/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 341.
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code 
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.3.1
 
43
version=1.7.6
27
44
SED=sed
28
45
 
 
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
48
 
29
49
## Use these settings for a traditional /usr/local install
30
50
# PREFIX=$(DESTDIR)/usr/local
31
51
# CONFDIR=$(DESTDIR)/etc/mandos
32
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
33
53
# MANDIR=$(PREFIX)/man
34
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
35
57
##
36
58
 
37
59
## These settings are for a package-type install
40
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
41
63
MANDIR=$(PREFIX)/share/man
42
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
43
75
##
44
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
45
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
46
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
47
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
49
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
50
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
51
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
52
88
 
53
89
# Do not change these two
54
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
55
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
56
 
        -DVERSION='"$(version)"'
57
 
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
58
94
 
59
95
# Commands to format a DocBook <refentry> document into a manual page
60
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
63
99
        --param make.single.year.ranges         1 \
64
100
        --param man.output.quietly              1 \
65
101
        --param man.authors.section.enabled     0 \
66
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
67
103
        $(notdir $<); \
68
 
        $(MANPOST) $(notdir $@))
69
 
# DocBook-to-man post-processing to fix a '\n' escape bug
70
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
71
108
 
72
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
73
110
        --param make.year.ranges                1 \
85
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
86
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
87
124
        plugins.d/plymouth
88
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
89
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
90
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
91
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
218
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
219
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
220
258
 
221
 
.PHONY : all doc html clean distclean run-client run-server install \
222
 
        install-server install-client uninstall uninstall-server \
223
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
224
268
 
225
269
clean:
226
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
228
272
distclean: clean
229
273
mostlyclean: clean
230
274
maintainer-clean: clean
231
 
        -rm --force --recursive keydir confdir
 
275
        -rm --force --recursive keydir confdir statedir
232
276
 
233
277
check:  all
234
278
        ./mandos --check
 
279
        ./mandos-ctl --check
235
280
 
236
281
# Run the client with a local config and key
237
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
240
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
241
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
242
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
243
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
244
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
245
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
246
 
        @echo "#                     seteuid: Operation not permitted            #"
247
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
248
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
249
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
250
298
                --config-file=plugin-runner.conf \
251
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
252
301
                $(CLIENTARGS)
253
302
 
254
303
# Used by run-client
257
306
        ./mandos-keygen --dir keydir --force
258
307
 
259
308
# Run the server with a local config
260
 
run-server: confdir/mandos.conf confdir/clients.conf
261
 
        @echo "#################################################################"
262
 
        @echo "# NOTE: Please IGNORE the error about \"Could not open file      #"
263
 
        @echo "# u'/var/run/mandos.pid'\" -  it is harmless and is caused by    #"
264
 
        @echo "# the server not running as root.  Do NOT run \"make run-server\" #"
265
 
        @echo "# server as root if you didn't also unpack and compile it thus. #"
266
 
        @echo "#################################################################"
267
 
        ./mandos --debug --no-dbus --configdir=confdir $(SERVERARGS)
 
309
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
310
        ./mandos --debug --no-dbus --configdir=confdir \
 
311
                --statedir=statedir $(SERVERARGS)
268
312
 
269
313
# Used by run-server
270
314
confdir/mandos.conf: mandos.conf
274
318
        install --directory confdir
275
319
        install --mode=u=rw $< $@
276
320
# Add a client password
277
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
322
statedir:
 
323
        install --directory statedir
278
324
 
279
325
install: install-server install-client-nokey
280
326
 
285
331
 
286
332
install-server: doc
287
333
        install --directory $(CONFDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
288
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
289
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
290
342
                mandos-ctl
298
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
299
351
        install --mode=u=rwx,go=rx init.d-mandos \
300
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
301
356
        install --mode=u=rw,go=r default-mandos \
302
357
                $(DESTDIR)/etc/default/mandos
303
358
        if [ -z $(DESTDIR) ]; then \
313
368
                > $(MANDIR)/man5/mandos.conf.5.gz
314
369
        gzip --best --to-stdout mandos-clients.conf.5 \
315
370
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
371
        gzip --best --to-stdout intro.8mandos \
 
372
                > $(MANDIR)/man8/intro.8mandos.gz
316
373
 
317
374
install-client-nokey: all doc
318
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
319
376
        install --directory --mode=u=rwx $(KEYDIR) \
320
 
                $(PREFIX)/lib/mandos/plugins.d
321
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
322
380
                install --mode=u=rwx \
323
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
324
383
        fi
 
384
        install --mode=u=rwx,go=rx --directory \
 
385
                "$(CONFDIR)/network-hooks.d"
325
386
        install --mode=u=rwx,go=rx \
326
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
327
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
328
389
                mandos-keygen
329
390
        install --mode=u=rwx,go=rx \
330
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
331
392
                plugins.d/password-prompt
332
393
        install --mode=u=rwxs,go=rx \
333
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
334
395
                plugins.d/mandos-client
335
396
        install --mode=u=rwxs,go=rx \
336
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
337
398
                plugins.d/usplash
338
399
        install --mode=u=rwxs,go=rx \
339
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
340
401
                plugins.d/splashy
341
402
        install --mode=u=rwxs,go=rx \
342
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
343
404
                plugins.d/askpass-fifo
344
405
        install --mode=u=rwxs,go=rx \
345
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
346
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
347
411
        install initramfs-tools-hook \
348
412
                $(INITRAMFSTOOLS)/hooks/mandos
349
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
394
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
395
459
                $(DESTDIR)/etc/crypttab
396
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
397
 
                $(PREFIX)/lib/mandos/plugin-runner \
398
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
399
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
400
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
401
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
402
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
403
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
404
468
                $(INITRAMFSTOOLS)/hooks/mandos \
405
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
406
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
412
476
                $(MANDIR)/man8/splashy.8mandos.gz \
413
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
414
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
415
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
416
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
417
481
        update-initramfs -k all -u
418
482
 
419
483
purge: purge-server purge-client
423
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
424
488
                $(DESTDIR)/etc/default/mandos \
425
489
                $(DESTDIR)/etc/init.d/mandos \
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
426
492
                $(DESTDIR)/var/run/mandos.pid
427
493
        -rmdir $(CONFDIR)
428
494