/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-09-09 01:36:41 UTC
  • mto: This revision was merged to the branch mainline in revision 410.
  • Revision ID: teddy@recompile.se-20240909013641-6zu6kx2f7meu134k
Make all required directories when installing

When installing into a normal system, one can assume that target
directories, such as /usr/bin, already exists.  But when installing
into a subdirectory for the purpose of creating a package, one cannot
assume that all directories already exist.  Therefore, when
installing, we must not check if any directories exist, and must
instead always create any directories we want to install into.

* Makefile (confdir/mandos.conf, confdir/clients.conf, install-html):
  Use the "-D" option to "install" instead of creating the directory
  separately.
  (install-server): Move creation of $(CONFDIR) down to before it is
  needed.  Don't check if the $(TMPFILES) or $(SYSUSERS) directories
  exist; instead create them by using the "-D" option to "install".
  Create the $(PREFIX)/sbin directory.  Always use
  "--target-directory" if possible; i.e. if the file name is the same.
  Create the $(DBUSPOLICYDIR) and $(DESTDIR)/etc/init.d directories by
  using the "-D" option to "install".  Don't check if the $(SYSTEMD)
  directory exists; instead create it by using the "-D" option to
  "install".  Create the $(DESTDIR)/etc/default and $(MANDIR)/man8
  directories by using the "-D" option to "install".  Create the
  $(MANDIR)/man5 directories explicitly.
  (install-client-nokey): Remove unnecessary creation of the
  $(CONFDIR) directory.  Don't check if the $(SYSUSERS) directory
  exists; instead create it by using the "-D" option to "install".
  Move the "--directory" argument to be the first argument, for
  clarity.  Create the $(PREFIX)/sbin directory.  Use the "-D"
  argument to "install" when installing
  $(INITRAMFSTOOLS)/hooks/mandos,
  $(INITRAMFSTOOLS)/conf.d/mandos-conf,
  $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos,
  $(INITRAMFSTOOLS)/scripts/init-premount/mandos,
  $(INITRAMFSTOOLS)/scripts/local-premount/mandos,
  $(DRACUTMODULE)/ask-password-mandos.path, and
  $(DRACUTMODULE)/dracut-module/ask-password-mandos.service.  Create
  the $(MANDIR)/man8 directory.

Reported-By: Erich Eckner <erich@eckner.net>
Thanks: Erich Eckner <erich@eckner.net> for analysis

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
CFLAGS=-Wall -g -std=gnu99
2
 
 
3
 
PROGS=plugbasedclient plugins.d/mandosclient plugins.d/passprompt
4
 
 
5
 
objects=$(shell for p in $(PROGS); do echo $${p}.o; done)
6
 
 
7
 
all: $(PROGS)
8
 
 
9
 
plugbasedclient: plugbasedclient.o
10
 
        $(LINK.o) -lgnutls $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
11
 
 
12
 
plugins.d/mandosclient: plugins.d/mandosclient.o
13
 
        $(LINK.o) -lgnutls -lavahi-core -lgpgme $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
14
 
 
15
 
plugins.d/passprompt: plugins.d/passprompt.o
16
 
        $(LINK.o) $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
17
 
 
18
 
.PHONY : clean
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
 
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
 
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
34
LINK_FORTIFY_LD:=-z relro -z now
 
35
LINK_FORTIFY:=
 
36
 
 
37
# If BROKEN_PIE is set, do not build with -pie
 
38
ifndef BROKEN_PIE
 
39
FORTIFY += -fPIE
 
40
LINK_FORTIFY += -pie
 
41
endif
 
42
#COVERAGE=--coverage
 
43
OPTIMIZE:=-Os -fno-strict-aliasing
 
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
 
46
htmldir:=man
 
47
version:=1.8.16
 
48
SED:=sed
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
 
57
 
 
58
## Use these settings for a traditional /usr/local install
 
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# CONFDIR:=$(DESTDIR)/etc/mandos
 
61
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
62
# MANDIR:=$(PREFIX)/man
 
63
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
64
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
65
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
66
# LIBDIR:=$(PREFIX)/lib
 
67
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
 
68
##
 
69
 
 
70
## These settings are for a package-type install
 
71
PREFIX:=$(DESTDIR)/usr
 
72
CONFDIR:=$(DESTDIR)/etc/mandos
 
73
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
74
MANDIR:=$(PREFIX)/share/man
 
75
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
76
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
77
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
78
LIBDIR:=$(shell \
 
79
        for d in \
 
80
        "/usr/lib/`dpkg-architecture \
 
81
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
82
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
83
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
84
                        echo "$(DESTDIR)$$d"; \
 
85
                        break; \
 
86
                fi; \
 
87
        done)
 
88
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
 
89
##
 
90
 
 
91
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
92
                        --variable=systemdsystemunitdir)
 
93
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=tmpfilesdir)
 
95
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=sysusersdir)
 
97
 
 
98
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
99
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
100
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
101
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
102
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
103
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
104
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
105
        || gpgme-config --libs; getconf LFS_LIBS; \
 
106
        getconf LFS_LDFLAGS)
 
107
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
108
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
109
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
110
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
 
111
 
 
112
# Do not change these two
 
113
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
114
        $(LANGUAGE) -DVERSION='"$(version)"'
 
115
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
116
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
117
 
 
118
# Commands to format a DocBook <refentry> document into a manual page
 
119
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
 
120
        --param man.charmap.use.subset          0 \
 
121
        --param make.year.ranges                1 \
 
122
        --param make.single.year.ranges         1 \
 
123
        --param man.output.quietly              1 \
 
124
        --param man.authors.section.enabled     0 \
 
125
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
126
        $(notdir $<); \
 
127
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
128
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
129
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
130
        $(notdir $@); fi >/dev/null)
 
131
 
 
132
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
133
        --param make.year.ranges                1 \
 
134
        --param make.single.year.ranges         1 \
 
135
        --param man.output.quietly              1 \
 
136
        --param man.authors.section.enabled     0 \
 
137
        --param citerefentry.link               1 \
 
138
        --output $@ \
 
139
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
140
        $<; $(HTMLPOST) $@)
 
141
# Fix citerefentry links
 
142
HTMLPOST:=$(SED) --in-place \
 
143
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
144
 
 
145
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
146
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
147
        plugins.d/plymouth
 
148
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
149
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
150
        $(PLUGIN_HELPERS)
 
151
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
152
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
153
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
154
        dracut-module/password-agent.8mandos \
 
155
        plugins.d/mandos-client.8mandos \
 
156
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
157
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
158
        plugins.d/plymouth.8mandos intro.8mandos
 
159
 
 
160
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
161
 
 
162
objects:=$(addsuffix .o,$(CPROGS))
 
163
 
 
164
.PHONY: all
 
165
all: $(PROGS) mandos.lsm
 
166
 
 
167
.PHONY: doc
 
168
doc: $(DOCS)
 
169
 
 
170
.PHONY: html
 
171
html: $(htmldocs)
 
172
 
 
173
%.5: %.xml common.ent legalnotice.xml
 
174
        $(DOCBOOKTOMAN)
 
175
%.5.xhtml: %.xml common.ent legalnotice.xml
 
176
        $(DOCBOOKTOHTML)
 
177
 
 
178
%.8: %.xml common.ent legalnotice.xml
 
179
        $(DOCBOOKTOMAN)
 
180
%.8.xhtml: %.xml common.ent legalnotice.xml
 
181
        $(DOCBOOKTOHTML)
 
182
 
 
183
%.8mandos: %.xml common.ent legalnotice.xml
 
184
        $(DOCBOOKTOMAN)
 
185
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
intro.8mandos: intro.xml common.ent legalnotice.xml
 
189
        $(DOCBOOKTOMAN)
 
190
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
191
        $(DOCBOOKTOHTML)
 
192
 
 
193
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
194
                legalnotice.xml
 
195
        $(DOCBOOKTOMAN)
 
196
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
197
                overview.xml legalnotice.xml
 
198
        $(DOCBOOKTOHTML)
 
199
 
 
200
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
201
                legalnotice.xml
 
202
        $(DOCBOOKTOMAN)
 
203
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
204
                 legalnotice.xml
 
205
        $(DOCBOOKTOHTML)
 
206
 
 
207
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
208
                legalnotice.xml
 
209
        $(DOCBOOKTOMAN)
 
210
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
211
                 legalnotice.xml
 
212
        $(DOCBOOKTOHTML)
 
213
 
 
214
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
215
                legalnotice.xml
 
216
        $(DOCBOOKTOMAN)
 
217
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
218
                 legalnotice.xml
 
219
        $(DOCBOOKTOHTML)
 
220
 
 
221
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
222
                legalnotice.xml
 
223
        $(DOCBOOKTOMAN)
 
224
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
225
                legalnotice.xml
 
226
        $(DOCBOOKTOHTML)
 
227
 
 
228
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
229
                legalnotice.xml
 
230
        $(DOCBOOKTOMAN)
 
231
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
232
                overview.xml legalnotice.xml
 
233
        $(DOCBOOKTOHTML)
 
234
 
 
235
dracut-module/password-agent.8mandos: \
 
236
                dracut-module/password-agent.xml common.ent \
 
237
                overview.xml legalnotice.xml
 
238
        $(DOCBOOKTOMAN)
 
239
dracut-module/password-agent.8mandos.xhtml: \
 
240
                dracut-module/password-agent.xml common.ent \
 
241
                overview.xml legalnotice.xml
 
242
        $(DOCBOOKTOHTML)
 
243
 
 
244
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
245
                                        common.ent \
 
246
                                        mandos-options.xml \
 
247
                                        overview.xml legalnotice.xml
 
248
        $(DOCBOOKTOMAN)
 
249
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
250
                                        common.ent \
 
251
                                        mandos-options.xml \
 
252
                                        overview.xml legalnotice.xml
 
253
        $(DOCBOOKTOHTML)
 
254
 
 
255
# Update all these files with version number $(version)
 
256
common.ent: Makefile
 
257
        $(strip $(SED) --in-place \
 
258
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
259
                $@)
 
260
 
 
261
mandos: Makefile
 
262
        $(strip $(SED) --in-place \
 
263
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
264
                $@)
 
265
 
 
266
mandos-keygen: Makefile
 
267
        $(strip $(SED) --in-place \
 
268
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
269
                $@)
 
270
 
 
271
mandos-ctl: Makefile
 
272
        $(strip $(SED) --in-place \
 
273
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
274
                $@)
 
275
 
 
276
mandos-monitor: Makefile
 
277
        $(strip $(SED) --in-place \
 
278
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
279
                $@)
 
280
 
 
281
mandos.lsm: Makefile
 
282
        $(strip $(SED) --in-place \
 
283
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
284
                $@)
 
285
        $(strip $(SED) --in-place \
 
286
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
287
                $@)
 
288
        $(strip $(SED) --in-place \
 
289
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
290
                $@)
 
291
 
 
292
# Need to add the GnuTLS, Avahi and GPGME libraries
 
293
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
294
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
295
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
296
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
297
 
 
298
# Need to add the libnl-route library
 
299
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
300
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
301
 
 
302
# Need to add the GLib and pthread libraries
 
303
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
304
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
305
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
306
 
 
307
.PHONY: clean
19
308
clean:
20
 
        -rm -f $(PROGS) $(objects) core
 
309
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
 
310
 
 
311
.PHONY: distclean
 
312
distclean: clean
 
313
.PHONY: mostlyclean
 
314
mostlyclean: clean
 
315
.PHONY: maintainer-clean
 
316
maintainer-clean: clean
 
317
        -rm --force --recursive keydir confdir statedir
 
318
 
 
319
.PHONY: check
 
320
check: all
 
321
        ./mandos --check
 
322
        ./mandos-ctl --check
 
323
        ./mandos-keygen --version
 
324
        ./plugin-runner --version
 
325
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
326
        ./dracut-module/password-agent --test
 
327
 
 
328
# Run the client with a local config and key
 
329
.PHONY: run-client
 
330
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
331
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
332
        @echo '######################################################'
 
333
        @echo '# The following error messages are harmless and can  #'
 
334
        @echo '#  be safely ignored:                                #'
 
335
        @echo '## From plugin-runner:                               #'
 
336
        @echo '# setgid: Operation not permitted                    #'
 
337
        @echo '# setuid: Operation not permitted                    #'
 
338
        @echo '## From askpass-fifo:                                #'
 
339
        @echo '# mkfifo: Permission denied                          #'
 
340
        @echo '## From mandos-client:                               #'
 
341
        @echo '# Failed to raise privileges: Operation not permi... #'
 
342
        @echo '# Warning: network hook "*" exited with status *     #'
 
343
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
344
        @echo '# Failed to bring up interface "*": Operation not... #'
 
345
        @echo '#                                                    #'
 
346
        @echo '# (The messages are caused by not running as root,   #'
 
347
        @echo '# but you should NOT run "make run-client" as root   #'
 
348
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
349
        @echo '# root, which is also NOT recommended.)              #'
 
350
        @echo '######################################################'
 
351
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
 
352
        ./plugin-runner --plugin-dir=plugins.d \
 
353
                --plugin-helper-dir=plugin-helpers \
 
354
                --config-file=plugin-runner.conf \
 
355
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
356
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
357
                $(CLIENTARGS)
 
358
 
 
359
# Used by run-client
 
360
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
361
        install --directory keydir
 
362
        ./mandos-keygen --dir keydir --force
 
363
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
364
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
365
        fi
 
366
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
367
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
368
        fi
 
369
 
 
370
# Run the server with a local config
 
371
.PHONY: run-server
 
372
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
373
        ./mandos --debug --no-dbus --configdir=confdir \
 
374
                --statedir=statedir $(SERVERARGS)
 
375
 
 
376
# Used by run-server
 
377
confdir/mandos.conf: mandos.conf
 
378
        install -D --mode=u=rw,go=r $^ $@
 
379
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
380
        install -D --mode=u=rw $< $@
 
381
# Add a client password
 
382
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
383
statedir:
 
384
        install --directory statedir
 
385
 
 
386
.PHONY: install
 
387
install: install-server install-client-nokey
 
388
 
 
389
.PHONY: install-html
 
390
install-html: html
 
391
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
 
392
                $(htmldocs)
 
393
 
 
394
.PHONY: install-server
 
395
install-server: doc
 
396
        if install --directory --mode=u=rwx --owner=$(USER) \
 
397
                --group=$(GROUP) $(STATEDIR); then \
 
398
                :; \
 
399
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
400
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
401
        fi
 
402
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
403
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
404
                        $(TMPFILES)/mandos.conf; \
 
405
        fi
 
406
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
407
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
408
                        $(SYSUSERS)/mandos.conf; \
 
409
        fi
 
410
        install --directory $(PREFIX)/sbin
 
411
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
412
                mandos
 
413
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
414
                mandos-ctl
 
415
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
416
                mandos-monitor
 
417
        install --directory $(CONFDIR)
 
418
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
 
419
                mandos.conf
 
420
        install --mode=u=rw --target-directory=$(CONFDIR) \
 
421
                clients.conf
 
422
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
423
                $(DBUSPOLICYDIR)/mandos.conf
 
424
        install -D --mode=u=rwx,go=rx init.d-mandos \
 
425
                $(DESTDIR)/etc/init.d/mandos
 
426
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
427
                install -D --mode=u=rw,go=r mandos.service \
 
428
                        $(SYSTEMD); \
 
429
        fi
 
430
        install -D --mode=u=rw,go=r default-mandos \
 
431
                $(DESTDIR)/etc/default/mandos
 
432
        if [ -z $(DESTDIR) ]; then \
 
433
                update-rc.d mandos defaults 25 15;\
 
434
        fi
 
435
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
 
436
        gzip --best --to-stdout mandos.8 \
 
437
                > $(MANDIR)/man8/mandos.8.gz
 
438
        gzip --best --to-stdout mandos-monitor.8 \
 
439
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
440
        gzip --best --to-stdout mandos-ctl.8 \
 
441
                > $(MANDIR)/man8/mandos-ctl.8.gz
 
442
        gzip --best --to-stdout mandos.conf.5 \
 
443
                > $(MANDIR)/man5/mandos.conf.5.gz
 
444
        gzip --best --to-stdout mandos-clients.conf.5 \
 
445
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
446
        gzip --best --to-stdout intro.8mandos \
 
447
                > $(MANDIR)/man8/intro.8mandos.gz
 
448
 
 
449
.PHONY: install-client-nokey
 
450
install-client-nokey: all doc
 
451
        install --directory --mode=u=rwx $(KEYDIR) \
 
452
                $(LIBDIR)/mandos/plugins.d \
 
453
                $(LIBDIR)/mandos/plugin-helpers
 
454
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
455
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
456
                        $(SYSUSERS)/mandos-client.conf; \
 
457
        fi
 
458
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
459
                install --directory \
 
460
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
461
                        "$(CONFDIR)/plugin-helpers"; \
 
462
        fi
 
463
        install --directory --mode=u=rwx,go=rx \
 
464
                "$(CONFDIR)/network-hooks.d"
 
465
        install --mode=u=rwx,go=rx \
 
466
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
467
        install --mode=u=rwx,go=rx \
 
468
                --target-directory=$(LIBDIR)/mandos \
 
469
                mandos-to-cryptroot-unlock
 
470
        install --directory $(PREFIX)/sbin
 
471
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
472
                mandos-keygen
 
473
        install --mode=u=rwx,go=rx \
 
474
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
475
                plugins.d/password-prompt
 
476
        install --mode=u=rwxs,go=rx \
 
477
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
478
                plugins.d/mandos-client
 
479
        install --mode=u=rwxs,go=rx \
 
480
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
481
                plugins.d/usplash
 
482
        install --mode=u=rwxs,go=rx \
 
483
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
484
                plugins.d/splashy
 
485
        install --mode=u=rwxs,go=rx \
 
486
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
487
                plugins.d/askpass-fifo
 
488
        install --mode=u=rwxs,go=rx \
 
489
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
490
                plugins.d/plymouth
 
491
        install --mode=u=rwx,go=rx \
 
492
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
493
                plugin-helpers/mandos-client-iprouteadddel
 
494
        install -D initramfs-tools-hook \
 
495
                $(INITRAMFSTOOLS)/hooks/mandos
 
496
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
497
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
498
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
499
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
500
        install -D initramfs-tools-script \
 
501
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
502
        install -D initramfs-tools-script-stop \
 
503
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
504
        install -D --mode=u=rw,go=r \
 
505
                --target-directory=$(DRACUTMODULE) \
 
506
                dracut-module/ask-password-mandos.path \
 
507
                dracut-module/ask-password-mandos.service
 
508
        install --mode=u=rwxs,go=rx \
 
509
                --target-directory=$(DRACUTMODULE) \
 
510
                dracut-module/module-setup.sh \
 
511
                dracut-module/cmdline-mandos.sh \
 
512
                dracut-module/password-agent
 
513
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
514
        install --directory $(MANDIR)/man8
 
515
        gzip --best --to-stdout mandos-keygen.8 \
 
516
                > $(MANDIR)/man8/mandos-keygen.8.gz
 
517
        gzip --best --to-stdout plugin-runner.8mandos \
 
518
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
519
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
520
                > $(MANDIR)/man8/mandos-client.8mandos.gz
 
521
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
 
522
                > $(MANDIR)/man8/password-prompt.8mandos.gz
 
523
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
524
                > $(MANDIR)/man8/usplash.8mandos.gz
 
525
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
526
                > $(MANDIR)/man8/splashy.8mandos.gz
 
527
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
528
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
529
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
530
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
531
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
532
                > $(MANDIR)/man8/password-agent.8mandos.gz
 
533
 
 
534
.PHONY: install-client
 
535
install-client: install-client-nokey
 
536
# Post-installation stuff
 
537
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 
538
        if command -v update-initramfs >/dev/null; then \
 
539
            update-initramfs -k all -u; \
 
540
        elif command -v dracut >/dev/null; then \
 
541
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
542
                if [ -w "$$initrd" ]; then \
 
543
                    chmod go-r "$$initrd"; \
 
544
                    dracut --force "$$initrd"; \
 
545
                fi; \
 
546
            done; \
 
547
        fi
 
548
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
 
549
 
 
550
.PHONY: uninstall
 
551
uninstall: uninstall-server uninstall-client
 
552
 
 
553
.PHONY: uninstall-server
 
554
uninstall-server:
 
555
        -rm --force $(PREFIX)/sbin/mandos \
 
556
                $(PREFIX)/sbin/mandos-ctl \
 
557
                $(PREFIX)/sbin/mandos-monitor \
 
558
                $(MANDIR)/man8/mandos.8.gz \
 
559
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
560
                $(MANDIR)/man8/mandos-ctl.8.gz \
 
561
                $(MANDIR)/man5/mandos.conf.5.gz \
 
562
                $(MANDIR)/man5/mandos-clients.conf.5.gz
 
563
        update-rc.d -f mandos remove
 
564
        -rmdir $(CONFDIR)
 
565
 
 
566
.PHONY: uninstall-client
 
567
uninstall-client:
 
568
# Refuse to uninstall client if /etc/crypttab is explicitly configured
 
569
# to use it.
 
570
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
 
571
                $(DESTDIR)/etc/crypttab
 
572
        -rm --force $(PREFIX)/sbin/mandos-keygen \
 
573
                $(LIBDIR)/mandos/plugin-runner \
 
574
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
575
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
576
                $(LIBDIR)/mandos/plugins.d/usplash \
 
577
                $(LIBDIR)/mandos/plugins.d/splashy \
 
578
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
579
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
580
                $(INITRAMFSTOOLS)/hooks/mandos \
 
581
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
582
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
583
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
584
                $(DRACUTMODULE)/ask-password-mandos.path \
 
585
                $(DRACUTMODULE)/ask-password-mandos.service \
 
586
                $(DRACUTMODULE)/module-setup.sh \
 
587
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
588
                $(DRACUTMODULE)/password-agent \
 
589
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
590
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
 
591
                $(MANDIR)/man8/mandos-client.8mandos.gz
 
592
                $(MANDIR)/man8/password-prompt.8mandos.gz \
 
593
                $(MANDIR)/man8/usplash.8mandos.gz \
 
594
                $(MANDIR)/man8/splashy.8mandos.gz \
 
595
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
596
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
597
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
598
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
599
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
600
        if command -v update-initramfs >/dev/null; then \
 
601
            update-initramfs -k all -u; \
 
602
        elif command -v dracut >/dev/null; then \
 
603
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
604
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
605
            done; \
 
606
        fi
 
607
 
 
608
.PHONY: purge
 
609
purge: purge-server purge-client
 
610
 
 
611
.PHONY: purge-server
 
612
purge-server: uninstall-server
 
613
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
614
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
615
                $(DESTDIR)/etc/default/mandos \
 
616
                $(DESTDIR)/etc/init.d/mandos \
 
617
                $(DESTDIR)/run/mandos.pid \
 
618
                $(DESTDIR)/var/run/mandos.pid
 
619
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
620
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
621
        fi
 
622
        -rmdir $(CONFDIR)
 
623
 
 
624
.PHONY: purge-client
 
625
purge-client: uninstall-client
 
626
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
627
        -rm --force $(CONFDIR)/plugin-runner.conf \
 
628
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
629
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
630
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)