/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-02-09 23:23:26 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 370.
  • Revision ID: teddy@recompile.se-20190209232326-z1z2kzpgfixz7iaj
Add support for using raw public keys in TLS (RFC 7250)

Since GnuTLS removed support for OpenPGP keys in TLS (RFC 6091), and
no other library supports it, we have to change the protocol to use
something else.  We choose to use "raw public keys" (RFC 7250).  Since
we still use OpenPGP keys to decrypt the secret password, this means
that each client will have two keys: One OpenPGP key and one TLS
public/private key, and the key ID of the latter key is used to
identify clients instead of the fingerprint of the OpenPGP key.

Note that this code is still compatible with GnuTLS before version
3.6.0 (when OpenPGP key support was removed).  This commit merely adds
support for using raw pulic keys instead with GnuTLS 3.6.6. or later.

* DBUS-API (Signals/ClientNotFound): Change name of first parameter
                                     from "Fingerprint" to "KeyID".
  (Mandos Client Interface/Properties/KeyID): New.
* INSTALL: Document conflict with GnuTLS 3.6.0 (which removed OpenPGP
           key support) up until 3.6.6, when support for raw public
           keys was added.  Also document new dependency of client on
           "gnutls-bin" package (for certtool).
* Makefile (run-client): Depend on TLS key files, and also pass them
                         as arguments to client.
  (keydir/tls-privkey.pem, keydir/tls-pubkey.pem): New.
  (confdir/clients.conf): Add dependency on TLS public key.
  (purge-client): Add removal of TLS key files.
* clients.conf ([foo]/key_id, [bar]/key_id): New.
* debian/control (Source: mandos/Build-Depends): Also allow
                                                 libgnutls30 (>= 3.6.6)
  (Package: mandos/Depends): - '' -
  (Package: mandos/Description): Alter description to match new
                                 design.
  (Package: mandos-client/Description): - '' -
  (Package: mandos-client/Depends): Move "gnutls-bin | openssl" to
                                    here from "Recommends".
* debian/mandos-client.README.Debian: Add --tls-privkey and
                                      --tls-pubkey options to test
                                      command.
* debian/mandos-client.postinst (create_key): Renamed to "create_keys"
                                             (all callers changed),
                                             and also create TLS key.
* debian/mandos-client.postrm (purge): Also remove TLS key files.
* intro.xml (DESCRIPTION): Describe new dual-key design.
* mandos (GnuTLS): Define different functions depending on whether
                   support for raw public keys is detected.
  (Client.key_id): New attribute.
  (ClientDBus.KeyID_dbus_property): New method.
  (ProxyClient.__init__): Take new "key_id" parameter.
  (ClientHandler.handle): Use key IDs when using raw public keys and
                          use fingerprints when using OpenPGP keys.
  (ClientHandler.peer_certificate): Also handle raw public keys.
  (ClientHandler.key_id): New.
  (MandosServer.handle_ipc): Pass key ID over the pipe IPC.  Also
                             check for key ID matches when looking up
                             clients.
  (main): Default GnuTLS priority string depends on whether we are
          using raw public keys or not.  When unpickling clients, set
          key_id if not set in the pickle.
  (main/MandosDBusService.ClientNotFound): Change name of first
                                           parameter from
                                           "Fingerprint" to "KeyID".
* mandos-clients.conf.xml (OPTIONS): Document new "key_id" option.
  (OPTIONS/secret): Mention new key ID matchning.
  (EXPANSION/RUNTIME EXPANSION): Add new "key_id" option.
  (EXAMPLE): - '' -
* mandos-ctl (tablewords, main/keywords): Add new "KeyID" property.
* mandos-keygen: Create TLS key files.  New "--tls-keytype" (-T)
                 option.  Alter help text to be more clear about key
                 types.  When in password mode, also output "key_id"
                 option.
* mandos-keygen.xml (SYNOPSIS): Add new "--tls-keytype" (-T) option.
  (DESCRIPTION): Alter to match new dual-key design.
  (OVERVIEW): - '' -
  (FILES): Add TLS key files.
* mandos-options.xml (priority): Document new default priority string
                                 when using raw public keys.
* mandos.xml (NETWORK PROTOCOL): Describe new protocol using key ID.
  (BUGS): Remove issue about checking expire times of OpenPGP keys,
          since TLS public keys do not have expiration times.
  (SECURITY/CLIENT): Alter description to match new design.
  (SEE ALSO/GnuTLS): - '' -
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.
* overview.xml: Alter text to match new design.
* plugin-runner.xml (EXAMPLE): Add --tls-pubkey and --tls-privkey
                               options to mandos-client options.
* plugins.d/mandos-client.c: Use raw public keys when compiling with
                             supporting GnuTLS versions. Add new
                             "--tls-pubkey" and "--tls-privkey"
                             options (which do nothing if GnuTLS
                             library does not support raw public
                             keys).  Alter text throughout to reflect
                             new design.  Only generate new DH
                             parameters (based on size of OpenPGP key)
                             when using OpenPGP in TLS.  Default
                             GnuTLS priority string depends on whether
                             we are using raw public keys or not.
* plugins.d/mandos-client.xml (SYNOPSIS): Add new "--tls-privkey" (-t)
                                          and "--tls-pubkey" (-T)
                                          options.
  (DESCRIPTION): Describe new dual-key design.
  (OPTIONS): Document new "--tls-privkey" (-t) and "--tls-pubkey" (-T)
             options.
  (OPTIONS/--dh-bits): No longer necessarily depends on OpenPGP key
                       size.
  (FILES): Add default locations for TLS public and private key files.
  (EXAMPLE): Use new --tls-pubkey and --tls-privkey options.
  (SECURITY): Alter wording slightly to reflect new dual-key design.
  (SEE ALSO/GnuTLS): Alter description to match new design.
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
13
#DEBUG:=-ggdb3 -fsanitize=address 
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
15
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
19
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
18
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
25
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
30
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-fstack-protector-all -fPIC
33
 
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
34
31
LINK_FORTIFY_LD:=-z relro -z now
35
32
LINK_FORTIFY:=
36
33
 
42
39
#COVERAGE=--coverage
43
40
OPTIMIZE:=-Os -fno-strict-aliasing
44
41
LANGUAGE:=-std=gnu11
45
 
CPPFLAGS+=-D_FILE_OFFSET_BITS=64
46
42
htmldir:=man
47
 
version:=1.8.16
 
43
version:=1.7.20
48
44
SED:=sed
49
 
PKG_CONFIG?=pkg-config
50
 
 
51
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
52
 
        || getent passwd nobody || echo 65534)))
53
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
54
 
        || getent group nogroup || echo 65534)))
55
 
 
56
 
LINUXVERSION:=$(shell uname --kernel-release)
 
45
 
 
46
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
57
48
 
58
49
## Use these settings for a traditional /usr/local install
59
50
# PREFIX:=$(DESTDIR)/usr/local
61
52
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
62
53
# MANDIR:=$(PREFIX)/man
63
54
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
64
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
65
55
# STATEDIR:=$(DESTDIR)/var/lib/mandos
66
56
# LIBDIR:=$(PREFIX)/lib
67
57
##
72
62
KEYDIR:=$(DESTDIR)/etc/keys/mandos
73
63
MANDIR:=$(PREFIX)/share/man
74
64
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
75
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
76
65
STATEDIR:=$(DESTDIR)/var/lib/mandos
77
66
LIBDIR:=$(shell \
78
67
        for d in \
79
 
        "/usr/lib/`dpkg-architecture \
80
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
81
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
82
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
83
71
                        echo "$(DESTDIR)$$d"; \
86
74
        done)
87
75
##
88
76
 
89
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
90
 
                        --variable=systemdsystemunitdir)
91
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
92
 
                        --variable=tmpfilesdir)
93
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
94
 
                        --variable=sysusersdir)
 
77
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
95
79
 
96
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
97
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
98
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
99
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
100
 
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
101
 
        || gpgme-config --cflags; getconf LFS_CFLAGS)
102
 
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
103
 
        || gpgme-config --libs; getconf LFS_LIBS; \
 
80
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
81
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
82
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
83
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
84
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
85
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
104
86
        getconf LFS_LDFLAGS)
105
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
106
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
107
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
108
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
 
87
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
88
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
109
89
 
110
90
# Do not change these two
111
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
112
 
        $(LANGUAGE) -DVERSION='"$(version)"'
113
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
114
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
91
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
92
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
115
94
 
116
95
# Commands to format a DocBook <refentry> document into a manual page
117
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
123
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
124
103
        $(notdir $<); \
125
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
126
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
127
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
128
 
        $(notdir $@); fi >/dev/null)
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
129
108
 
130
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
131
110
        --param make.year.ranges                1 \
144
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
145
124
        plugins.d/plymouth
146
125
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
147
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
148
 
        $(PLUGIN_HELPERS)
 
126
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
149
127
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
150
128
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
151
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
152
 
        dracut-module/password-agent.8mandos \
153
130
        plugins.d/mandos-client.8mandos \
154
131
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
155
132
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
159
136
 
160
137
objects:=$(addsuffix .o,$(CPROGS))
161
138
 
162
 
.PHONY: all
163
139
all: $(PROGS) mandos.lsm
164
140
 
165
 
.PHONY: doc
166
141
doc: $(DOCS)
167
142
 
168
 
.PHONY: html
169
143
html: $(htmldocs)
170
144
 
171
145
%.5: %.xml common.ent legalnotice.xml
230
204
                overview.xml legalnotice.xml
231
205
        $(DOCBOOKTOHTML)
232
206
 
233
 
dracut-module/password-agent.8mandos: \
234
 
                dracut-module/password-agent.xml common.ent \
235
 
                overview.xml legalnotice.xml
236
 
        $(DOCBOOKTOMAN)
237
 
dracut-module/password-agent.8mandos.xhtml: \
238
 
                dracut-module/password-agent.xml common.ent \
239
 
                overview.xml legalnotice.xml
240
 
        $(DOCBOOKTOHTML)
241
 
 
242
207
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
243
208
                                        common.ent \
244
209
                                        mandos-options.xml \
287
252
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
288
253
                $@)
289
254
 
290
 
# Need to add the GnuTLS, Avahi and GPGME libraries
291
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
292
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
293
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
294
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
295
 
 
296
 
# Need to add the libnl-route library
297
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
298
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
299
 
 
300
 
# Need to add the GLib and pthread libraries
301
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
302
 
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
303
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
304
 
 
305
 
.PHONY: clean
 
255
# Need to add the GnuTLS, Avahi and GPGME libraries, and can't use
 
256
# -fsanitize=leak because GnuTLS and GPGME both leak memory.
 
257
plugins.d/mandos-client: plugins.d/mandos-client.c
 
258
        $(CC) $(filter-out -fsanitize=leak,$(CFLAGS)) $(strip\
 
259
        ) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) $(strip\
 
260
                ) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) $^ $(strip\
 
261
                ) -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
262
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
 
273
 
306
274
clean:
307
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
308
276
 
309
 
.PHONY: distclean
310
277
distclean: clean
311
 
.PHONY: mostlyclean
312
278
mostlyclean: clean
313
 
.PHONY: maintainer-clean
314
279
maintainer-clean: clean
315
280
        -rm --force --recursive keydir confdir statedir
316
281
 
317
 
.PHONY: check
318
 
check: all
 
282
check:  all
319
283
        ./mandos --check
320
284
        ./mandos-ctl --check
321
 
        ./mandos-keygen --version
322
 
        ./plugin-runner --version
323
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
324
 
        ./dracut-module/password-agent --test
325
285
 
326
286
# Run the client with a local config and key
327
 
.PHONY: run-client
328
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
329
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
330
 
        @echo '######################################################'
331
 
        @echo '# The following error messages are harmless and can  #'
332
 
        @echo '#  be safely ignored:                                #'
333
 
        @echo '## From plugin-runner:                               #'
334
 
        @echo '# setgid: Operation not permitted                    #'
335
 
        @echo '# setuid: Operation not permitted                    #'
336
 
        @echo '## From askpass-fifo:                                #'
337
 
        @echo '# mkfifo: Permission denied                          #'
338
 
        @echo '## From mandos-client:                               #'
339
 
        @echo '# Failed to raise privileges: Operation not permi... #'
340
 
        @echo '# Warning: network hook "*" exited with status *     #'
341
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
342
 
        @echo '# Failed to bring up interface "*": Operation not... #'
343
 
        @echo '#                                                    #'
344
 
        @echo '# (The messages are caused by not running as root,   #'
345
 
        @echo '# but you should NOT run "make run-client" as root   #'
346
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
347
 
        @echo '# root, which is also NOT recommended.)              #'
348
 
        @echo '######################################################'
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
349
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
350
303
        ./plugin-runner --plugin-dir=plugins.d \
351
304
                --plugin-helper-dir=plugin-helpers \
358
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
359
312
        install --directory keydir
360
313
        ./mandos-keygen --dir keydir --force
361
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
362
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
363
 
        fi
364
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
365
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
366
 
        fi
367
314
 
368
315
# Run the server with a local config
369
 
.PHONY: run-server
370
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
371
317
        ./mandos --debug --no-dbus --configdir=confdir \
372
318
                --statedir=statedir $(SERVERARGS)
383
329
statedir:
384
330
        install --directory statedir
385
331
 
386
 
.PHONY: install
387
332
install: install-server install-client-nokey
388
333
 
389
 
.PHONY: install-html
390
334
install-html: html
391
335
        install --directory $(htmldir)
392
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
393
337
                $(htmldocs)
394
338
 
395
 
.PHONY: install-server
396
339
install-server: doc
397
340
        install --directory $(CONFDIR)
398
341
        if install --directory --mode=u=rwx --owner=$(USER) \
401
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
402
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
403
346
        fi
404
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
405
 
                        -a -d "$(TMPFILES)" ]; then \
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
406
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
407
349
                        $(TMPFILES)/mandos.conf; \
408
350
        fi
409
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
410
 
                        -a -d "$(SYSUSERS)" ]; then \
411
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
412
 
                        $(SYSUSERS)/mandos.conf; \
413
 
        fi
414
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
415
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
416
353
                mandos-ctl
445
382
        gzip --best --to-stdout intro.8mandos \
446
383
                > $(MANDIR)/man8/intro.8mandos.gz
447
384
 
448
 
.PHONY: install-client-nokey
449
385
install-client-nokey: all doc
450
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
451
387
        install --directory --mode=u=rwx $(KEYDIR) \
452
388
                $(LIBDIR)/mandos/plugins.d \
453
389
                $(LIBDIR)/mandos/plugin-helpers
454
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
455
 
                        -a -d "$(SYSUSERS)" ]; then \
456
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
457
 
                        $(SYSUSERS)/mandos-client.conf; \
458
 
        fi
459
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
460
391
                install --mode=u=rwx \
461
392
                        --directory "$(CONFDIR)/plugins.d" \
466
397
        install --mode=u=rwx,go=rx \
467
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
468
399
        install --mode=u=rwx,go=rx \
469
 
                --target-directory=$(LIBDIR)/mandos \
470
 
                mandos-to-cryptroot-unlock
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
471
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
472
402
                mandos-keygen
473
403
        install --mode=u=rwx,go=rx \
495
425
                $(INITRAMFSTOOLS)/hooks/mandos
496
426
        install --mode=u=rw,go=r initramfs-tools-conf \
497
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
498
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
499
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
500
428
        install initramfs-tools-script \
501
429
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
502
430
        install initramfs-tools-script-stop \
503
431
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
504
 
        install --directory $(DRACUTMODULE)
505
 
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
506
 
                dracut-module/ask-password-mandos.path \
507
 
                dracut-module/ask-password-mandos.service
508
 
        install --mode=u=rwxs,go=rx \
509
 
                --target-directory=$(DRACUTMODULE) \
510
 
                dracut-module/module-setup.sh \
511
 
                dracut-module/cmdline-mandos.sh \
512
 
                dracut-module/password-agent
513
432
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
514
433
        gzip --best --to-stdout mandos-keygen.8 \
515
434
                > $(MANDIR)/man8/mandos-keygen.8.gz
527
446
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
528
447
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
529
448
                > $(MANDIR)/man8/plymouth.8mandos.gz
530
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
531
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
532
449
 
533
 
.PHONY: install-client
534
450
install-client: install-client-nokey
535
451
# Post-installation stuff
536
452
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
537
 
        if command -v update-initramfs >/dev/null; then \
538
 
            update-initramfs -k all -u; \
539
 
        elif command -v dracut >/dev/null; then \
540
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
541
 
                if [ -w "$$initrd" ]; then \
542
 
                    chmod go-r "$$initrd"; \
543
 
                    dracut --force "$$initrd"; \
544
 
                fi; \
545
 
            done; \
546
 
        fi
 
453
        update-initramfs -k all -u
547
454
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
548
455
 
549
 
.PHONY: uninstall
550
456
uninstall: uninstall-server uninstall-client
551
457
 
552
 
.PHONY: uninstall-server
553
458
uninstall-server:
554
459
        -rm --force $(PREFIX)/sbin/mandos \
555
460
                $(PREFIX)/sbin/mandos-ctl \
562
467
        update-rc.d -f mandos remove
563
468
        -rmdir $(CONFDIR)
564
469
 
565
 
.PHONY: uninstall-client
566
470
uninstall-client:
567
471
# Refuse to uninstall client if /etc/crypttab is explicitly configured
568
472
# to use it.
579
483
                $(INITRAMFSTOOLS)/hooks/mandos \
580
484
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
581
485
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
582
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
583
 
                $(DRACUTMODULE)/ask-password-mandos.path \
584
 
                $(DRACUTMODULE)/ask-password-mandos.service \
585
 
                $(DRACUTMODULE)/module-setup.sh \
586
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
587
 
                $(DRACUTMODULE)/password-agent \
588
486
                $(MANDIR)/man8/mandos-keygen.8.gz \
589
487
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
590
488
                $(MANDIR)/man8/mandos-client.8mandos.gz
593
491
                $(MANDIR)/man8/splashy.8mandos.gz \
594
492
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
595
493
                $(MANDIR)/man8/plymouth.8mandos.gz \
596
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
597
494
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
598
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
599
 
        if command -v update-initramfs >/dev/null; then \
600
 
            update-initramfs -k all -u; \
601
 
        elif command -v dracut >/dev/null; then \
602
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
603
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
604
 
            done; \
605
 
        fi
 
495
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
496
        update-initramfs -k all -u
606
497
 
607
 
.PHONY: purge
608
498
purge: purge-server purge-client
609
499
 
610
 
.PHONY: purge-server
611
500
purge-server: uninstall-server
612
501
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
613
502
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
618
507
                $(DESTDIR)/var/run/mandos.pid
619
508
        -rmdir $(CONFDIR)
620
509
 
621
 
.PHONY: purge-client
622
510
purge-client: uninstall-client
623
511
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
624
512
        -rm --force $(CONFDIR)/plugin-runner.conf \