To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to Makefile
- browse files at revision 237.7.761
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.761
- Committer: teddy at recompile
- Date: 2020-04-05 21:30:59 UTC
- mto: This revision was merged to the branch mainline in revision 398.
- Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk
Fix file descriptor leak in mandos-client
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
Makefile
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
-Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
-Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
-Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
-Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
-Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
-Wvolatile-register-var -Woverlength-strings
13
#DEBUG=-ggdb3
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
13
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
## Check which sanitizing options can be used
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
# echo 'int main(){}' | $(CC) --language=c $(option) \
18
# /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
17
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
19
21
-fsanitize=shift -fsanitize=integer-divide-by-zero \
20
22
-fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
21
23
-fsanitize=return -fsanitize=signed-integer-overflow \
23
25
-fsanitize=object-size -fsanitize=float-divide-by-zero \
24
26
-fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
27
-fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
-fsanitize=enum
27
# Check which sanitizing options can be used
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
-o /dev/null >/dev/null 2>&1 && echo $(option)))
31
LINK_FORTIFY_LD=-z relro -z now
32
LINK_FORTIFY=
28
-fsanitize=enum -fsanitize-address-use-after-scope
29
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
LINK_FORTIFY_LD:=-z relro -z now
34
LINK_FORTIFY:=
33
35
34
36
# If BROKEN_PIE is set, do not build with -pie
35
37
ifndef BROKEN_PIE
37
39
LINK_FORTIFY += -pie
38
40
endif
39
41
#COVERAGE=--coverage
40
OPTIMIZE=-Os -fno-strict-aliasing
41
LANGUAGE=-std=gnu11
42
htmldir=man
43
version=1.7.6
44
SED=sed
45
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
42
OPTIMIZE:=-Os -fno-strict-aliasing
43
LANGUAGE:=-std=gnu11
44
FEATURES:=-D_FILE_OFFSET_BITS=64
45
htmldir:=man
46
version:=1.8.10
47
SED:=sed
48
PKG_CONFIG?=pkg-config
49
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
51
|| getent passwd nobody || echo 65534)))
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
53
|| getent group nogroup || echo 65534)))
54
55
LINUXVERSION:=$(shell uname --kernel-release)
48
56
49
57
## Use these settings for a traditional /usr/local install
50
# PREFIX=$(DESTDIR)/usr/local
51
# CONFDIR=$(DESTDIR)/etc/mandos
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
53
# MANDIR=$(PREFIX)/man
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
56
# LIBDIR=$(PREFIX)/lib
58
# PREFIX:=$(DESTDIR)/usr/local
59
# CONFDIR:=$(DESTDIR)/etc/mandos
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
61
# MANDIR:=$(PREFIX)/man
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
65
# LIBDIR:=$(PREFIX)/lib
57
66
##
58
67
59
68
## These settings are for a package-type install
60
PREFIX=$(DESTDIR)/usr
61
CONFDIR=$(DESTDIR)/etc/mandos
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
63
MANDIR=$(PREFIX)/share/man
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
65
STATEDIR=$(DESTDIR)/var/lib/mandos
66
LIBDIR=$(shell \
69
PREFIX:=$(DESTDIR)/usr
70
CONFDIR:=$(DESTDIR)/etc/mandos
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
72
MANDIR:=$(PREFIX)/share/man
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
76
LIBDIR:=$(shell \
67
77
for d in \
68
"/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
78
"/usr/lib/`dpkg-architecture \
79
-qDEB_HOST_MULTIARCH 2>/dev/null`" \
69
80
"`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
70
81
if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
71
82
echo "$(DESTDIR)$$d"; \
74
85
done)
75
86
##
76
87
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
89
--variable=systemdsystemunitdir)
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
91
--variable=tmpfilesdir)
92
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
93
--variable=sysusersdir)
78
94
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
82
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
95
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
96
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
97
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
98
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
99
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
100
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
85
101
getconf LFS_LDFLAGS)
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
102
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
103
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
104
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
105
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
88
106
89
107
# Do not change these two
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
91
$(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
92
$(GPGME_CFLAGS) -DVERSION='"$(version)"'
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
108
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
109
$(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
110
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
111
) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
94
112
95
113
# Commands to format a DocBook <refentry> document into a manual page
96
114
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
102
120
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
103
121
$(notdir $<); \
104
122
if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
105
&& type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
106
man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
107
fi >/dev/null)
123
&& command -v man >/dev/null; then LANG=en_US.UTF-8 \
124
MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
125
$(notdir $@); fi >/dev/null)
108
126
109
127
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
110
128
--param make.year.ranges 1 \
116
134
/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
117
135
$<; $(HTMLPOST) $@)
118
136
# Fix citerefentry links
119
HTMLPOST=$(SED) --in-place \
137
HTMLPOST:=$(SED) --in-place \
120
138
--expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
121
139
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
140
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
123
141
plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
124
142
plugins.d/plymouth
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
143
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
144
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
145
$(PLUGIN_HELPERS)
146
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
147
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
129
148
mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
149
dracut-module/password-agent.8mandos \
130
150
plugins.d/mandos-client.8mandos \
131
151
plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
132
152
plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
133
153
plugins.d/plymouth.8mandos intro.8mandos
134
154
135
htmldocs=$(addsuffix .xhtml,$(DOCS))
136
137
objects=$(addsuffix .o,$(CPROGS))
138
155
htmldocs:=$(addsuffix .xhtml,$(DOCS))
156
157
objects:=$(addsuffix .o,$(CPROGS))
158
159
.PHONY: all
139
160
all: $(PROGS) mandos.lsm
140
161
162
.PHONY: doc
141
163
doc: $(DOCS)
142
164
165
.PHONY: html
143
166
html: $(htmldocs)
144
167
145
168
%.5: %.xml common.ent legalnotice.xml
204
227
overview.xml legalnotice.xml
205
228
$(DOCBOOKTOHTML)
206
229
230
dracut-module/password-agent.8mandos: \
231
dracut-module/password-agent.xml common.ent \
232
overview.xml legalnotice.xml
233
$(DOCBOOKTOMAN)
234
dracut-module/password-agent.8mandos.xhtml: \
235
dracut-module/password-agent.xml common.ent \
236
overview.xml legalnotice.xml
237
$(DOCBOOKTOHTML)
238
207
239
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
208
240
common.ent \
209
241
mandos-options.xml \
252
284
--expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
253
285
$@)
254
286
255
plugins.d/mandos-client: plugins.d/mandos-client.c
256
$(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
257
) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
258
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
260
$(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
261
) $(LOADLIBES) $(LDLIBS) -o $@
262
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
264
check run-client run-server install install-html \
265
install-server install-client-nokey install-client uninstall \
266
uninstall-server uninstall-client purge purge-server \
267
purge-client
268
287
# Need to add the GnuTLS, Avahi and GPGME libraries
288
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
289
) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
290
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
291
) $(AVAHI_LIBS) $(GPGME_LIBS)
292
293
# Need to add the libnl-route library
294
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
295
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
296
297
# Need to add the GLib and pthread libraries
298
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
299
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
300
301
.PHONY: clean
269
302
clean:
270
303
-rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
271
304
305
.PHONY: distclean
272
306
distclean: clean
307
.PHONY: mostlyclean
273
308
mostlyclean: clean
309
.PHONY: maintainer-clean
274
310
maintainer-clean: clean
275
311
-rm --force --recursive keydir confdir statedir
276
312
277
check: all
313
.PHONY: check
314
check: all
278
315
./mandos --check
279
316
./mandos-ctl --check
317
./mandos-keygen --version
318
./plugin-runner --version
319
./plugin-helpers/mandos-client-iprouteadddel --version
320
./dracut-module/password-agent --test
280
321
281
322
# Run the client with a local config and key
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
283
@echo "###################################################################"
284
@echo "# The following error messages are harmless and can be safely #"
285
@echo "# ignored. The messages are caused by not running as root, but #"
286
@echo "# you should NOT run \"make run-client\" as root unless you also #"
287
@echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
288
@echo "# From plugin-runner: setgid: Operation not permitted #"
289
@echo "# setuid: Operation not permitted #"
290
@echo "# From askpass-fifo: mkfifo: Permission denied #"
291
@echo "# From mandos-client: #"
292
@echo "# Failed to raise privileges: Operation not permitted #"
293
@echo "# Warning: network hook \"*\" exited with status * #"
294
@echo "###################################################################"
323
.PHONY: run-client
324
run-client: all keydir/seckey.txt keydir/pubkey.txt \
325
keydir/tls-privkey.pem keydir/tls-pubkey.pem
326
@echo '######################################################'
327
@echo '# The following error messages are harmless and can #'
328
@echo '# be safely ignored: #'
329
@echo '## From plugin-runner: #'
330
@echo '# setgid: Operation not permitted #'
331
@echo '# setuid: Operation not permitted #'
332
@echo '## From askpass-fifo: #'
333
@echo '# mkfifo: Permission denied #'
334
@echo '## From mandos-client: #'
335
@echo '# Failed to raise privileges: Operation not permi... #'
336
@echo '# Warning: network hook "*" exited with status * #'
337
@echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
338
@echo '# Failed to bring up interface "*": Operation not... #'
339
@echo '# #'
340
@echo '# (The messages are caused by not running as root, #'
341
@echo '# but you should NOT run "make run-client" as root #'
342
@echo '# unless you also unpacked and compiled Mandos as #'
343
@echo '# root, which is also NOT recommended.) #'
344
@echo '######################################################'
295
345
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
296
346
./plugin-runner --plugin-dir=plugins.d \
297
347
--plugin-helper-dir=plugin-helpers \
298
348
--config-file=plugin-runner.conf \
299
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
349
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
300
350
--env-for=mandos-client:GNOME_KEYRING_CONTROL= \
301
351
$(CLIENTARGS)
302
352
303
353
# Used by run-client
304
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
354
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
305
355
install --directory keydir
306
356
./mandos-keygen --dir keydir --force
357
if ! [ -e keydir/tls-privkey.pem ]; then \
358
install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
359
fi
360
if ! [ -e keydir/tls-pubkey.pem ]; then \
361
install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
362
fi
307
363
308
364
# Run the server with a local config
365
.PHONY: run-server
309
366
run-server: confdir/mandos.conf confdir/clients.conf statedir
310
367
./mandos --debug --no-dbus --configdir=confdir \
311
368
--statedir=statedir $(SERVERARGS)
314
371
confdir/mandos.conf: mandos.conf
315
372
install --directory confdir
316
373
install --mode=u=rw,go=r $^ $@
317
confdir/clients.conf: clients.conf keydir/seckey.txt
374
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
318
375
install --directory confdir
319
376
install --mode=u=rw $< $@
320
377
# Add a client password
322
379
statedir:
323
380
install --directory statedir
324
381
382
.PHONY: install
325
383
install: install-server install-client-nokey
326
384
385
.PHONY: install-html
327
386
install-html: html
328
387
install --directory $(htmldir)
329
388
install --mode=u=rw,go=r --target-directory=$(htmldir) \
330
389
$(htmldocs)
331
390
391
.PHONY: install-server
332
392
install-server: doc
333
393
install --directory $(CONFDIR)
334
394
if install --directory --mode=u=rwx --owner=$(USER) \
337
397
elif install --directory --mode=u=rwx $(STATEDIR); then \
338
398
chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
339
399
fi
400
if [ "$(TMPFILES)" != "$(DESTDIR)" \
401
-a -d "$(TMPFILES)" ]; then \
402
install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
403
$(TMPFILES)/mandos.conf; \
404
fi
405
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
406
-a -d "$(SYSUSERS)" ]; then \
407
install --mode=u=rw,go=r sysusers.d-mandos.conf \
408
$(SYSUSERS)/mandos.conf; \
409
fi
340
410
install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
341
411
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
342
412
mandos-ctl
371
441
gzip --best --to-stdout intro.8mandos \
372
442
> $(MANDIR)/man8/intro.8mandos.gz
373
443
444
.PHONY: install-client-nokey
374
445
install-client-nokey: all doc
375
446
install --directory $(LIBDIR)/mandos $(CONFDIR)
376
447
install --directory --mode=u=rwx $(KEYDIR) \
377
448
$(LIBDIR)/mandos/plugins.d \
378
449
$(LIBDIR)/mandos/plugin-helpers
450
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
451
-a -d "$(SYSUSERS)" ]; then \
452
install --mode=u=rw,go=r sysusers.d-mandos.conf \
453
$(SYSUSERS)/mandos-client.conf; \
454
fi
379
455
if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
380
456
install --mode=u=rwx \
381
--directory "$(CONFDIR)/plugins.d"; \
382
install --directory "$(CONFDIR)/plugin-helpers"; \
457
--directory "$(CONFDIR)/plugins.d" \
458
"$(CONFDIR)/plugin-helpers"; \
383
459
fi
384
460
install --mode=u=rwx,go=rx --directory \
385
461
"$(CONFDIR)/network-hooks.d"
386
462
install --mode=u=rwx,go=rx \
387
463
--target-directory=$(LIBDIR)/mandos plugin-runner
464
install --mode=u=rwx,go=rx \
465
--target-directory=$(LIBDIR)/mandos \
466
mandos-to-cryptroot-unlock
388
467
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
389
468
mandos-keygen
390
469
install --mode=u=rwx,go=rx \
405
484
install --mode=u=rwxs,go=rx \
406
485
--target-directory=$(LIBDIR)/mandos/plugins.d \
407
486
plugins.d/plymouth
408
install --mode=u=rwxs,go=rx \
487
install --mode=u=rwx,go=rx \
409
488
--target-directory=$(LIBDIR)/mandos/plugin-helpers \
410
489
plugin-helpers/mandos-client-iprouteadddel
411
490
install initramfs-tools-hook \
412
491
$(INITRAMFSTOOLS)/hooks/mandos
413
install --mode=u=rw,go=r initramfs-tools-hook-conf \
414
$(INITRAMFSTOOLS)/conf-hooks.d/mandos
492
install --mode=u=rw,go=r initramfs-tools-conf \
493
$(INITRAMFSTOOLS)/conf.d/mandos-conf
494
install --mode=u=rw,go=r initramfs-tools-conf-hook \
495
$(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
415
496
install initramfs-tools-script \
416
497
$(INITRAMFSTOOLS)/scripts/init-premount/mandos
498
install initramfs-tools-script-stop \
499
$(INITRAMFSTOOLS)/scripts/local-premount/mandos
500
install --directory $(DRACUTMODULE)
501
install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
502
dracut-module/ask-password-mandos.path \
503
dracut-module/ask-password-mandos.service
504
install --mode=u=rwxs,go=rx \
505
--target-directory=$(DRACUTMODULE) \
506
dracut-module/module-setup.sh \
507
dracut-module/cmdline-mandos.sh \
508
dracut-module/password-agent
417
509
install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
418
510
gzip --best --to-stdout mandos-keygen.8 \
419
511
> $(MANDIR)/man8/mandos-keygen.8.gz
431
523
> $(MANDIR)/man8/askpass-fifo.8mandos.gz
432
524
gzip --best --to-stdout plugins.d/plymouth.8mandos \
433
525
> $(MANDIR)/man8/plymouth.8mandos.gz
526
gzip --best --to-stdout dracut-module/password-agent.8mandos \
527
> $(MANDIR)/man8/password-agent.8mandos.gz
434
528
529
.PHONY: install-client
435
530
install-client: install-client-nokey
436
531
# Post-installation stuff
437
532
-$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
438
update-initramfs -k all -u
533
if command -v update-initramfs >/dev/null; then \
534
update-initramfs -k all -u; \
535
elif command -v dracut >/dev/null; then \
536
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
537
if [ -w "$$initrd" ]; then \
538
chmod go-r "$$initrd"; \
539
dracut --force "$$initrd"; \
540
fi; \
541
done; \
542
fi
439
543
echo "Now run mandos-keygen --password --dir $(KEYDIR)"
440
544
545
.PHONY: uninstall
441
546
uninstall: uninstall-server uninstall-client
442
547
548
.PHONY: uninstall-server
443
549
uninstall-server:
444
550
-rm --force $(PREFIX)/sbin/mandos \
445
551
$(PREFIX)/sbin/mandos-ctl \
452
558
update-rc.d -f mandos remove
453
559
-rmdir $(CONFDIR)
454
560
561
.PHONY: uninstall-client
455
562
uninstall-client:
456
563
# Refuse to uninstall client if /etc/crypttab is explicitly configured
457
564
# to use it.
468
575
$(INITRAMFSTOOLS)/hooks/mandos \
469
576
$(INITRAMFSTOOLS)/conf-hooks.d/mandos \
470
577
$(INITRAMFSTOOLS)/scripts/init-premount/mandos \
578
$(INITRAMFSTOOLS)/scripts/local-premount/mandos \
579
$(DRACUTMODULE)/ask-password-mandos.path \
580
$(DRACUTMODULE)/ask-password-mandos.service \
581
$(DRACUTMODULE)/module-setup.sh \
582
$(DRACUTMODULE)/cmdline-mandos.sh \
583
$(DRACUTMODULE)/password-agent \
471
584
$(MANDIR)/man8/mandos-keygen.8.gz \
472
585
$(MANDIR)/man8/plugin-runner.8mandos.gz \
473
586
$(MANDIR)/man8/mandos-client.8mandos.gz
476
589
$(MANDIR)/man8/splashy.8mandos.gz \
477
590
$(MANDIR)/man8/askpass-fifo.8mandos.gz \
478
591
$(MANDIR)/man8/plymouth.8mandos.gz \
592
$(MANDIR)/man8/password-agent.8mandos.gz \
479
593
-rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
480
$(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
481
update-initramfs -k all -u
594
$(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
595
if command -v update-initramfs >/dev/null; then \
596
update-initramfs -k all -u; \
597
elif command -v dracut >/dev/null; then \
598
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
599
test -w "$$initrd" && dracut --force "$$initrd"; \
600
done; \
601
fi
482
602
603
.PHONY: purge
483
604
purge: purge-server purge-client
484
605
606
.PHONY: purge-server
485
607
purge-server: uninstall-server
486
608
-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
487
609
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
492
614
$(DESTDIR)/var/run/mandos.pid
493
615
-rmdir $(CONFDIR)
494
616
617
.PHONY: purge-client
495
618
purge-client: uninstall-client
496
-shred --remove $(KEYDIR)/seckey.txt
619
-shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
497
620
-rm --force $(CONFDIR)/plugin-runner.conf \
498
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
621
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
622
$(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
499
623
-rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0