/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-07-14 22:39:15 UTC
  • Revision ID: teddy@recompile.se-20190714223915-aqjkms3t3taa6tye
Only use sanitizing options when debugging

The C compiler's sanitizing options introduce code in the output
binary which is fragile and not very security conscious.  It has
become clear that sanitizing is only really meant for use while
debugging.

As a side effect, this makes compilation faster, as the Makefile, for
production builds, no longer runs the compiler repeatedly to find all
its currently supported sanitizing options.

* Makefile (DEBUG): Add "$(SANITIZE)".
  (SANITIZE): Comment out.
  (CFLAGS): Remove "$(SANITIZE)".
  (plugins.d/mandos-client): Revert back to use plain $(LINK.c), since
                             we no longer need to remove the leak
                             sanitizer by overriding CFLAGS.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code 
9
 
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
13
41
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
16
 
htmldir=man
17
 
version=1.0
18
 
SED=sed
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.4
 
46
SED:=sed
 
47
 
 
48
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
49
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
19
50
 
20
51
## Use these settings for a traditional /usr/local install
21
 
# PREFIX=$(DESTDIR)/usr/local
22
 
# CONFDIR=$(DESTDIR)/etc/mandos
23
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
24
 
# MANDIR=$(PREFIX)/man
25
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
52
# PREFIX:=$(DESTDIR)/usr/local
 
53
# CONFDIR:=$(DESTDIR)/etc/mandos
 
54
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
55
# MANDIR:=$(PREFIX)/man
 
56
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
57
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
58
# LIBDIR:=$(PREFIX)/lib
26
59
##
27
60
 
28
61
## These settings are for a package-type install
29
 
PREFIX=$(DESTDIR)/usr
30
 
CONFDIR=$(DESTDIR)/etc/mandos
31
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
32
 
MANDIR=$(PREFIX)/share/man
33
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
62
PREFIX:=$(DESTDIR)/usr
 
63
CONFDIR:=$(DESTDIR)/etc/mandos
 
64
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
65
MANDIR:=$(PREFIX)/share/man
 
66
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
67
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
68
LIBDIR:=$(shell \
 
69
        for d in \
 
70
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
71
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
72
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
73
                        echo "$(DESTDIR)$$d"; \
 
74
                        break; \
 
75
                fi; \
 
76
        done)
34
77
##
35
78
 
36
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
37
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
38
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
39
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
40
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
41
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
79
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
80
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
81
 
 
82
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
83
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
84
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
85
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
86
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
87
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
88
        getconf LFS_LDFLAGS)
 
89
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
90
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
42
91
 
43
92
# Do not change these two
44
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
45
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
46
 
        -DVERSION='"$(version)"'
47
 
LDFLAGS=$(COVERAGE)
 
93
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
94
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
95
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
48
96
 
49
97
# Commands to format a DocBook <refentry> document into a manual page
50
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
98
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
51
99
        --param man.charmap.use.subset          0 \
52
100
        --param make.year.ranges                1 \
53
101
        --param make.single.year.ranges         1 \
54
102
        --param man.output.quietly              1 \
55
103
        --param man.authors.section.enabled     0 \
56
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
104
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
57
105
        $(notdir $<); \
58
 
        $(MANPOST) $(notdir $@)
59
 
# DocBook-to-man post-processing to fix a '\n' escape bug
60
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
106
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
107
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
108
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
109
        fi >/dev/null)
61
110
 
62
 
DOCBOOKTOHTML=xsltproc --nonet --xinclude \
 
111
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
63
112
        --param make.year.ranges                1 \
64
113
        --param make.single.year.ranges         1 \
65
114
        --param man.output.quietly              1 \
67
116
        --param citerefentry.link               1 \
68
117
        --output $@ \
69
118
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
70
 
        $<; $(HTMLPOST) $@
 
119
        $<; $(HTMLPOST) $@)
71
120
# Fix citerefentry links
72
 
HTMLPOST=$(SED) --in-place --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
121
HTMLPOST:=$(SED) --in-place \
 
122
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
73
123
 
74
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
75
 
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo
76
 
CPROGS=plugin-runner $(PLUGINS)
77
 
PROGS=mandos mandos-keygen $(CPROGS)
78
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
 
124
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
125
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
126
        plugins.d/plymouth
 
127
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
128
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
129
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
130
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
131
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
79
132
        plugins.d/mandos-client.8mandos \
80
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
81
 
        mandos-clients.conf.5
82
 
 
83
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
84
 
 
85
 
objects=$(addsuffix .o,$(CPROGS))
86
 
 
87
 
all: $(PROGS)
 
133
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
134
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
135
        plugins.d/plymouth.8mandos intro.8mandos
 
136
 
 
137
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
138
 
 
139
objects:=$(addsuffix .o,$(CPROGS))
 
140
 
 
141
all: $(PROGS) mandos.lsm
88
142
 
89
143
doc: $(DOCS)
90
144
 
105
159
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
106
160
        $(DOCBOOKTOHTML)
107
161
 
 
162
intro.8mandos: intro.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOMAN)
 
164
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
165
        $(DOCBOOKTOHTML)
 
166
 
108
167
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
109
168
                legalnotice.xml
110
169
        $(DOCBOOKTOMAN)
119
178
                 legalnotice.xml
120
179
        $(DOCBOOKTOHTML)
121
180
 
 
181
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
182
                legalnotice.xml
 
183
        $(DOCBOOKTOMAN)
 
184
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
185
                 legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
189
                legalnotice.xml
 
190
        $(DOCBOOKTOMAN)
 
191
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
192
                 legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
122
195
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
123
196
                legalnotice.xml
124
197
        $(DOCBOOKTOMAN)
146
219
 
147
220
# Update all these files with version number $(version)
148
221
common.ent: Makefile
149
 
        $(SED) --in-place --expression='s/^\(<ENTITY VERSION "\)[^"]*">$$/\1$(version)"/' $@
 
222
        $(strip $(SED) --in-place \
 
223
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
224
                $@)
150
225
 
151
226
mandos: Makefile
152
 
        $(SED) --in-place --expression='s/^\(version = "\)[^"]*"/\1$(version)"/' $@
 
227
        $(strip $(SED) --in-place \
 
228
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
229
                $@)
153
230
 
154
231
mandos-keygen: Makefile
155
 
        $(SED) --in-place --expression='s/^\(VERSION="\)[^"]*"/\1$(version)"/' $@
156
 
 
157
 
plugins.d/mandos-client: plugins.d/mandos-client.o
158
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
159
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
160
 
 
161
 
.PHONY : all doc html clean distclean run-client run-server install \
162
 
        install-server install-client uninstall uninstall-server \
163
 
        uninstall-client purge purge-server purge-client
 
232
        $(strip $(SED) --in-place \
 
233
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
234
                $@)
 
235
 
 
236
mandos-ctl: Makefile
 
237
        $(strip $(SED) --in-place \
 
238
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
239
                $@)
 
240
 
 
241
mandos-monitor: Makefile
 
242
        $(strip $(SED) --in-place \
 
243
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
244
                $@)
 
245
 
 
246
mandos.lsm: Makefile
 
247
        $(strip $(SED) --in-place \
 
248
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
249
                $@)
 
250
        $(strip $(SED) --in-place \
 
251
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
252
                $@)
 
253
        $(strip $(SED) --in-place \
 
254
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
255
                $@)
 
256
 
 
257
# Need to add the GnuTLS, Avahi and GPGME libraries
 
258
plugins.d/mandos-client: plugins.d/mandos-client.c
 
259
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
260
                ) $(GPGME_CFLAGS) -lrt $(GNUTLS_LIBS) $(strip\
 
261
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
262
                ) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
164
273
 
165
274
clean:
166
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
168
277
distclean: clean
169
278
mostlyclean: clean
170
279
maintainer-clean: clean
171
 
        -rm --force --recursive keydir confdir
 
280
        -rm --force --recursive keydir confdir statedir
172
281
 
173
282
check:  all
174
283
        ./mandos --check
 
284
        ./mandos-ctl --check
175
285
 
176
286
# Run the client with a local config and key
177
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
 
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
178
303
        ./plugin-runner --plugin-dir=plugins.d \
 
304
                --plugin-helper-dir=plugin-helpers \
179
305
                --config-file=plugin-runner.conf \
180
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
306
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
307
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
308
                $(CLIENTARGS)
181
309
 
182
310
# Used by run-client
183
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
184
312
        install --directory keydir
185
313
        ./mandos-keygen --dir keydir --force
186
314
 
187
315
# Run the server with a local config
188
 
run-server: confdir/mandos.conf confdir/clients.conf
189
 
        ./mandos --debug --configdir=confdir
 
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
317
        ./mandos --debug --no-dbus --configdir=confdir \
 
318
                --statedir=statedir $(SERVERARGS)
190
319
 
191
320
# Used by run-server
192
321
confdir/mandos.conf: mandos.conf
193
322
        install --directory confdir
194
323
        install --mode=u=rw,go=r $^ $@
195
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
196
325
        install --directory confdir
197
326
        install --mode=u=rw $< $@
198
327
# Add a client password
199
 
        ./mandos-keygen --dir keydir --password >> $@
 
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
329
statedir:
 
330
        install --directory statedir
200
331
 
201
332
install: install-server install-client-nokey
202
333
 
203
 
install-html: $(htmldocs)
 
334
install-html: html
204
335
        install --directory $(htmldir)
205
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
206
337
                $(htmldocs)
207
338
 
208
339
install-server: doc
209
340
        install --directory $(CONFDIR)
 
341
        if install --directory --mode=u=rwx --owner=$(USER) \
 
342
                --group=$(GROUP) $(STATEDIR); then \
 
343
                :; \
 
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
346
        fi
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
349
                        $(TMPFILES)/mandos.conf; \
 
350
        fi
210
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
353
                mandos-ctl
 
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
355
                mandos-monitor
211
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
212
357
                mandos.conf
213
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
214
359
                clients.conf
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
215
362
        install --mode=u=rwx,go=rx init.d-mandos \
216
363
                $(DESTDIR)/etc/init.d/mandos
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
366
        fi
217
367
        install --mode=u=rw,go=r default-mandos \
218
368
                $(DESTDIR)/etc/default/mandos
219
369
        if [ -z $(DESTDIR) ]; then \
221
371
        fi
222
372
        gzip --best --to-stdout mandos.8 \
223
373
                > $(MANDIR)/man8/mandos.8.gz
 
374
        gzip --best --to-stdout mandos-monitor.8 \
 
375
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
376
        gzip --best --to-stdout mandos-ctl.8 \
 
377
                > $(MANDIR)/man8/mandos-ctl.8.gz
224
378
        gzip --best --to-stdout mandos.conf.5 \
225
379
                > $(MANDIR)/man5/mandos.conf.5.gz
226
380
        gzip --best --to-stdout mandos-clients.conf.5 \
227
381
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
382
        gzip --best --to-stdout intro.8mandos \
 
383
                > $(MANDIR)/man8/intro.8mandos.gz
228
384
 
229
385
install-client-nokey: all doc
230
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
231
387
        install --directory --mode=u=rwx $(KEYDIR) \
232
 
                $(PREFIX)/lib/mandos/plugins.d
233
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
388
                $(LIBDIR)/mandos/plugins.d \
 
389
                $(LIBDIR)/mandos/plugin-helpers
 
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
234
391
                install --mode=u=rwx \
235
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
 
393
                        "$(CONFDIR)/plugin-helpers"; \
236
394
        fi
237
 
        install --mode=u=rwx,go=rx \
238
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
395
        install --mode=u=rwx,go=rx --directory \
 
396
                "$(CONFDIR)/network-hooks.d"
 
397
        install --mode=u=rwx,go=rx \
 
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
399
        install --mode=u=rwx,go=rx \
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
239
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
240
402
                mandos-keygen
241
403
        install --mode=u=rwx,go=rx \
242
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
404
                --target-directory=$(LIBDIR)/mandos/plugins.d \
243
405
                plugins.d/password-prompt
244
406
        install --mode=u=rwxs,go=rx \
245
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
407
                --target-directory=$(LIBDIR)/mandos/plugins.d \
246
408
                plugins.d/mandos-client
247
409
        install --mode=u=rwxs,go=rx \
248
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
410
                --target-directory=$(LIBDIR)/mandos/plugins.d \
249
411
                plugins.d/usplash
250
412
        install --mode=u=rwxs,go=rx \
251
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
413
                --target-directory=$(LIBDIR)/mandos/plugins.d \
252
414
                plugins.d/splashy
253
415
        install --mode=u=rwxs,go=rx \
254
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
416
                --target-directory=$(LIBDIR)/mandos/plugins.d \
255
417
                plugins.d/askpass-fifo
 
418
        install --mode=u=rwxs,go=rx \
 
419
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
420
                plugins.d/plymouth
 
421
        install --mode=u=rwx,go=rx \
 
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
423
                plugin-helpers/mandos-client-iprouteadddel
256
424
        install initramfs-tools-hook \
257
425
                $(INITRAMFSTOOLS)/hooks/mandos
258
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
259
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
 
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
428
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
429
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
260
430
        install initramfs-tools-script \
261
 
                $(INITRAMFSTOOLS)/scripts/local-top/mandos
 
431
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
432
        install initramfs-tools-script-stop \
 
433
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
262
434
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
263
435
        gzip --best --to-stdout mandos-keygen.8 \
264
436
                > $(MANDIR)/man8/mandos-keygen.8.gz
265
437
        gzip --best --to-stdout plugin-runner.8mandos \
266
438
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
439
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
440
                > $(MANDIR)/man8/mandos-client.8mandos.gz
267
441
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
268
442
                > $(MANDIR)/man8/password-prompt.8mandos.gz
269
 
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
270
 
                > $(MANDIR)/man8/mandos-client.8mandos.gz
 
443
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
444
                > $(MANDIR)/man8/usplash.8mandos.gz
 
445
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
446
                > $(MANDIR)/man8/splashy.8mandos.gz
 
447
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
448
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
449
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
450
                > $(MANDIR)/man8/plymouth.8mandos.gz
271
451
 
272
452
install-client: install-client-nokey
273
453
# Post-installation stuff
279
459
 
280
460
uninstall-server:
281
461
        -rm --force $(PREFIX)/sbin/mandos \
 
462
                $(PREFIX)/sbin/mandos-ctl \
 
463
                $(PREFIX)/sbin/mandos-monitor \
282
464
                $(MANDIR)/man8/mandos.8.gz \
 
465
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
466
                $(MANDIR)/man8/mandos-ctl.8.gz \
283
467
                $(MANDIR)/man5/mandos.conf.5.gz \
284
468
                $(MANDIR)/man5/mandos-clients.conf.5.gz
285
469
        update-rc.d -f mandos remove
291
475
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
292
476
                $(DESTDIR)/etc/crypttab
293
477
        -rm --force $(PREFIX)/sbin/mandos-keygen \
294
 
                $(PREFIX)/lib/mandos/plugin-runner \
295
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
296
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
297
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
298
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
 
478
                $(LIBDIR)/mandos/plugin-runner \
 
479
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
480
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
481
                $(LIBDIR)/mandos/plugins.d/usplash \
 
482
                $(LIBDIR)/mandos/plugins.d/splashy \
 
483
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
484
                $(LIBDIR)/mandos/plugins.d/plymouth \
299
485
                $(INITRAMFSTOOLS)/hooks/mandos \
300
486
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
301
 
                $(INITRAMFSTOOLS)/scripts/local-top/mandos \
 
487
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
488
                $(MANDIR)/man8/mandos-keygen.8.gz \
302
489
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
303
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
490
                $(MANDIR)/man8/mandos-client.8mandos.gz
304
491
                $(MANDIR)/man8/password-prompt.8mandos.gz \
305
 
                $(MANDIR)/man8/mandos-client.8mandos.gz
306
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
307
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
492
                $(MANDIR)/man8/usplash.8mandos.gz \
 
493
                $(MANDIR)/man8/splashy.8mandos.gz \
 
494
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
495
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
496
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
497
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
308
498
        update-initramfs -k all -u
309
499
 
310
500
purge: purge-server purge-client
311
501
 
312
502
purge-server: uninstall-server
313
503
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
504
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
314
505
                $(DESTDIR)/etc/default/mandos \
315
506
                $(DESTDIR)/etc/init.d/mandos \
 
507
                $(SYSTEMD)/mandos.service \
 
508
                $(DESTDIR)/run/mandos.pid \
316
509
                $(DESTDIR)/var/run/mandos.pid
317
510
        -rmdir $(CONFDIR)
318
511
 
319
512
purge-client: uninstall-client
320
 
        -shred --remove $(KEYDIR)/seckey.txt
 
513
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
321
514
        -rm --force $(CONFDIR)/plugin-runner.conf \
322
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
515
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
516
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
323
517
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)