/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 341.
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.6.2
 
43
version=1.7.6
27
44
SED=sed
28
45
 
29
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
31
48
 
32
49
## Use these settings for a traditional /usr/local install
33
50
# PREFIX=$(DESTDIR)/usr/local
36
53
# MANDIR=$(PREFIX)/man
37
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
39
57
##
40
58
 
41
59
## These settings are for a package-type install
45
63
MANDIR=$(PREFIX)/share/man
46
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
48
75
##
49
76
 
50
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
56
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
57
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
58
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
59
88
 
60
89
# Do not change these two
61
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
62
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
63
 
        -DVERSION='"$(version)"'
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
64
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
65
94
 
66
95
# Commands to format a DocBook <refentry> document into a manual page
72
101
        --param man.authors.section.enabled     0 \
73
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
74
103
        $(notdir $<); \
75
 
        $(MANPOST) $(notdir $@);\
76
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
77
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
78
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
79
107
        fi >/dev/null)
80
 
# DocBook-to-man post-processing to fix a '\n' escape bug
81
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
82
108
 
83
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
84
110
        --param make.year.ranges                1 \
96
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
97
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
98
124
        plugins.d/plymouth
99
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
100
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
101
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
102
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
229
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
230
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
231
258
 
232
 
.PHONY : all doc html clean distclean run-client run-server install \
233
 
        install-server install-client uninstall uninstall-server \
234
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
235
268
 
236
269
clean:
237
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
252
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
253
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
254
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
255
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
256
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
257
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
258
 
        @echo "#                     seteuid: Operation not permitted            #"
259
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
260
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
261
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
262
298
                --config-file=plugin-runner.conf \
263
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
264
301
                $(CLIENTARGS)
265
302
 
266
303
# Used by run-client
281
318
        install --directory confdir
282
319
        install --mode=u=rw $< $@
283
320
# Add a client password
284
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
285
322
statedir:
286
323
        install --directory statedir
287
324
 
294
331
 
295
332
install-server: doc
296
333
        install --directory $(CONFDIR)
297
 
        install --directory --mode=u=rwx --owner=$(USER) \
298
 
                --group=$(GROUP) $(STATEDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
299
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
300
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
301
342
                mandos-ctl
310
351
        install --mode=u=rwx,go=rx init.d-mandos \
311
352
                $(DESTDIR)/etc/init.d/mandos
312
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
313
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD) \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
314
355
        fi
315
356
        install --mode=u=rw,go=r default-mandos \
316
357
                $(DESTDIR)/etc/default/mandos
331
372
                > $(MANDIR)/man8/intro.8mandos.gz
332
373
 
333
374
install-client-nokey: all doc
334
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
335
376
        install --directory --mode=u=rwx $(KEYDIR) \
336
 
                $(PREFIX)/lib/mandos/plugins.d
337
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
338
380
                install --mode=u=rwx \
339
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
340
383
        fi
341
384
        install --mode=u=rwx,go=rx --directory \
342
385
                "$(CONFDIR)/network-hooks.d"
343
386
        install --mode=u=rwx,go=rx \
344
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
345
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
346
389
                mandos-keygen
347
390
        install --mode=u=rwx,go=rx \
348
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
349
392
                plugins.d/password-prompt
350
393
        install --mode=u=rwxs,go=rx \
351
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
352
395
                plugins.d/mandos-client
353
396
        install --mode=u=rwxs,go=rx \
354
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
355
398
                plugins.d/usplash
356
399
        install --mode=u=rwxs,go=rx \
357
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
358
401
                plugins.d/splashy
359
402
        install --mode=u=rwxs,go=rx \
360
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
361
404
                plugins.d/askpass-fifo
362
405
        install --mode=u=rwxs,go=rx \
363
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
364
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
365
411
        install initramfs-tools-hook \
366
412
                $(INITRAMFSTOOLS)/hooks/mandos
367
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
412
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
413
459
                $(DESTDIR)/etc/crypttab
414
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
415
 
                $(PREFIX)/lib/mandos/plugin-runner \
416
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
417
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
418
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
419
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
420
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
421
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
422
468
                $(INITRAMFSTOOLS)/hooks/mandos \
423
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
424
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
430
476
                $(MANDIR)/man8/splashy.8mandos.gz \
431
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
432
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
433
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
434
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
435
481
        update-initramfs -k all -u
436
482
 
437
483
purge: purge-server purge-client