66
43
##
67
44
 
68
45
## These settings are for a package-type install
69
 
PREFIX:=$(DESTDIR)/usr
70
 
CONFDIR:=$(DESTDIR)/etc/mandos
71
 
KEYDIR:=$(DESTDIR)/etc/keys/mandos
72
 
MANDIR:=$(PREFIX)/share/man
73
 
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
74
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
75
 
STATEDIR:=$(DESTDIR)/var/lib/mandos
76
 
LIBDIR:=$(shell \
 
46
PREFIX=$(DESTDIR)/usr
 
47
CONFDIR=$(DESTDIR)/etc/mandos
 
48
KEYDIR=$(DESTDIR)/etc/keys/mandos
 
49
MANDIR=$(PREFIX)/share/man
 
50
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
51
STATEDIR=$(DESTDIR)/var/lib/mandos
 
52
LIBDIR=$(shell \
77
53
        for d in \
78
 
        "/usr/lib/`dpkg-architecture \
79
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
54
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
80
55
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
81
56
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
82
57
                        echo "$(DESTDIR)$$d"; \
85
60
        done)
86
61
##
87
62
 
88
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
89
 
                        --variable=systemdsystemunitdir)
90
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
91
 
                        --variable=tmpfilesdir)
92
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
93
 
                        --variable=sysusersdir)
 
63
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
94
64
 
95
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
96
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
97
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
98
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
99
 
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
100
 
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
65
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
 
66
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
 
67
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
 
68
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
 
69
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
70
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
101
71
        getconf LFS_LDFLAGS)
102
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
103
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
104
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
105
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
 
72
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
73
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
106
74
 
107
75
# Do not change these two
108
76
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
109
 
        $(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
110
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
111
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
77
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 
78
        -DVERSION='"$(version)"'
 
79
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
112
80
 
113
81
# Commands to format a DocBook <refentry> document into a manual page
114
82
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
120
88
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
121
89
        $(notdir $<); \
122
90
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
123
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
124
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
125
 
        $(notdir $@); fi >/dev/null)
 
91
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
92
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
93
        fi >/dev/null)
126
94
 
127
95
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
128
96
        --param make.year.ranges                1 \
134
102
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
135
103
        $<; $(HTMLPOST) $@)
136
104
# Fix citerefentry links
137
 
HTMLPOST:=$(SED) --in-place \
 
105
HTMLPOST=$(SED) --in-place \
138
106
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
139
107
 
140
 
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
108
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
141
109
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
142
110
        plugins.d/plymouth
143
 
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
144
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
145
 
        $(PLUGIN_HELPERS)
146
 
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
147
 
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
111
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
112
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
113
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
114
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
148
115
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
149
 
        dracut-module/password-agent.8mandos \
150
116
        plugins.d/mandos-client.8mandos \
151
117
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
152
118
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
153
119
        plugins.d/plymouth.8mandos intro.8mandos
154
120
 
155
 
htmldocs:=$(addsuffix .xhtml,$(DOCS))
156
 
 
157
 
objects:=$(addsuffix .o,$(CPROGS))
158
 
 
159
 
.PHONY: all
 
121
htmldocs=$(addsuffix .xhtml,$(DOCS))
 
122
 
 
123
objects=$(addsuffix .o,$(CPROGS))
 
124
 
160
125
all: $(PROGS) mandos.lsm
161
126
 
162
 
.PHONY: doc
163
127
doc: $(DOCS)
164
128
 
165
 
.PHONY: html
166
129
html: $(htmldocs)
167
130
 
168
131
%.5: %.xml common.ent legalnotice.xml
227
190
                overview.xml legalnotice.xml
228
191
        $(DOCBOOKTOHTML)
229
192
 
230
 
dracut-module/password-agent.8mandos: \
231
 
                dracut-module/password-agent.xml common.ent \
232
 
                overview.xml legalnotice.xml
233
 
        $(DOCBOOKTOMAN)
234
 
dracut-module/password-agent.8mandos.xhtml: \
235
 
                dracut-module/password-agent.xml common.ent \
236
 
                overview.xml legalnotice.xml
237
 
        $(DOCBOOKTOHTML)
238
 
 
239
193
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
240
194
                                        common.ent \
241
195
                                        mandos-options.xml \
284
238
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
285
239
                $@)
286
240
 
287
 
# Need to add the GnuTLS, Avahi and GPGME libraries
288
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
289
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
290
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
291
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
292
 
 
293
 
# Need to add the libnl-route library
294
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
295
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
296
 
 
297
 
# Need to add the GLib and pthread libraries
298
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
299
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
300
 
 
301
 
.PHONY: clean
 
241
plugins.d/mandos-client: plugins.d/mandos-client.c
 
242
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
243
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
244
 
 
245
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
246
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
247
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
248
 
 
249
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
250
        check run-client run-server install install-html \
 
251
        install-server install-client-nokey install-client uninstall \
 
252
        uninstall-server uninstall-client purge purge-server \
 
253
        purge-client
 
254
 
302
255
clean:
303
256
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
304
257
 
305
 
.PHONY: distclean
306
258
distclean: clean
307
 
.PHONY: mostlyclean
308
259
mostlyclean: clean
309
 
.PHONY: maintainer-clean
310
260
maintainer-clean: clean
311
261
        -rm --force --recursive keydir confdir statedir
312
262
 
313
 
.PHONY: check
314
 
check: all
 
263
check:  all
315
264
        ./mandos --check
316
265
        ./mandos-ctl --check
317
 
        ./mandos-keygen --version
318
 
        ./plugin-runner --version
319
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
320
 
        ./dracut-module/password-agent --test
321
266
 
322
267
# Run the client with a local config and key
323
 
.PHONY: run-client
324
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
325
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
326
 
        @echo '######################################################'
327
 
        @echo '# The following error messages are harmless and can  #'
328
 
        @echo '#  be safely ignored:                                #'
329
 
        @echo '## From plugin-runner:                               #'
330
 
        @echo '# setgid: Operation not permitted                    #'
331
 
        @echo '# setuid: Operation not permitted                    #'
332
 
        @echo '## From askpass-fifo:                                #'
333
 
        @echo '# mkfifo: Permission denied                          #'
334
 
        @echo '## From mandos-client:                               #'
335
 
        @echo '# Failed to raise privileges: Operation not permi... #'
336
 
        @echo '# Warning: network hook "*" exited with status *     #'
337
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
338
 
        @echo '# Failed to bring up interface "*": Operation not... #'
339
 
        @echo '#                                                    #'
340
 
        @echo '# (The messages are caused by not running as root,   #'
341
 
        @echo '# but you should NOT run "make run-client" as root   #'
342
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
343
 
        @echo '# root, which is also NOT recommended.)              #'
344
 
        @echo '######################################################'
 
268
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
269
        @echo "###################################################################"
 
270
        @echo "# The following error messages are harmless and can be safely     #"
 
271
        @echo "# ignored.  The messages are caused by not running as root, but   #"
 
272
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
 
273
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
 
274
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
275
        @echo "#                     setuid: Operation not permitted             #"
 
276
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
277
        @echo "# From mandos-client:                                             #"
 
278
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
279
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
280
        @echo "###################################################################"
345
281
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
346
282
        ./plugin-runner --plugin-dir=plugins.d \
347
283
                --plugin-helper-dir=plugin-helpers \
348
284
                --config-file=plugin-runner.conf \
349
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
285
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
350
286
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
351
287
                $(CLIENTARGS)
352
288
 
353
289
# Used by run-client
354
 
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
290
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
355
291
        install --directory keydir
356
292
        ./mandos-keygen --dir keydir --force
357
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
358
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
359
 
        fi
360
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
361
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
362
 
        fi
363
293
 
364
294
# Run the server with a local config
365
 
.PHONY: run-server
366
295
run-server: confdir/mandos.conf confdir/clients.conf statedir
367
296
        ./mandos --debug --no-dbus --configdir=confdir \
368
297
                --statedir=statedir $(SERVERARGS)
371
300
confdir/mandos.conf: mandos.conf
372
301
        install --directory confdir
373
302
        install --mode=u=rw,go=r $^ $@
374
 
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
303
confdir/clients.conf: clients.conf keydir/seckey.txt
375
304
        install --directory confdir
376
305
        install --mode=u=rw $< $@
377
306
# Add a client password
379
308
statedir:
380
309
        install --directory statedir
381
310
 
382
 
.PHONY: install
383
311
install: install-server install-client-nokey
384
312
 
385
 
.PHONY: install-html
386
313
install-html: html
387
314
        install --directory $(htmldir)
388
315
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
389
316
                $(htmldocs)
390
317
 
391
 
.PHONY: install-server
392
318
install-server: doc
393
319
        install --directory $(CONFDIR)
394
320
        if install --directory --mode=u=rwx --owner=$(USER) \
397
323
        elif install --directory --mode=u=rwx $(STATEDIR); then \
398
324
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
399
325
        fi
400
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
401
 
                        -a -d "$(TMPFILES)" ]; then \
402
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
403
 
                        $(TMPFILES)/mandos.conf; \
404
 
        fi
405
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
406
 
                        -a -d "$(SYSUSERS)" ]; then \
407
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
408
 
                        $(SYSUSERS)/mandos.conf; \
409
 
        fi
410
326
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
411
327
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
412
328
                mandos-ctl
441
357
        gzip --best --to-stdout intro.8mandos \
442
358
                > $(MANDIR)/man8/intro.8mandos.gz
443
359
 
444
 
.PHONY: install-client-nokey
445
360
install-client-nokey: all doc
446
361
        install --directory $(LIBDIR)/mandos $(CONFDIR)
447
362
        install --directory --mode=u=rwx $(KEYDIR) \
448
363
                $(LIBDIR)/mandos/plugins.d \
449
364
                $(LIBDIR)/mandos/plugin-helpers
450
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
451
 
                        -a -d "$(SYSUSERS)" ]; then \
452
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
453
 
                        $(SYSUSERS)/mandos-client.conf; \
454
 
        fi
455
365
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
456
366
                install --mode=u=rwx \
457
 
                        --directory "$(CONFDIR)/plugins.d" \
458
 
                        "$(CONFDIR)/plugin-helpers"; \
 
367
                        --directory "$(CONFDIR)/plugins.d"; \
 
368
                install --directory "$(CONFDIR)/plugin-helpers"; \
459
369
        fi
460
370
        install --mode=u=rwx,go=rx --directory \
461
371
                "$(CONFDIR)/network-hooks.d"
462
372
        install --mode=u=rwx,go=rx \
463
373
                --target-directory=$(LIBDIR)/mandos plugin-runner
464
 
        install --mode=u=rwx,go=rx \
465
 
                --target-directory=$(LIBDIR)/mandos \
466
 
                mandos-to-cryptroot-unlock
467
374
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
468
375
                mandos-keygen
469
376
        install --mode=u=rwx,go=rx \
484
391
        install --mode=u=rwxs,go=rx \
485
392
                --target-directory=$(LIBDIR)/mandos/plugins.d \
486
393
                plugins.d/plymouth
487
 
        install --mode=u=rwx,go=rx \
 
394
        install --mode=u=rwxs,go=rx \
488
395
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
489
396
                plugin-helpers/mandos-client-iprouteadddel
490
397
        install initramfs-tools-hook \
491
398
                $(INITRAMFSTOOLS)/hooks/mandos
492
 
        install --mode=u=rw,go=r initramfs-tools-conf \
493
 
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
494
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
495
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
399
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
 
400
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
496
401
        install initramfs-tools-script \
497
402
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
498
 
        install initramfs-tools-script-stop \
499
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
500
 
        install --directory $(DRACUTMODULE)
501
 
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
502
 
                dracut-module/ask-password-mandos.path \
503
 
                dracut-module/ask-password-mandos.service
504
 
        install --mode=u=rwxs,go=rx \
505
 
                --target-directory=$(DRACUTMODULE) \
506
 
                dracut-module/module-setup.sh \
507
 
                dracut-module/cmdline-mandos.sh \
508
 
                dracut-module/password-agent
509
403
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
510
404
        gzip --best --to-stdout mandos-keygen.8 \
511
405
                > $(MANDIR)/man8/mandos-keygen.8.gz
523
417
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
524
418
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
525
419
                > $(MANDIR)/man8/plymouth.8mandos.gz
526
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
527
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
528
420
 
529
 
.PHONY: install-client
530
421
install-client: install-client-nokey
531
422
# Post-installation stuff
532
423
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
533
 
        if command -v update-initramfs >/dev/null; then \
534
 
            update-initramfs -k all -u; \
535
 
        elif command -v dracut >/dev/null; then \
536
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
537
 
                if [ -w "$$initrd" ]; then \
538
 
                    chmod go-r "$$initrd"; \
539
 
                    dracut --force "$$initrd"; \
540
 
                fi; \
541
 
            done; \
542
 
        fi
 
424
        update-initramfs -k all -u
543
425
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
544
426
 
545
 
.PHONY: uninstall
546
427
uninstall: uninstall-server uninstall-client
547
428
 
548
 
.PHONY: uninstall-server
549
429
uninstall-server:
550
430
        -rm --force $(PREFIX)/sbin/mandos \
551
431
                $(PREFIX)/sbin/mandos-ctl \
558
438
        update-rc.d -f mandos remove
559
439
        -rmdir $(CONFDIR)
560
440
 
561
 
.PHONY: uninstall-client
562
441
uninstall-client:
563
442
# Refuse to uninstall client if /etc/crypttab is explicitly configured
564
443
# to use it.
575
454
                $(INITRAMFSTOOLS)/hooks/mandos \
576
455
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
577
456
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
578
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
579
 
                $(DRACUTMODULE)/ask-password-mandos.path \
580
 
                $(DRACUTMODULE)/ask-password-mandos.service \
581
 
                $(DRACUTMODULE)/module-setup.sh \
582
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
583
 
                $(DRACUTMODULE)/password-agent \
584
457
                $(MANDIR)/man8/mandos-keygen.8.gz \
585
458
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
586
459
                $(MANDIR)/man8/mandos-client.8mandos.gz
589
462
                $(MANDIR)/man8/splashy.8mandos.gz \
590
463
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
591
464
                $(MANDIR)/man8/plymouth.8mandos.gz \
592
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
593
465
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
594
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
595
 
        if command -v update-initramfs >/dev/null; then \
596
 
            update-initramfs -k all -u; \
597
 
        elif command -v dracut >/dev/null; then \
598
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
599
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
600
 
            done; \
601
 
        fi
 
466
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
467
        update-initramfs -k all -u
602
468
 
603
 
.PHONY: purge
604
469
purge: purge-server purge-client
605
470
 
606
 
.PHONY: purge-server
607
471
purge-server: uninstall-server
608
472
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
609
473
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
614
478
                $(DESTDIR)/var/run/mandos.pid
615
479
        -rmdir $(CONFDIR)
616
480
 
617
 
.PHONY: purge-client
618
481
purge-client: uninstall-client
619
 
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
482
        -shred --remove $(KEYDIR)/seckey.txt
620
483
        -rm --force $(CONFDIR)/plugin-runner.conf \
621
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
622
 
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
484
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
623
485
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)