/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-06-03 17:27:03 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 343.
  • Revision ID: teddy@recompile.se-20160603172703-mc6tjor6rhq4xy74
mandos: Bug fix: Do multiprocessing cleanup correctly on exit

* mandos (main): Save module "multiprocessing" and open file "wnull"
                 as scope variables accessible by function cleanup(),
                 since the module and global variable may not be
                 accessible when the cleanup() function is run as
                 scheduled by atexit().

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
13
#DEBUG=-ggdb3
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
19
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
 
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
21
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
22
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
25
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
30
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
 
LINK_FORTIFY_LD:=-z relro -z now
34
 
LINK_FORTIFY:=
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
31
LINK_FORTIFY_LD=-z relro -z now
 
32
LINK_FORTIFY=
35
33
 
36
34
# If BROKEN_PIE is set, do not build with -pie
37
35
ifndef BROKEN_PIE
39
37
LINK_FORTIFY += -pie
40
38
endif
41
39
#COVERAGE=--coverage
42
 
OPTIMIZE:=-Os -fno-strict-aliasing
43
 
LANGUAGE:=-std=gnu11
44
 
htmldir:=man
45
 
version:=1.8.4
46
 
SED:=sed
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
 
42
htmldir=man
 
43
version=1.7.7
 
44
SED=sed
47
45
 
48
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
49
 
        || getent passwd nobody || echo 65534)))
50
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
51
 
        || getent group nogroup || echo 65534)))
 
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
52
48
 
53
49
## Use these settings for a traditional /usr/local install
54
 
# PREFIX:=$(DESTDIR)/usr/local
55
 
# CONFDIR:=$(DESTDIR)/etc/mandos
56
 
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
57
 
# MANDIR:=$(PREFIX)/man
58
 
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
59
 
# STATEDIR:=$(DESTDIR)/var/lib/mandos
60
 
# LIBDIR:=$(PREFIX)/lib
 
50
# PREFIX=$(DESTDIR)/usr/local
 
51
# CONFDIR=$(DESTDIR)/etc/mandos
 
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
 
53
# MANDIR=$(PREFIX)/man
 
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
61
57
##
62
58
 
63
59
## These settings are for a package-type install
64
 
PREFIX:=$(DESTDIR)/usr
65
 
CONFDIR:=$(DESTDIR)/etc/mandos
66
 
KEYDIR:=$(DESTDIR)/etc/keys/mandos
67
 
MANDIR:=$(PREFIX)/share/man
68
 
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
69
 
STATEDIR:=$(DESTDIR)/var/lib/mandos
70
 
LIBDIR:=$(shell \
 
60
PREFIX=$(DESTDIR)/usr
 
61
CONFDIR=$(DESTDIR)/etc/mandos
 
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
 
63
MANDIR=$(PREFIX)/share/man
 
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
71
67
        for d in \
72
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
73
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
78
74
        done)
79
75
##
80
76
 
81
 
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
82
 
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
TMPFILES=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
83
79
 
84
 
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
85
 
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
86
 
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
87
 
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
88
 
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
89
 
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
80
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
 
81
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
 
82
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
 
83
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
 
84
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
85
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
90
86
        getconf LFS_LDFLAGS)
91
 
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
92
 
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
 
87
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
88
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
93
89
 
94
90
# Do not change these two
95
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
96
 
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
97
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
98
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
91
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
92
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
93
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
94
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
99
95
 
100
96
# Commands to format a DocBook <refentry> document into a manual page
101
97
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
107
103
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
108
104
        $(notdir $<); \
109
105
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
110
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
111
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
112
 
        $(notdir $@); fi >/dev/null)
 
106
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
107
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
108
        fi >/dev/null)
113
109
 
114
110
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
115
111
        --param make.year.ranges                1 \
121
117
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
122
118
        $<; $(HTMLPOST) $@)
123
119
# Fix citerefentry links
124
 
HTMLPOST:=$(SED) --in-place \
 
120
HTMLPOST=$(SED) --in-place \
125
121
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
126
122
 
127
 
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
123
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
128
124
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
129
125
        plugins.d/plymouth
130
 
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
131
 
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
132
 
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
133
 
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
126
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
127
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
128
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
129
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
134
130
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
135
131
        plugins.d/mandos-client.8mandos \
136
132
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
137
133
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
138
134
        plugins.d/plymouth.8mandos intro.8mandos
139
135
 
140
 
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
136
htmldocs=$(addsuffix .xhtml,$(DOCS))
141
137
 
142
 
objects:=$(addsuffix .o,$(CPROGS))
 
138
objects=$(addsuffix .o,$(CPROGS))
143
139
 
144
140
all: $(PROGS) mandos.lsm
145
141
 
257
253
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
258
254
                $@)
259
255
 
260
 
# Need to add the GnuTLS, Avahi and GPGME libraries
261
256
plugins.d/mandos-client: plugins.d/mandos-client.c
262
 
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
263
 
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
264
 
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
265
 
                ) $(LDLIBS) -o $@
 
257
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
258
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
266
259
 
267
 
# Need to add the libnl-route library
268
260
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
269
261
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
270
262
                ) $(LOADLIBES) $(LDLIBS) -o $@
283
275
maintainer-clean: clean
284
276
        -rm --force --recursive keydir confdir statedir
285
277
 
286
 
check: all
 
278
check:  all
287
279
        ./mandos --check
288
280
        ./mandos-ctl --check
289
 
        ./mandos-keygen --version
290
 
        ./plugin-runner --version
291
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
292
281
 
293
282
# Run the client with a local config and key
294
 
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
283
run-client: all keydir/seckey.txt keydir/pubkey.txt
295
284
        @echo "###################################################################"
296
285
        @echo "# The following error messages are harmless and can be safely     #"
297
 
        @echo "# ignored:                                                        #"
 
286
        @echo "# ignored.  The messages are caused by not running as root, but   #"
 
287
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
 
288
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
298
289
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
299
290
        @echo "#                     setuid: Operation not permitted             #"
300
291
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
301
292
        @echo "# From mandos-client:                                             #"
302
293
        @echo "#             Failed to raise privileges: Operation not permitted #"
303
294
        @echo "#             Warning: network hook \"*\" exited with status *      #"
304
 
        @echo "#                                                                 #"
305
 
        @echo "# (The messages are caused by not running as root, but you should #"
306
 
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
307
 
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
308
295
        @echo "###################################################################"
309
296
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
310
297
        ./plugin-runner --plugin-dir=plugins.d \
311
298
                --plugin-helper-dir=plugin-helpers \
312
299
                --config-file=plugin-runner.conf \
313
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
300
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
314
301
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
315
302
                $(CLIENTARGS)
316
303
 
317
304
# Used by run-client
318
 
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
305
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
319
306
        install --directory keydir
320
307
        ./mandos-keygen --dir keydir --force
321
308
 
328
315
confdir/mandos.conf: mandos.conf
329
316
        install --directory confdir
330
317
        install --mode=u=rw,go=r $^ $@
331
 
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
318
confdir/clients.conf: clients.conf keydir/seckey.txt
332
319
        install --directory confdir
333
320
        install --mode=u=rw $< $@
334
321
# Add a client password
403
390
                "$(CONFDIR)/network-hooks.d"
404
391
        install --mode=u=rwx,go=rx \
405
392
                --target-directory=$(LIBDIR)/mandos plugin-runner
406
 
        install --mode=u=rwx,go=rx \
407
 
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
408
393
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
409
394
                mandos-keygen
410
395
        install --mode=u=rwx,go=rx \
430
415
                plugin-helpers/mandos-client-iprouteadddel
431
416
        install initramfs-tools-hook \
432
417
                $(INITRAMFSTOOLS)/hooks/mandos
433
 
        install --mode=u=rw,go=r initramfs-tools-conf \
434
 
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
435
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
436
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
418
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
 
419
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
437
420
        install initramfs-tools-script \
438
421
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
439
 
        install initramfs-tools-script-stop \
440
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
441
422
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
442
423
        gzip --best --to-stdout mandos-keygen.8 \
443
424
                > $(MANDIR)/man8/mandos-keygen.8.gz
455
436
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
456
437
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
457
438
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
439
        gzip --best --to-stdout intro.8mandos \
 
440
                > $(MANDIR)/man8/intro.8mandos.gz
458
441
 
459
442
install-client: install-client-nokey
460
443
# Post-installation stuff
517
500
        -rmdir $(CONFDIR)
518
501
 
519
502
purge-client: uninstall-client
520
 
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
503
        -shred --remove $(KEYDIR)/seckey.txt
521
504
        -rm --force $(CONFDIR)/plugin-runner.conf \
522
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
523
 
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
505
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
524
506
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)