/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugin-runner.xml

  • Committer: Teddy Hogeborn
  • Date: 2018-08-19 01:35:11 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 368.
  • Revision ID: teddy@recompile.se-20180819013511-cku25q9yeub3dnr0
Adapt to changes in cryptsetup; use "cryptroot-unlock" program

* Makefile (install-client-nokey): Also install new script files
  "mandos-to-cryptroot-unlock" and "initramfs-tools-script-stop".
* debian/mandos-client.dirs: Add
  "usr/share/initramfs-tools/scripts/local-premount".
* initramfs-tools-hook: Also copy "mandos-to-cryptroot-unlock".
* initramfs-tools-script: Only modify keyscript setting in cryptroot
  file if the file exists, otherwise start
  "mandos-to-cryptroot-unlock" in background.
* initramfs-tools-script-stop: New script to make sure plugin-runner
  has stopped before continuing.
* mandos-to-cryptroot-unlock: New script to run plugin-runner and feed
  any password it gets into the "cryptroot-unlock" program.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "plugin-runner">
6
 
<!ENTITY TIMESTAMP "2008-09-06">
 
5
<!ENTITY TIMESTAMP "2018-02-08">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- Nwalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
 
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
34
45
      <holder>Teddy Hogeborn</holder>
35
46
      <holder>Björn Påhlsson</holder>
36
47
    </copyright>
37
48
    <xi:include href="legalnotice.xml"/>
38
49
  </refentryinfo>
39
 
 
 
50
  
40
51
  <refmeta>
41
52
    <refentrytitle>&COMMANDNAME;</refentrytitle>
42
53
    <manvolnum>8mandos</manvolnum>
48
59
      Run Mandos plugins, pass data from first to succeed.
49
60
    </refpurpose>
50
61
  </refnamediv>
51
 
 
 
62
  
52
63
  <refsynopsisdiv>
53
64
    <cmdsynopsis>
54
65
      <command>&COMMANDNAME;</command>
55
66
      <group rep="repeat">
56
67
        <arg choice="plain"><option>--global-env=<replaceable
57
 
        >VAR</replaceable><literal>=</literal><replaceable
 
68
        >ENV</replaceable><literal>=</literal><replaceable
58
69
        >value</replaceable></option></arg>
59
70
        <arg choice="plain"><option>-G
60
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
71
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
61
72
        >value</replaceable> </option></arg>
62
73
      </group>
63
74
      <sbr/>
111
122
      <arg><option>--plugin-dir=<replaceable
112
123
      >DIRECTORY</replaceable></option></arg>
113
124
      <sbr/>
 
125
      <arg><option>--plugin-helper-dir=<replaceable
 
126
      >DIRECTORY</replaceable></option></arg>
 
127
      <sbr/>
114
128
      <arg><option>--config-file=<replaceable
115
129
      >FILE</replaceable></option></arg>
116
130
      <sbr/>
170
184
    <variablelist>
171
185
      <varlistentry>
172
186
        <term><option>--global-env
173
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
187
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
174
188
        >value</replaceable></option></term>
175
189
        <term><option>-G
176
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
190
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
177
191
        >value</replaceable></option></term>
178
192
        <listitem>
179
193
          <para>
247
261
          </para>
248
262
        </listitem>
249
263
      </varlistentry>
250
 
 
 
264
      
251
265
      <varlistentry>
252
266
        <term><option>--disable
253
267
        <replaceable>PLUGIN</replaceable></option></term>
258
272
            Disable the plugin named
259
273
            <replaceable>PLUGIN</replaceable>.  The plugin will not be
260
274
            started.
261
 
          </para>       
 
275
          </para>
262
276
        </listitem>
263
277
      </varlistentry>
264
 
 
 
278
      
265
279
      <varlistentry>
266
280
        <term><option>--enable
267
281
        <replaceable>PLUGIN</replaceable></option></term>
276
290
          </para>
277
291
        </listitem>
278
292
      </varlistentry>
279
 
 
 
293
      
280
294
      <varlistentry>
281
295
        <term><option>--groupid
282
296
        <replaceable>ID</replaceable></option></term>
289
303
          </para>
290
304
        </listitem>
291
305
      </varlistentry>
292
 
 
 
306
      
293
307
      <varlistentry>
294
308
        <term><option>--userid
295
309
        <replaceable>ID</replaceable></option></term>
302
316
          </para>
303
317
        </listitem>
304
318
      </varlistentry>
305
 
 
 
319
      
306
320
      <varlistentry>
307
321
        <term><option>--plugin-dir
308
322
        <replaceable>DIRECTORY</replaceable></option></term>
317
331
      </varlistentry>
318
332
      
319
333
      <varlistentry>
 
334
        <term><option>--plugin-helper-dir
 
335
        <replaceable>DIRECTORY</replaceable></option></term>
 
336
        <listitem>
 
337
          <para>
 
338
            Specify a different plugin helper directory.  The default
 
339
            is <filename>/lib/mandos/plugin-helpers</filename>, which
 
340
            will exist in the initial <acronym>RAM</acronym> disk
 
341
            environment.  (This will simply be passed to all plugins
 
342
            via the <envar>MANDOSPLUGINHELPERDIR</envar> environment
 
343
            variable.  See <xref linkend="writing_plugins"/>)
 
344
          </para>
 
345
        </listitem>
 
346
      </varlistentry>
 
347
      
 
348
      <varlistentry>
320
349
        <term><option>--config-file
321
350
        <replaceable>FILE</replaceable></option></term>
322
351
        <listitem>
365
394
          </para>
366
395
        </listitem>
367
396
      </varlistentry>
368
 
 
 
397
      
369
398
      <varlistentry>
370
399
        <term><option>--version</option></term>
371
400
        <term><option>-V</option></term>
377
406
      </varlistentry>
378
407
    </variablelist>
379
408
  </refsect1>
380
 
 
 
409
  
381
410
  <refsect1 id="overview">
382
411
    <title>OVERVIEW</title>
383
412
    <xi:include href="overview.xml"/>
403
432
      code will make this plugin-runner output the password from that
404
433
      plugin, stop any other plugins, and exit.
405
434
    </para>
406
 
 
 
435
    
407
436
    <refsect2 id="writing_plugins">
408
437
      <title>WRITING PLUGINS</title>
409
438
      <para>
423
452
      <para>
424
453
        The plugin will run in the initial RAM disk environment, so
425
454
        care must be taken not to depend on any files or running
426
 
        services not available there.
 
455
        services not available there.  Any helper executables required
 
456
        by the plugin (which are not in the <envar>PATH</envar>) can
 
457
        be placed in the plugin helper directory, the name of which
 
458
        will be made available to the plugin via the
 
459
        <envar>MANDOSPLUGINHELPERDIR</envar> environment variable.
427
460
      </para>
428
461
      <para>
429
462
        The plugin must exit cleanly and free all allocated resources
472
505
      only passes on its environment to all the plugins.  The
473
506
      environment passed to plugins can be modified using the
474
507
      <option>--global-env</option> and <option>--env-for</option>
475
 
      options.
 
508
      options.  Also, the <option>--plugin-helper-dir</option> option
 
509
      will affect the environment variable
 
510
      <envar>MANDOSPLUGINHELPERDIR</envar> for the plugins.
476
511
    </para>
477
512
  </refsect1>
478
513
  
511
546
            </para>
512
547
          </listitem>
513
548
        </varlistentry>
 
549
        <varlistentry>
 
550
          <term><filename class="directory"
 
551
          >/lib/mandos/plugins.d</filename></term>
 
552
          <listitem>
 
553
            <para>
 
554
              The default plugin directory; can be changed by the
 
555
              <option>--plugin-dir</option> option.
 
556
            </para>
 
557
          </listitem>
 
558
        </varlistentry>
 
559
        <varlistentry>
 
560
          <term><filename class="directory"
 
561
          >/lib/mandos/plugin-helpers</filename></term>
 
562
          <listitem>
 
563
            <para>
 
564
              The default plugin helper directory; can be changed by
 
565
              the <option>--plugin-helper-dir</option> option.
 
566
            </para>
 
567
          </listitem>
 
568
        </varlistentry>
514
569
      </variablelist>
515
570
    </para>
516
571
  </refsect1>
521
576
      The <option>--config-file</option> option is ignored when
522
577
      specified from within a configuration file.
523
578
    </para>
 
579
    <xi:include href="bugs.xml"/>
524
580
  </refsect1>
525
581
  
526
582
  <refsect1 id="examples">
569
625
    </informalexample>
570
626
    <informalexample>
571
627
      <para>
572
 
        Run plugins from a different directory, read a different
573
 
        configuration file, and add two options to the
 
628
        Read a different configuration file, run plugins from a
 
629
        different directory, specify an alternate plugin helper
 
630
        directory and add two options to the
574
631
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
575
632
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
576
633
      </para>
577
634
      <para>
578
635
 
579
636
<!-- do not wrap this line -->
580
 
<userinput>&COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt</userinput>
 
637
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
581
638
 
582
639
      </para>
583
640
    </informalexample>
615
672
  <refsect1 id="see_also">
616
673
    <title>SEE ALSO</title>
617
674
    <para>
 
675
      <citerefentry><refentrytitle>intro</refentrytitle>
 
676
      <manvolnum>8mandos</manvolnum></citerefentry>,
618
677
      <citerefentry><refentrytitle>cryptsetup</refentrytitle>
619
678
      <manvolnum>8</manvolnum></citerefentry>,
620
679
      <citerefentry><refentrytitle>crypttab</refentrytitle>