/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

Merge new wireless network hook.  Fix bridge network hook to use
hardware addresses instead of interface names.  Implement and document
new "CONNECT" environment variable for network hooks.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
 
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
 
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
 
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
5
 
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
 
2
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
 
3
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
6
4
        -Wunsafe-loop-optimizations -Wpointer-arith \
7
5
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
8
 
        -Wconversion -Wlogical-op -Waggregate-return \
9
 
        -Wstrict-prototypes -Wold-style-definition \
10
 
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
 
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
 
        -Wvolatile-register-var -Woverlength-strings
 
6
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
 
7
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
 
8
#       -Wunreachable-code
13
9
#DEBUG=-ggdb3
14
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
10
# For info about _FORTIFY_SOURCE, see
 
11
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
15
12
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
13
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
17
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
 
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
19
 
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
20
 
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
21
 
        -fsanitize=return -fsanitize=signed-integer-overflow \
22
 
        -fsanitize=bounds -fsanitize=alignment \
23
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
24
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
 
        -fsanitize=enum
27
 
# Check which sanitizing options can be used
28
 
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
 
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
 
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
31
14
LINK_FORTIFY_LD=-z relro -z now
32
15
LINK_FORTIFY=
33
16
 
37
20
LINK_FORTIFY += -pie
38
21
endif
39
22
#COVERAGE=--coverage
40
 
OPTIMIZE=-Os -fno-strict-aliasing
41
 
LANGUAGE=-std=gnu11
 
23
OPTIMIZE=-Os
 
24
LANGUAGE=-std=gnu99
42
25
htmldir=man
43
 
version=1.7.6
 
26
version=1.4.1
44
27
SED=sed
45
28
 
46
29
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
30
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
48
31
 
49
32
## Use these settings for a traditional /usr/local install
50
33
# PREFIX=$(DESTDIR)/usr/local
53
36
# MANDIR=$(PREFIX)/man
54
37
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
55
38
# STATEDIR=$(DESTDIR)/var/lib/mandos
56
 
# LIBDIR=$(PREFIX)/lib
57
39
##
58
40
 
59
41
## These settings are for a package-type install
63
45
MANDIR=$(PREFIX)/share/man
64
46
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
65
47
STATEDIR=$(DESTDIR)/var/lib/mandos
66
 
LIBDIR=$(shell \
67
 
        for d in \
68
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
69
 
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
70
 
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
71
 
                        echo "$(DESTDIR)$$d"; \
72
 
                        break; \
73
 
                fi; \
74
 
        done)
75
48
##
76
49
 
77
 
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
78
 
 
79
50
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
80
51
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
81
52
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
83
54
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
84
55
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
85
56
        getconf LFS_LDFLAGS)
86
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
87
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
88
57
 
89
58
# Do not change these two
90
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
91
 
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
92
 
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
93
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
59
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
60
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 
61
        -DVERSION='"$(version)"'
 
62
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
94
63
 
95
64
# Commands to format a DocBook <refentry> document into a manual page
96
65
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
99
68
        --param make.single.year.ranges         1 \
100
69
        --param man.output.quietly              1 \
101
70
        --param man.authors.section.enabled     0 \
102
 
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
71
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
103
72
        $(notdir $<); \
104
 
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
105
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
106
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
107
 
        fi >/dev/null)
 
73
        $(MANPOST) $(notdir $@);\
 
74
        LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
 
75
        --local-file $(notdir $@) >/dev/null)
 
76
# DocBook-to-man post-processing to fix a '\n' escape bug
 
77
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
108
78
 
109
79
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
110
80
        --param make.year.ranges                1 \
122
92
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
123
93
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
124
94
        plugins.d/plymouth
125
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
126
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
95
CPROGS=plugin-runner $(PLUGINS)
127
96
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
128
97
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
129
98
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
256
225
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
257
226
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
258
227
 
259
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
260
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
261
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
262
 
 
263
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
264
 
        check run-client run-server install install-html \
265
 
        install-server install-client-nokey install-client uninstall \
266
 
        uninstall-server uninstall-client purge purge-server \
267
 
        purge-client
 
228
.PHONY : all doc html clean distclean run-client run-server install \
 
229
        install-server install-client uninstall uninstall-server \
 
230
        uninstall-client purge purge-server purge-client
268
231
 
269
232
clean:
270
233
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
276
239
 
277
240
check:  all
278
241
        ./mandos --check
279
 
        ./mandos-ctl --check
280
242
 
281
243
# Run the client with a local config and key
282
244
run-client: all keydir/seckey.txt keydir/pubkey.txt
285
247
        @echo "# ignored.  The messages are caused by not running as root, but   #"
286
248
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
287
249
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
288
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
289
 
        @echo "#                     setuid: Operation not permitted             #"
 
250
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
290
251
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
291
 
        @echo "# From mandos-client:                                             #"
292
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
293
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
252
        @echo "# From mandos-client: setuid: Operation not permitted             #"
 
253
        @echo "#                     seteuid: Operation not permitted            #"
 
254
        @echo "#                     klogctl: Operation not permitted            #"
294
255
        @echo "###################################################################"
295
 
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
296
256
        ./plugin-runner --plugin-dir=plugins.d \
297
 
                --plugin-helper-dir=plugin-helpers \
298
257
                --config-file=plugin-runner.conf \
299
258
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
300
 
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
301
259
                $(CLIENTARGS)
302
260
 
303
261
# Used by run-client
306
264
        ./mandos-keygen --dir keydir --force
307
265
 
308
266
# Run the server with a local config
309
 
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
267
run-server: confdir/mandos.conf confdir/clients.conf
310
268
        ./mandos --debug --no-dbus --configdir=confdir \
311
269
                --statedir=statedir $(SERVERARGS)
312
270
 
318
276
        install --directory confdir
319
277
        install --mode=u=rw $< $@
320
278
# Add a client password
321
 
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
279
        ./mandos-keygen --dir keydir --password >> $@
322
280
statedir:
323
281
        install --directory statedir
324
282
 
331
289
 
332
290
install-server: doc
333
291
        install --directory $(CONFDIR)
334
 
        if install --directory --mode=u=rwx --owner=$(USER) \
335
 
                --group=$(GROUP) $(STATEDIR); then \
336
 
                :; \
337
 
        elif install --directory --mode=u=rwx $(STATEDIR); then \
338
 
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
339
 
        fi
 
292
        install --directory --mode=u=rwx --owner=$(USER) \
 
293
                --group=$(GROUP) $(STATEDIR)
340
294
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
341
295
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
342
296
                mandos-ctl
350
304
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
351
305
        install --mode=u=rwx,go=rx init.d-mandos \
352
306
                $(DESTDIR)/etc/init.d/mandos
353
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
354
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
355
 
        fi
356
307
        install --mode=u=rw,go=r default-mandos \
357
308
                $(DESTDIR)/etc/default/mandos
358
309
        if [ -z $(DESTDIR) ]; then \
368
319
                > $(MANDIR)/man5/mandos.conf.5.gz
369
320
        gzip --best --to-stdout mandos-clients.conf.5 \
370
321
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
371
 
        gzip --best --to-stdout intro.8mandos \
372
 
                > $(MANDIR)/man8/intro.8mandos.gz
373
322
 
374
323
install-client-nokey: all doc
375
 
        install --directory $(LIBDIR)/mandos $(CONFDIR)
 
324
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
376
325
        install --directory --mode=u=rwx $(KEYDIR) \
377
 
                $(LIBDIR)/mandos/plugins.d \
378
 
                $(LIBDIR)/mandos/plugin-helpers
379
 
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
326
                $(PREFIX)/lib/mandos/plugins.d
 
327
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
380
328
                install --mode=u=rwx \
381
329
                        --directory "$(CONFDIR)/plugins.d"; \
382
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
383
330
        fi
384
331
        install --mode=u=rwx,go=rx --directory \
385
332
                "$(CONFDIR)/network-hooks.d"
386
333
        install --mode=u=rwx,go=rx \
387
 
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
334
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
388
335
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
389
336
                mandos-keygen
390
337
        install --mode=u=rwx,go=rx \
391
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
338
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
392
339
                plugins.d/password-prompt
393
340
        install --mode=u=rwxs,go=rx \
394
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
341
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
395
342
                plugins.d/mandos-client
396
343
        install --mode=u=rwxs,go=rx \
397
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
344
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
398
345
                plugins.d/usplash
399
346
        install --mode=u=rwxs,go=rx \
400
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
347
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
401
348
                plugins.d/splashy
402
349
        install --mode=u=rwxs,go=rx \
403
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
350
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
404
351
                plugins.d/askpass-fifo
405
352
        install --mode=u=rwxs,go=rx \
406
 
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
353
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
407
354
                plugins.d/plymouth
408
 
        install --mode=u=rwxs,go=rx \
409
 
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
410
 
                plugin-helpers/mandos-client-iprouteadddel
411
355
        install initramfs-tools-hook \
412
356
                $(INITRAMFSTOOLS)/hooks/mandos
413
357
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
458
402
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
459
403
                $(DESTDIR)/etc/crypttab
460
404
        -rm --force $(PREFIX)/sbin/mandos-keygen \
461
 
                $(LIBDIR)/mandos/plugin-runner \
462
 
                $(LIBDIR)/mandos/plugins.d/password-prompt \
463
 
                $(LIBDIR)/mandos/plugins.d/mandos-client \
464
 
                $(LIBDIR)/mandos/plugins.d/usplash \
465
 
                $(LIBDIR)/mandos/plugins.d/splashy \
466
 
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
467
 
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
405
                $(PREFIX)/lib/mandos/plugin-runner \
 
406
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
 
407
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
 
408
                $(PREFIX)/lib/mandos/plugins.d/usplash \
 
409
                $(PREFIX)/lib/mandos/plugins.d/splashy \
 
410
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
 
411
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
468
412
                $(INITRAMFSTOOLS)/hooks/mandos \
469
413
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
470
414
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
476
420
                $(MANDIR)/man8/splashy.8mandos.gz \
477
421
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
478
422
                $(MANDIR)/man8/plymouth.8mandos.gz \
479
 
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
480
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
423
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
 
424
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
481
425
        update-initramfs -k all -u
482
426
 
483
427
purge: purge-server purge-client
487
431
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
488
432
                $(DESTDIR)/etc/default/mandos \
489
433
                $(DESTDIR)/etc/init.d/mandos \
490
 
                $(SYSTEMD)/mandos.service \
491
 
                $(DESTDIR)/run/mandos.pid \
492
434
                $(DESTDIR)/var/run/mandos.pid
493
435
        -rmdir $(CONFDIR)
494
436