/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-08-02 22:16:53 UTC
  • mto: This revision was merged to the branch mainline in revision 386.
  • Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install

There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation.  It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time.  The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file.  The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor).  The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.

Fixing this should also make the Debian CI autopkgtest tests work.

* debian/mandos.postinst (configure): After creating (or renaming)
                                      user & group, reload D-Bus
                                      daemon (if present).

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
9
 
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
12
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
14
 
LINK_FORTIFY_LD=-z relro -z now
15
 
LINK_FORTIFY=
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
16
35
 
17
36
# If BROKEN_PIE is set, do not build with -pie
18
37
ifndef BROKEN_PIE
20
39
LINK_FORTIFY += -pie
21
40
endif
22
41
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
25
 
htmldir=man
26
 
version=1.4.1
27
 
SED=sed
28
 
 
29
 
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.5
 
46
SED:=sed
 
47
PKG_CONFIG?=pkg-config
 
48
 
 
49
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
50
        || getent passwd nobody || echo 65534)))
 
51
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
52
        || getent group nogroup || echo 65534)))
 
53
 
 
54
LINUXVERSION:=$(shell uname --kernel-release)
31
55
 
32
56
## Use these settings for a traditional /usr/local install
33
 
# PREFIX=$(DESTDIR)/usr/local
34
 
# CONFDIR=$(DESTDIR)/etc/mandos
35
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
36
 
# MANDIR=$(PREFIX)/man
37
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
 
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
57
# PREFIX:=$(DESTDIR)/usr/local
 
58
# CONFDIR:=$(DESTDIR)/etc/mandos
 
59
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
60
# MANDIR:=$(PREFIX)/man
 
61
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
62
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
63
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
64
# LIBDIR:=$(PREFIX)/lib
39
65
##
40
66
 
41
67
## These settings are for a package-type install
42
 
PREFIX=$(DESTDIR)/usr
43
 
CONFDIR=$(DESTDIR)/etc/mandos
44
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
45
 
MANDIR=$(PREFIX)/share/man
46
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
 
STATEDIR=$(DESTDIR)/var/lib/mandos
 
68
PREFIX:=$(DESTDIR)/usr
 
69
CONFDIR:=$(DESTDIR)/etc/mandos
 
70
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
71
MANDIR:=$(PREFIX)/share/man
 
72
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
73
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
74
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
75
LIBDIR:=$(shell \
 
76
        for d in \
 
77
        "/usr/lib/`dpkg-architecture \
 
78
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
79
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
80
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
81
                        echo "$(DESTDIR)$$d"; \
 
82
                        break; \
 
83
                fi; \
 
84
        done)
48
85
##
49
86
 
50
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
51
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
52
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
53
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
54
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
55
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
87
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
88
                        --variable=systemdsystemunitdir)
 
89
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
90
                        --variable=tmpfilesdir)
 
91
 
 
92
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
93
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
94
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
95
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
96
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
97
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
56
98
        getconf LFS_LDFLAGS)
 
99
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
100
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
101
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
102
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
57
103
 
58
104
# Do not change these two
59
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
60
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
61
 
        -DVERSION='"$(version)"'
62
 
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
105
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
106
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
107
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
108
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
63
109
 
64
110
# Commands to format a DocBook <refentry> document into a manual page
65
111
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
68
114
        --param make.single.year.ranges         1 \
69
115
        --param man.output.quietly              1 \
70
116
        --param man.authors.section.enabled     0 \
71
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
117
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
72
118
        $(notdir $<); \
73
 
        $(MANPOST) $(notdir $@);\
74
 
        LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
75
 
        --local-file $(notdir $@) >/dev/null)
76
 
# DocBook-to-man post-processing to fix a '\n' escape bug
77
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
119
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
120
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
121
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
122
        $(notdir $@); fi >/dev/null)
78
123
 
79
124
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
80
125
        --param make.year.ranges                1 \
86
131
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
87
132
        $<; $(HTMLPOST) $@)
88
133
# Fix citerefentry links
89
 
HTMLPOST=$(SED) --in-place \
 
134
HTMLPOST:=$(SED) --in-place \
90
135
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
91
136
 
92
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
 
137
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
93
138
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
94
139
        plugins.d/plymouth
95
 
CPROGS=plugin-runner $(PLUGINS)
96
 
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
97
 
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
140
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
141
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
142
        $(PLUGIN_HELPERS)
 
143
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
144
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
98
145
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
146
        dracut-module/password-agent.8mandos \
99
147
        plugins.d/mandos-client.8mandos \
100
148
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
101
149
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
102
150
        plugins.d/plymouth.8mandos intro.8mandos
103
151
 
104
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
 
152
htmldocs:=$(addsuffix .xhtml,$(DOCS))
105
153
 
106
 
objects=$(addsuffix .o,$(CPROGS))
 
154
objects:=$(addsuffix .o,$(CPROGS))
107
155
 
108
156
all: $(PROGS) mandos.lsm
109
157
 
173
221
                overview.xml legalnotice.xml
174
222
        $(DOCBOOKTOHTML)
175
223
 
 
224
dracut-module/password-agent.8mandos: \
 
225
                dracut-module/password-agent.xml common.ent \
 
226
                overview.xml legalnotice.xml
 
227
        $(DOCBOOKTOMAN)
 
228
dracut-module/password-agent.8mandos.xhtml: \
 
229
                dracut-module/password-agent.xml common.ent \
 
230
                overview.xml legalnotice.xml
 
231
        $(DOCBOOKTOHTML)
 
232
 
176
233
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
177
234
                                        common.ent \
178
235
                                        mandos-options.xml \
221
278
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
222
279
                $@)
223
280
 
 
281
# Need to add the GnuTLS, Avahi and GPGME libraries
224
282
plugins.d/mandos-client: plugins.d/mandos-client.c
225
 
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
226
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
227
 
 
228
 
.PHONY : all doc html clean distclean run-client run-server install \
229
 
        install-server install-client uninstall uninstall-server \
230
 
        uninstall-client purge purge-server purge-client
 
283
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
284
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
 
285
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
286
                ) $(LDLIBS) -o $@
 
287
 
 
288
# Need to add the libnl-route library
 
289
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
290
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
291
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
292
 
 
293
# Need to add the GLib and pthread libraries
 
294
dracut-module/password-agent: dracut-module/password-agent.c
 
295
        $(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
 
296
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
297
 
 
298
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
299
        check run-client run-server install install-html \
 
300
        install-server install-client-nokey install-client uninstall \
 
301
        uninstall-server uninstall-client purge purge-server \
 
302
        purge-client
231
303
 
232
304
clean:
233
305
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
237
309
maintainer-clean: clean
238
310
        -rm --force --recursive keydir confdir statedir
239
311
 
240
 
check:  all
 
312
check: all
241
313
        ./mandos --check
 
314
        ./mandos-ctl --check
 
315
        ./mandos-keygen --version
 
316
        ./plugin-runner --version
 
317
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
318
        ./dracut-module/password-agent --test
242
319
 
243
320
# Run the client with a local config and key
244
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
245
 
        @echo "###################################################################"
246
 
        @echo "# The following error messages are harmless and can be safely     #"
247
 
        @echo "# ignored.  The messages are caused by not running as root, but   #"
248
 
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
249
 
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
250
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
251
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
252
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
253
 
        @echo "#                     seteuid: Operation not permitted            #"
254
 
        @echo "#                     klogctl: Operation not permitted            #"
255
 
        @echo "###################################################################"
 
321
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
322
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
323
        @echo '######################################################'
 
324
        @echo '# The following error messages are harmless and can  #'
 
325
        @echo '#  be safely ignored:                                #'
 
326
        @echo '## From plugin-runner:                               #'
 
327
        @echo '# setgid: Operation not permitted                    #'
 
328
        @echo '# setuid: Operation not permitted                    #'
 
329
        @echo '## From askpass-fifo:                                #'
 
330
        @echo '# mkfifo: Permission denied                          #'
 
331
        @echo '## From mandos-client:                               #'
 
332
        @echo '# Failed to raise privileges: Operation not permi... #'
 
333
        @echo '# Warning: network hook "*" exited with status *     #'
 
334
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
335
        @echo '# Failed to bring up interface "*": Operation not... #'
 
336
        @echo '#                                                    #'
 
337
        @echo '# (The messages are caused by not running as root,   #'
 
338
        @echo '# but you should NOT run "make run-client" as root   #'
 
339
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
340
        @echo '# root, which is also NOT recommended.)              #'
 
341
        @echo '######################################################'
 
342
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
256
343
        ./plugin-runner --plugin-dir=plugins.d \
 
344
                --plugin-helper-dir=plugin-helpers \
257
345
                --config-file=plugin-runner.conf \
258
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
346
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
347
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
259
348
                $(CLIENTARGS)
260
349
 
261
350
# Used by run-client
262
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
351
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
263
352
        install --directory keydir
264
353
        ./mandos-keygen --dir keydir --force
265
354
 
266
355
# Run the server with a local config
267
 
run-server: confdir/mandos.conf confdir/clients.conf
 
356
run-server: confdir/mandos.conf confdir/clients.conf statedir
268
357
        ./mandos --debug --no-dbus --configdir=confdir \
269
358
                --statedir=statedir $(SERVERARGS)
270
359
 
272
361
confdir/mandos.conf: mandos.conf
273
362
        install --directory confdir
274
363
        install --mode=u=rw,go=r $^ $@
275
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
364
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
276
365
        install --directory confdir
277
366
        install --mode=u=rw $< $@
278
367
# Add a client password
279
 
        ./mandos-keygen --dir keydir --password >> $@
 
368
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
280
369
statedir:
281
370
        install --directory statedir
282
371
 
289
378
 
290
379
install-server: doc
291
380
        install --directory $(CONFDIR)
292
 
        install --directory --mode=u=rwx --owner=$(USER) \
293
 
                --group=$(GROUP) $(STATEDIR)
 
381
        if install --directory --mode=u=rwx --owner=$(USER) \
 
382
                --group=$(GROUP) $(STATEDIR); then \
 
383
                :; \
 
384
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
385
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
386
        fi
 
387
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
388
                        -a -d "$(TMPFILES)" ]; then \
 
389
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
390
                        $(TMPFILES)/mandos.conf; \
 
391
        fi
294
392
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
295
393
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
296
394
                mandos-ctl
304
402
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
305
403
        install --mode=u=rwx,go=rx init.d-mandos \
306
404
                $(DESTDIR)/etc/init.d/mandos
 
405
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
406
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
407
        fi
307
408
        install --mode=u=rw,go=r default-mandos \
308
409
                $(DESTDIR)/etc/default/mandos
309
410
        if [ -z $(DESTDIR) ]; then \
319
420
                > $(MANDIR)/man5/mandos.conf.5.gz
320
421
        gzip --best --to-stdout mandos-clients.conf.5 \
321
422
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
423
        gzip --best --to-stdout intro.8mandos \
 
424
                > $(MANDIR)/man8/intro.8mandos.gz
322
425
 
323
426
install-client-nokey: all doc
324
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
427
        install --directory $(LIBDIR)/mandos $(CONFDIR)
325
428
        install --directory --mode=u=rwx $(KEYDIR) \
326
 
                $(PREFIX)/lib/mandos/plugins.d
327
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
429
                $(LIBDIR)/mandos/plugins.d \
 
430
                $(LIBDIR)/mandos/plugin-helpers
 
431
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
328
432
                install --mode=u=rwx \
329
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
433
                        --directory "$(CONFDIR)/plugins.d" \
 
434
                        "$(CONFDIR)/plugin-helpers"; \
330
435
        fi
331
 
        install --mode=u=rwx,go=rx \
332
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
436
        install --mode=u=rwx,go=rx --directory \
 
437
                "$(CONFDIR)/network-hooks.d"
 
438
        install --mode=u=rwx,go=rx \
 
439
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
440
        install --mode=u=rwx,go=rx \
 
441
                --target-directory=$(LIBDIR)/mandos \
 
442
                mandos-to-cryptroot-unlock
333
443
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
334
444
                mandos-keygen
335
445
        install --mode=u=rwx,go=rx \
336
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
446
                --target-directory=$(LIBDIR)/mandos/plugins.d \
337
447
                plugins.d/password-prompt
338
448
        install --mode=u=rwxs,go=rx \
339
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
449
                --target-directory=$(LIBDIR)/mandos/plugins.d \
340
450
                plugins.d/mandos-client
341
451
        install --mode=u=rwxs,go=rx \
342
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
452
                --target-directory=$(LIBDIR)/mandos/plugins.d \
343
453
                plugins.d/usplash
344
454
        install --mode=u=rwxs,go=rx \
345
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
455
                --target-directory=$(LIBDIR)/mandos/plugins.d \
346
456
                plugins.d/splashy
347
457
        install --mode=u=rwxs,go=rx \
348
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
458
                --target-directory=$(LIBDIR)/mandos/plugins.d \
349
459
                plugins.d/askpass-fifo
350
460
        install --mode=u=rwxs,go=rx \
351
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
461
                --target-directory=$(LIBDIR)/mandos/plugins.d \
352
462
                plugins.d/plymouth
 
463
        install --mode=u=rwx,go=rx \
 
464
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
465
                plugin-helpers/mandos-client-iprouteadddel
353
466
        install initramfs-tools-hook \
354
467
                $(INITRAMFSTOOLS)/hooks/mandos
355
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
356
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
468
        install --mode=u=rw,go=r initramfs-tools-conf \
 
469
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
470
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
471
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
357
472
        install initramfs-tools-script \
358
473
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
474
        install initramfs-tools-script-stop \
 
475
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
476
        install --directory $(DRACUTMODULE)
 
477
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
478
                dracut-module/ask-password-mandos.path \
 
479
                dracut-module/ask-password-mandos.service
 
480
        install --mode=u=rwxs,go=rx \
 
481
                --target-directory=$(DRACUTMODULE) \
 
482
                dracut-module/module-setup.sh \
 
483
                dracut-module/cmdline-mandos.sh \
 
484
                dracut-module/password-agent
359
485
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
360
486
        gzip --best --to-stdout mandos-keygen.8 \
361
487
                > $(MANDIR)/man8/mandos-keygen.8.gz
373
499
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
374
500
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
375
501
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
502
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
503
                > $(MANDIR)/man8/password-agent.8mandos.gz
376
504
 
377
505
install-client: install-client-nokey
378
506
# Post-installation stuff
379
507
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
380
 
        update-initramfs -k all -u
 
508
        if command -v update-initramfs >/dev/null; then \
 
509
            update-initramfs -k all -u; \
 
510
        elif command -v dracut >/dev/null; then \
 
511
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
512
                if [ -w "$$initrd" ]; then \
 
513
                    chmod go-r "$$initrd"; \
 
514
                    dracut --force "$$initrd"; \
 
515
                fi; \
 
516
            done; \
 
517
        fi
381
518
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
382
519
 
383
520
uninstall: uninstall-server uninstall-client
400
537
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
401
538
                $(DESTDIR)/etc/crypttab
402
539
        -rm --force $(PREFIX)/sbin/mandos-keygen \
403
 
                $(PREFIX)/lib/mandos/plugin-runner \
404
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
405
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
406
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
407
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
408
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
409
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
540
                $(LIBDIR)/mandos/plugin-runner \
 
541
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
542
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
543
                $(LIBDIR)/mandos/plugins.d/usplash \
 
544
                $(LIBDIR)/mandos/plugins.d/splashy \
 
545
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
546
                $(LIBDIR)/mandos/plugins.d/plymouth \
410
547
                $(INITRAMFSTOOLS)/hooks/mandos \
411
548
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
412
549
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
550
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
551
                $(DRACUTMODULE)/ask-password-mandos.path \
 
552
                $(DRACUTMODULE)/ask-password-mandos.service \
 
553
                $(DRACUTMODULE)/module-setup.sh \
 
554
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
555
                $(DRACUTMODULE)/password-agent \
413
556
                $(MANDIR)/man8/mandos-keygen.8.gz \
414
557
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
415
558
                $(MANDIR)/man8/mandos-client.8mandos.gz
418
561
                $(MANDIR)/man8/splashy.8mandos.gz \
419
562
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
420
563
                $(MANDIR)/man8/plymouth.8mandos.gz \
421
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
422
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
423
 
        update-initramfs -k all -u
 
564
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
565
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
566
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
567
        if command -v update-initramfs >/dev/null; then \
 
568
            update-initramfs -k all -u; \
 
569
        elif command -v dracut >/dev/null; then \
 
570
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
571
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
572
            done; \
 
573
        fi
424
574
 
425
575
purge: purge-server purge-client
426
576
 
429
579
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
430
580
                $(DESTDIR)/etc/default/mandos \
431
581
                $(DESTDIR)/etc/init.d/mandos \
 
582
                $(SYSTEMD)/mandos.service \
 
583
                $(DESTDIR)/run/mandos.pid \
432
584
                $(DESTDIR)/var/run/mandos.pid
433
585
        -rmdir $(CONFDIR)
434
586
 
435
587
purge-client: uninstall-client
436
 
        -shred --remove $(KEYDIR)/seckey.txt
 
588
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
437
589
        -rm --force $(CONFDIR)/plugin-runner.conf \
438
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
590
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
591
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
439
592
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)