/mandos/trunk : changes

» Changes from revision 845

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 845 to 826

expand all

Rev	Summary	Authors	Date
845	Client: Install intro(8mandos) manual page Client: Install intro(8mandos) manual page When installing client, include the intro(8mandos) manual page so that it is available even if the server is not installed. * Makefile (install-client-nokey): Also install intro.8mandos.	Teddy Hogeborn	9 years ago
844	Use HTTPS in home page links Use HTTPS in home page links Since we have a real certificate now, change all links to the home page to use HTTPS. * README: Use HTTPS in home page links * debian/control (Source: mandos/Homepage): - '' - * debian/copyright (Source): - '' - * intro.xml (SEE ALSO): - '' - * mandos.lsm (Primary-site): - '' -	Teddy Hogeborn	9 years ago
843	Merge from release branch Merge from release branch	Teddy Hogeborn	9 years ago
842	Server: Do not set execute bit on tmpfiles.d/mandos.conf Server: Do not set execute bit on tmpfiles.d/mandos.conf * Makefile (install-server): Install tmpfiles.d/mandos.conf with "u=rw,go=r" instead of "u=rwx,go=r".	Teddy Hogeborn	9 years ago
841	Server: Debian package bug fix: Include /usr/lib/tmpfiles.d ... Server: Debian package bug fix: Include /usr/lib/tmpfiles.d dir The Debian package for the server needs the /usr/lib/tmpfiles.d directory in its .dirs file in order for the directory to exist when the Makefile "install-server" rule is run, otherwise the tmpfiles.d-mandos.conf file will not be installed. * debian/mandos.dirs (usr/lib/tmpfiles.d): Added.	Teddy Hogeborn	9 years ago
840	Client: Make plugin helper directory in initramfs image mode... Client: Make plugin helper directory in initramfs image mode u=rwx,go= Make the plugin helper directory was secure in the initramfs image just as it is in the normal file system. * initramfs-tools-hook: Install plugin-helper directory into initramfs image as mode u=rwx.	Teddy Hogeborn	9 years ago
839	Client: Make plugin helper override directory mode u=rwx,go= Client: Make plugin helper override directory mode u=rwx,go= Even though it currently is not used, a local administrator might use setuid (or setcap) executables as plugin helpers. Thus, the plugin helper override directory (/etc/mandos/plugin-helpers) must be secured, just as the plugin override directory (/etc/mandos/plugins.d) is. * Makefile (install-client-nokey): Install plugin-helper directory as mode u=rwx. * debian/mandos-client.lintian-overrides: Do not warn about permissions on plugin helper directory. * debian/mandos-client.postinst (configure): Fix permissions on plugin helper local override directory (/etc/mandos/plugin-helpers), but only if not listed by "dpkg-statoverride".	Teddy Hogeborn	9 years ago
838	Server: New tmpfiles.d file for persistent state directory Server: New tmpfiles.d file for persistent state directory Provide a tmpfiles.d(5) file for systemd to create persistent state directory on so-called "volatile" systems. * Makefile (TMPFILES): New. (install-server): Also install "tmpfiles.d-mandos.conf" file as "/usr/lib/tmpfiles.d/mandos.conf". * tmpfiles.d-mandos.conf: New.	Teddy Hogeborn	9 years ago
837	Server: Make persistent state directory mode u=rwx,go= Server: Make persistent state directory mode u=rwx,go= The Makefile target "install-server" creates the server persistent state directory /var/lib/mandos as mode u=rwx,go= (0700). Make this also the case for the Debian package (unless overridden by dpkg-statoverride). * debian/mandos.postinst (configure): Fix state directory permissions, but only if not listed by "dpkg-statoverride".	Teddy Hogeborn	9 years ago
836	Client: Fix permissions on plugin helper directory. Client: Fix permissions on plugin helper directory. The Makefile target "install-client-nokey" creates the plugin-helper directory /usr/lib/<ARCH>/mandos/plugin-helpers as mode u=rwx,go= (0700). Make this also the case for the Debian package. Also change the Makefile so it does not install the plugin helper "mandos-client-iprouteadddel" as setuid root; this is unnecessary and was, due to dh_fixperms, never propagated to the Debian package anyway. * Makefile (install-client-nokey): Do not set setuid bit on "plugin-helpers/mandos-client-iprouteadddel". * debian/mandos-client.postinst (configure): If older version, fix permissions on plugin helper directory. * debian/rules (override_dh_fixperms-arch): Exclude plugin helper directory from dh_fixperms.	Teddy Hogeborn	9 years ago
835	Client: Document default directories more clearly Client: Document default directories more clearly Document default plugin directory and default plugin helper directory also in the FILES section of the manual. * plugin-runner.xml (FILES): Add "/lib/mandos/plugins.d" and "/lib/mandos/plugin-helpers".	Teddy Hogeborn	9 years ago
834	Client: Remove dead code in plugin-runner Client: Remove dead code in plugin-runner WCOREDUMP is always a subset of WTERMSIG; ignore WCOREDUMP. * plugin-runner.c (main): Remove WCOREDUMP clause.	Teddy Hogeborn	9 years ago
833	Client: Fix plymouth agent; broken since 1.7.2. Client: Fix plymouth agent; broken since 1.7.2. Fix an very old memory bug in the plymouth agent (which has been present since its apperance in version 1.2), but which was only recently detected at run time due to the new -fsanitize=address compile- time flag, which has been used since version 1.7.2. This detection of a memory access violation causes the program to abort, making the Plymouth graphical boot system unable to accept interactive input of passwords when using the Mandos client. * plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when allocating new_argv. Also tolerate a zero-length argv.	Teddy Hogeborn	9 years ago
832	Merge from release branch Merge from release branch	Teddy Hogeborn	9 years ago
831	Server: Fix bug where it did not exit timely on signals Server: Fix bug where it did not exit timely on signals Use GLib.unix_signal_add() instead of signal.signal() to catch signals; this will allow GLib to do its internal magic with signal file descriptors. (GLib does not handle signals properly otherwise.) The function unix_signal_add() requires GLib 2.30 or later, which was not required by PyGobject until version 3.7.1, so depend on this. * INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1 * mandos (main): Use GLib.unix_signal_add instead of signal.signal. * init.d-mandos (do_stop): Remove workaround. * mandos.service ([Service]): - '' -	Teddy Hogeborn	9 years ago
830	Server: Use python-gi instead of old python-gobject Server: Use python-gi instead of old python-gobject The python-gobject module is old, deprecated, and replaced with the python-gi (GObject Introspection) module; use that instead. * debian/control (Source: mandos/Build-Depends-Indep): Change "python-gi \| python-gobject" to "python-gi". * mandos: Import "GLib" instead of "GObject"; change all users. * mandos-monitor: - '' -	Teddy Hogeborn	9 years ago
829	Server: Fix minor thing with Python 3 compatibility Server: Fix minor thing with Python 3 compatibility Fix another small thing with unpickling string values. * mandos (main): When restoring pickled client data, only decode byte string for "host" key if it really is a byte string.	Teddy Hogeborn	9 years ago
828	Server: Add Python 3 compatibility Server: Add Python 3 compatibility Add Python 3 compatibility by not using the python-avahi module. Also fix miscellaneous things which differs in Python 3. Especially hard to fix is loading and saving clients data between Python 3 and 2, since pickle formats have problems with strings. * INSTALL: Remove python-avahi (and change python-gobject to python-gi, which is preferred now). * debian/control (Source: mandos/Build-Depends-Indep): Remove "python-avahi". * mandos: Wrap future_builtins import in try-except clause. Do not import avahi module. Use codecs.decode(..., "base64) instead of .decode("base64). Use .keys(), .values(), and .items() instead of .iterkeys(), .itervalues(), and .iteritems(). (alternate_dbus_interfaces/wrapper): Python 3 still requires the "black magic", but luckily it still works. The Python 3 type() constructor requires first argument to be a string, not a byte string. (copy_function): New. Use throughout. (Avahi, avahi): New class and global variable. (GnuTLS._need_version): Changed to be a byte string. (main): Decode byte strings loaded from pickle file. (main/cleanup): Dump using pickle prototoc 2 which Python 2 can read.	Teddy Hogeborn	9 years ago
827	Merge from release branch Merge from release branch	Teddy Hogeborn	9 years ago
826	Server bug fix: Work around bug when stopping server Server bug fix: Work around bug when stopping server * init.d-mandos (do_stop): Work around SIGTERM ignoring bug by doing "mandos-ctl >/dev/null 2>&1" after sending signal. * mandos.service (ExecStop): New; set to "/bin/kill -TERM $MAINPID ; /usr/sbin/mandos-ctl >/dev/null 2>&1" to work around SIGTERM ignoring bug.	Teddy Hogeborn	9 years ago

Older »