/mandos/release : revision 237.7.749

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to dracut-module/password-agent.c

Committer: teddy at recompile
Date: 2020-02-05 21:39:28 UTC
mto: This revision was merged to the branch mainline in revision 396.
Revision ID: teddy@recompile.se-20200205213928-vpvt0fwfg47ikv6f

Allow users to alter ask-password-mandos.service

If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:

[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug

Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).

* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
  $PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
  end of line.
* dracut-module/module-setup.sh (install): Install all files named
  /etc/systemd/system/ask-password-mandos.service.d/*.conf if any
  exists.  Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
  of at end of line.

files modified:
Makefile

TODO

debian/control

dracut-module/password-agent.c

initramfs-tools-hook

mandos

mandos.service

plugin-runner.c

plugins.d/plymouth.c

Show diffs side-by-side

added added

removed removed

dracut-module/password-agent.c

#include <sysexits.h> /* EX_USAGE, EX_OSERR, EX_OSFILE */

#include <errno.h> /* errno, error_t, EACCES,

ENAMETOOLONG, ENOENT, ENOTDIR,

ENOMEM, EEXIST, ECHILD, EPERM,

EEXIST, ECHILD, EPERM, ENOMEM,

EAGAIN, EINTR, ENOBUFS, EADDRINUSE,

ECONNREFUSED, ECONNRESET,

ETOOMANYREFS, EMSGSIZE, EBADF,

ARGP_ERR_UNKNOWN, ARGP_KEY_ARGS,

struct argp, argp_parse(),

ARGP_NO_EXIT */

#include <stdint.h> /* SIZE_MAX */

#include <unistd.h> /* uid_t, gid_t, close(), pipe2(),

fork(), _exit(), dup2(),

STDOUT_FILENO, setresgid(),

IN_EXCL_UNLINK, IN_ONLYDIR,

struct inotify_event */

#include <fnmatch.h> /* fnmatch(), FNM_FILE_NAME */

#include <stdio.h> /* asprintf(), FILE, stderr, fopen(),

100

fclose(), getline(), sscanf(),

101

feof(), ferror(), rename(),

102

fdopen(), fprintf(), fscanf() */

#include <stdio.h> /* asprintf(), FILE, fopen(),

getline(), sscanf(), feof(),

100

ferror(), fclose(), stderr,

101

rename(), fdopen(), fprintf(),

102

fscanf() */

103

#include <glib.h> /* GKeyFile, g_key_file_free(), g_key_file_new(),

104

GError, g_key_file_load_from_file(),

105

G_KEY_FILE_NONE, TRUE, G_FILE_ERROR_NOENT,

651

652

__attribute__((nonnull, warn_unused_result))

653

bool add_to_queue(task_queue *const queue, const task_context task){

654

if((queue->length + 1) > (SIZE_MAX / sizeof(task_context))){

655

/* overflow */

656

error(0, ENOMEM, "Failed to allocate %" PRIuMAX

657

" tasks for queue->tasks", (uintmax_t)(queue->length + 1));

658

errno = ENOMEM;

659

return false;

660

}

661

654

const size_t needed_size = sizeof(task_context)*(queue->length + 1);

662

655

if(needed_size > (queue->allocated)){

663

656

task_context *const new_tasks = realloc(queue->tasks,

868

861

}

869

862

close(pipefds[1]);

870

863

871

if(pid == -1){

872

error(0, errno, "Failed to fork()");

873

close(pipefds[0]);

874

return false;

875

}

876

877

864

if(not add_to_queue(queue, (task_context){

878

865

.func=wait_for_mandos_client_exit,

879

866

.pid=pid,

1897

1884

g_assert_true(queue->tasks[0].func == dummy_func);

1898

1885

}

1899

1886

1900

static void test_add_to_queue_overflow(__attribute__((unused))

1901

test_fixture *fixture,

1902

__attribute__((unused))

1903

gconstpointer user_data){

1904

__attribute__((cleanup(cleanup_queue)))

1905

task_queue *queue = create_queue();

1906

g_assert_nonnull(queue);

1907

g_assert_true(queue->length == 0);

1908

queue->length = SIZE_MAX / sizeof(task_context); /* fake max size */

1909

1910

FILE *real_stderr = stderr;

1911

FILE *devnull = fopen("/dev/null", "we");

1912

g_assert_nonnull(devnull);

1913

stderr = devnull;

1914

const bool ret = add_to_queue(queue,

1915

(task_context){ .func=dummy_func });

1916

g_assert_true(errno == ENOMEM);

1917

g_assert_false(ret);

1918

stderr = real_stderr;

1919

g_assert_cmpint(fclose(devnull), ==, 0);

1920

queue->length = 0; /* Restore real size */

1921

}

1922

1923

1887

static void dummy_func(__attribute__((unused))

1924

1888

const task_context task,

1925

1889

__attribute__((unused))

2196

2160

}

2197

2161

exit(EXIT_SUCCESS);

2198

2162

}

2199

if(pid == -1){

2200

error(EXIT_FAILURE, errno, "Failed to fork()");

2201

}

2202

2203

2163

int status;

2204

2164

waitpid(pid, &status, 0);

2205

2165

if(WIFEXITED(status) and (WEXITSTATUS(status) == EXIT_SUCCESS)){

5958

5918

test_fixture *fixture,

5959

5919

__attribute__((unused))

5960

5920

gconstpointer user_data){

5961

#ifndef __amd64__

5962

g_test_skip("Skipping EMSGSIZE test on non-AMD64 platform");

5963

#else

5964

5921

__attribute__((cleanup(cleanup_close)))

5965

5922

const int epoll_fd = epoll_create1(EPOLL_CLOEXEC);

5966

5923

g_assert_cmpint(epoll_fd, >=, 0);

6019

5976

g_assert_cmpuint((unsigned int)queue->length, ==, 0);

6020

5977

g_assert_true(string_set_contains(cancelled_filenames,

6021

5978

question_filename));

6022

#endif

6023

5979

}

6024

5980

6025

5981

static void test_send_password_to_socket_retry(__attribute__((unused))

7906

7862

test_add("/parse_arguments/mixed", test_parse_arguments_mixed);

7907

7863

test_add("/queue/create", test_create_queue);

7908

7864

test_add("/queue/add", test_add_to_queue);

7909

test_add("/queue/add/overflow", test_add_to_queue_overflow);

7910

7865

test_add("/queue/has_question/empty",

7911

7866

test_queue_has_question_empty);

7912

7867

test_add("/queue/has_question/false",

Older »