/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to debian/mandos-client.postinst

  • Committer: Teddy Hogeborn
  • Date: 2019-08-18 00:42:22 UTC
  • mto: This revision was merged to the branch mainline in revision 390.
  • Revision ID: teddy@recompile.se-20190818004222-lfrgtnmqz766a08e
Client: Use the systemd sysusers.d mechanism, if present

* Makefile (install-client-nokey): Also install sysusers.d file, if
                                   $(SYSUSERS) exists.
* sysusers.d-mandos.conf: Adjust comment to match reality.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/mandos-client.postinst
22
22
# Update the initial RAM file system image
23
23
update_initramfs()
24
24
{
25
 
    update-initramfs -u -k all
 
25
    if command -v update-initramfs >/dev/null; then
 
26
        update-initramfs -k all -u
 
27
    elif command -v dracut >/dev/null; then
 
28
        dracut_version="`dpkg-query --showformat='${Version}' --show dracut`"
 
29
        if dpkg --compare-versions "$dracut_version" lt 043-1 \
 
30
                && bash -c '. /etc/dracut.conf; . /etc/dracut.conf.d/*; [ "$hostonly" != yes ]'; then
 
31
            echo 'Dracut is not configured to use hostonly mode!' >&2
 
32
            return 1
 
33
        fi
 
34
        # Logic taken from dracut.postinst
 
35
        for kernel in /boot/vmlinu[xz]-*; do
 
36
            kversion="${kernel#/boot/vmlinu[xz]-}"
 
37
            # Dracut preserves old permissions of initramfs image
 
38
            # files, so we adjust permissions before creating new
 
39
            # initramfs image containing secret keys.
 
40
            chmod go-r /boot/initrd.img-"$kversion"
 
41
            if [ "$kversion" != "*" ]; then
 
42
                /etc/kernel/postinst.d/dracut "$kversion"
 
43
            fi
 
44
        done
 
45
    fi
26
46
    
27
47
    if dpkg --compare-versions "$2" lt-nl "1.0.10-1"; then
28
48
        # Make old initrd.img files unreadable too, in case they were
71
91
             --load-privkey=/etc/keys/mandos/tls-privkey.pem \
72
92
             --outfile=/dev/null --pubkey-info --no-text \
73
93
             2>/dev/null; then
74
 
            shred --remove -- /etc/keys/mandos/tls-privkey.pem
75
 
            rm -- /etc/keys/mandos/tls-pubkey.pem
 
94
            shred --remove -- /etc/keys/mandos/tls-privkey.pem \
 
95
                  2>/dev/null || :
 
96
            rm --force -- /etc/keys/mandos/tls-pubkey.pem
76
97
        fi
77
98
    fi
78
99
 
93
114
        local umask=$(umask)
94
115
        umask 077
95
116
        cp --archive "$TLS_PRIVKEYTMP" /etc/keys/mandos/tls-privkey.pem
96
 
        shred --remove -- "$TLS_PRIVKEYTMP"
 
117
        shred --remove -- "$TLS_PRIVKEYTMP" 2>/dev/null || :
97
118
 
98
119
        # First try certtool from GnuTLS
99
120
        if ! certtool --password='' \
122
143
        db_go
123
144
        db_stop
124
145
    else
125
 
        shred --remove -- "$TLS_PRIVKEYTMP"
 
146
        shred --remove -- "$TLS_PRIVKEYTMP" 2>/dev/null || :
126
147
    fi
127
148
}
128
149