/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-07-14 22:39:15 UTC
  • Revision ID: teddy@recompile.se-20190714223915-aqjkms3t3taa6tye
Only use sanitizing options when debugging

The C compiler's sanitizing options introduce code in the output
binary which is fragile and not very security conscious.  It has
become clear that sanitizing is only really meant for use while
debugging.

As a side effect, this makes compilation faster, as the Makefile, for
production builds, no longer runs the compiler repeatedly to find all
its currently supported sanitizing options.

* Makefile (DEBUG): Add "$(SANITIZE)".
  (SANITIZE): Comment out.
  (CFLAGS): Remove "$(SANITIZE)".
  (plugins.d/mandos-client): Revert back to use plain $(LINK.c), since
                             we no longer need to remove the leak
                             sanitizer by overriding CFLAGS.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code 
9
 
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
13
41
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.4
 
46
SED:=sed
 
47
 
 
48
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
49
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
16
50
 
17
51
## Use these settings for a traditional /usr/local install
18
 
# PREFIX=$(DESTDIR)/usr/local
19
 
# CONFDIR=$(DESTDIR)/etc/mandos
20
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
21
 
# MANDIR=$(PREFIX)/man
22
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
52
# PREFIX:=$(DESTDIR)/usr/local
 
53
# CONFDIR:=$(DESTDIR)/etc/mandos
 
54
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
55
# MANDIR:=$(PREFIX)/man
 
56
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
57
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
58
# LIBDIR:=$(PREFIX)/lib
23
59
##
24
60
 
25
61
## These settings are for a package-type install
26
 
PREFIX=$(DESTDIR)/usr
27
 
CONFDIR=$(DESTDIR)/etc/mandos
28
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
29
 
MANDIR=$(PREFIX)/share/man
30
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
62
PREFIX:=$(DESTDIR)/usr
 
63
CONFDIR:=$(DESTDIR)/etc/mandos
 
64
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
65
MANDIR:=$(PREFIX)/share/man
 
66
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
67
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
68
LIBDIR:=$(shell \
 
69
        for d in \
 
70
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
71
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
72
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
73
                        echo "$(DESTDIR)$$d"; \
 
74
                        break; \
 
75
                fi; \
 
76
        done)
31
77
##
32
78
 
33
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
34
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
35
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
36
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
37
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
38
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
79
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
80
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
81
 
 
82
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
83
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
84
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
85
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
86
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
87
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
88
        getconf LFS_LDFLAGS)
 
89
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
90
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
39
91
 
40
92
# Do not change these two
41
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
42
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
43
 
LDFLAGS=$(COVERAGE)
 
93
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
94
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
95
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
44
96
 
45
97
# Commands to format a DocBook <refentry> document into a manual page
46
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
98
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
47
99
        --param man.charmap.use.subset          0 \
48
100
        --param make.year.ranges                1 \
49
101
        --param make.single.year.ranges         1 \
50
102
        --param man.output.quietly              1 \
51
103
        --param man.authors.section.enabled     0 \
52
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
104
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
53
105
        $(notdir $<); \
54
 
        $(MANPOST) $(notdir $@)
55
 
# DocBook-to-man post-processing to fix a '\n' escape bug
56
 
MANPOST=sed --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
57
 
 
58
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client
59
 
PROGS=plugin-runner $(PLUGINS)
60
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
 
106
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
107
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
108
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
109
        fi >/dev/null)
 
110
 
 
111
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
112
        --param make.year.ranges                1 \
 
113
        --param make.single.year.ranges         1 \
 
114
        --param man.output.quietly              1 \
 
115
        --param man.authors.section.enabled     0 \
 
116
        --param citerefentry.link               1 \
 
117
        --output $@ \
 
118
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
119
        $<; $(HTMLPOST) $@)
 
120
# Fix citerefentry links
 
121
HTMLPOST:=$(SED) --in-place \
 
122
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
123
 
 
124
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
125
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
126
        plugins.d/plymouth
 
127
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
128
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
129
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
130
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
131
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
61
132
        plugins.d/mandos-client.8mandos \
62
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
63
 
        mandos-clients.conf.5
64
 
 
65
 
objects=$(addsuffix .o,$(PROGS))
66
 
 
67
 
all: $(PROGS)
 
133
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
134
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
135
        plugins.d/plymouth.8mandos intro.8mandos
 
136
 
 
137
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
138
 
 
139
objects:=$(addsuffix .o,$(CPROGS))
 
140
 
 
141
all: $(PROGS) mandos.lsm
68
142
 
69
143
doc: $(DOCS)
70
144
 
71
 
%.5: %.xml legalnotice.xml
72
 
        $(DOCBOOKTOMAN)
73
 
 
74
 
%.8: %.xml legalnotice.xml
75
 
        $(DOCBOOKTOMAN)
76
 
 
77
 
%.8mandos: %.xml legalnotice.xml
78
 
        $(DOCBOOKTOMAN)
79
 
 
80
 
mandos.8: mandos.xml mandos-options.xml overview.xml legalnotice.xml
81
 
        $(DOCBOOKTOMAN)
82
 
 
83
 
mandos-keygen.8: mandos-keygen.xml overview.xml legalnotice.xml
84
 
        $(DOCBOOKTOMAN)
85
 
 
86
 
mandos.conf.5: mandos.conf.xml mandos-options.xml legalnotice.xml
87
 
        $(DOCBOOKTOMAN)
88
 
 
89
 
plugin-runner.8mandos: plugin-runner.xml overview.xml legalnotice.xml
90
 
        $(DOCBOOKTOMAN)
 
145
html: $(htmldocs)
 
146
 
 
147
%.5: %.xml common.ent legalnotice.xml
 
148
        $(DOCBOOKTOMAN)
 
149
%.5.xhtml: %.xml common.ent legalnotice.xml
 
150
        $(DOCBOOKTOHTML)
 
151
 
 
152
%.8: %.xml common.ent legalnotice.xml
 
153
        $(DOCBOOKTOMAN)
 
154
%.8.xhtml: %.xml common.ent legalnotice.xml
 
155
        $(DOCBOOKTOHTML)
 
156
 
 
157
%.8mandos: %.xml common.ent legalnotice.xml
 
158
        $(DOCBOOKTOMAN)
 
159
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
160
        $(DOCBOOKTOHTML)
 
161
 
 
162
intro.8mandos: intro.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOMAN)
 
164
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
165
        $(DOCBOOKTOHTML)
 
166
 
 
167
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
168
                legalnotice.xml
 
169
        $(DOCBOOKTOMAN)
 
170
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
171
                overview.xml legalnotice.xml
 
172
        $(DOCBOOKTOHTML)
 
173
 
 
174
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
175
                legalnotice.xml
 
176
        $(DOCBOOKTOMAN)
 
177
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
178
                 legalnotice.xml
 
179
        $(DOCBOOKTOHTML)
 
180
 
 
181
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
182
                legalnotice.xml
 
183
        $(DOCBOOKTOMAN)
 
184
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
185
                 legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
189
                legalnotice.xml
 
190
        $(DOCBOOKTOMAN)
 
191
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
192
                 legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
 
195
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
196
                legalnotice.xml
 
197
        $(DOCBOOKTOMAN)
 
198
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
199
                legalnotice.xml
 
200
        $(DOCBOOKTOHTML)
 
201
 
 
202
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
203
                legalnotice.xml
 
204
        $(DOCBOOKTOMAN)
 
205
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
206
                overview.xml legalnotice.xml
 
207
        $(DOCBOOKTOHTML)
91
208
 
92
209
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
210
                                        common.ent \
93
211
                                        mandos-options.xml \
94
212
                                        overview.xml legalnotice.xml
95
213
        $(DOCBOOKTOMAN)
96
 
 
97
 
plugins.d/mandos-client: plugins.d/mandos-client.o
98
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
99
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
100
 
 
101
 
.PHONY : all doc clean distclean run-client run-server install \
102
 
        install-server install-client uninstall uninstall-server \
103
 
        uninstall-client purge purge-server purge-client
 
214
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
215
                                        common.ent \
 
216
                                        mandos-options.xml \
 
217
                                        overview.xml legalnotice.xml
 
218
        $(DOCBOOKTOHTML)
 
219
 
 
220
# Update all these files with version number $(version)
 
221
common.ent: Makefile
 
222
        $(strip $(SED) --in-place \
 
223
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
224
                $@)
 
225
 
 
226
mandos: Makefile
 
227
        $(strip $(SED) --in-place \
 
228
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
229
                $@)
 
230
 
 
231
mandos-keygen: Makefile
 
232
        $(strip $(SED) --in-place \
 
233
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
234
                $@)
 
235
 
 
236
mandos-ctl: Makefile
 
237
        $(strip $(SED) --in-place \
 
238
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
239
                $@)
 
240
 
 
241
mandos-monitor: Makefile
 
242
        $(strip $(SED) --in-place \
 
243
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
244
                $@)
 
245
 
 
246
mandos.lsm: Makefile
 
247
        $(strip $(SED) --in-place \
 
248
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
249
                $@)
 
250
        $(strip $(SED) --in-place \
 
251
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
252
                $@)
 
253
        $(strip $(SED) --in-place \
 
254
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
255
                $@)
 
256
 
 
257
# Need to add the GnuTLS, Avahi and GPGME libraries
 
258
plugins.d/mandos-client: plugins.d/mandos-client.c
 
259
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
260
                ) $(GPGME_CFLAGS) -lrt $(GNUTLS_LIBS) $(strip\
 
261
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
262
                ) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
104
273
 
105
274
clean:
106
 
        -rm --force $(PROGS) $(objects) $(DOCS) core
 
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
107
276
 
108
277
distclean: clean
109
278
mostlyclean: clean
110
279
maintainer-clean: clean
111
 
        -rm --force --recursive keydir confdir
 
280
        -rm --force --recursive keydir confdir statedir
112
281
 
113
 
check:
 
282
check:  all
114
283
        ./mandos --check
 
284
        ./mandos-ctl --check
115
285
 
116
286
# Run the client with a local config and key
117
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
 
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
118
303
        ./plugin-runner --plugin-dir=plugins.d \
 
304
                --plugin-helper-dir=plugin-helpers \
119
305
                --config-file=plugin-runner.conf \
120
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
306
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
307
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
308
                $(CLIENTARGS)
121
309
 
122
310
# Used by run-client
123
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
124
312
        install --directory keydir
125
313
        ./mandos-keygen --dir keydir --force
126
314
 
127
315
# Run the server with a local config
128
 
run-server: confdir/mandos.conf confdir/clients.conf
129
 
        ./mandos --debug --configdir=confdir
 
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
317
        ./mandos --debug --no-dbus --configdir=confdir \
 
318
                --statedir=statedir $(SERVERARGS)
130
319
 
131
320
# Used by run-server
132
321
confdir/mandos.conf: mandos.conf
133
322
        install --directory confdir
134
323
        install --mode=u=rw,go=r $^ $@
135
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
136
325
        install --directory confdir
137
326
        install --mode=u=rw $< $@
138
327
# Add a client password
139
 
        ./mandos-keygen --dir keydir --password >> $@
 
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
329
statedir:
 
330
        install --directory statedir
140
331
 
141
332
install: install-server install-client-nokey
142
333
 
 
334
install-html: html
 
335
        install --directory $(htmldir)
 
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
337
                $(htmldocs)
 
338
 
143
339
install-server: doc
144
340
        install --directory $(CONFDIR)
 
341
        if install --directory --mode=u=rwx --owner=$(USER) \
 
342
                --group=$(GROUP) $(STATEDIR); then \
 
343
                :; \
 
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
346
        fi
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
349
                        $(TMPFILES)/mandos.conf; \
 
350
        fi
145
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
353
                mandos-ctl
 
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
355
                mandos-monitor
146
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
147
357
                mandos.conf
148
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
149
359
                clients.conf
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
150
362
        install --mode=u=rwx,go=rx init.d-mandos \
151
363
                $(DESTDIR)/etc/init.d/mandos
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
366
        fi
152
367
        install --mode=u=rw,go=r default-mandos \
153
368
                $(DESTDIR)/etc/default/mandos
154
369
        if [ -z $(DESTDIR) ]; then \
156
371
        fi
157
372
        gzip --best --to-stdout mandos.8 \
158
373
                > $(MANDIR)/man8/mandos.8.gz
 
374
        gzip --best --to-stdout mandos-monitor.8 \
 
375
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
376
        gzip --best --to-stdout mandos-ctl.8 \
 
377
                > $(MANDIR)/man8/mandos-ctl.8.gz
159
378
        gzip --best --to-stdout mandos.conf.5 \
160
379
                > $(MANDIR)/man5/mandos.conf.5.gz
161
380
        gzip --best --to-stdout mandos-clients.conf.5 \
162
381
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
382
        gzip --best --to-stdout intro.8mandos \
 
383
                > $(MANDIR)/man8/intro.8mandos.gz
163
384
 
164
385
install-client-nokey: all doc
165
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
166
387
        install --directory --mode=u=rwx $(KEYDIR) \
167
 
                $(PREFIX)/lib/mandos/plugins.d
168
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
388
                $(LIBDIR)/mandos/plugins.d \
 
389
                $(LIBDIR)/mandos/plugin-helpers
 
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
169
391
                install --mode=u=rwx \
170
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
 
393
                        "$(CONFDIR)/plugin-helpers"; \
171
394
        fi
172
 
        install --mode=u=rwx,go=rx \
173
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
395
        install --mode=u=rwx,go=rx --directory \
 
396
                "$(CONFDIR)/network-hooks.d"
 
397
        install --mode=u=rwx,go=rx \
 
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
399
        install --mode=u=rwx,go=rx \
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
174
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
175
402
                mandos-keygen
176
403
        install --mode=u=rwx,go=rx \
177
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
404
                --target-directory=$(LIBDIR)/mandos/plugins.d \
178
405
                plugins.d/password-prompt
179
406
        install --mode=u=rwxs,go=rx \
180
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
407
                --target-directory=$(LIBDIR)/mandos/plugins.d \
181
408
                plugins.d/mandos-client
182
 
        install --mode=u=rwx,go=rx \
183
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
409
        install --mode=u=rwxs,go=rx \
 
410
                --target-directory=$(LIBDIR)/mandos/plugins.d \
184
411
                plugins.d/usplash
 
412
        install --mode=u=rwxs,go=rx \
 
413
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
414
                plugins.d/splashy
 
415
        install --mode=u=rwxs,go=rx \
 
416
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
417
                plugins.d/askpass-fifo
 
418
        install --mode=u=rwxs,go=rx \
 
419
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
420
                plugins.d/plymouth
 
421
        install --mode=u=rwx,go=rx \
 
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
423
                plugin-helpers/mandos-client-iprouteadddel
185
424
        install initramfs-tools-hook \
186
425
                $(INITRAMFSTOOLS)/hooks/mandos
187
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
188
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
 
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
428
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
429
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
189
430
        install initramfs-tools-script \
190
 
                $(INITRAMFSTOOLS)/scripts/local-top/mandos
 
431
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
432
        install initramfs-tools-script-stop \
 
433
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
191
434
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
192
435
        gzip --best --to-stdout mandos-keygen.8 \
193
436
                > $(MANDIR)/man8/mandos-keygen.8.gz
194
437
        gzip --best --to-stdout plugin-runner.8mandos \
195
438
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
439
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
440
                > $(MANDIR)/man8/mandos-client.8mandos.gz
196
441
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
197
442
                > $(MANDIR)/man8/password-prompt.8mandos.gz
198
 
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
199
 
                > $(MANDIR)/man8/mandos-client.8mandos.gz
 
443
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
444
                > $(MANDIR)/man8/usplash.8mandos.gz
 
445
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
446
                > $(MANDIR)/man8/splashy.8mandos.gz
 
447
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
448
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
449
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
450
                > $(MANDIR)/man8/plymouth.8mandos.gz
200
451
 
201
452
install-client: install-client-nokey
202
453
# Post-installation stuff
208
459
 
209
460
uninstall-server:
210
461
        -rm --force $(PREFIX)/sbin/mandos \
 
462
                $(PREFIX)/sbin/mandos-ctl \
 
463
                $(PREFIX)/sbin/mandos-monitor \
211
464
                $(MANDIR)/man8/mandos.8.gz \
 
465
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
466
                $(MANDIR)/man8/mandos-ctl.8.gz \
212
467
                $(MANDIR)/man5/mandos.conf.5.gz \
213
468
                $(MANDIR)/man5/mandos-clients.conf.5.gz
214
469
        update-rc.d -f mandos remove
220
475
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
221
476
                $(DESTDIR)/etc/crypttab
222
477
        -rm --force $(PREFIX)/sbin/mandos-keygen \
223
 
                $(PREFIX)/lib/mandos/plugin-runner \
224
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
225
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
226
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
 
478
                $(LIBDIR)/mandos/plugin-runner \
 
479
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
480
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
481
                $(LIBDIR)/mandos/plugins.d/usplash \
 
482
                $(LIBDIR)/mandos/plugins.d/splashy \
 
483
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
484
                $(LIBDIR)/mandos/plugins.d/plymouth \
227
485
                $(INITRAMFSTOOLS)/hooks/mandos \
228
486
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
229
 
                $(INITRAMFSTOOLS)/scripts/local-top/mandos \
 
487
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
488
                $(MANDIR)/man8/mandos-keygen.8.gz \
230
489
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
231
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
490
                $(MANDIR)/man8/mandos-client.8mandos.gz
232
491
                $(MANDIR)/man8/password-prompt.8mandos.gz \
233
 
                $(MANDIR)/man8/mandos-client.8mandos.gz
234
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
235
 
                rm --force $(CONFDIR)/plugins.d/README; \
236
 
        fi
237
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
238
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
492
                $(MANDIR)/man8/usplash.8mandos.gz \
 
493
                $(MANDIR)/man8/splashy.8mandos.gz \
 
494
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
495
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
496
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
497
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
239
498
        update-initramfs -k all -u
240
499
 
241
500
purge: purge-server purge-client
242
501
 
243
502
purge-server: uninstall-server
244
503
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
504
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
245
505
                $(DESTDIR)/etc/default/mandos \
246
506
                $(DESTDIR)/etc/init.d/mandos \
 
507
                $(SYSTEMD)/mandos.service \
 
508
                $(DESTDIR)/run/mandos.pid \
247
509
                $(DESTDIR)/var/run/mandos.pid
248
510
        -rmdir $(CONFDIR)
249
511
 
250
512
purge-client: uninstall-client
251
 
        -shred --remove $(KEYDIR)/seckey.txt
 
513
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
252
514
        -rm --force $(CONFDIR)/plugin-runner.conf \
253
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
515
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
516
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
254
517
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)