/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 18:43:11 UTC
  • mto: This revision was merged to the branch mainline in revision 412.
  • Revision ID: teddy@recompile.se-20241117184311-ox25kvngy62h209g
Debian package: Avoid suggesting a C compiler unnecessarily

The list of suggested packages, meant to enable the "mandos" program
to find the correct value of SO_BINDTODEVICE by using a C compiler,
are not necessary when Python 3.3 or later is used, since it has the
SO_BINDTODEVICE constant defined in the "socket" module.  Also, Python
2.6 or older has the same constant in the old "IN" module.  Therefore,
we should suggest these Python versions as alternatives to a C
compiler, so that a C compiler is not installed unnecessarily.

debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and
"python (<= 2.6)" as alternatives to "libc6-dev | libc-dev" and
"c-compiler".

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code 
9
 
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
12
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
14
 
LINK_FORTIFY_LD=-z relro -z now
15
 
LINK_FORTIFY=
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
34
LINK_FORTIFY_LD:=-z relro -z now
 
35
LINK_FORTIFY:=
 
36
 
 
37
# If BROKEN_PIE is set, do not build with -pie
16
38
ifndef BROKEN_PIE
17
39
FORTIFY += -fPIE
18
 
LINK_FORTIFY_LD += -fPIE
19
40
LINK_FORTIFY += -pie
20
41
endif
21
42
#COVERAGE=--coverage
22
 
OPTIMIZE=-Os
23
 
LANGUAGE=-std=gnu99
24
 
htmldir=man
25
 
version=1.0.14
26
 
SED=sed
 
43
OPTIMIZE:=-Os -fno-strict-aliasing
 
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
 
46
htmldir:=man
 
47
version:=1.8.17
 
48
SED:=sed
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
27
57
 
28
58
## Use these settings for a traditional /usr/local install
29
 
# PREFIX=$(DESTDIR)/usr/local
30
 
# CONFDIR=$(DESTDIR)/etc/mandos
31
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
32
 
# MANDIR=$(PREFIX)/man
33
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# BINDIR:=$(PREFIX)/sbin
 
61
# CONFDIR:=$(DESTDIR)/etc/mandos
 
62
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
63
# MANDIR:=$(PREFIX)/man
 
64
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
65
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
66
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
67
# LIBDIR:=$(PREFIX)/lib
 
68
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
34
69
##
35
70
 
36
71
## These settings are for a package-type install
37
 
PREFIX=$(DESTDIR)/usr
38
 
CONFDIR=$(DESTDIR)/etc/mandos
39
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
40
 
MANDIR=$(PREFIX)/share/man
41
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
72
PREFIX:=$(DESTDIR)/usr
 
73
BINDIR:=$(PREFIX)/sbin
 
74
CONFDIR:=$(DESTDIR)/etc/mandos
 
75
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
76
MANDIR:=$(PREFIX)/share/man
 
77
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
78
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
79
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
80
LIBDIR:=$(shell \
 
81
        for d in \
 
82
        "/usr/lib/`dpkg-architecture \
 
83
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
84
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
85
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
86
                        echo "$(DESTDIR)$$d"; \
 
87
                        break; \
 
88
                fi; \
 
89
        done)
 
90
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
42
91
##
43
92
 
44
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
45
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
46
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
47
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
48
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
49
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
93
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=systemdsystemunitdir)
 
95
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=tmpfilesdir)
 
97
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
98
                        --variable=sysusersdir)
 
99
 
 
100
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
101
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
102
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
103
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
104
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
105
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
106
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
107
        || gpgme-config --libs; getconf LFS_LIBS; \
50
108
        getconf LFS_LDFLAGS)
 
109
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
110
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
111
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
112
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
51
113
 
52
114
# Do not change these two
53
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
54
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
55
 
        -DVERSION='"$(version)"'
56
 
LDFLAGS=$(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
115
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
116
        $(LANGUAGE) -DVERSION='"$(version)"'
 
117
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
118
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
57
119
 
58
120
# Commands to format a DocBook <refentry> document into a manual page
59
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
121
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
60
122
        --param man.charmap.use.subset          0 \
61
123
        --param make.year.ranges                1 \
62
124
        --param make.single.year.ranges         1 \
63
125
        --param man.output.quietly              1 \
64
126
        --param man.authors.section.enabled     0 \
65
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
127
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
66
128
        $(notdir $<); \
67
 
        $(MANPOST) $(notdir $@)
68
 
# DocBook-to-man post-processing to fix a '\n' escape bug
69
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
129
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
130
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
131
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
132
        $(notdir $@); fi >/dev/null)
70
133
 
71
 
DOCBOOKTOHTML=xsltproc --nonet --xinclude \
 
134
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
72
135
        --param make.year.ranges                1 \
73
136
        --param make.single.year.ranges         1 \
74
137
        --param man.output.quietly              1 \
76
139
        --param citerefentry.link               1 \
77
140
        --output $@ \
78
141
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
79
 
        $<; $(HTMLPOST) $@
 
142
        $<; $(HTMLPOST) $@)
80
143
# Fix citerefentry links
81
 
HTMLPOST=$(SED) --in-place \
 
144
HTMLPOST:=$(SED) --in-place \
82
145
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
83
146
 
84
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
85
 
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo
86
 
CPROGS=plugin-runner $(PLUGINS)
87
 
PROGS=mandos mandos-keygen mandos-ctl $(CPROGS)
88
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
 
147
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
148
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
149
        plugins.d/plymouth
 
150
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
151
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
152
        $(PLUGIN_HELPERS)
 
153
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
154
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
155
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
156
        dracut-module/password-agent.8mandos \
89
157
        plugins.d/mandos-client.8mandos \
90
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
91
 
        plugins.d/usplash.8mandos plugins.d/splashy.8mandos \
92
 
        plugins.d/askpass-fifo.8mandos mandos-clients.conf.5
93
 
 
94
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
95
 
 
96
 
objects=$(addsuffix .o,$(CPROGS))
97
 
 
 
158
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
159
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
160
        plugins.d/plymouth.8mandos intro.8mandos
 
161
 
 
162
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
163
 
 
164
objects:=$(addsuffix .o,$(CPROGS))
 
165
 
 
166
.PHONY: all
98
167
all: $(PROGS) mandos.lsm
99
168
 
 
169
.PHONY: doc
100
170
doc: $(DOCS)
101
171
 
 
172
.PHONY: html
102
173
html: $(htmldocs)
103
174
 
104
175
%.5: %.xml common.ent legalnotice.xml
116
187
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
117
188
        $(DOCBOOKTOHTML)
118
189
 
 
190
intro.8mandos: intro.xml common.ent legalnotice.xml
 
191
        $(DOCBOOKTOMAN)
 
192
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
119
195
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
120
196
                legalnotice.xml
121
197
        $(DOCBOOKTOMAN)
130
206
                 legalnotice.xml
131
207
        $(DOCBOOKTOHTML)
132
208
 
 
209
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
210
                legalnotice.xml
 
211
        $(DOCBOOKTOMAN)
 
212
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
213
                 legalnotice.xml
 
214
        $(DOCBOOKTOHTML)
 
215
 
 
216
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
217
                legalnotice.xml
 
218
        $(DOCBOOKTOMAN)
 
219
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
220
                 legalnotice.xml
 
221
        $(DOCBOOKTOHTML)
 
222
 
133
223
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
134
224
                legalnotice.xml
135
225
        $(DOCBOOKTOMAN)
144
234
                overview.xml legalnotice.xml
145
235
        $(DOCBOOKTOHTML)
146
236
 
 
237
dracut-module/password-agent.8mandos: \
 
238
                dracut-module/password-agent.xml common.ent \
 
239
                overview.xml legalnotice.xml
 
240
        $(DOCBOOKTOMAN)
 
241
dracut-module/password-agent.8mandos.xhtml: \
 
242
                dracut-module/password-agent.xml common.ent \
 
243
                overview.xml legalnotice.xml
 
244
        $(DOCBOOKTOHTML)
 
245
 
147
246
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
148
247
                                        common.ent \
149
248
                                        mandos-options.xml \
157
256
 
158
257
# Update all these files with version number $(version)
159
258
common.ent: Makefile
160
 
        $(SED) --in-place \
 
259
        $(strip $(SED) --in-place \
161
260
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
162
 
                $@
 
261
                $@)
163
262
 
164
263
mandos: Makefile
165
 
        $(SED) --in-place \
 
264
        $(strip $(SED) --in-place \
166
265
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
167
 
                $@
 
266
                $@)
168
267
 
169
268
mandos-keygen: Makefile
170
 
        $(SED) --in-place \
 
269
        $(strip $(SED) --in-place \
171
270
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
172
 
                $@
 
271
                $@)
173
272
 
174
273
mandos-ctl: Makefile
175
 
        $(SED) --in-place \
176
 
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
177
 
                $@
 
274
        $(strip $(SED) --in-place \
 
275
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
276
                $@)
 
277
 
 
278
mandos-monitor: Makefile
 
279
        $(strip $(SED) --in-place \
 
280
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
281
                $@)
178
282
 
179
283
mandos.lsm: Makefile
180
 
        $(SED) --in-place \
 
284
        $(strip $(SED) --in-place \
181
285
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
182
 
                $@
183
 
        $(SED) --in-place \
 
286
                $@)
 
287
        $(strip $(SED) --in-place \
184
288
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
185
 
                $@
186
 
        $(SED) --in-place \
 
289
                $@)
 
290
        $(strip $(SED) --in-place \
187
291
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
188
 
                $@
189
 
 
190
 
plugins.d/mandos-client: plugins.d/mandos-client.o
191
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
192
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
193
 
 
194
 
.PHONY : all doc html clean distclean run-client run-server install \
195
 
        install-server install-client uninstall uninstall-server \
196
 
        uninstall-client purge purge-server purge-client
197
 
 
 
292
                $@)
 
293
 
 
294
# Does the linker support the --no-warn-execstack option?
 
295
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
 
296
# These programs use nested functions, which uses an executable stack
 
297
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
298
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
299
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
300
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
301
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
302
endif
 
303
 
 
304
# Need to add the GnuTLS, Avahi and GPGME libraries
 
305
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
306
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
307
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
308
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
309
 
 
310
# Need to add the libnl-route library
 
311
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
312
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
313
 
 
314
# Need to add the GLib and pthread libraries
 
315
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
316
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
317
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
318
 
 
319
.PHONY: clean
198
320
clean:
199
321
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
200
322
 
 
323
.PHONY: distclean
201
324
distclean: clean
 
325
.PHONY: mostlyclean
202
326
mostlyclean: clean
 
327
.PHONY: maintainer-clean
203
328
maintainer-clean: clean
204
 
        -rm --force --recursive keydir confdir
 
329
        -rm --force --recursive keydir confdir statedir
205
330
 
206
 
check:  all
 
331
.PHONY: check
 
332
check: all
207
333
        ./mandos --check
 
334
        ./mandos-ctl --check
 
335
        ./mandos-keygen --version
 
336
        ./plugin-runner --version
 
337
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
338
        ./dracut-module/password-agent --test
208
339
 
209
340
# Run the client with a local config and key
210
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
341
.PHONY: run-client
 
342
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
343
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
344
        @echo '######################################################'
 
345
        @echo '# The following error messages are harmless and can  #'
 
346
        @echo '#  be safely ignored:                                #'
 
347
        @echo '## From plugin-runner:                               #'
 
348
        @echo '# setgid: Operation not permitted                    #'
 
349
        @echo '# setuid: Operation not permitted                    #'
 
350
        @echo '## From askpass-fifo:                                #'
 
351
        @echo '# mkfifo: Permission denied                          #'
 
352
        @echo '## From mandos-client:                               #'
 
353
        @echo '# Failed to raise privileges: Operation not permi... #'
 
354
        @echo '# Warning: network hook "*" exited with status *     #'
 
355
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
356
        @echo '# Failed to bring up interface "*": Operation not... #'
 
357
        @echo '#                                                    #'
 
358
        @echo '# (The messages are caused by not running as root,   #'
 
359
        @echo '# but you should NOT run "make run-client" as root   #'
 
360
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
361
        @echo '# root, which is also NOT recommended.)              #'
 
362
        @echo '######################################################'
 
363
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
211
364
        ./plugin-runner --plugin-dir=plugins.d \
 
365
                --plugin-helper-dir=plugin-helpers \
212
366
                --config-file=plugin-runner.conf \
213
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
367
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
368
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
214
369
                $(CLIENTARGS)
215
370
 
216
371
# Used by run-client
217
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
372
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
218
373
        install --directory keydir
219
374
        ./mandos-keygen --dir keydir --force
 
375
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
376
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
377
        fi
 
378
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
379
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
380
        fi
220
381
 
221
382
# Run the server with a local config
222
 
run-server: confdir/mandos.conf confdir/clients.conf
223
 
        ./mandos --debug --no-dbus --configdir=confdir $(SERVERARGS)
 
383
.PHONY: run-server
 
384
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
385
        ./mandos --debug --no-dbus --configdir=confdir \
 
386
                --statedir=statedir $(SERVERARGS)
224
387
 
225
388
# Used by run-server
226
389
confdir/mandos.conf: mandos.conf
227
 
        install --directory confdir
228
 
        install --mode=u=rw,go=r $^ $@
229
 
confdir/clients.conf: clients.conf keydir/seckey.txt
230
 
        install --directory confdir
231
 
        install --mode=u=rw $< $@
 
390
        install -D --mode=u=rw,go=r $^ $@
 
391
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
392
        install -D --mode=u=rw $< $@
232
393
# Add a client password
233
 
        ./mandos-keygen --dir keydir --password >> $@
 
394
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
395
statedir:
 
396
        install --directory statedir
234
397
 
 
398
.PHONY: install
235
399
install: install-server install-client-nokey
236
400
 
 
401
.PHONY: install-html
237
402
install-html: html
238
 
        install --directory $(htmldir)
239
 
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
403
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
240
404
                $(htmldocs)
241
405
 
 
406
.PHONY: install-server
242
407
install-server: doc
 
408
        if install --directory --mode=u=rwx --owner=$(USER) \
 
409
                --group=$(GROUP) $(STATEDIR); then \
 
410
                :; \
 
411
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
412
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
413
        fi
 
414
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
415
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
416
                        $(TMPFILES)/mandos.conf; \
 
417
        fi
 
418
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
419
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
420
                        $(SYSUSERS)/mandos.conf; \
 
421
        fi
 
422
        install --directory $(BINDIR)
 
423
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
 
424
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
425
                mandos-ctl
 
426
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
427
                mandos-monitor
243
428
        install --directory $(CONFDIR)
244
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
245
429
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
246
430
                mandos.conf
247
431
        install --mode=u=rw --target-directory=$(CONFDIR) \
248
432
                clients.conf
249
 
        install --mode=u=rwx,go=rx init.d-mandos \
 
433
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
434
                $(DBUSPOLICYDIR)/mandos.conf
 
435
        install -D --mode=u=rwx,go=rx init.d-mandos \
250
436
                $(DESTDIR)/etc/init.d/mandos
251
 
        install --mode=u=rw,go=r default-mandos \
 
437
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
438
                install -D --mode=u=rw,go=r mandos.service \
 
439
                        $(SYSTEMD); \
 
440
        fi
 
441
        install -D --mode=u=rw,go=r default-mandos \
252
442
                $(DESTDIR)/etc/default/mandos
253
443
        if [ -z $(DESTDIR) ]; then \
254
444
                update-rc.d mandos defaults 25 15;\
255
445
        fi
 
446
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
256
447
        gzip --best --to-stdout mandos.8 \
257
448
                > $(MANDIR)/man8/mandos.8.gz
 
449
        gzip --best --to-stdout mandos-monitor.8 \
 
450
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
451
        gzip --best --to-stdout mandos-ctl.8 \
 
452
                > $(MANDIR)/man8/mandos-ctl.8.gz
258
453
        gzip --best --to-stdout mandos.conf.5 \
259
454
                > $(MANDIR)/man5/mandos.conf.5.gz
260
455
        gzip --best --to-stdout mandos-clients.conf.5 \
261
456
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
457
        gzip --best --to-stdout intro.8mandos \
 
458
                > $(MANDIR)/man8/intro.8mandos.gz
262
459
 
 
460
.PHONY: install-client-nokey
263
461
install-client-nokey: all doc
264
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
265
462
        install --directory --mode=u=rwx $(KEYDIR) \
266
 
                $(PREFIX)/lib/mandos/plugins.d
267
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
268
 
                install --mode=u=rwx \
269
 
                        --directory "$(CONFDIR)/plugins.d"; \
270
 
        fi
271
 
        install --mode=u=rwx,go=rx \
272
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
273
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
463
                $(LIBDIR)/mandos/plugins.d \
 
464
                $(LIBDIR)/mandos/plugin-helpers
 
465
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
466
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
467
                        $(SYSUSERS)/mandos-client.conf; \
 
468
        fi
 
469
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
470
                install --directory \
 
471
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
472
                        "$(CONFDIR)/plugin-helpers"; \
 
473
        fi
 
474
        install --directory --mode=u=rwx,go=rx \
 
475
                "$(CONFDIR)/network-hooks.d"
 
476
        install --mode=u=rwx,go=rx \
 
477
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
478
        install --mode=u=rwx,go=rx \
 
479
                --target-directory=$(LIBDIR)/mandos \
 
480
                mandos-to-cryptroot-unlock
 
481
        install --directory $(BINDIR)
 
482
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
274
483
                mandos-keygen
275
484
        install --mode=u=rwx,go=rx \
276
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
277
486
                plugins.d/password-prompt
278
487
        install --mode=u=rwxs,go=rx \
279
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
488
                --target-directory=$(LIBDIR)/mandos/plugins.d \
280
489
                plugins.d/mandos-client
281
490
        install --mode=u=rwxs,go=rx \
282
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
491
                --target-directory=$(LIBDIR)/mandos/plugins.d \
283
492
                plugins.d/usplash
284
493
        install --mode=u=rwxs,go=rx \
285
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
494
                --target-directory=$(LIBDIR)/mandos/plugins.d \
286
495
                plugins.d/splashy
287
496
        install --mode=u=rwxs,go=rx \
288
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
497
                --target-directory=$(LIBDIR)/mandos/plugins.d \
289
498
                plugins.d/askpass-fifo
290
 
        install initramfs-tools-hook \
 
499
        install --mode=u=rwxs,go=rx \
 
500
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
501
                plugins.d/plymouth
 
502
        install --mode=u=rwx,go=rx \
 
503
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
504
                plugin-helpers/mandos-client-iprouteadddel
 
505
        install -D initramfs-tools-hook \
291
506
                $(INITRAMFSTOOLS)/hooks/mandos
292
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
293
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
294
 
        install initramfs-tools-script \
 
507
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
508
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
509
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
510
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
511
        install -D initramfs-tools-script \
295
512
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
513
        install -D initramfs-tools-script-stop \
 
514
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
515
        install -D --mode=u=rw,go=r \
 
516
                --target-directory=$(DRACUTMODULE) \
 
517
                dracut-module/ask-password-mandos.path \
 
518
                dracut-module/ask-password-mandos.service
 
519
        install --mode=u=rwxs,go=rx \
 
520
                --target-directory=$(DRACUTMODULE) \
 
521
                dracut-module/module-setup.sh \
 
522
                dracut-module/cmdline-mandos.sh \
 
523
                dracut-module/password-agent
296
524
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
525
        install --directory $(MANDIR)/man8
297
526
        gzip --best --to-stdout mandos-keygen.8 \
298
527
                > $(MANDIR)/man8/mandos-keygen.8.gz
299
528
        gzip --best --to-stdout plugin-runner.8mandos \
300
529
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
530
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
531
                > $(MANDIR)/man8/mandos-client.8mandos.gz
301
532
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
302
533
                > $(MANDIR)/man8/password-prompt.8mandos.gz
303
 
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
304
 
                > $(MANDIR)/man8/mandos-client.8mandos.gz
305
534
        gzip --best --to-stdout plugins.d/usplash.8mandos \
306
535
                > $(MANDIR)/man8/usplash.8mandos.gz
307
536
        gzip --best --to-stdout plugins.d/splashy.8mandos \
308
537
                > $(MANDIR)/man8/splashy.8mandos.gz
309
538
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
310
539
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
540
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
541
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
542
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
543
                > $(MANDIR)/man8/password-agent.8mandos.gz
311
544
 
 
545
.PHONY: install-client
312
546
install-client: install-client-nokey
313
547
# Post-installation stuff
314
 
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
315
 
        update-initramfs -k all -u
 
548
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
 
549
        if command -v update-initramfs >/dev/null; then \
 
550
            update-initramfs -k all -u; \
 
551
        elif command -v dracut >/dev/null; then \
 
552
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
553
                if [ -w "$$initrd" ]; then \
 
554
                    chmod go-r "$$initrd"; \
 
555
                    dracut --force "$$initrd"; \
 
556
                fi; \
 
557
            done; \
 
558
        fi
316
559
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
317
560
 
 
561
.PHONY: uninstall
318
562
uninstall: uninstall-server uninstall-client
319
563
 
 
564
.PHONY: uninstall-server
320
565
uninstall-server:
321
 
        -rm --force $(PREFIX)/sbin/mandos \
 
566
        -rm --force $(BINDIR)/mandos \
 
567
                $(BINDIR)/mandos-ctl \
 
568
                $(BINDIR)/mandos-monitor \
322
569
                $(MANDIR)/man8/mandos.8.gz \
 
570
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
571
                $(MANDIR)/man8/mandos-ctl.8.gz \
323
572
                $(MANDIR)/man5/mandos.conf.5.gz \
324
573
                $(MANDIR)/man5/mandos-clients.conf.5.gz
325
574
        update-rc.d -f mandos remove
326
575
        -rmdir $(CONFDIR)
327
576
 
 
577
.PHONY: uninstall-client
328
578
uninstall-client:
329
579
# Refuse to uninstall client if /etc/crypttab is explicitly configured
330
580
# to use it.
331
581
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
332
582
                $(DESTDIR)/etc/crypttab
333
 
        -rm --force $(PREFIX)/sbin/mandos-keygen \
334
 
                $(PREFIX)/lib/mandos/plugin-runner \
335
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
336
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
337
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
338
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
339
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
 
583
        -rm --force $(BINDIR)/mandos-keygen \
 
584
                $(LIBDIR)/mandos/plugin-runner \
 
585
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
586
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
587
                $(LIBDIR)/mandos/plugins.d/usplash \
 
588
                $(LIBDIR)/mandos/plugins.d/splashy \
 
589
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
590
                $(LIBDIR)/mandos/plugins.d/plymouth \
340
591
                $(INITRAMFSTOOLS)/hooks/mandos \
341
592
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
342
593
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
594
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
595
                $(DRACUTMODULE)/ask-password-mandos.path \
 
596
                $(DRACUTMODULE)/ask-password-mandos.service \
 
597
                $(DRACUTMODULE)/module-setup.sh \
 
598
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
599
                $(DRACUTMODULE)/password-agent \
 
600
                $(MANDIR)/man8/mandos-keygen.8.gz \
343
601
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
344
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
602
                $(MANDIR)/man8/mandos-client.8mandos.gz
345
603
                $(MANDIR)/man8/password-prompt.8mandos.gz \
346
604
                $(MANDIR)/man8/usplash.8mandos.gz \
347
605
                $(MANDIR)/man8/splashy.8mandos.gz \
348
606
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
349
 
                $(MANDIR)/man8/mandos-client.8mandos.gz
350
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
351
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
352
 
        update-initramfs -k all -u
 
607
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
608
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
609
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
610
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
611
        if command -v update-initramfs >/dev/null; then \
 
612
            update-initramfs -k all -u; \
 
613
        elif command -v dracut >/dev/null; then \
 
614
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
615
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
616
            done; \
 
617
        fi
353
618
 
 
619
.PHONY: purge
354
620
purge: purge-server purge-client
355
621
 
 
622
.PHONY: purge-server
356
623
purge-server: uninstall-server
357
624
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
625
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
358
626
                $(DESTDIR)/etc/default/mandos \
359
627
                $(DESTDIR)/etc/init.d/mandos \
 
628
                $(DESTDIR)/run/mandos.pid \
360
629
                $(DESTDIR)/var/run/mandos.pid
 
630
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
631
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
632
        fi
361
633
        -rmdir $(CONFDIR)
362
634
 
 
635
.PHONY: purge-client
363
636
purge-client: uninstall-client
364
 
        -shred --remove $(KEYDIR)/seckey.txt
 
637
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
365
638
        -rm --force $(CONFDIR)/plugin-runner.conf \
366
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
639
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
640
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
367
641
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)