/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-08-02 22:16:53 UTC
  • mto: This revision was merged to the branch mainline in revision 386.
  • Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install

There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation.  It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time.  The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file.  The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor).  The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.

Fixing this should also make the Debian CI autopkgtest tests work.

* debian/mandos.postinst (configure): After creating (or renaming)
                                      user & group, reload D-Bus
                                      daemon (if present).

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Wunreachable-code -Winline \
8
 
        -Wvolatile-register-var
9
 
DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
13
41
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
16
 
# PREFIX=/usr/local
17
 
PREFIX=$(DESTDIR)/usr
18
 
# CONFDIR=/usr/local/lib/mandos
19
 
CONFDIR=$(DESTDIR)/etc/mandos
20
 
# KEYDIR=/usr/local/lib/mandos/keys
21
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
22
 
# MANDIR=/usr/local/man
23
 
MANDIR=$(DESTDIR)/usr/share/man
24
 
 
25
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
26
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
27
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
28
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
29
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
30
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.5
 
46
SED:=sed
 
47
PKG_CONFIG?=pkg-config
 
48
 
 
49
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
50
        || getent passwd nobody || echo 65534)))
 
51
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
52
        || getent group nogroup || echo 65534)))
 
53
 
 
54
LINUXVERSION:=$(shell uname --kernel-release)
 
55
 
 
56
## Use these settings for a traditional /usr/local install
 
57
# PREFIX:=$(DESTDIR)/usr/local
 
58
# CONFDIR:=$(DESTDIR)/etc/mandos
 
59
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
60
# MANDIR:=$(PREFIX)/man
 
61
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
62
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
63
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
64
# LIBDIR:=$(PREFIX)/lib
 
65
##
 
66
 
 
67
## These settings are for a package-type install
 
68
PREFIX:=$(DESTDIR)/usr
 
69
CONFDIR:=$(DESTDIR)/etc/mandos
 
70
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
71
MANDIR:=$(PREFIX)/share/man
 
72
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
73
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
74
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
75
LIBDIR:=$(shell \
 
76
        for d in \
 
77
        "/usr/lib/`dpkg-architecture \
 
78
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
79
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
80
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
81
                        echo "$(DESTDIR)$$d"; \
 
82
                        break; \
 
83
                fi; \
 
84
        done)
 
85
##
 
86
 
 
87
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
88
                        --variable=systemdsystemunitdir)
 
89
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
90
                        --variable=tmpfilesdir)
 
91
 
 
92
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
93
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
94
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
95
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
96
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
97
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
98
        getconf LFS_LDFLAGS)
 
99
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
100
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
101
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
102
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
31
103
 
32
104
# Do not change these two
33
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
34
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
35
 
LDFLAGS=$(COVERAGE)
 
105
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
106
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
107
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
108
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
36
109
 
37
 
# Commands to format a DocBook refentry document into a manual page
38
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
110
# Commands to format a DocBook <refentry> document into a manual page
 
111
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
39
112
        --param man.charmap.use.subset          0 \
40
113
        --param make.year.ranges                1 \
41
114
        --param make.single.year.ranges         1 \
42
115
        --param man.output.quietly              1 \
43
116
        --param man.authors.section.enabled     0 \
44
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
117
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
45
118
        $(notdir $<); \
46
 
        $(MANPOST) $(notdir $@)
47
 
# DocBook-to-man post-processing to fix a \n escape bug
48
 
MANPOST=sed --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
49
 
 
50
 
PLUGINS=plugins.d/password-prompt plugins.d/password-request
51
 
PROGS=plugin-runner $(PLUGINS)
52
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
53
 
        plugins.d/password-request.8mandos \
54
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
55
 
        mandos-clients.conf.5
56
 
 
57
 
objects=$(addsuffix .o,$(PROGS))
58
 
 
59
 
all: $(PROGS)
 
119
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
120
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
121
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
122
        $(notdir $@); fi >/dev/null)
 
123
 
 
124
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
125
        --param make.year.ranges                1 \
 
126
        --param make.single.year.ranges         1 \
 
127
        --param man.output.quietly              1 \
 
128
        --param man.authors.section.enabled     0 \
 
129
        --param citerefentry.link               1 \
 
130
        --output $@ \
 
131
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
132
        $<; $(HTMLPOST) $@)
 
133
# Fix citerefentry links
 
134
HTMLPOST:=$(SED) --in-place \
 
135
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
136
 
 
137
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
138
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
139
        plugins.d/plymouth
 
140
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
141
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
142
        $(PLUGIN_HELPERS)
 
143
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
144
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
145
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
146
        dracut-module/password-agent.8mandos \
 
147
        plugins.d/mandos-client.8mandos \
 
148
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
149
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
150
        plugins.d/plymouth.8mandos intro.8mandos
 
151
 
 
152
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
153
 
 
154
objects:=$(addsuffix .o,$(CPROGS))
 
155
 
 
156
all: $(PROGS) mandos.lsm
60
157
 
61
158
doc: $(DOCS)
62
159
 
63
 
%.5: %.xml legalnotice.xml
64
 
        $(DOCBOOKTOMAN)
65
 
 
66
 
%.8: %.xml legalnotice.xml
67
 
        $(DOCBOOKTOMAN)
68
 
 
69
 
%.8mandos: %.xml legalnotice.xml
70
 
        $(DOCBOOKTOMAN)
71
 
 
72
 
mandos.8: mandos.xml mandos-options.xml overview.xml legalnotice.xml
73
 
        $(DOCBOOKTOMAN)
74
 
 
75
 
mandos-keygen.8: mandos-keygen.xml overview.xml legalnotice.xml
76
 
        $(DOCBOOKTOMAN)
77
 
 
78
 
mandos.conf.5: mandos.conf.xml mandos-options.xml legalnotice.xml
79
 
        $(DOCBOOKTOMAN)
80
 
 
81
 
plugin-runner.8mandos: plugin-runner.xml overview.xml legalnotice.xml
82
 
        $(DOCBOOKTOMAN)
83
 
 
84
 
plugins.d/password-request.8mandos: plugins.d/password-request.xml \
85
 
                                        mandos-options.xml \
86
 
                                        overview.xml legalnotice.xml
87
 
        $(DOCBOOKTOMAN)
88
 
 
89
 
plugins.d/password-request: plugins.d/password-request.o
90
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
91
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
92
 
 
93
 
.PHONY : all doc clean distclean run-client run-server install \
94
 
        install-server install-client uninstall uninstall-server \
95
 
        uninstall-client purge purge-server purge-client
 
160
html: $(htmldocs)
 
161
 
 
162
%.5: %.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOMAN)
 
164
%.5.xhtml: %.xml common.ent legalnotice.xml
 
165
        $(DOCBOOKTOHTML)
 
166
 
 
167
%.8: %.xml common.ent legalnotice.xml
 
168
        $(DOCBOOKTOMAN)
 
169
%.8.xhtml: %.xml common.ent legalnotice.xml
 
170
        $(DOCBOOKTOHTML)
 
171
 
 
172
%.8mandos: %.xml common.ent legalnotice.xml
 
173
        $(DOCBOOKTOMAN)
 
174
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
175
        $(DOCBOOKTOHTML)
 
176
 
 
177
intro.8mandos: intro.xml common.ent legalnotice.xml
 
178
        $(DOCBOOKTOMAN)
 
179
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
180
        $(DOCBOOKTOHTML)
 
181
 
 
182
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
183
                legalnotice.xml
 
184
        $(DOCBOOKTOMAN)
 
185
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
186
                overview.xml legalnotice.xml
 
187
        $(DOCBOOKTOHTML)
 
188
 
 
189
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
190
                legalnotice.xml
 
191
        $(DOCBOOKTOMAN)
 
192
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
193
                 legalnotice.xml
 
194
        $(DOCBOOKTOHTML)
 
195
 
 
196
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
197
                legalnotice.xml
 
198
        $(DOCBOOKTOMAN)
 
199
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
200
                 legalnotice.xml
 
201
        $(DOCBOOKTOHTML)
 
202
 
 
203
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
204
                legalnotice.xml
 
205
        $(DOCBOOKTOMAN)
 
206
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
207
                 legalnotice.xml
 
208
        $(DOCBOOKTOHTML)
 
209
 
 
210
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
211
                legalnotice.xml
 
212
        $(DOCBOOKTOMAN)
 
213
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
214
                legalnotice.xml
 
215
        $(DOCBOOKTOHTML)
 
216
 
 
217
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
218
                legalnotice.xml
 
219
        $(DOCBOOKTOMAN)
 
220
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
221
                overview.xml legalnotice.xml
 
222
        $(DOCBOOKTOHTML)
 
223
 
 
224
dracut-module/password-agent.8mandos: \
 
225
                dracut-module/password-agent.xml common.ent \
 
226
                overview.xml legalnotice.xml
 
227
        $(DOCBOOKTOMAN)
 
228
dracut-module/password-agent.8mandos.xhtml: \
 
229
                dracut-module/password-agent.xml common.ent \
 
230
                overview.xml legalnotice.xml
 
231
        $(DOCBOOKTOHTML)
 
232
 
 
233
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
234
                                        common.ent \
 
235
                                        mandos-options.xml \
 
236
                                        overview.xml legalnotice.xml
 
237
        $(DOCBOOKTOMAN)
 
238
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
239
                                        common.ent \
 
240
                                        mandos-options.xml \
 
241
                                        overview.xml legalnotice.xml
 
242
        $(DOCBOOKTOHTML)
 
243
 
 
244
# Update all these files with version number $(version)
 
245
common.ent: Makefile
 
246
        $(strip $(SED) --in-place \
 
247
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
248
                $@)
 
249
 
 
250
mandos: Makefile
 
251
        $(strip $(SED) --in-place \
 
252
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
253
                $@)
 
254
 
 
255
mandos-keygen: Makefile
 
256
        $(strip $(SED) --in-place \
 
257
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
258
                $@)
 
259
 
 
260
mandos-ctl: Makefile
 
261
        $(strip $(SED) --in-place \
 
262
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
263
                $@)
 
264
 
 
265
mandos-monitor: Makefile
 
266
        $(strip $(SED) --in-place \
 
267
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
268
                $@)
 
269
 
 
270
mandos.lsm: Makefile
 
271
        $(strip $(SED) --in-place \
 
272
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
273
                $@)
 
274
        $(strip $(SED) --in-place \
 
275
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
276
                $@)
 
277
        $(strip $(SED) --in-place \
 
278
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
279
                $@)
 
280
 
 
281
# Need to add the GnuTLS, Avahi and GPGME libraries
 
282
plugins.d/mandos-client: plugins.d/mandos-client.c
 
283
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
284
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
 
285
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
286
                ) $(LDLIBS) -o $@
 
287
 
 
288
# Need to add the libnl-route library
 
289
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
290
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
291
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
292
 
 
293
# Need to add the GLib and pthread libraries
 
294
dracut-module/password-agent: dracut-module/password-agent.c
 
295
        $(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
 
296
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
297
 
 
298
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
299
        check run-client run-server install install-html \
 
300
        install-server install-client-nokey install-client uninstall \
 
301
        uninstall-server uninstall-client purge purge-server \
 
302
        purge-client
96
303
 
97
304
clean:
98
 
        -rm --force $(PROGS) $(objects) $(DOCS) core
 
305
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
99
306
 
100
307
distclean: clean
101
308
mostlyclean: clean
102
309
maintainer-clean: clean
103
 
        -rm --force --recursive keydir confdir
 
310
        -rm --force --recursive keydir confdir statedir
104
311
 
105
 
check:
 
312
check: all
106
313
        ./mandos --check
 
314
        ./mandos-ctl --check
 
315
        ./mandos-keygen --version
 
316
        ./plugin-runner --version
 
317
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
318
        ./dracut-module/password-agent --test
107
319
 
108
320
# Run the client with a local config and key
109
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
321
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
322
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
323
        @echo '######################################################'
 
324
        @echo '# The following error messages are harmless and can  #'
 
325
        @echo '#  be safely ignored:                                #'
 
326
        @echo '## From plugin-runner:                               #'
 
327
        @echo '# setgid: Operation not permitted                    #'
 
328
        @echo '# setuid: Operation not permitted                    #'
 
329
        @echo '## From askpass-fifo:                                #'
 
330
        @echo '# mkfifo: Permission denied                          #'
 
331
        @echo '## From mandos-client:                               #'
 
332
        @echo '# Failed to raise privileges: Operation not permi... #'
 
333
        @echo '# Warning: network hook "*" exited with status *     #'
 
334
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
335
        @echo '# Failed to bring up interface "*": Operation not... #'
 
336
        @echo '#                                                    #'
 
337
        @echo '# (The messages are caused by not running as root,   #'
 
338
        @echo '# but you should NOT run "make run-client" as root   #'
 
339
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
340
        @echo '# root, which is also NOT recommended.)              #'
 
341
        @echo '######################################################'
 
342
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
110
343
        ./plugin-runner --plugin-dir=plugins.d \
 
344
                --plugin-helper-dir=plugin-helpers \
111
345
                --config-file=plugin-runner.conf \
112
 
                --options-for=password-request:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
346
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
347
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
348
                $(CLIENTARGS)
113
349
 
114
350
# Used by run-client
115
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
351
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
116
352
        install --directory keydir
117
353
        ./mandos-keygen --dir keydir --force
118
354
 
119
355
# Run the server with a local config
120
 
run-server: confdir/mandos.conf confdir/clients.conf
121
 
        ./mandos --debug --configdir=confdir
 
356
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
357
        ./mandos --debug --no-dbus --configdir=confdir \
 
358
                --statedir=statedir $(SERVERARGS)
122
359
 
123
360
# Used by run-server
124
361
confdir/mandos.conf: mandos.conf
125
362
        install --directory confdir
126
363
        install --mode=u=rw,go=r $^ $@
127
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
364
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
128
365
        install --directory confdir
129
366
        install --mode=u=rw $< $@
130
367
# Add a client password
131
 
        ./mandos-keygen --dir keydir --password >> $@
132
 
 
133
 
install: install-server install-client
 
368
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
369
statedir:
 
370
        install --directory statedir
 
371
 
 
372
install: install-server install-client-nokey
 
373
 
 
374
install-html: html
 
375
        install --directory $(htmldir)
 
376
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
377
                $(htmldocs)
134
378
 
135
379
install-server: doc
136
 
        install --directory $(CONFDIR) $(MANDIR)/man5 \
137
 
                $(MANDIR)/man8
 
380
        install --directory $(CONFDIR)
 
381
        if install --directory --mode=u=rwx --owner=$(USER) \
 
382
                --group=$(GROUP) $(STATEDIR); then \
 
383
                :; \
 
384
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
385
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
386
        fi
 
387
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
388
                        -a -d "$(TMPFILES)" ]; then \
 
389
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
390
                        $(TMPFILES)/mandos.conf; \
 
391
        fi
138
392
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
393
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
394
                mandos-ctl
 
395
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
396
                mandos-monitor
139
397
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
140
398
                mandos.conf
141
399
        install --mode=u=rw --target-directory=$(CONFDIR) \
142
400
                clients.conf
143
 
        install --mode=u=rwx,go=rx init.d-mandos /etc/init.d/mandos
144
 
        install --mode=u=rw,go=r default-mandos /etc/default/mandos
145
 
        update-rc.d mandos defaults
 
401
        install --mode=u=rw,go=r dbus-mandos.conf \
 
402
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
403
        install --mode=u=rwx,go=rx init.d-mandos \
 
404
                $(DESTDIR)/etc/init.d/mandos
 
405
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
406
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
407
        fi
 
408
        install --mode=u=rw,go=r default-mandos \
 
409
                $(DESTDIR)/etc/default/mandos
 
410
        if [ -z $(DESTDIR) ]; then \
 
411
                update-rc.d mandos defaults 25 15;\
 
412
        fi
146
413
        gzip --best --to-stdout mandos.8 \
147
414
                > $(MANDIR)/man8/mandos.8.gz
 
415
        gzip --best --to-stdout mandos-monitor.8 \
 
416
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
417
        gzip --best --to-stdout mandos-ctl.8 \
 
418
                > $(MANDIR)/man8/mandos-ctl.8.gz
148
419
        gzip --best --to-stdout mandos.conf.5 \
149
420
                > $(MANDIR)/man5/mandos.conf.5.gz
150
421
        gzip --best --to-stdout mandos-clients.conf.5 \
151
422
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
423
        gzip --best --to-stdout intro.8mandos \
 
424
                > $(MANDIR)/man8/intro.8mandos.gz
152
425
 
153
 
install-client: all doc /usr/share/initramfs-tools/hooks/.
154
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR) \
155
 
                $(MANDIR)/man8
156
 
        install --directory --mode=u=rwx $(KEYDIR)
157
 
        install --directory --mode=u=rwx \
158
 
                $(PREFIX)/lib/mandos/plugins.d
159
 
        if [ "$(CONFDIR)/plugins.d" \
160
 
                        != "$(PREFIX)/lib/mandos/plugins.d" ]; then \
 
426
install-client-nokey: all doc
 
427
        install --directory $(LIBDIR)/mandos $(CONFDIR)
 
428
        install --directory --mode=u=rwx $(KEYDIR) \
 
429
                $(LIBDIR)/mandos/plugins.d \
 
430
                $(LIBDIR)/mandos/plugin-helpers
 
431
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
161
432
                install --mode=u=rwx \
162
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
433
                        --directory "$(CONFDIR)/plugins.d" \
 
434
                        "$(CONFDIR)/plugin-helpers"; \
163
435
        fi
164
 
        install --mode=u=rwx,go=rx \
165
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
436
        install --mode=u=rwx,go=rx --directory \
 
437
                "$(CONFDIR)/network-hooks.d"
 
438
        install --mode=u=rwx,go=rx \
 
439
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
440
        install --mode=u=rwx,go=rx \
 
441
                --target-directory=$(LIBDIR)/mandos \
 
442
                mandos-to-cryptroot-unlock
166
443
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
167
444
                mandos-keygen
168
445
        install --mode=u=rwx,go=rx \
169
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
446
                --target-directory=$(LIBDIR)/mandos/plugins.d \
170
447
                plugins.d/password-prompt
171
448
        install --mode=u=rwxs,go=rx \
172
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
173
 
                plugins.d/password-request
174
 
        install --mode=u=rwx,go=rx \
175
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
449
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
450
                plugins.d/mandos-client
 
451
        install --mode=u=rwxs,go=rx \
 
452
                --target-directory=$(LIBDIR)/mandos/plugins.d \
176
453
                plugins.d/usplash
 
454
        install --mode=u=rwxs,go=rx \
 
455
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
456
                plugins.d/splashy
 
457
        install --mode=u=rwxs,go=rx \
 
458
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
459
                plugins.d/askpass-fifo
 
460
        install --mode=u=rwxs,go=rx \
 
461
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
462
                plugins.d/plymouth
 
463
        install --mode=u=rwx,go=rx \
 
464
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
465
                plugin-helpers/mandos-client-iprouteadddel
177
466
        install initramfs-tools-hook \
178
 
                /usr/share/initramfs-tools/hooks/mandos
179
 
        install initramfs-tools-hook-conf \
180
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos
 
467
                $(INITRAMFSTOOLS)/hooks/mandos
 
468
        install --mode=u=rw,go=r initramfs-tools-conf \
 
469
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
470
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
471
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
181
472
        install initramfs-tools-script \
182
 
                /usr/share/initramfs-tools/scripts/local-top/mandos
 
473
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
474
        install initramfs-tools-script-stop \
 
475
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
476
        install --directory $(DRACUTMODULE)
 
477
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
478
                dracut-module/ask-password-mandos.path \
 
479
                dracut-module/ask-password-mandos.service
 
480
        install --mode=u=rwxs,go=rx \
 
481
                --target-directory=$(DRACUTMODULE) \
 
482
                dracut-module/module-setup.sh \
 
483
                dracut-module/cmdline-mandos.sh \
 
484
                dracut-module/password-agent
183
485
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
184
486
        gzip --best --to-stdout mandos-keygen.8 \
185
487
                > $(MANDIR)/man8/mandos-keygen.8.gz
186
488
        gzip --best --to-stdout plugin-runner.8mandos \
187
489
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
490
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
491
                > $(MANDIR)/man8/mandos-client.8mandos.gz
188
492
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
189
493
                > $(MANDIR)/man8/password-prompt.8mandos.gz
190
 
        gzip --best --to-stdout plugins.d/password-request.8mandos \
191
 
                > $(MANDIR)/man8/password-request.8mandos.gz
 
494
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
495
                > $(MANDIR)/man8/usplash.8mandos.gz
 
496
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
497
                > $(MANDIR)/man8/splashy.8mandos.gz
 
498
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
499
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
500
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
501
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
502
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
503
                > $(MANDIR)/man8/password-agent.8mandos.gz
 
504
 
 
505
install-client: install-client-nokey
192
506
# Post-installation stuff
193
507
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
194
 
        update-initramfs -k all -u
 
508
        if command -v update-initramfs >/dev/null; then \
 
509
            update-initramfs -k all -u; \
 
510
        elif command -v dracut >/dev/null; then \
 
511
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
512
                if [ -w "$$initrd" ]; then \
 
513
                    chmod go-r "$$initrd"; \
 
514
                    dracut --force "$$initrd"; \
 
515
                fi; \
 
516
            done; \
 
517
        fi
195
518
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
196
519
 
197
520
uninstall: uninstall-server uninstall-client
198
521
 
199
522
uninstall-server:
200
523
        -rm --force $(PREFIX)/sbin/mandos \
 
524
                $(PREFIX)/sbin/mandos-ctl \
 
525
                $(PREFIX)/sbin/mandos-monitor \
201
526
                $(MANDIR)/man8/mandos.8.gz \
 
527
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
528
                $(MANDIR)/man8/mandos-ctl.8.gz \
202
529
                $(MANDIR)/man5/mandos.conf.5.gz \
203
530
                $(MANDIR)/man5/mandos-clients.conf.5.gz
204
531
        update-rc.d -f mandos remove
208
535
# Refuse to uninstall client if /etc/crypttab is explicitly configured
209
536
# to use it.
210
537
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
211
 
                /etc/crypttab
 
538
                $(DESTDIR)/etc/crypttab
212
539
        -rm --force $(PREFIX)/sbin/mandos-keygen \
213
 
                $(PREFIX)/lib/mandos/plugin-runner \
214
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
215
 
                $(PREFIX)/lib/mandos/plugins.d/password-request \
216
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
217
 
                /usr/share/initramfs-tools/hooks/mandos \
218
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos \
219
 
                /usr/share/initramfs-tools/scripts/local-top/mandos \
 
540
                $(LIBDIR)/mandos/plugin-runner \
 
541
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
542
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
543
                $(LIBDIR)/mandos/plugins.d/usplash \
 
544
                $(LIBDIR)/mandos/plugins.d/splashy \
 
545
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
546
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
547
                $(INITRAMFSTOOLS)/hooks/mandos \
 
548
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
549
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
550
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
551
                $(DRACUTMODULE)/ask-password-mandos.path \
 
552
                $(DRACUTMODULE)/ask-password-mandos.service \
 
553
                $(DRACUTMODULE)/module-setup.sh \
 
554
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
555
                $(DRACUTMODULE)/password-agent \
 
556
                $(MANDIR)/man8/mandos-keygen.8.gz \
220
557
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
221
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
558
                $(MANDIR)/man8/mandos-client.8mandos.gz
222
559
                $(MANDIR)/man8/password-prompt.8mandos.gz \
223
 
                $(MANDIR)/man8/password-request.8mandos.gz
224
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
225
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
226
 
        update-initramfs -k all -u
 
560
                $(MANDIR)/man8/usplash.8mandos.gz \
 
561
                $(MANDIR)/man8/splashy.8mandos.gz \
 
562
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
563
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
564
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
565
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
566
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
567
        if command -v update-initramfs >/dev/null; then \
 
568
            update-initramfs -k all -u; \
 
569
        elif command -v dracut >/dev/null; then \
 
570
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
571
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
572
            done; \
 
573
        fi
227
574
 
228
575
purge: purge-server purge-client
229
576
 
230
577
purge-server: uninstall-server
231
578
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
232
 
                /etc/default/mandos /etc/init.d/mandos \
233
 
                /var/run/mandos.pid
 
579
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
580
                $(DESTDIR)/etc/default/mandos \
 
581
                $(DESTDIR)/etc/init.d/mandos \
 
582
                $(SYSTEMD)/mandos.service \
 
583
                $(DESTDIR)/run/mandos.pid \
 
584
                $(DESTDIR)/var/run/mandos.pid
234
585
        -rmdir $(CONFDIR)
235
586
 
236
587
purge-client: uninstall-client
237
 
        -shred --remove $(KEYDIR)/seckey.txt
 
588
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
238
589
        -rm --force $(CONFDIR)/plugin-runner.conf \
239
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
590
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
591
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
240
592
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)