/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-07-14 22:39:15 UTC
  • Revision ID: teddy@recompile.se-20190714223915-aqjkms3t3taa6tye
Only use sanitizing options when debugging

The C compiler's sanitizing options introduce code in the output
binary which is fragile and not very security conscious.  It has
become clear that sanitizing is only really meant for use while
debugging.

As a side effect, this makes compilation faster, as the Makefile, for
production builds, no longer runs the compiler repeatedly to find all
its currently supported sanitizing options.

* Makefile (DEBUG): Add "$(SANITIZE)".
  (SANITIZE): Comment out.
  (CFLAGS): Remove "$(SANITIZE)".
  (plugins.d/mandos-client): Revert back to use plain $(LINK.c), since
                             we no longer need to remove the leak
                             sanitizer by overriding CFLAGS.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Wunreachable-code -Winline \
8
 
        -Wvolatile-register-var
9
 
DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
13
41
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
16
 
# PREFIX=/usr/local
17
 
PREFIX=$(DESTDIR)/usr
18
 
# CONFDIR=/usr/local/lib/mandos
19
 
CONFDIR=$(DESTDIR)/etc/mandos
20
 
# MANDIR=/usr/local/man
21
 
MANDIR=$(DESTDIR)/usr/share/man
22
 
 
23
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
24
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
25
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
26
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
27
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
28
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.4
 
46
SED:=sed
 
47
 
 
48
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
49
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
50
 
 
51
## Use these settings for a traditional /usr/local install
 
52
# PREFIX:=$(DESTDIR)/usr/local
 
53
# CONFDIR:=$(DESTDIR)/etc/mandos
 
54
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
55
# MANDIR:=$(PREFIX)/man
 
56
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
57
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
58
# LIBDIR:=$(PREFIX)/lib
 
59
##
 
60
 
 
61
## These settings are for a package-type install
 
62
PREFIX:=$(DESTDIR)/usr
 
63
CONFDIR:=$(DESTDIR)/etc/mandos
 
64
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
65
MANDIR:=$(PREFIX)/share/man
 
66
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
67
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
68
LIBDIR:=$(shell \
 
69
        for d in \
 
70
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
71
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
72
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
73
                        echo "$(DESTDIR)$$d"; \
 
74
                        break; \
 
75
                fi; \
 
76
        done)
 
77
##
 
78
 
 
79
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
80
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
81
 
 
82
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
83
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
84
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
85
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
86
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
87
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
88
        getconf LFS_LDFLAGS)
 
89
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
90
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
29
91
 
30
92
# Do not change these two
31
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
32
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
33
 
LDFLAGS=$(COVERAGE)
 
93
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
94
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
95
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
34
96
 
35
 
# Commands to format a DocBook refentry document into a manual page
36
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
97
# Commands to format a DocBook <refentry> document into a manual page
 
98
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
37
99
        --param man.charmap.use.subset          0 \
38
100
        --param make.year.ranges                1 \
39
101
        --param make.single.year.ranges         1 \
40
102
        --param man.output.quietly              1 \
41
103
        --param man.authors.section.enabled     0 \
42
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
104
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
43
105
        $(notdir $<); \
44
 
        $(MANPOST) $(notdir $@)
45
 
# DocBook-to-man post-processing to fix a \n escape bug
46
 
MANPOST=sed --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
47
 
 
48
 
PLUGINS=plugins.d/password-prompt plugins.d/password-request
49
 
PROGS=plugin-runner $(PLUGINS)
50
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
51
 
        plugins.d/password-request.8mandos \
52
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
53
 
        mandos-clients.conf.5
54
 
 
55
 
objects=$(addsuffix .o,$(PROGS))
56
 
 
57
 
all: $(PROGS)
 
106
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
107
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
108
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
109
        fi >/dev/null)
 
110
 
 
111
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
112
        --param make.year.ranges                1 \
 
113
        --param make.single.year.ranges         1 \
 
114
        --param man.output.quietly              1 \
 
115
        --param man.authors.section.enabled     0 \
 
116
        --param citerefentry.link               1 \
 
117
        --output $@ \
 
118
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
119
        $<; $(HTMLPOST) $@)
 
120
# Fix citerefentry links
 
121
HTMLPOST:=$(SED) --in-place \
 
122
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
123
 
 
124
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
125
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
126
        plugins.d/plymouth
 
127
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
128
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
129
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
130
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
131
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
132
        plugins.d/mandos-client.8mandos \
 
133
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
134
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
135
        plugins.d/plymouth.8mandos intro.8mandos
 
136
 
 
137
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
138
 
 
139
objects:=$(addsuffix .o,$(CPROGS))
 
140
 
 
141
all: $(PROGS) mandos.lsm
58
142
 
59
143
doc: $(DOCS)
60
144
 
61
 
%.5: %.xml legalnotice.xml
62
 
        $(DOCBOOKTOMAN)
63
 
 
64
 
%.8: %.xml legalnotice.xml
65
 
        $(DOCBOOKTOMAN)
66
 
 
67
 
%.8mandos: %.xml legalnotice.xml
68
 
        $(DOCBOOKTOMAN)
69
 
 
70
 
mandos.8: mandos.xml mandos-options.xml overview.xml legalnotice.xml
71
 
        $(DOCBOOKTOMAN)
72
 
 
73
 
mandos-keygen.8: mandos-keygen.xml overview.xml legalnotice.xml
74
 
        $(DOCBOOKTOMAN)
75
 
 
76
 
mandos.conf.5: mandos.conf.xml mandos-options.xml legalnotice.xml
77
 
        $(DOCBOOKTOMAN)
78
 
 
79
 
plugin-runner.8mandos: plugin-runner.xml overview.xml legalnotice.xml
80
 
        $(DOCBOOKTOMAN)
81
 
 
82
 
plugins.d/password-request.8mandos: plugins.d/password-request.xml \
83
 
                                        mandos-options.xml \
84
 
                                        overview.xml legalnotice.xml
85
 
        $(DOCBOOKTOMAN)
86
 
 
87
 
plugins.d/password-request: plugins.d/password-request.o
88
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
89
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
90
 
 
91
 
.PHONY : all doc clean distclean run-client run-server install \
92
 
        install-server install-client uninstall uninstall-server \
93
 
        uninstall-client purge purge-server purge-client
 
145
html: $(htmldocs)
 
146
 
 
147
%.5: %.xml common.ent legalnotice.xml
 
148
        $(DOCBOOKTOMAN)
 
149
%.5.xhtml: %.xml common.ent legalnotice.xml
 
150
        $(DOCBOOKTOHTML)
 
151
 
 
152
%.8: %.xml common.ent legalnotice.xml
 
153
        $(DOCBOOKTOMAN)
 
154
%.8.xhtml: %.xml common.ent legalnotice.xml
 
155
        $(DOCBOOKTOHTML)
 
156
 
 
157
%.8mandos: %.xml common.ent legalnotice.xml
 
158
        $(DOCBOOKTOMAN)
 
159
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
160
        $(DOCBOOKTOHTML)
 
161
 
 
162
intro.8mandos: intro.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOMAN)
 
164
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
165
        $(DOCBOOKTOHTML)
 
166
 
 
167
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
168
                legalnotice.xml
 
169
        $(DOCBOOKTOMAN)
 
170
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
171
                overview.xml legalnotice.xml
 
172
        $(DOCBOOKTOHTML)
 
173
 
 
174
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
175
                legalnotice.xml
 
176
        $(DOCBOOKTOMAN)
 
177
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
178
                 legalnotice.xml
 
179
        $(DOCBOOKTOHTML)
 
180
 
 
181
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
182
                legalnotice.xml
 
183
        $(DOCBOOKTOMAN)
 
184
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
185
                 legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
189
                legalnotice.xml
 
190
        $(DOCBOOKTOMAN)
 
191
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
192
                 legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
 
195
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
196
                legalnotice.xml
 
197
        $(DOCBOOKTOMAN)
 
198
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
199
                legalnotice.xml
 
200
        $(DOCBOOKTOHTML)
 
201
 
 
202
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
203
                legalnotice.xml
 
204
        $(DOCBOOKTOMAN)
 
205
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
206
                overview.xml legalnotice.xml
 
207
        $(DOCBOOKTOHTML)
 
208
 
 
209
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
210
                                        common.ent \
 
211
                                        mandos-options.xml \
 
212
                                        overview.xml legalnotice.xml
 
213
        $(DOCBOOKTOMAN)
 
214
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
215
                                        common.ent \
 
216
                                        mandos-options.xml \
 
217
                                        overview.xml legalnotice.xml
 
218
        $(DOCBOOKTOHTML)
 
219
 
 
220
# Update all these files with version number $(version)
 
221
common.ent: Makefile
 
222
        $(strip $(SED) --in-place \
 
223
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
224
                $@)
 
225
 
 
226
mandos: Makefile
 
227
        $(strip $(SED) --in-place \
 
228
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
229
                $@)
 
230
 
 
231
mandos-keygen: Makefile
 
232
        $(strip $(SED) --in-place \
 
233
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
234
                $@)
 
235
 
 
236
mandos-ctl: Makefile
 
237
        $(strip $(SED) --in-place \
 
238
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
239
                $@)
 
240
 
 
241
mandos-monitor: Makefile
 
242
        $(strip $(SED) --in-place \
 
243
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
244
                $@)
 
245
 
 
246
mandos.lsm: Makefile
 
247
        $(strip $(SED) --in-place \
 
248
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
249
                $@)
 
250
        $(strip $(SED) --in-place \
 
251
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
252
                $@)
 
253
        $(strip $(SED) --in-place \
 
254
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
255
                $@)
 
256
 
 
257
# Need to add the GnuTLS, Avahi and GPGME libraries
 
258
plugins.d/mandos-client: plugins.d/mandos-client.c
 
259
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
260
                ) $(GPGME_CFLAGS) -lrt $(GNUTLS_LIBS) $(strip\
 
261
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
262
                ) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
94
273
 
95
274
clean:
96
 
        -rm --force $(PROGS) $(objects) $(DOCS) core
 
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
97
276
 
98
277
distclean: clean
99
278
mostlyclean: clean
100
279
maintainer-clean: clean
101
 
        -rm --force --recursive keydir confdir
 
280
        -rm --force --recursive keydir confdir statedir
102
281
 
103
 
check:
 
282
check:  all
104
283
        ./mandos --check
 
284
        ./mandos-ctl --check
105
285
 
106
286
# Run the client with a local config and key
107
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
108
 
        keydir/secring.gpg keydir/pubring.gpg
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
 
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
109
303
        ./plugin-runner --plugin-dir=plugins.d \
 
304
                --plugin-helper-dir=plugin-helpers \
110
305
                --config-file=plugin-runner.conf \
111
 
                --options-for=password-request:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
306
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
307
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
308
                $(CLIENTARGS)
112
309
 
113
310
# Used by run-client
114
 
keydir/secring.gpg: keydir/seckey.txt
115
 
        gpg --homedir $(dir $<) --import $^
116
 
keydir/pubring.gpg: keydir/pubkey.txt
117
 
        gpg --homedir $(dir $<) --import $^
118
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
119
312
        install --directory keydir
120
313
        ./mandos-keygen --dir keydir --force
121
314
 
122
315
# Run the server with a local config
123
 
run-server: confdir/mandos.conf confdir/clients.conf
124
 
        ./mandos --debug --configdir=confdir
 
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
317
        ./mandos --debug --no-dbus --configdir=confdir \
 
318
                --statedir=statedir $(SERVERARGS)
125
319
 
126
320
# Used by run-server
127
321
confdir/mandos.conf: mandos.conf
128
322
        install --directory confdir
129
 
        install $^ $@
130
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
323
        install --mode=u=rw,go=r $^ $@
 
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
131
325
        install --directory confdir
132
 
        install clients.conf $@
 
326
        install --mode=u=rw $< $@
133
327
# Add a client password
134
 
        ./mandos-keygen --dir keydir --password >> $@
135
 
 
136
 
install: install-server install-client
 
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
329
statedir:
 
330
        install --directory statedir
 
331
 
 
332
install: install-server install-client-nokey
 
333
 
 
334
install-html: html
 
335
        install --directory $(htmldir)
 
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
337
                $(htmldocs)
137
338
 
138
339
install-server: doc
139
 
        install --directory --parents $(CONFDIR) $(MANDIR)/man5 \
140
 
                $(MANDIR)/man8
141
 
        install --mode=0755 mandos $(PREFIX)/sbin/mandos
142
 
        install --mode=0644 --target-directory=$(CONFDIR) mandos.conf
143
 
        install --mode=0640 --target-directory=$(CONFDIR) \
 
340
        install --directory $(CONFDIR)
 
341
        if install --directory --mode=u=rwx --owner=$(USER) \
 
342
                --group=$(GROUP) $(STATEDIR); then \
 
343
                :; \
 
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
346
        fi
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
349
                        $(TMPFILES)/mandos.conf; \
 
350
        fi
 
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
353
                mandos-ctl
 
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
355
                mandos-monitor
 
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
 
357
                mandos.conf
 
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
144
359
                clients.conf
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
362
        install --mode=u=rwx,go=rx init.d-mandos \
 
363
                $(DESTDIR)/etc/init.d/mandos
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
366
        fi
 
367
        install --mode=u=rw,go=r default-mandos \
 
368
                $(DESTDIR)/etc/default/mandos
 
369
        if [ -z $(DESTDIR) ]; then \
 
370
                update-rc.d mandos defaults 25 15;\
 
371
        fi
145
372
        gzip --best --to-stdout mandos.8 \
146
373
                > $(MANDIR)/man8/mandos.8.gz
 
374
        gzip --best --to-stdout mandos-monitor.8 \
 
375
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
376
        gzip --best --to-stdout mandos-ctl.8 \
 
377
                > $(MANDIR)/man8/mandos-ctl.8.gz
147
378
        gzip --best --to-stdout mandos.conf.5 \
148
379
                > $(MANDIR)/man5/mandos.conf.5.gz
149
380
        gzip --best --to-stdout mandos-clients.conf.5 \
150
381
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
382
        gzip --best --to-stdout intro.8mandos \
 
383
                > $(MANDIR)/man8/intro.8mandos.gz
151
384
 
152
 
install-client: all doc /usr/share/initramfs-tools/hooks/.
153
 
        install --directory --parents $(PREFIX)/lib/mandos \
154
 
                $(CONFDIR) $(MANDIR)/man8
155
 
        install --directory --mode=0700 $(PREFIX)/lib/mandos/plugins.d
156
 
        chmod u=rwx,g=,o= $(PREFIX)/lib/mandos/plugins.d
157
 
        install --mode=0755 --target-directory=$(PREFIX)/lib/mandos \
158
 
                plugin-runner
159
 
        install --mode=0755 --target-directory=$(PREFIX)/sbin \
 
385
install-client-nokey: all doc
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
 
387
        install --directory --mode=u=rwx $(KEYDIR) \
 
388
                $(LIBDIR)/mandos/plugins.d \
 
389
                $(LIBDIR)/mandos/plugin-helpers
 
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
391
                install --mode=u=rwx \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
 
393
                        "$(CONFDIR)/plugin-helpers"; \
 
394
        fi
 
395
        install --mode=u=rwx,go=rx --directory \
 
396
                "$(CONFDIR)/network-hooks.d"
 
397
        install --mode=u=rwx,go=rx \
 
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
399
        install --mode=u=rwx,go=rx \
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
 
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
160
402
                mandos-keygen
161
 
        install --mode=0755 \
162
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
        install --mode=u=rwx,go=rx \
 
404
                --target-directory=$(LIBDIR)/mandos/plugins.d \
163
405
                plugins.d/password-prompt
164
 
        install --mode=4755 \
165
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
166
 
                plugins.d/password-request
 
406
        install --mode=u=rwxs,go=rx \
 
407
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
408
                plugins.d/mandos-client
 
409
        install --mode=u=rwxs,go=rx \
 
410
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
411
                plugins.d/usplash
 
412
        install --mode=u=rwxs,go=rx \
 
413
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
414
                plugins.d/splashy
 
415
        install --mode=u=rwxs,go=rx \
 
416
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
417
                plugins.d/askpass-fifo
 
418
        install --mode=u=rwxs,go=rx \
 
419
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
420
                plugins.d/plymouth
 
421
        install --mode=u=rwx,go=rx \
 
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
423
                plugin-helpers/mandos-client-iprouteadddel
167
424
        install initramfs-tools-hook \
168
 
                /usr/share/initramfs-tools/hooks/mandos
169
 
        install initramfs-tools-hook-conf \
170
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos
 
425
                $(INITRAMFSTOOLS)/hooks/mandos
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
 
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
428
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
429
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
171
430
        install initramfs-tools-script \
172
 
                /usr/share/initramfs-tools/scripts/local-top/mandos
 
431
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
432
        install initramfs-tools-script-stop \
 
433
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
434
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
173
435
        gzip --best --to-stdout mandos-keygen.8 \
174
436
                > $(MANDIR)/man8/mandos-keygen.8.gz
175
437
        gzip --best --to-stdout plugin-runner.8mandos \
176
438
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
439
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
440
                > $(MANDIR)/man8/mandos-client.8mandos.gz
177
441
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
178
442
                > $(MANDIR)/man8/password-prompt.8mandos.gz
179
 
        gzip --best --to-stdout plugins.d/password-request.8mandos \
180
 
                > $(MANDIR)/man8/password-request.8mandos.gz
181
 
        -$(PREFIX)/sbin/mandos-keygen
 
443
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
444
                > $(MANDIR)/man8/usplash.8mandos.gz
 
445
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
446
                > $(MANDIR)/man8/splashy.8mandos.gz
 
447
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
448
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
449
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
450
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
451
 
 
452
install-client: install-client-nokey
 
453
# Post-installation stuff
 
454
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
182
455
        update-initramfs -k all -u
 
456
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
183
457
 
184
458
uninstall: uninstall-server uninstall-client
185
459
 
186
 
uninstall-server: $(PREFIX)/sbin/mandos
 
460
uninstall-server:
187
461
        -rm --force $(PREFIX)/sbin/mandos \
 
462
                $(PREFIX)/sbin/mandos-ctl \
 
463
                $(PREFIX)/sbin/mandos-monitor \
188
464
                $(MANDIR)/man8/mandos.8.gz \
 
465
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
466
                $(MANDIR)/man8/mandos-ctl.8.gz \
189
467
                $(MANDIR)/man5/mandos.conf.5.gz \
190
468
                $(MANDIR)/man5/mandos-clients.conf.5.gz
 
469
        update-rc.d -f mandos remove
191
470
        -rmdir $(CONFDIR)
192
471
 
193
472
uninstall-client:
194
473
# Refuse to uninstall client if /etc/crypttab is explicitly configured
195
474
# to use it.
196
475
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
197
 
                /etc/crypttab
 
476
                $(DESTDIR)/etc/crypttab
198
477
        -rm --force $(PREFIX)/sbin/mandos-keygen \
199
 
                $(PREFIX)/lib/mandos/plugin-runner \
200
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
201
 
                $(PREFIX)/lib/mandos/plugins.d/password-request \
202
 
                /usr/share/initramfs-tools/hooks/mandos \
203
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos \
 
478
                $(LIBDIR)/mandos/plugin-runner \
 
479
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
480
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
481
                $(LIBDIR)/mandos/plugins.d/usplash \
 
482
                $(LIBDIR)/mandos/plugins.d/splashy \
 
483
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
484
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
485
                $(INITRAMFSTOOLS)/hooks/mandos \
 
486
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
487
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
488
                $(MANDIR)/man8/mandos-keygen.8.gz \
204
489
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
205
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
490
                $(MANDIR)/man8/mandos-client.8mandos.gz
206
491
                $(MANDIR)/man8/password-prompt.8mandos.gz \
207
 
                $(MANDIR)/man8/password-request.8mandos.gz
208
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
209
 
                 $(PREFIX)/lib/mandos $(CONFDIR)
 
492
                $(MANDIR)/man8/usplash.8mandos.gz \
 
493
                $(MANDIR)/man8/splashy.8mandos.gz \
 
494
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
495
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
496
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
497
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
210
498
        update-initramfs -k all -u
211
499
 
212
500
purge: purge-server purge-client
213
501
 
214
502
purge-server: uninstall-server
215
 
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf
 
503
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
504
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
505
                $(DESTDIR)/etc/default/mandos \
 
506
                $(DESTDIR)/etc/init.d/mandos \
 
507
                $(SYSTEMD)/mandos.service \
 
508
                $(DESTDIR)/run/mandos.pid \
 
509
                $(DESTDIR)/var/run/mandos.pid
216
510
        -rmdir $(CONFDIR)
217
511
 
218
512
purge-client: uninstall-client
219
 
        -rm --force $(CONFDIR)/seckey.txt $(CONFDIR)/pubkey.txt
220
 
        -rmdir $(CONFDIR) $(CONFDIR)/plugins.d
 
513
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
514
        -rm --force $(CONFDIR)/plugin-runner.conf \
 
515
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
516
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
517
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)