/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-02-09 23:23:26 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 370.
  • Revision ID: teddy@recompile.se-20190209232326-z1z2kzpgfixz7iaj
Add support for using raw public keys in TLS (RFC 7250)

Since GnuTLS removed support for OpenPGP keys in TLS (RFC 6091), and
no other library supports it, we have to change the protocol to use
something else.  We choose to use "raw public keys" (RFC 7250).  Since
we still use OpenPGP keys to decrypt the secret password, this means
that each client will have two keys: One OpenPGP key and one TLS
public/private key, and the key ID of the latter key is used to
identify clients instead of the fingerprint of the OpenPGP key.

Note that this code is still compatible with GnuTLS before version
3.6.0 (when OpenPGP key support was removed).  This commit merely adds
support for using raw pulic keys instead with GnuTLS 3.6.6. or later.

* DBUS-API (Signals/ClientNotFound): Change name of first parameter
                                     from "Fingerprint" to "KeyID".
  (Mandos Client Interface/Properties/KeyID): New.
* INSTALL: Document conflict with GnuTLS 3.6.0 (which removed OpenPGP
           key support) up until 3.6.6, when support for raw public
           keys was added.  Also document new dependency of client on
           "gnutls-bin" package (for certtool).
* Makefile (run-client): Depend on TLS key files, and also pass them
                         as arguments to client.
  (keydir/tls-privkey.pem, keydir/tls-pubkey.pem): New.
  (confdir/clients.conf): Add dependency on TLS public key.
  (purge-client): Add removal of TLS key files.
* clients.conf ([foo]/key_id, [bar]/key_id): New.
* debian/control (Source: mandos/Build-Depends): Also allow
                                                 libgnutls30 (>= 3.6.6)
  (Package: mandos/Depends): - '' -
  (Package: mandos/Description): Alter description to match new
                                 design.
  (Package: mandos-client/Description): - '' -
  (Package: mandos-client/Depends): Move "gnutls-bin | openssl" to
                                    here from "Recommends".
* debian/mandos-client.README.Debian: Add --tls-privkey and
                                      --tls-pubkey options to test
                                      command.
* debian/mandos-client.postinst (create_key): Renamed to "create_keys"
                                             (all callers changed),
                                             and also create TLS key.
* debian/mandos-client.postrm (purge): Also remove TLS key files.
* intro.xml (DESCRIPTION): Describe new dual-key design.
* mandos (GnuTLS): Define different functions depending on whether
                   support for raw public keys is detected.
  (Client.key_id): New attribute.
  (ClientDBus.KeyID_dbus_property): New method.
  (ProxyClient.__init__): Take new "key_id" parameter.
  (ClientHandler.handle): Use key IDs when using raw public keys and
                          use fingerprints when using OpenPGP keys.
  (ClientHandler.peer_certificate): Also handle raw public keys.
  (ClientHandler.key_id): New.
  (MandosServer.handle_ipc): Pass key ID over the pipe IPC.  Also
                             check for key ID matches when looking up
                             clients.
  (main): Default GnuTLS priority string depends on whether we are
          using raw public keys or not.  When unpickling clients, set
          key_id if not set in the pickle.
  (main/MandosDBusService.ClientNotFound): Change name of first
                                           parameter from
                                           "Fingerprint" to "KeyID".
* mandos-clients.conf.xml (OPTIONS): Document new "key_id" option.
  (OPTIONS/secret): Mention new key ID matchning.
  (EXPANSION/RUNTIME EXPANSION): Add new "key_id" option.
  (EXAMPLE): - '' -
* mandos-ctl (tablewords, main/keywords): Add new "KeyID" property.
* mandos-keygen: Create TLS key files.  New "--tls-keytype" (-T)
                 option.  Alter help text to be more clear about key
                 types.  When in password mode, also output "key_id"
                 option.
* mandos-keygen.xml (SYNOPSIS): Add new "--tls-keytype" (-T) option.
  (DESCRIPTION): Alter to match new dual-key design.
  (OVERVIEW): - '' -
  (FILES): Add TLS key files.
* mandos-options.xml (priority): Document new default priority string
                                 when using raw public keys.
* mandos.xml (NETWORK PROTOCOL): Describe new protocol using key ID.
  (BUGS): Remove issue about checking expire times of OpenPGP keys,
          since TLS public keys do not have expiration times.
  (SECURITY/CLIENT): Alter description to match new design.
  (SEE ALSO/GnuTLS): - '' -
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.
* overview.xml: Alter text to match new design.
* plugin-runner.xml (EXAMPLE): Add --tls-pubkey and --tls-privkey
                               options to mandos-client options.
* plugins.d/mandos-client.c: Use raw public keys when compiling with
                             supporting GnuTLS versions. Add new
                             "--tls-pubkey" and "--tls-privkey"
                             options (which do nothing if GnuTLS
                             library does not support raw public
                             keys).  Alter text throughout to reflect
                             new design.  Only generate new DH
                             parameters (based on size of OpenPGP key)
                             when using OpenPGP in TLS.  Default
                             GnuTLS priority string depends on whether
                             we are using raw public keys or not.
* plugins.d/mandos-client.xml (SYNOPSIS): Add new "--tls-privkey" (-t)
                                          and "--tls-pubkey" (-T)
                                          options.
  (DESCRIPTION): Describe new dual-key design.
  (OPTIONS): Document new "--tls-privkey" (-t) and "--tls-pubkey" (-T)
             options.
  (OPTIONS/--dh-bits): No longer necessarily depends on OpenPGP key
                       size.
  (FILES): Add default locations for TLS public and private key files.
  (EXAMPLE): Use new --tls-pubkey and --tls-privkey options.
  (SECURITY): Alter wording slightly to reflect new dual-key design.
  (SEE ALSO/GnuTLS): Alter description to match new design.
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
13
#DEBUG:=-ggdb3 -fsanitize=address 
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
15
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
19
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
18
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
25
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
30
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-fstack-protector-all -fPIC
33
 
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
34
31
LINK_FORTIFY_LD:=-z relro -z now
35
32
LINK_FORTIFY:=
36
33
 
42
39
#COVERAGE=--coverage
43
40
OPTIMIZE:=-Os -fno-strict-aliasing
44
41
LANGUAGE:=-std=gnu11
45
 
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
46
42
htmldir:=man
47
 
version:=1.8.16
 
43
version:=1.7.20
48
44
SED:=sed
49
 
PKG_CONFIG?=pkg-config
50
 
 
51
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
52
 
        || getent passwd nobody || echo 65534)))
53
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
54
 
        || getent group nogroup || echo 65534)))
55
 
 
56
 
LINUXVERSION:=$(shell uname --kernel-release)
 
45
 
 
46
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
57
48
 
58
49
## Use these settings for a traditional /usr/local install
59
50
# PREFIX:=$(DESTDIR)/usr/local
61
52
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
62
53
# MANDIR:=$(PREFIX)/man
63
54
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
64
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
65
55
# STATEDIR:=$(DESTDIR)/var/lib/mandos
66
56
# LIBDIR:=$(PREFIX)/lib
67
 
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
68
57
##
69
58
 
70
59
## These settings are for a package-type install
73
62
KEYDIR:=$(DESTDIR)/etc/keys/mandos
74
63
MANDIR:=$(PREFIX)/share/man
75
64
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
76
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
77
65
STATEDIR:=$(DESTDIR)/var/lib/mandos
78
66
LIBDIR:=$(shell \
79
67
        for d in \
80
 
        "/usr/lib/`dpkg-architecture \
81
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
82
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
83
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
84
71
                        echo "$(DESTDIR)$$d"; \
85
72
                        break; \
86
73
                fi; \
87
74
        done)
88
 
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
89
75
##
90
76
 
91
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
92
 
                        --variable=systemdsystemunitdir)
93
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
94
 
                        --variable=tmpfilesdir)
95
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
96
 
                        --variable=sysusersdir)
 
77
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
97
79
 
98
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
99
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
100
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
101
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
102
 
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
103
 
        || gpgme-config --cflags; getconf LFS_CFLAGS)
104
 
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
105
 
        || gpgme-config --libs; getconf LFS_LIBS; \
 
80
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
81
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
82
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
83
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
84
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
85
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
106
86
        getconf LFS_LDFLAGS)
107
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
108
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
109
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
110
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
 
87
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
88
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
111
89
 
112
90
# Do not change these two
113
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
114
 
        $(LANGUAGE) -DVERSION='"$(version)"'
115
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
116
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
91
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
92
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
117
94
 
118
95
# Commands to format a DocBook <refentry> document into a manual page
119
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
125
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
126
103
        $(notdir $<); \
127
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
128
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
129
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
130
 
        $(notdir $@); fi >/dev/null)
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
131
108
 
132
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
133
110
        --param make.year.ranges                1 \
146
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
147
124
        plugins.d/plymouth
148
125
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
149
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
150
 
        $(PLUGIN_HELPERS)
 
126
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
151
127
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
152
128
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
153
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
154
 
        dracut-module/password-agent.8mandos \
155
130
        plugins.d/mandos-client.8mandos \
156
131
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
157
132
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
161
136
 
162
137
objects:=$(addsuffix .o,$(CPROGS))
163
138
 
164
 
.PHONY: all
165
139
all: $(PROGS) mandos.lsm
166
140
 
167
 
.PHONY: doc
168
141
doc: $(DOCS)
169
142
 
170
 
.PHONY: html
171
143
html: $(htmldocs)
172
144
 
173
145
%.5: %.xml common.ent legalnotice.xml
232
204
                overview.xml legalnotice.xml
233
205
        $(DOCBOOKTOHTML)
234
206
 
235
 
dracut-module/password-agent.8mandos: \
236
 
                dracut-module/password-agent.xml common.ent \
237
 
                overview.xml legalnotice.xml
238
 
        $(DOCBOOKTOMAN)
239
 
dracut-module/password-agent.8mandos.xhtml: \
240
 
                dracut-module/password-agent.xml common.ent \
241
 
                overview.xml legalnotice.xml
242
 
        $(DOCBOOKTOHTML)
243
 
 
244
207
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
245
208
                                        common.ent \
246
209
                                        mandos-options.xml \
289
252
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
290
253
                $@)
291
254
 
292
 
# Uses nested functions
293
 
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
294
 
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
295
 
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
296
 
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
297
 
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
298
 
 
299
 
# Need to add the GnuTLS, Avahi and GPGME libraries
300
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
301
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
302
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
303
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
304
 
 
305
 
# Need to add the libnl-route library
306
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
307
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
308
 
 
309
 
# Need to add the GLib and pthread libraries
310
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
311
 
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
312
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
313
 
 
314
 
.PHONY: clean
 
255
# Need to add the GnuTLS, Avahi and GPGME libraries, and can't use
 
256
# -fsanitize=leak because GnuTLS and GPGME both leak memory.
 
257
plugins.d/mandos-client: plugins.d/mandos-client.c
 
258
        $(CC) $(filter-out -fsanitize=leak,$(CFLAGS)) $(strip\
 
259
        ) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) $(strip\
 
260
                ) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) $^ $(strip\
 
261
                ) -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
262
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
 
273
 
315
274
clean:
316
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
317
276
 
318
 
.PHONY: distclean
319
277
distclean: clean
320
 
.PHONY: mostlyclean
321
278
mostlyclean: clean
322
 
.PHONY: maintainer-clean
323
279
maintainer-clean: clean
324
280
        -rm --force --recursive keydir confdir statedir
325
281
 
326
 
.PHONY: check
327
 
check: all
 
282
check:  all
328
283
        ./mandos --check
329
284
        ./mandos-ctl --check
330
 
        ./mandos-keygen --version
331
 
        ./plugin-runner --version
332
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
333
 
        ./dracut-module/password-agent --test
334
285
 
335
286
# Run the client with a local config and key
336
 
.PHONY: run-client
337
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
338
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
339
 
        @echo '######################################################'
340
 
        @echo '# The following error messages are harmless and can  #'
341
 
        @echo '#  be safely ignored:                                #'
342
 
        @echo '## From plugin-runner:                               #'
343
 
        @echo '# setgid: Operation not permitted                    #'
344
 
        @echo '# setuid: Operation not permitted                    #'
345
 
        @echo '## From askpass-fifo:                                #'
346
 
        @echo '# mkfifo: Permission denied                          #'
347
 
        @echo '## From mandos-client:                               #'
348
 
        @echo '# Failed to raise privileges: Operation not permi... #'
349
 
        @echo '# Warning: network hook "*" exited with status *     #'
350
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
351
 
        @echo '# Failed to bring up interface "*": Operation not... #'
352
 
        @echo '#                                                    #'
353
 
        @echo '# (The messages are caused by not running as root,   #'
354
 
        @echo '# but you should NOT run "make run-client" as root   #'
355
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
356
 
        @echo '# root, which is also NOT recommended.)              #'
357
 
        @echo '######################################################'
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
358
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
359
303
        ./plugin-runner --plugin-dir=plugins.d \
360
304
                --plugin-helper-dir=plugin-helpers \
367
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
368
312
        install --directory keydir
369
313
        ./mandos-keygen --dir keydir --force
370
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
371
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
372
 
        fi
373
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
374
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
375
 
        fi
376
314
 
377
315
# Run the server with a local config
378
 
.PHONY: run-server
379
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
380
317
        ./mandos --debug --no-dbus --configdir=confdir \
381
318
                --statedir=statedir $(SERVERARGS)
382
319
 
383
320
# Used by run-server
384
321
confdir/mandos.conf: mandos.conf
385
 
        install -D --mode=u=rw,go=r $^ $@
 
322
        install --directory confdir
 
323
        install --mode=u=rw,go=r $^ $@
386
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
387
 
        install -D --mode=u=rw $< $@
 
325
        install --directory confdir
 
326
        install --mode=u=rw $< $@
388
327
# Add a client password
389
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
390
329
statedir:
391
330
        install --directory statedir
392
331
 
393
 
.PHONY: install
394
332
install: install-server install-client-nokey
395
333
 
396
 
.PHONY: install-html
397
334
install-html: html
398
 
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
 
335
        install --directory $(htmldir)
 
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
399
337
                $(htmldocs)
400
338
 
401
 
.PHONY: install-server
402
339
install-server: doc
 
340
        install --directory $(CONFDIR)
403
341
        if install --directory --mode=u=rwx --owner=$(USER) \
404
342
                --group=$(GROUP) $(STATEDIR); then \
405
343
                :; \
406
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
407
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
408
346
        fi
409
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
410
 
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
411
349
                        $(TMPFILES)/mandos.conf; \
412
350
        fi
413
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
414
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
415
 
                        $(SYSUSERS)/mandos.conf; \
416
 
        fi
417
 
        install --directory $(PREFIX)/sbin
418
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
419
 
                mandos
 
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
420
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
421
353
                mandos-ctl
422
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
423
355
                mandos-monitor
424
 
        install --directory $(CONFDIR)
425
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
426
357
                mandos.conf
427
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
428
359
                clients.conf
429
 
        install -D --mode=u=rw,go=r dbus-mandos.conf \
430
 
                $(DBUSPOLICYDIR)/mandos.conf
431
 
        install -D --mode=u=rwx,go=rx init.d-mandos \
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
362
        install --mode=u=rwx,go=rx init.d-mandos \
432
363
                $(DESTDIR)/etc/init.d/mandos
433
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
434
 
                install -D --mode=u=rw,go=r mandos.service \
435
 
                        $(SYSTEMD); \
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
436
366
        fi
437
 
        install -D --mode=u=rw,go=r default-mandos \
 
367
        install --mode=u=rw,go=r default-mandos \
438
368
                $(DESTDIR)/etc/default/mandos
439
369
        if [ -z $(DESTDIR) ]; then \
440
370
                update-rc.d mandos defaults 25 15;\
441
371
        fi
442
 
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
443
372
        gzip --best --to-stdout mandos.8 \
444
373
                > $(MANDIR)/man8/mandos.8.gz
445
374
        gzip --best --to-stdout mandos-monitor.8 \
453
382
        gzip --best --to-stdout intro.8mandos \
454
383
                > $(MANDIR)/man8/intro.8mandos.gz
455
384
 
456
 
.PHONY: install-client-nokey
457
385
install-client-nokey: all doc
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
458
387
        install --directory --mode=u=rwx $(KEYDIR) \
459
388
                $(LIBDIR)/mandos/plugins.d \
460
389
                $(LIBDIR)/mandos/plugin-helpers
461
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
462
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
463
 
                        $(SYSUSERS)/mandos-client.conf; \
464
 
        fi
465
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
466
 
                install --directory \
467
 
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
391
                install --mode=u=rwx \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
468
393
                        "$(CONFDIR)/plugin-helpers"; \
469
394
        fi
470
 
        install --directory --mode=u=rwx,go=rx \
 
395
        install --mode=u=rwx,go=rx --directory \
471
396
                "$(CONFDIR)/network-hooks.d"
472
397
        install --mode=u=rwx,go=rx \
473
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
474
399
        install --mode=u=rwx,go=rx \
475
 
                --target-directory=$(LIBDIR)/mandos \
476
 
                mandos-to-cryptroot-unlock
477
 
        install --directory $(PREFIX)/sbin
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
478
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
479
402
                mandos-keygen
480
403
        install --mode=u=rwx,go=rx \
498
421
        install --mode=u=rwx,go=rx \
499
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
500
423
                plugin-helpers/mandos-client-iprouteadddel
501
 
        install -D initramfs-tools-hook \
 
424
        install initramfs-tools-hook \
502
425
                $(INITRAMFSTOOLS)/hooks/mandos
503
 
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
504
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
505
 
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
506
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
507
 
        install -D initramfs-tools-script \
 
428
        install initramfs-tools-script \
508
429
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
509
 
        install -D initramfs-tools-script-stop \
 
430
        install initramfs-tools-script-stop \
510
431
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
511
 
        install -D --mode=u=rw,go=r \
512
 
                --target-directory=$(DRACUTMODULE) \
513
 
                dracut-module/ask-password-mandos.path \
514
 
                dracut-module/ask-password-mandos.service
515
 
        install --mode=u=rwxs,go=rx \
516
 
                --target-directory=$(DRACUTMODULE) \
517
 
                dracut-module/module-setup.sh \
518
 
                dracut-module/cmdline-mandos.sh \
519
 
                dracut-module/password-agent
520
432
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
521
 
        install --directory $(MANDIR)/man8
522
433
        gzip --best --to-stdout mandos-keygen.8 \
523
434
                > $(MANDIR)/man8/mandos-keygen.8.gz
524
435
        gzip --best --to-stdout plugin-runner.8mandos \
535
446
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
536
447
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
537
448
                > $(MANDIR)/man8/plymouth.8mandos.gz
538
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
539
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
540
449
 
541
 
.PHONY: install-client
542
450
install-client: install-client-nokey
543
451
# Post-installation stuff
544
452
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
545
 
        if command -v update-initramfs >/dev/null; then \
546
 
            update-initramfs -k all -u; \
547
 
        elif command -v dracut >/dev/null; then \
548
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
549
 
                if [ -w "$$initrd" ]; then \
550
 
                    chmod go-r "$$initrd"; \
551
 
                    dracut --force "$$initrd"; \
552
 
                fi; \
553
 
            done; \
554
 
        fi
 
453
        update-initramfs -k all -u
555
454
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
556
455
 
557
 
.PHONY: uninstall
558
456
uninstall: uninstall-server uninstall-client
559
457
 
560
 
.PHONY: uninstall-server
561
458
uninstall-server:
562
459
        -rm --force $(PREFIX)/sbin/mandos \
563
460
                $(PREFIX)/sbin/mandos-ctl \
570
467
        update-rc.d -f mandos remove
571
468
        -rmdir $(CONFDIR)
572
469
 
573
 
.PHONY: uninstall-client
574
470
uninstall-client:
575
471
# Refuse to uninstall client if /etc/crypttab is explicitly configured
576
472
# to use it.
587
483
                $(INITRAMFSTOOLS)/hooks/mandos \
588
484
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
589
485
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
590
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
591
 
                $(DRACUTMODULE)/ask-password-mandos.path \
592
 
                $(DRACUTMODULE)/ask-password-mandos.service \
593
 
                $(DRACUTMODULE)/module-setup.sh \
594
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
595
 
                $(DRACUTMODULE)/password-agent \
596
486
                $(MANDIR)/man8/mandos-keygen.8.gz \
597
487
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
598
488
                $(MANDIR)/man8/mandos-client.8mandos.gz
601
491
                $(MANDIR)/man8/splashy.8mandos.gz \
602
492
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
603
493
                $(MANDIR)/man8/plymouth.8mandos.gz \
604
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
605
494
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
606
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
607
 
        if command -v update-initramfs >/dev/null; then \
608
 
            update-initramfs -k all -u; \
609
 
        elif command -v dracut >/dev/null; then \
610
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
611
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
612
 
            done; \
613
 
        fi
 
495
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
496
        update-initramfs -k all -u
614
497
 
615
 
.PHONY: purge
616
498
purge: purge-server purge-client
617
499
 
618
 
.PHONY: purge-server
619
500
purge-server: uninstall-server
620
501
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
621
502
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
622
503
                $(DESTDIR)/etc/default/mandos \
623
504
                $(DESTDIR)/etc/init.d/mandos \
 
505
                $(SYSTEMD)/mandos.service \
624
506
                $(DESTDIR)/run/mandos.pid \
625
507
                $(DESTDIR)/var/run/mandos.pid
626
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
627
 
                -rm --force -- $(SYSTEMD)/mandos.service; \
628
 
        fi
629
508
        -rmdir $(CONFDIR)
630
509
 
631
 
.PHONY: purge-client
632
510
purge-client: uninstall-client
633
511
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
634
512
        -rm --force $(CONFDIR)/plugin-runner.conf \