/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-09-09 04:24:39 UTC
  • mto: This revision was merged to the branch mainline in revision 410.
  • Revision ID: teddy@recompile.se-20240909042439-j85mr20uli2hnyis
Eliminate compiler warnings

Many programs use nested functions, which now result in a linker
warning about executable stack.  Hide this warning.  Also, rewrite a
loop in the plymouth plugin to avoid warning about signed overflow.
This change also makes the plugin pick the alphabetically first
process entry instead of the last, in case many plymouth processes are
found (which should be unlikely).

* Makefile (plugin-runner, dracut-module/password-agent,
  plugins.d/password-prompt, plugins.d/mandos-client,
  plugins.d/plymouth): New target; set LDFLAGS to add "-Xlinker
  --no-warn-execstack".
* plugins.d/plymouth.c (get_pid): When no pid files are found, and we
  are looking through the process list, go though it from the start
  instead of from the end, i.e. in normal alphabetical order and not
  in reverse order.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Wunreachable-code -Winline \
8
 
        -Wvolatile-register-var
9
 
DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
34
LINK_FORTIFY_LD:=-z relro -z now
 
35
LINK_FORTIFY:=
 
36
 
 
37
# If BROKEN_PIE is set, do not build with -pie
 
38
ifndef BROKEN_PIE
 
39
FORTIFY += -fPIE
 
40
LINK_FORTIFY += -pie
 
41
endif
13
42
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
16
 
# PREFIX=/usr/local
17
 
PREFIX=$(DESTDIR)/usr
18
 
# CONFDIR=/usr/local/lib/mandos
19
 
CONFDIR=$(DESTDIR)/etc/mandos
20
 
# KEYDIR=/usr/local/lib/mandos/keys
21
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
22
 
# MANDIR=/usr/local/man
23
 
MANDIR=$(DESTDIR)/usr/share/man
24
 
PIDDIR=/var/run/mandos
25
 
USER=nobody
26
 
GROUP=nogroup
27
 
 
28
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
29
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
30
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
31
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
32
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
33
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
43
OPTIMIZE:=-Os -fno-strict-aliasing
 
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
 
46
htmldir:=man
 
47
version:=1.8.16
 
48
SED:=sed
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
 
57
 
 
58
## Use these settings for a traditional /usr/local install
 
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# CONFDIR:=$(DESTDIR)/etc/mandos
 
61
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
62
# MANDIR:=$(PREFIX)/man
 
63
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
64
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
65
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
66
# LIBDIR:=$(PREFIX)/lib
 
67
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
 
68
##
 
69
 
 
70
## These settings are for a package-type install
 
71
PREFIX:=$(DESTDIR)/usr
 
72
CONFDIR:=$(DESTDIR)/etc/mandos
 
73
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
74
MANDIR:=$(PREFIX)/share/man
 
75
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
76
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
77
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
78
LIBDIR:=$(shell \
 
79
        for d in \
 
80
        "/usr/lib/`dpkg-architecture \
 
81
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
82
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
83
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
84
                        echo "$(DESTDIR)$$d"; \
 
85
                        break; \
 
86
                fi; \
 
87
        done)
 
88
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
 
89
##
 
90
 
 
91
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
92
                        --variable=systemdsystemunitdir)
 
93
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=tmpfilesdir)
 
95
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=sysusersdir)
 
97
 
 
98
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
99
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
100
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
101
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
102
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
103
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
104
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
105
        || gpgme-config --libs; getconf LFS_LIBS; \
 
106
        getconf LFS_LDFLAGS)
 
107
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
108
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
109
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
110
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
34
111
 
35
112
# Do not change these two
36
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
37
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
38
 
LDFLAGS=$(COVERAGE)
 
113
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
114
        $(LANGUAGE) -DVERSION='"$(version)"'
 
115
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
116
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
39
117
 
40
 
# Commands to format a DocBook refentry document into a manual page
41
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
118
# Commands to format a DocBook <refentry> document into a manual page
 
119
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
42
120
        --param man.charmap.use.subset          0 \
43
121
        --param make.year.ranges                1 \
44
122
        --param make.single.year.ranges         1 \
45
123
        --param man.output.quietly              1 \
46
124
        --param man.authors.section.enabled     0 \
47
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
125
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
48
126
        $(notdir $<); \
49
 
        $(MANPOST) $(notdir $@)
50
 
# DocBook-to-man post-processing to fix a \n escape bug
51
 
MANPOST=sed --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
52
 
 
53
 
PLUGINS=plugins.d/password-prompt plugins.d/password-request
54
 
PROGS=plugin-runner $(PLUGINS)
55
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
56
 
        plugins.d/password-request.8mandos \
57
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
58
 
        mandos-clients.conf.5
59
 
 
60
 
objects=$(addsuffix .o,$(PROGS))
61
 
 
62
 
all: $(PROGS)
63
 
 
 
127
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
128
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
129
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
130
        $(notdir $@); fi >/dev/null)
 
131
 
 
132
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
133
        --param make.year.ranges                1 \
 
134
        --param make.single.year.ranges         1 \
 
135
        --param man.output.quietly              1 \
 
136
        --param man.authors.section.enabled     0 \
 
137
        --param citerefentry.link               1 \
 
138
        --output $@ \
 
139
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
140
        $<; $(HTMLPOST) $@)
 
141
# Fix citerefentry links
 
142
HTMLPOST:=$(SED) --in-place \
 
143
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
144
 
 
145
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
146
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
147
        plugins.d/plymouth
 
148
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
149
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
150
        $(PLUGIN_HELPERS)
 
151
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
152
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
153
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
154
        dracut-module/password-agent.8mandos \
 
155
        plugins.d/mandos-client.8mandos \
 
156
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
157
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
158
        plugins.d/plymouth.8mandos intro.8mandos
 
159
 
 
160
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
161
 
 
162
objects:=$(addsuffix .o,$(CPROGS))
 
163
 
 
164
.PHONY: all
 
165
all: $(PROGS) mandos.lsm
 
166
 
 
167
.PHONY: doc
64
168
doc: $(DOCS)
65
169
 
66
 
%.5: %.xml legalnotice.xml
67
 
        $(DOCBOOKTOMAN)
68
 
 
69
 
%.8: %.xml legalnotice.xml
70
 
        $(DOCBOOKTOMAN)
71
 
 
72
 
%.8mandos: %.xml legalnotice.xml
73
 
        $(DOCBOOKTOMAN)
74
 
 
75
 
mandos.8: mandos.xml mandos-options.xml overview.xml legalnotice.xml
76
 
        $(DOCBOOKTOMAN)
77
 
 
78
 
mandos-keygen.8: mandos-keygen.xml overview.xml legalnotice.xml
79
 
        $(DOCBOOKTOMAN)
80
 
 
81
 
mandos.conf.5: mandos.conf.xml mandos-options.xml legalnotice.xml
82
 
        $(DOCBOOKTOMAN)
83
 
 
84
 
plugin-runner.8mandos: plugin-runner.xml overview.xml legalnotice.xml
85
 
        $(DOCBOOKTOMAN)
86
 
 
87
 
plugins.d/password-request.8mandos: plugins.d/password-request.xml \
88
 
                                        mandos-options.xml \
89
 
                                        overview.xml legalnotice.xml
90
 
        $(DOCBOOKTOMAN)
91
 
 
92
 
plugins.d/password-request: plugins.d/password-request.o
93
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
94
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
95
 
 
96
 
.PHONY : all doc clean distclean run-client run-server install \
97
 
        install-server install-client uninstall uninstall-server \
98
 
        uninstall-client purge purge-server purge-client
99
 
 
 
170
.PHONY: html
 
171
html: $(htmldocs)
 
172
 
 
173
%.5: %.xml common.ent legalnotice.xml
 
174
        $(DOCBOOKTOMAN)
 
175
%.5.xhtml: %.xml common.ent legalnotice.xml
 
176
        $(DOCBOOKTOHTML)
 
177
 
 
178
%.8: %.xml common.ent legalnotice.xml
 
179
        $(DOCBOOKTOMAN)
 
180
%.8.xhtml: %.xml common.ent legalnotice.xml
 
181
        $(DOCBOOKTOHTML)
 
182
 
 
183
%.8mandos: %.xml common.ent legalnotice.xml
 
184
        $(DOCBOOKTOMAN)
 
185
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
intro.8mandos: intro.xml common.ent legalnotice.xml
 
189
        $(DOCBOOKTOMAN)
 
190
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
191
        $(DOCBOOKTOHTML)
 
192
 
 
193
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
194
                legalnotice.xml
 
195
        $(DOCBOOKTOMAN)
 
196
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
197
                overview.xml legalnotice.xml
 
198
        $(DOCBOOKTOHTML)
 
199
 
 
200
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
201
                legalnotice.xml
 
202
        $(DOCBOOKTOMAN)
 
203
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
204
                 legalnotice.xml
 
205
        $(DOCBOOKTOHTML)
 
206
 
 
207
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
208
                legalnotice.xml
 
209
        $(DOCBOOKTOMAN)
 
210
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
211
                 legalnotice.xml
 
212
        $(DOCBOOKTOHTML)
 
213
 
 
214
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
215
                legalnotice.xml
 
216
        $(DOCBOOKTOMAN)
 
217
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
218
                 legalnotice.xml
 
219
        $(DOCBOOKTOHTML)
 
220
 
 
221
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
222
                legalnotice.xml
 
223
        $(DOCBOOKTOMAN)
 
224
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
225
                legalnotice.xml
 
226
        $(DOCBOOKTOHTML)
 
227
 
 
228
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
229
                legalnotice.xml
 
230
        $(DOCBOOKTOMAN)
 
231
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
232
                overview.xml legalnotice.xml
 
233
        $(DOCBOOKTOHTML)
 
234
 
 
235
dracut-module/password-agent.8mandos: \
 
236
                dracut-module/password-agent.xml common.ent \
 
237
                overview.xml legalnotice.xml
 
238
        $(DOCBOOKTOMAN)
 
239
dracut-module/password-agent.8mandos.xhtml: \
 
240
                dracut-module/password-agent.xml common.ent \
 
241
                overview.xml legalnotice.xml
 
242
        $(DOCBOOKTOHTML)
 
243
 
 
244
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
245
                                        common.ent \
 
246
                                        mandos-options.xml \
 
247
                                        overview.xml legalnotice.xml
 
248
        $(DOCBOOKTOMAN)
 
249
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
250
                                        common.ent \
 
251
                                        mandos-options.xml \
 
252
                                        overview.xml legalnotice.xml
 
253
        $(DOCBOOKTOHTML)
 
254
 
 
255
# Update all these files with version number $(version)
 
256
common.ent: Makefile
 
257
        $(strip $(SED) --in-place \
 
258
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
259
                $@)
 
260
 
 
261
mandos: Makefile
 
262
        $(strip $(SED) --in-place \
 
263
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
264
                $@)
 
265
 
 
266
mandos-keygen: Makefile
 
267
        $(strip $(SED) --in-place \
 
268
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
269
                $@)
 
270
 
 
271
mandos-ctl: Makefile
 
272
        $(strip $(SED) --in-place \
 
273
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
274
                $@)
 
275
 
 
276
mandos-monitor: Makefile
 
277
        $(strip $(SED) --in-place \
 
278
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
279
                $@)
 
280
 
 
281
mandos.lsm: Makefile
 
282
        $(strip $(SED) --in-place \
 
283
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
284
                $@)
 
285
        $(strip $(SED) --in-place \
 
286
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
287
                $@)
 
288
        $(strip $(SED) --in-place \
 
289
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
290
                $@)
 
291
 
 
292
# Uses nested functions
 
293
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
294
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
295
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
296
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
297
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
298
 
 
299
# Need to add the GnuTLS, Avahi and GPGME libraries
 
300
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
301
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
302
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
303
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
304
 
 
305
# Need to add the libnl-route library
 
306
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
307
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
308
 
 
309
# Need to add the GLib and pthread libraries
 
310
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
311
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
312
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
313
 
 
314
.PHONY: clean
100
315
clean:
101
 
        -rm --force $(PROGS) $(objects) $(DOCS) core
 
316
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
102
317
 
 
318
.PHONY: distclean
103
319
distclean: clean
 
320
.PHONY: mostlyclean
104
321
mostlyclean: clean
 
322
.PHONY: maintainer-clean
105
323
maintainer-clean: clean
106
 
        -rm --force --recursive keydir confdir
 
324
        -rm --force --recursive keydir confdir statedir
107
325
 
108
 
check:
 
326
.PHONY: check
 
327
check: all
109
328
        ./mandos --check
 
329
        ./mandos-ctl --check
 
330
        ./mandos-keygen --version
 
331
        ./plugin-runner --version
 
332
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
333
        ./dracut-module/password-agent --test
110
334
 
111
335
# Run the client with a local config and key
112
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
336
.PHONY: run-client
 
337
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
338
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
339
        @echo '######################################################'
 
340
        @echo '# The following error messages are harmless and can  #'
 
341
        @echo '#  be safely ignored:                                #'
 
342
        @echo '## From plugin-runner:                               #'
 
343
        @echo '# setgid: Operation not permitted                    #'
 
344
        @echo '# setuid: Operation not permitted                    #'
 
345
        @echo '## From askpass-fifo:                                #'
 
346
        @echo '# mkfifo: Permission denied                          #'
 
347
        @echo '## From mandos-client:                               #'
 
348
        @echo '# Failed to raise privileges: Operation not permi... #'
 
349
        @echo '# Warning: network hook "*" exited with status *     #'
 
350
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
351
        @echo '# Failed to bring up interface "*": Operation not... #'
 
352
        @echo '#                                                    #'
 
353
        @echo '# (The messages are caused by not running as root,   #'
 
354
        @echo '# but you should NOT run "make run-client" as root   #'
 
355
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
356
        @echo '# root, which is also NOT recommended.)              #'
 
357
        @echo '######################################################'
 
358
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
113
359
        ./plugin-runner --plugin-dir=plugins.d \
 
360
                --plugin-helper-dir=plugin-helpers \
114
361
                --config-file=plugin-runner.conf \
115
 
                --options-for=password-request:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
362
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
363
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
364
                $(CLIENTARGS)
116
365
 
117
366
# Used by run-client
118
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
367
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
119
368
        install --directory keydir
120
369
        ./mandos-keygen --dir keydir --force
 
370
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
371
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
372
        fi
 
373
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
374
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
375
        fi
121
376
 
122
377
# Run the server with a local config
123
 
run-server: confdir/mandos.conf confdir/clients.conf
124
 
        ./mandos --debug --configdir=confdir
 
378
.PHONY: run-server
 
379
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
380
        ./mandos --debug --no-dbus --configdir=confdir \
 
381
                --statedir=statedir $(SERVERARGS)
125
382
 
126
383
# Used by run-server
127
384
confdir/mandos.conf: mandos.conf
128
 
        install --directory confdir
129
 
        install --mode=u=rw,go=r $^ $@
130
 
confdir/clients.conf: clients.conf keydir/seckey.txt
131
 
        install --directory confdir
132
 
        install --mode=u=rw,g=r $< $@
 
385
        install -D --mode=u=rw,go=r $^ $@
 
386
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
387
        install -D --mode=u=rw $< $@
133
388
# Add a client password
134
 
        ./mandos-keygen --dir keydir --password >> $@
135
 
 
136
 
install: install-server install-client
137
 
 
 
389
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
390
statedir:
 
391
        install --directory statedir
 
392
 
 
393
.PHONY: install
 
394
install: install-server install-client-nokey
 
395
 
 
396
.PHONY: install-html
 
397
install-html: html
 
398
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
 
399
                $(htmldocs)
 
400
 
 
401
.PHONY: install-server
138
402
install-server: doc
139
 
        install --directory $(CONFDIR) $(MANDIR)/man5 \
140
 
                $(MANDIR)/man8
141
 
        install --mode=u=rwx,go=rx --owner=$(USER) --group=$(GROUP) \
142
 
                --directory $(PIDDIR)
143
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
403
        if install --directory --mode=u=rwx --owner=$(USER) \
 
404
                --group=$(GROUP) $(STATEDIR); then \
 
405
                :; \
 
406
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
407
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
408
        fi
 
409
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
410
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
411
                        $(TMPFILES)/mandos.conf; \
 
412
        fi
 
413
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
414
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
415
                        $(SYSUSERS)/mandos.conf; \
 
416
        fi
 
417
        install --directory $(PREFIX)/sbin
 
418
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
419
                mandos
 
420
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
421
                mandos-ctl
 
422
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
423
                mandos-monitor
 
424
        install --directory $(CONFDIR)
144
425
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
145
426
                mandos.conf
146
 
        install --mode=u=rw,g=r --target-directory=$(CONFDIR) \
 
427
        install --mode=u=rw --target-directory=$(CONFDIR) \
147
428
                clients.conf
148
 
        install --mode=u=rwx,go=rx init.d-mandos /etc/init.d/mandos
149
 
        install --mode=u=rw,go=r default-mandos /etc/default/mandos
150
 
        update-rc.d mandos defaults
 
429
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
430
                $(DBUSPOLICYDIR)/mandos.conf
 
431
        install -D --mode=u=rwx,go=rx init.d-mandos \
 
432
                $(DESTDIR)/etc/init.d/mandos
 
433
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
434
                install -D --mode=u=rw,go=r mandos.service \
 
435
                        $(SYSTEMD); \
 
436
        fi
 
437
        install -D --mode=u=rw,go=r default-mandos \
 
438
                $(DESTDIR)/etc/default/mandos
 
439
        if [ -z $(DESTDIR) ]; then \
 
440
                update-rc.d mandos defaults 25 15;\
 
441
        fi
 
442
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
151
443
        gzip --best --to-stdout mandos.8 \
152
444
                > $(MANDIR)/man8/mandos.8.gz
 
445
        gzip --best --to-stdout mandos-monitor.8 \
 
446
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
447
        gzip --best --to-stdout mandos-ctl.8 \
 
448
                > $(MANDIR)/man8/mandos-ctl.8.gz
153
449
        gzip --best --to-stdout mandos.conf.5 \
154
450
                > $(MANDIR)/man5/mandos.conf.5.gz
155
451
        gzip --best --to-stdout mandos-clients.conf.5 \
156
452
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
453
        gzip --best --to-stdout intro.8mandos \
 
454
                > $(MANDIR)/man8/intro.8mandos.gz
157
455
 
158
 
install-client: all doc /usr/share/initramfs-tools/hooks/.
159
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR) \
160
 
                $(MANDIR)/man8
161
 
        install --directory --mode=u=rwx $(KEYDIR)
162
 
        install --directory --mode=u=rwx \
163
 
                $(PREFIX)/lib/mandos/plugins.d
164
 
        if [ "$(CONFDIR)/plugins.d" \
165
 
                        != "$(PREFIX)/lib/mandos/plugins.d" ]; then \
166
 
                        install --directory "$(CONFDIR)/plugins.d"; \
167
 
                fi
168
 
        install --mode=u=rwx,go=rx \
169
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
456
.PHONY: install-client-nokey
 
457
install-client-nokey: all doc
 
458
        install --directory --mode=u=rwx $(KEYDIR) \
 
459
                $(LIBDIR)/mandos/plugins.d \
 
460
                $(LIBDIR)/mandos/plugin-helpers
 
461
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
462
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
463
                        $(SYSUSERS)/mandos-client.conf; \
 
464
        fi
 
465
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
466
                install --directory \
 
467
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
468
                        "$(CONFDIR)/plugin-helpers"; \
 
469
        fi
 
470
        install --directory --mode=u=rwx,go=rx \
 
471
                "$(CONFDIR)/network-hooks.d"
 
472
        install --mode=u=rwx,go=rx \
 
473
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
474
        install --mode=u=rwx,go=rx \
 
475
                --target-directory=$(LIBDIR)/mandos \
 
476
                mandos-to-cryptroot-unlock
 
477
        install --directory $(PREFIX)/sbin
170
478
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
171
479
                mandos-keygen
172
480
        install --mode=u=rwx,go=rx \
173
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
481
                --target-directory=$(LIBDIR)/mandos/plugins.d \
174
482
                plugins.d/password-prompt
175
483
        install --mode=u=rwxs,go=rx \
176
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
177
 
                plugins.d/password-request
178
 
        install --mode=u=rwx,go=rx \
179
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
484
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
485
                plugins.d/mandos-client
 
486
        install --mode=u=rwxs,go=rx \
 
487
                --target-directory=$(LIBDIR)/mandos/plugins.d \
180
488
                plugins.d/usplash
181
 
        install initramfs-tools-hook \
182
 
                /usr/share/initramfs-tools/hooks/mandos
183
 
        install initramfs-tools-hook-conf \
184
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos
185
 
        install initramfs-tools-script \
186
 
                /usr/share/initramfs-tools/scripts/local-top/mandos
 
489
        install --mode=u=rwxs,go=rx \
 
490
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
491
                plugins.d/splashy
 
492
        install --mode=u=rwxs,go=rx \
 
493
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
494
                plugins.d/askpass-fifo
 
495
        install --mode=u=rwxs,go=rx \
 
496
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
497
                plugins.d/plymouth
 
498
        install --mode=u=rwx,go=rx \
 
499
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
500
                plugin-helpers/mandos-client-iprouteadddel
 
501
        install -D initramfs-tools-hook \
 
502
                $(INITRAMFSTOOLS)/hooks/mandos
 
503
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
504
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
505
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
506
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
507
        install -D initramfs-tools-script \
 
508
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
509
        install -D initramfs-tools-script-stop \
 
510
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
511
        install -D --mode=u=rw,go=r \
 
512
                --target-directory=$(DRACUTMODULE) \
 
513
                dracut-module/ask-password-mandos.path \
 
514
                dracut-module/ask-password-mandos.service
 
515
        install --mode=u=rwxs,go=rx \
 
516
                --target-directory=$(DRACUTMODULE) \
 
517
                dracut-module/module-setup.sh \
 
518
                dracut-module/cmdline-mandos.sh \
 
519
                dracut-module/password-agent
187
520
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
521
        install --directory $(MANDIR)/man8
188
522
        gzip --best --to-stdout mandos-keygen.8 \
189
523
                > $(MANDIR)/man8/mandos-keygen.8.gz
190
524
        gzip --best --to-stdout plugin-runner.8mandos \
191
525
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
526
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
527
                > $(MANDIR)/man8/mandos-client.8mandos.gz
192
528
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
193
529
                > $(MANDIR)/man8/password-prompt.8mandos.gz
194
 
        gzip --best --to-stdout plugins.d/password-request.8mandos \
195
 
                > $(MANDIR)/man8/password-request.8mandos.gz
 
530
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
531
                > $(MANDIR)/man8/usplash.8mandos.gz
 
532
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
533
                > $(MANDIR)/man8/splashy.8mandos.gz
 
534
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
535
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
536
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
537
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
538
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
539
                > $(MANDIR)/man8/password-agent.8mandos.gz
 
540
 
 
541
.PHONY: install-client
 
542
install-client: install-client-nokey
 
543
# Post-installation stuff
196
544
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
197
 
        update-initramfs -k all -u
 
545
        if command -v update-initramfs >/dev/null; then \
 
546
            update-initramfs -k all -u; \
 
547
        elif command -v dracut >/dev/null; then \
 
548
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
549
                if [ -w "$$initrd" ]; then \
 
550
                    chmod go-r "$$initrd"; \
 
551
                    dracut --force "$$initrd"; \
 
552
                fi; \
 
553
            done; \
 
554
        fi
198
555
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
199
556
 
 
557
.PHONY: uninstall
200
558
uninstall: uninstall-server uninstall-client
201
559
 
 
560
.PHONY: uninstall-server
202
561
uninstall-server:
203
562
        -rm --force $(PREFIX)/sbin/mandos \
 
563
                $(PREFIX)/sbin/mandos-ctl \
 
564
                $(PREFIX)/sbin/mandos-monitor \
204
565
                $(MANDIR)/man8/mandos.8.gz \
 
566
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
567
                $(MANDIR)/man8/mandos-ctl.8.gz \
205
568
                $(MANDIR)/man5/mandos.conf.5.gz \
206
569
                $(MANDIR)/man5/mandos-clients.conf.5.gz
207
570
        update-rc.d -f mandos remove
208
 
        -rmdir $(CONFDIR) $(PIDDIR)
 
571
        -rmdir $(CONFDIR)
209
572
 
 
573
.PHONY: uninstall-client
210
574
uninstall-client:
211
575
# Refuse to uninstall client if /etc/crypttab is explicitly configured
212
576
# to use it.
213
577
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
214
 
                /etc/crypttab
 
578
                $(DESTDIR)/etc/crypttab
215
579
        -rm --force $(PREFIX)/sbin/mandos-keygen \
216
 
                $(PREFIX)/lib/mandos/plugin-runner \
217
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
218
 
                $(PREFIX)/lib/mandos/plugins.d/password-request \
219
 
                /usr/share/initramfs-tools/hooks/mandos \
220
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos \
 
580
                $(LIBDIR)/mandos/plugin-runner \
 
581
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
582
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
583
                $(LIBDIR)/mandos/plugins.d/usplash \
 
584
                $(LIBDIR)/mandos/plugins.d/splashy \
 
585
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
586
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
587
                $(INITRAMFSTOOLS)/hooks/mandos \
 
588
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
589
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
590
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
591
                $(DRACUTMODULE)/ask-password-mandos.path \
 
592
                $(DRACUTMODULE)/ask-password-mandos.service \
 
593
                $(DRACUTMODULE)/module-setup.sh \
 
594
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
595
                $(DRACUTMODULE)/password-agent \
 
596
                $(MANDIR)/man8/mandos-keygen.8.gz \
221
597
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
222
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
598
                $(MANDIR)/man8/mandos-client.8mandos.gz
223
599
                $(MANDIR)/man8/password-prompt.8mandos.gz \
224
 
                $(MANDIR)/man8/password-request.8mandos.gz
225
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
226
 
                 $(PREFIX)/lib/mandos $(CONFDIR)
227
 
        update-initramfs -k all -u
 
600
                $(MANDIR)/man8/usplash.8mandos.gz \
 
601
                $(MANDIR)/man8/splashy.8mandos.gz \
 
602
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
603
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
604
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
605
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
606
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
607
        if command -v update-initramfs >/dev/null; then \
 
608
            update-initramfs -k all -u; \
 
609
        elif command -v dracut >/dev/null; then \
 
610
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
611
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
612
            done; \
 
613
        fi
228
614
 
 
615
.PHONY: purge
229
616
purge: purge-server purge-client
230
617
 
 
618
.PHONY: purge-server
231
619
purge-server: uninstall-server
232
620
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
233
 
                /etc/default/mandos /etc/init.d/mandos
 
621
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
622
                $(DESTDIR)/etc/default/mandos \
 
623
                $(DESTDIR)/etc/init.d/mandos \
 
624
                $(DESTDIR)/run/mandos.pid \
 
625
                $(DESTDIR)/var/run/mandos.pid
 
626
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
627
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
628
        fi
234
629
        -rmdir $(CONFDIR)
235
630
 
 
631
.PHONY: purge-client
236
632
purge-client: uninstall-client
237
 
        -shred --remove $(KEYDIR)/seckey.txt
 
633
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
238
634
        -rm --force $(CONFDIR)/plugin-runner.conf \
239
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
635
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
636
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
240
637
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)