/mandos/trunk : changes

» Changes from revision 1305

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1144 to 1125

expand all

Rev	Summary	Authors	Date
1144	dracut-module/password-agent.c: Update #include comments dracut-module/password-agent.c: Update #include comments * dracut-module/password-agent.c: Update #include comments to add "ENOTDIR", "O_NOFOLLOW", "IN_MOVED_FROM", "IN_EXCL_UNLINK", and "IN_ONLYDIR".	Teddy Hogeborn	5 years ago
1143	dracut-module/password-agent.c: Use O_NOCTTY dracut-module/password-agent.c: Use O_NOCTTY Whenever a file is opened using open(), use the O_NOCTTY flag, just to be safe. * dracut-module/password-agent.c (test_start_mandos_client_execv): Use O_NOCTTY. (test_wait_for_mandos_client_exit_failure): - '' - (test_wait_for_mandos_client_exit_killed): - '' - (test_read_mandos_client_output_readerror): - '' - (test_read_inotify_event_readerror): - '' - (test_connect_question_socket_bad_epoll): - '' - (test_send_password_to_socket_bad_epoll): - '' - (assert_add_existing_questions_to_devnull): - '' -	Teddy Hogeborn	5 years ago
1142	dracut-module/password-agent.c: Require agent directory dracut-module/password-agent.c: Require agent directory Require the --agent-directory (by default "/run/systemd/ask-password") to be an actual directory; fail otherwise. * dracut-module/password-agent.c (main): Make ENOTDIR from add_inotify_dir_watch() result in EX_OSFILE. (add_inotify_dir_watch): Add "IN_ONLYDIR" flag to inotify_add_watch(). (test_add_inotify_dir_watch_nondir): New test. (run_tests): Add new test.	Teddy Hogeborn	5 years ago
1141	dracut-module/password-agent.c: Bug fix: Ignore deleted file... dracut-module/password-agent.c: Bug fix: Ignore deleted files If a question file ("ask.") is opened, deleted, and then closed, we still get an IN_CLOSE_WRITE ievent after the IN_DELETE ievent. We should pass the IN_EXCL_UNLINK flag to inotify_add_watch() to avoid this. dracut-module/password-agent.c (add_inotify_dir_watch): Add "IN_EXCL_UNLINK" flag to inotify_add_watch(). (test_add_inotify_dir_watch_IN_EXCL_UNLINK): New test. (run_tests): Add new test.	Teddy Hogeborn	5 years ago
1140	dracut-module/password-agent.c: Bug fix: Handle IN_MOVED_FRO... dracut-module/password-agent.c: Bug fix: Handle IN_MOVED_FROM If a question file ("ask.") is moved away from the question directory or is renamed in it, treat this the same as IN_DELETE. If it was a simple rename within the question directory from, say, "ask.foo" to "ask.bar", the separate IN_MOVED_TO ievent will get the "ask.bar" name and add it, so we don't need to consider this as a special case. dracut-module/password-agent.c (add_inotify_dir_watch): Add "IN_MOVED_FROM" to flags. (read_inotify_event): Treat IN_MOVED_FROM the same as IN_DELETE. (test_add_inotify_dir_watch_IN_MOVED_FROM): New test. (test_read_inotify_event_IN_MOVED_FROM): - '' - (test_read_inotify_event_IN_MOVED_FROM_badname): - '' - (run_tests): Add new tests.	Teddy Hogeborn	5 years ago
1139	Update Python 3 compatibility Update Python 3 compatibility When running the server on Python 3, get rid of a few deprecation warnings. * mandos (main): Use only "configparser.Configparser", and only fall back to configparser.SafeConfigParser on Python versions lower than 3.2. Also, only call GLib.threads_init() when using a PyGObject version lower than 3.10.2.	Teddy Hogeborn	5 years ago
1138	Fix bug in server Debian package: Fails to start on first in... Fix bug in server Debian package: Fails to start on first install There has been a very long-standing bug where installation of the server (the "mandos" Debian package) would fail to start the server properly right after installation. It would work on manual (re)start after installation, or after reboot, and even after package purge and reinstall, it would then work the first time. The problem, it turns out, is when the new "_mandos" user (and corresponding group) is created, the D-Bus server is not reloaded, and is therefore not aware of that user, and does not recognize the user and group name in the /etc/dbus-1/system.d/mandos.conf file. The Mandos server, when it tries to start and access the D-Bus, is then not permitted to connect to its D-Bus bus name, and disables D-Bus use as a fallback measure; i.e. the server works, but it is not controllable via D-Bus commands (via mandos-ctl or mandos-monitor). The next time the D-Bus daemon is reloaded for any reason, the new user & group would become visible to the D-Bus daemon and after that, any restart of the Mandos server would succeed and it would bind to its D-Bus name properly, and thereby be visible and controllable by mandos-ctl & mandos-monitor. This was mostly invisible when using sysvinit, but systemd makes the problem visible since the systemd service file for the Mandos server is configured to not consider the Mandos server "started" until the D-Bus name has been bound; this makes the starting of the service wait for 90 seconds and then fail with a timeout error. Fixing this should also make the Debian CI autopkgtest tests work. * debian/mandos.postinst (configure): After creating (or renaming) user & group, reload D-Bus daemon (if present).	Teddy Hogeborn	5 years ago
1137	Makefile: "pkg-config" is now overrideable by PKG_CONFIG Makefile: "pkg-config" is now overrideable by PKG_CONFIG * Makefile (PKG_CONFIG): New. (SYSTEMD, TMPFILES): Use $(PKG_CONFIG) instead of "pkg-config". (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS): - '' - (LIBNL3_CFLAGS, LIBNL3_LIBS, GLIB_CFLAGS, GLIB_LIBS): - '' - Closes: 933701 Reported-by: Helmut Grohne <helmut@subdivi.de> Suggested-by: Helmut Grohne <helmut@subdivi.de> Thanks: Helmut Grohne <helmut@subdivi.de> for bug report and patch	Teddy Hogeborn	5 years ago
1136	Break some long lines and refine documentation Break some long lines and refine documentation * Makefile (LINUXVERSION): New. (LIBDIR): Break long line. (SYSTEMD, TMPFILES): Change ":=" to "=" to not run unless required. (run-client): Break long lines, and add two more harmless warnings to informational message. (install-server): Break long line. (install-client-nokey): - '' - (install-client): Shorten long line by using $(LINUXVERSION). (uninstall-client): - '' -	Teddy Hogeborn	5 years ago
1135	password-agent: Fix memory alignment issue password-agent: Fix memory alignment issue On many architectures (armel, armhf, mips, mips64el, mipsel, hppa, ia64, sh4, and sparc64) GCC shows a warning when casting a "char " to a "struct inotify_event "; The exact warning message from GCC is "cast increases required alignment of target type [-Wcast-align]". * dracut-module/password-agent.c (read_inotify_event): Change "ievent_buffer" to an anonymous struct instead of a char array. (test_read_inotify_event_IN_CLOSE_WRITE): - '' - (test_read_inotify_event_IN_MOVED_TO): - '' - (test_read_inotify_event_IN_DELETE): - '' - (test_read_inotify_event_IN_CLOSE_WRITE_badname): - '' - (test_read_inotify_event_IN_MOVED_TO_badname): - '' - (test_read_inotify_event_IN_DELETE_badname): - '' -	Teddy Hogeborn	5 years ago
1134	Merge from release branch Merge from release branch	Teddy Hogeborn	5 years ago
1133	Update Debian package standard-version to "4.4.0" Update Debian package standard-version to "4.4.0" * debian/control (Standards-Version): Update to "4.4.0".	Teddy Hogeborn	5 years ago
1132	Server: Reap zombies created by multiprocessing.Process() Server: Reap zombies created by multiprocessing.Process() When creating checkers as multiprocessing.Process() objects, the multiprocessing module also creates a parent process (for the call_pipe() function) to call the actual checker process, but this parent process is not reaped. This is not a huge problem, since the zombie is always reaped automatically the next time the multiprocess starts a new process, but the zombies can be up to as many as there have ever been simultaneous checker processes. To fix this, the process object must be join():ed when they report completion of the child checker process. * mandos (Client): Fix doc string to correctly state that Client.checker is a multiprocess.Process() and not a subprocess.Popen() object. (Client.checker_callback): After the returncode of the checker process has been read, wait for the self.checker Process object to finish by calling join() on it. Reported-by: Peter Palfrader <weasel@debian.org>	Teddy Hogeborn	5 years ago
1131	Make tests and man page examples match Make tests and man page examples match Make the tests test_manual_page_example[1-5] match exactly what is written in the manual page, and add comments to manual page as reminders to keep tests and manual page examples in sync. * mandos-ctl (Test_commands_from_options.test_manual_page_example_1): Remove "--verbose" option, since the manual does not have it as the first example, and change assertion to match. * mandos-ctl.xml (EXAMPLE): Add comments to all examples documenting which test function they correspond to. Also remove unnecessary quotes from option arguments in fourth example, and clarify language slightly in fifth example.	Teddy Hogeborn	5 years ago
1130	Update Python 3 compatibility Update Python 3 compatibility * mandos (gnutls.ClientSession.__init__): Use byte string argument to check_version() instead of a unicode string. (gnutls): - '' - (ClientHandler.handle): Change default values for "fpr" and "key_id" to be byte strings instead of unicode strings. (main): Use "key in dict" instead of "dict.has_key(key)". * mandos-ctl: Fix Emacs test runner to use "--check" instead of "--test". (rfc3339_duration_to_delta): Change doctest string to not depend on exact repr() string representation of values and instead do value comparisons. (parse_pre_1_6_1_interval): - '' -	Teddy Hogeborn	5 years ago
1129	Debian package: Override the last lintian warning Debian package: Override the last lintian warning * debian/source/lintian-overrides: New.	Teddy Hogeborn	5 years ago
1128	Add debconf translation support Add debconf translation support * debian/mandos-client.templates: Reformatted by debconf-gettextize(1). * debian/mandos.templates: - '' - * debian/po/POTFILES.in: New. * debian/po/templates.pot: - '' -	Teddy Hogeborn	5 years ago
1127	Add dracut(8) support Add dracut(8) support Add support for the dracut(8) system for generating initramfs image files; dracut is an alternative to the "initramfs-tools" package. * .bzrignore (dracut-module/password-agent): Ignore new binary file. * dracut-module: New directory for the dracut module. * INSTALL (Prerequisites/Libraries/Mandos Client): Add dracut as an alternative to initramfs-tools, and also add GLib. * Makefile (DRACUTMODULE, GLIB_CFLAGS, GLIB_LIBS): New. (CPROGS): Add "dracut-module/password-agent". (DOCS): Add "dracut-module/password-agent.8mandos". (dracut-module/password-agent.8mandos): New. (dracut-module/password-agent.8mandos.xhtml): - '' - (dracut-module/password-agent): - '' - (check): Add command to run tests of password-agent(8mandos). (install-client-nokey): Also install the dracut module directory, its files, and the password-agent(8mandos) manual page. (install-client): To update the initramfs image file, run update-initramfs or dracut depending on what is installed. (uninstall-client): - '' - and also uninstall the the files in the dracut module directory, that directory itself, and the password-agent(8mandos) manual page. * debian/control (Build-Depends): Add "libglib2.0-dev (>=2.40)". (Package: mandos-client/Depends): Add "dracut (>= 044+241-3)" as an alternative dependency to initramfs-tools. (Package: mandos-client/Conflicts): New; set to "dracut-config-generic". (debian/mandos-client.README.Debian): Document alternative commands to update the initramfs image for when dracut is used. * debian/mandos-client.postinst (update_initramfs): Use alternative commands to update the initramfs image for when dracut is used. * debian/tests/control (password-agent, password-agent-suid): Add two new tests. * dracut-module/ask-password-mandos.path: New. * dracut-module/ask-password-mandos.service: - '' - * dracut-module/cmdline-mandos.sh: - '' - * dracut-module/module-setup.sh: - '' - * dracut-module/password-agent.c: - '' - * dracut-module/password-agent.xml: - '' - * initramfs-unpack: Use the dracut "skipcpio" command, if available. Also be more flexible and try hard to detect where compressed data starts. * plugins.d/mandos-client.xml (SECURITY): Be more precise that the mandos-client binary might not always be setuid, but that the program assumes that it has been started that way. * plugins.d/password-prompt.c: Add new "--prompt" option. (conflict_detection): First try to detect the new PID file of plymouth. (main): Define and use new "prompt" variable. * plugins.d/password-prompt.xml (SYNOPSIS): Show new --prompt option. (DESCRIPTION): Describe new behavior of looking for plymouth PID file. (OPTIONS): Document new "--prompt" option. (ENVIRONMENT): Clarify that the CRYPTTAB_SOURCE and CRYPTTAB_NAME environment variables are not used if the --prompt option is used. Remove unnecessarily specific details about where the CRYPTTAB_SOURCE and CRYPTTAB_NAME comes from, since this can now be either initramfs-tools or dracut. (SEE ALSO): Remove superfluous crypttab(5) reference, and add commas to separate the other references. * plugins.d/plymouth.c: Add new "--prompt" and "--debug" options. (debug): New global flag. (fprintf_plus): New function, used for debug output. (exec_and_wait): Add extra "const" to "argv" argument. (main): Define and use new "prompt" variable. Add debug output. (main/options, main/parse_opt): New; used to parse options. * plugins.d/plymouth.xml (SYNOPSIS): Show new options. (OPTIONS): Document new options. (ENVIRONMENT): Clarify that the cryptsource and crypttarget environment variables are not used if the --prompt option is used. Remove unnecessarily specific details about where the cryptsource and crypttarget comes from, since this can now be either initramfs-tools or dracut. (EXAMPLE): Add an example using an option. (SEE ALSO): Remove superfluous crypttab(5) reference. * plugins.d/splashy.xml (ENVIRONMENT): Clarify that the cryptsource and crypttarget environment variables are not used if the --prompt option is used. Remove unnecessarily specific details about where the cryptsource and crypttarget comes from, since this can now be either initramfs-tools or dracut. (SEE ALSO): Remove superfluous crypttab(5) reference. * plugins.d/usplash.xml (ENVIRONMENT): Clarify that the cryptsource and crypttarget environment variables are not used if the --prompt option is used. Remove unnecessarily specific details about where the cryptsource and crypttarget comes from, since this can now be either initramfs-tools or dracut. (SEE ALSO): Remove superfluous crypttab(5) reference.	Teddy Hogeborn	5 years ago
1126	Remove unused lintian override for Debian package Remove unused lintian override for Debian package * debian/mandos.lintian-overrides (init.d-script-needs-depends-on-lsb-base): Remove.	Teddy Hogeborn	5 years ago
1125	Remove unnecessary "Testsuite: autopkgtest" from debian/cont... Remove unnecessary "Testsuite: autopkgtest" from debian/control * debian/control (Testsuite): Remove.	Teddy Hogeborn	5 years ago