/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 18:43:11 UTC
  • mto: This revision was merged to the branch mainline in revision 412.
  • Revision ID: teddy@recompile.se-20241117184311-ox25kvngy62h209g
Debian package: Avoid suggesting a C compiler unnecessarily

The list of suggested packages, meant to enable the "mandos" program
to find the correct value of SO_BINDTODEVICE by using a C compiler,
are not necessary when Python 3.3 or later is used, since it has the
SO_BINDTODEVICE constant defined in the "socket" module.  Also, Python
2.6 or older has the same constant in the old "IN" module.  Therefore,
we should suggest these Python versions as alternatives to a C
compiler, so that a C compiler is not installed unnecessarily.

debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and
"python (<= 2.6)" as alternatives to "libc6-dev | libc-dev" and
"c-compiler".

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
29
29
 
30
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
33
34
LINK_FORTIFY_LD:=-z relro -z now
34
35
LINK_FORTIFY:=
35
36
 
41
42
#COVERAGE=--coverage
42
43
OPTIMIZE:=-Os -fno-strict-aliasing
43
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
44
46
htmldir:=man
45
 
version:=1.8.5
 
47
version:=1.8.17
46
48
SED:=sed
47
49
PKG_CONFIG?=pkg-config
48
50
 
55
57
 
56
58
## Use these settings for a traditional /usr/local install
57
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# BINDIR:=$(PREFIX)/sbin
58
61
# CONFDIR:=$(DESTDIR)/etc/mandos
59
62
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
60
63
# MANDIR:=$(PREFIX)/man
62
65
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
63
66
# STATEDIR:=$(DESTDIR)/var/lib/mandos
64
67
# LIBDIR:=$(PREFIX)/lib
 
68
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
65
69
##
66
70
 
67
71
## These settings are for a package-type install
68
72
PREFIX:=$(DESTDIR)/usr
 
73
BINDIR:=$(PREFIX)/sbin
69
74
CONFDIR:=$(DESTDIR)/etc/mandos
70
75
KEYDIR:=$(DESTDIR)/etc/keys/mandos
71
76
MANDIR:=$(PREFIX)/share/man
82
87
                        break; \
83
88
                fi; \
84
89
        done)
 
90
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
85
91
##
86
92
 
87
93
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
88
94
                        --variable=systemdsystemunitdir)
89
95
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
90
96
                        --variable=tmpfilesdir)
 
97
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
98
                        --variable=sysusersdir)
91
99
 
92
100
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
93
101
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
94
102
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
95
103
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
96
 
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
97
 
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
104
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
105
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
106
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
107
        || gpgme-config --libs; getconf LFS_LIBS; \
98
108
        getconf LFS_LDFLAGS)
99
109
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
100
110
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
102
112
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
103
113
 
104
114
# Do not change these two
105
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
106
 
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
115
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
116
        $(LANGUAGE) -DVERSION='"$(version)"'
107
117
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
108
118
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
109
119
 
153
163
 
154
164
objects:=$(addsuffix .o,$(CPROGS))
155
165
 
 
166
.PHONY: all
156
167
all: $(PROGS) mandos.lsm
157
168
 
 
169
.PHONY: doc
158
170
doc: $(DOCS)
159
171
 
 
172
.PHONY: html
160
173
html: $(htmldocs)
161
174
 
162
175
%.5: %.xml common.ent legalnotice.xml
278
291
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
279
292
                $@)
280
293
 
 
294
# Does the linker support the --no-warn-execstack option?
 
295
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
 
296
# These programs use nested functions, which uses an executable stack
 
297
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
298
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
299
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
300
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
301
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
302
endif
 
303
 
281
304
# Need to add the GnuTLS, Avahi and GPGME libraries
282
 
plugins.d/mandos-client: plugins.d/mandos-client.c
283
 
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
284
 
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
285
 
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
286
 
                ) $(LDLIBS) -o $@
 
305
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
306
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
307
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
308
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
287
309
 
288
310
# Need to add the libnl-route library
289
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
290
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
291
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
311
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
312
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
292
313
 
293
314
# Need to add the GLib and pthread libraries
294
 
dracut-module/password-agent: dracut-module/password-agent.c
295
 
        $(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
296
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
297
 
 
298
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
299
 
        check run-client run-server install install-html \
300
 
        install-server install-client-nokey install-client uninstall \
301
 
        uninstall-server uninstall-client purge purge-server \
302
 
        purge-client
303
 
 
 
315
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
316
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
317
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
318
 
 
319
.PHONY: clean
304
320
clean:
305
321
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
306
322
 
 
323
.PHONY: distclean
307
324
distclean: clean
 
325
.PHONY: mostlyclean
308
326
mostlyclean: clean
 
327
.PHONY: maintainer-clean
309
328
maintainer-clean: clean
310
329
        -rm --force --recursive keydir confdir statedir
311
330
 
 
331
.PHONY: check
312
332
check: all
313
333
        ./mandos --check
314
334
        ./mandos-ctl --check
318
338
        ./dracut-module/password-agent --test
319
339
 
320
340
# Run the client with a local config and key
 
341
.PHONY: run-client
321
342
run-client: all keydir/seckey.txt keydir/pubkey.txt \
322
343
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
323
344
        @echo '######################################################'
351
372
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
352
373
        install --directory keydir
353
374
        ./mandos-keygen --dir keydir --force
 
375
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
376
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
377
        fi
 
378
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
379
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
380
        fi
354
381
 
355
382
# Run the server with a local config
 
383
.PHONY: run-server
356
384
run-server: confdir/mandos.conf confdir/clients.conf statedir
357
385
        ./mandos --debug --no-dbus --configdir=confdir \
358
386
                --statedir=statedir $(SERVERARGS)
359
387
 
360
388
# Used by run-server
361
389
confdir/mandos.conf: mandos.conf
362
 
        install --directory confdir
363
 
        install --mode=u=rw,go=r $^ $@
 
390
        install -D --mode=u=rw,go=r $^ $@
364
391
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
365
 
        install --directory confdir
366
 
        install --mode=u=rw $< $@
 
392
        install -D --mode=u=rw $< $@
367
393
# Add a client password
368
394
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
369
395
statedir:
370
396
        install --directory statedir
371
397
 
 
398
.PHONY: install
372
399
install: install-server install-client-nokey
373
400
 
 
401
.PHONY: install-html
374
402
install-html: html
375
 
        install --directory $(htmldir)
376
 
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
403
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
377
404
                $(htmldocs)
378
405
 
 
406
.PHONY: install-server
379
407
install-server: doc
380
 
        install --directory $(CONFDIR)
381
408
        if install --directory --mode=u=rwx --owner=$(USER) \
382
409
                --group=$(GROUP) $(STATEDIR); then \
383
410
                :; \
384
411
        elif install --directory --mode=u=rwx $(STATEDIR); then \
385
412
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
386
413
        fi
387
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
388
 
                        -a -d "$(TMPFILES)" ]; then \
389
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
414
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
415
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
390
416
                        $(TMPFILES)/mandos.conf; \
391
417
        fi
392
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
393
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
418
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
419
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
420
                        $(SYSUSERS)/mandos.conf; \
 
421
        fi
 
422
        install --directory $(BINDIR)
 
423
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
 
424
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
394
425
                mandos-ctl
395
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
426
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
396
427
                mandos-monitor
 
428
        install --directory $(CONFDIR)
397
429
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
398
430
                mandos.conf
399
431
        install --mode=u=rw --target-directory=$(CONFDIR) \
400
432
                clients.conf
401
 
        install --mode=u=rw,go=r dbus-mandos.conf \
402
 
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
403
 
        install --mode=u=rwx,go=rx init.d-mandos \
 
433
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
434
                $(DBUSPOLICYDIR)/mandos.conf
 
435
        install -D --mode=u=rwx,go=rx init.d-mandos \
404
436
                $(DESTDIR)/etc/init.d/mandos
405
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
406
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
437
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
438
                install -D --mode=u=rw,go=r mandos.service \
 
439
                        $(SYSTEMD); \
407
440
        fi
408
 
        install --mode=u=rw,go=r default-mandos \
 
441
        install -D --mode=u=rw,go=r default-mandos \
409
442
                $(DESTDIR)/etc/default/mandos
410
443
        if [ -z $(DESTDIR) ]; then \
411
444
                update-rc.d mandos defaults 25 15;\
412
445
        fi
 
446
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
413
447
        gzip --best --to-stdout mandos.8 \
414
448
                > $(MANDIR)/man8/mandos.8.gz
415
449
        gzip --best --to-stdout mandos-monitor.8 \
423
457
        gzip --best --to-stdout intro.8mandos \
424
458
                > $(MANDIR)/man8/intro.8mandos.gz
425
459
 
 
460
.PHONY: install-client-nokey
426
461
install-client-nokey: all doc
427
 
        install --directory $(LIBDIR)/mandos $(CONFDIR)
428
462
        install --directory --mode=u=rwx $(KEYDIR) \
429
463
                $(LIBDIR)/mandos/plugins.d \
430
464
                $(LIBDIR)/mandos/plugin-helpers
 
465
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
466
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
467
                        $(SYSUSERS)/mandos-client.conf; \
 
468
        fi
431
469
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
432
 
                install --mode=u=rwx \
433
 
                        --directory "$(CONFDIR)/plugins.d" \
 
470
                install --directory \
 
471
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
434
472
                        "$(CONFDIR)/plugin-helpers"; \
435
473
        fi
436
 
        install --mode=u=rwx,go=rx --directory \
 
474
        install --directory --mode=u=rwx,go=rx \
437
475
                "$(CONFDIR)/network-hooks.d"
438
476
        install --mode=u=rwx,go=rx \
439
477
                --target-directory=$(LIBDIR)/mandos plugin-runner
440
478
        install --mode=u=rwx,go=rx \
441
479
                --target-directory=$(LIBDIR)/mandos \
442
480
                mandos-to-cryptroot-unlock
443
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
481
        install --directory $(BINDIR)
 
482
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
444
483
                mandos-keygen
445
484
        install --mode=u=rwx,go=rx \
446
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
463
502
        install --mode=u=rwx,go=rx \
464
503
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
465
504
                plugin-helpers/mandos-client-iprouteadddel
466
 
        install initramfs-tools-hook \
 
505
        install -D initramfs-tools-hook \
467
506
                $(INITRAMFSTOOLS)/hooks/mandos
468
 
        install --mode=u=rw,go=r initramfs-tools-conf \
 
507
        install -D --mode=u=rw,go=r initramfs-tools-conf \
469
508
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
470
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
509
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
471
510
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
472
 
        install initramfs-tools-script \
 
511
        install -D initramfs-tools-script \
473
512
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
474
 
        install initramfs-tools-script-stop \
 
513
        install -D initramfs-tools-script-stop \
475
514
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
476
 
        install --directory $(DRACUTMODULE)
477
 
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
515
        install -D --mode=u=rw,go=r \
 
516
                --target-directory=$(DRACUTMODULE) \
478
517
                dracut-module/ask-password-mandos.path \
479
518
                dracut-module/ask-password-mandos.service
480
519
        install --mode=u=rwxs,go=rx \
483
522
                dracut-module/cmdline-mandos.sh \
484
523
                dracut-module/password-agent
485
524
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
525
        install --directory $(MANDIR)/man8
486
526
        gzip --best --to-stdout mandos-keygen.8 \
487
527
                > $(MANDIR)/man8/mandos-keygen.8.gz
488
528
        gzip --best --to-stdout plugin-runner.8mandos \
502
542
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
503
543
                > $(MANDIR)/man8/password-agent.8mandos.gz
504
544
 
 
545
.PHONY: install-client
505
546
install-client: install-client-nokey
506
547
# Post-installation stuff
507
 
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 
548
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
508
549
        if command -v update-initramfs >/dev/null; then \
509
550
            update-initramfs -k all -u; \
510
551
        elif command -v dracut >/dev/null; then \
517
558
        fi
518
559
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
519
560
 
 
561
.PHONY: uninstall
520
562
uninstall: uninstall-server uninstall-client
521
563
 
 
564
.PHONY: uninstall-server
522
565
uninstall-server:
523
 
        -rm --force $(PREFIX)/sbin/mandos \
524
 
                $(PREFIX)/sbin/mandos-ctl \
525
 
                $(PREFIX)/sbin/mandos-monitor \
 
566
        -rm --force $(BINDIR)/mandos \
 
567
                $(BINDIR)/mandos-ctl \
 
568
                $(BINDIR)/mandos-monitor \
526
569
                $(MANDIR)/man8/mandos.8.gz \
527
570
                $(MANDIR)/man8/mandos-monitor.8.gz \
528
571
                $(MANDIR)/man8/mandos-ctl.8.gz \
531
574
        update-rc.d -f mandos remove
532
575
        -rmdir $(CONFDIR)
533
576
 
 
577
.PHONY: uninstall-client
534
578
uninstall-client:
535
579
# Refuse to uninstall client if /etc/crypttab is explicitly configured
536
580
# to use it.
537
581
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
538
582
                $(DESTDIR)/etc/crypttab
539
 
        -rm --force $(PREFIX)/sbin/mandos-keygen \
 
583
        -rm --force $(BINDIR)/mandos-keygen \
540
584
                $(LIBDIR)/mandos/plugin-runner \
541
585
                $(LIBDIR)/mandos/plugins.d/password-prompt \
542
586
                $(LIBDIR)/mandos/plugins.d/mandos-client \
572
616
            done; \
573
617
        fi
574
618
 
 
619
.PHONY: purge
575
620
purge: purge-server purge-client
576
621
 
 
622
.PHONY: purge-server
577
623
purge-server: uninstall-server
578
624
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
579
625
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
580
626
                $(DESTDIR)/etc/default/mandos \
581
627
                $(DESTDIR)/etc/init.d/mandos \
582
 
                $(SYSTEMD)/mandos.service \
583
628
                $(DESTDIR)/run/mandos.pid \
584
629
                $(DESTDIR)/var/run/mandos.pid
 
630
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
631
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
632
        fi
585
633
        -rmdir $(CONFDIR)
586
634
 
 
635
.PHONY: purge-client
587
636
purge-client: uninstall-client
588
637
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
589
638
        -rm --force $(CONFDIR)/plugin-runner.conf \