/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-07-14 22:39:15 UTC
  • Revision ID: teddy@recompile.se-20190714223915-aqjkms3t3taa6tye
Only use sanitizing options when debugging

The C compiler's sanitizing options introduce code in the output
binary which is fragile and not very security conscious.  It has
become clear that sanitizing is only really meant for use while
debugging.

As a side effect, this makes compilation faster, as the Makefile, for
production builds, no longer runs the compiler repeatedly to find all
its currently supported sanitizing options.

* Makefile (DEBUG): Add "$(SANITIZE)".
  (SANITIZE): Comment out.
  (CFLAGS): Remove "$(SANITIZE)".
  (plugins.d/mandos-client): Revert back to use plain $(LINK.c), since
                             we no longer need to remove the leak
                             sanitizer by overriding CFLAGS.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
CXXFLAGS=-Wall -W -g
2
 
LDFLAGS=-lgnutls
3
 
 
4
 
all: client server
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
 
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
 
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
 
41
#COVERAGE=--coverage
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.4
 
46
SED:=sed
 
47
 
 
48
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
49
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
50
 
 
51
## Use these settings for a traditional /usr/local install
 
52
# PREFIX:=$(DESTDIR)/usr/local
 
53
# CONFDIR:=$(DESTDIR)/etc/mandos
 
54
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
55
# MANDIR:=$(PREFIX)/man
 
56
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
57
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
58
# LIBDIR:=$(PREFIX)/lib
 
59
##
 
60
 
 
61
## These settings are for a package-type install
 
62
PREFIX:=$(DESTDIR)/usr
 
63
CONFDIR:=$(DESTDIR)/etc/mandos
 
64
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
65
MANDIR:=$(PREFIX)/share/man
 
66
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
67
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
68
LIBDIR:=$(shell \
 
69
        for d in \
 
70
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
71
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
72
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
73
                        echo "$(DESTDIR)$$d"; \
 
74
                        break; \
 
75
                fi; \
 
76
        done)
 
77
##
 
78
 
 
79
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
80
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
81
 
 
82
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
83
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
84
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
85
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
86
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
87
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
88
        getconf LFS_LDFLAGS)
 
89
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
90
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
 
91
 
 
92
# Do not change these two
 
93
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
94
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
95
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
96
 
 
97
# Commands to format a DocBook <refentry> document into a manual page
 
98
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
 
99
        --param man.charmap.use.subset          0 \
 
100
        --param make.year.ranges                1 \
 
101
        --param make.single.year.ranges         1 \
 
102
        --param man.output.quietly              1 \
 
103
        --param man.authors.section.enabled     0 \
 
104
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
105
        $(notdir $<); \
 
106
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
107
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
108
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
109
        fi >/dev/null)
 
110
 
 
111
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
112
        --param make.year.ranges                1 \
 
113
        --param make.single.year.ranges         1 \
 
114
        --param man.output.quietly              1 \
 
115
        --param man.authors.section.enabled     0 \
 
116
        --param citerefentry.link               1 \
 
117
        --output $@ \
 
118
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
119
        $<; $(HTMLPOST) $@)
 
120
# Fix citerefentry links
 
121
HTMLPOST:=$(SED) --in-place \
 
122
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
123
 
 
124
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
125
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
126
        plugins.d/plymouth
 
127
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
128
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
129
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
130
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
131
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
132
        plugins.d/mandos-client.8mandos \
 
133
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
134
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
135
        plugins.d/plymouth.8mandos intro.8mandos
 
136
 
 
137
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
138
 
 
139
objects:=$(addsuffix .o,$(CPROGS))
 
140
 
 
141
all: $(PROGS) mandos.lsm
 
142
 
 
143
doc: $(DOCS)
 
144
 
 
145
html: $(htmldocs)
 
146
 
 
147
%.5: %.xml common.ent legalnotice.xml
 
148
        $(DOCBOOKTOMAN)
 
149
%.5.xhtml: %.xml common.ent legalnotice.xml
 
150
        $(DOCBOOKTOHTML)
 
151
 
 
152
%.8: %.xml common.ent legalnotice.xml
 
153
        $(DOCBOOKTOMAN)
 
154
%.8.xhtml: %.xml common.ent legalnotice.xml
 
155
        $(DOCBOOKTOHTML)
 
156
 
 
157
%.8mandos: %.xml common.ent legalnotice.xml
 
158
        $(DOCBOOKTOMAN)
 
159
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
160
        $(DOCBOOKTOHTML)
 
161
 
 
162
intro.8mandos: intro.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOMAN)
 
164
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
165
        $(DOCBOOKTOHTML)
 
166
 
 
167
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
168
                legalnotice.xml
 
169
        $(DOCBOOKTOMAN)
 
170
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
171
                overview.xml legalnotice.xml
 
172
        $(DOCBOOKTOHTML)
 
173
 
 
174
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
175
                legalnotice.xml
 
176
        $(DOCBOOKTOMAN)
 
177
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
178
                 legalnotice.xml
 
179
        $(DOCBOOKTOHTML)
 
180
 
 
181
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
182
                legalnotice.xml
 
183
        $(DOCBOOKTOMAN)
 
184
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
185
                 legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
189
                legalnotice.xml
 
190
        $(DOCBOOKTOMAN)
 
191
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
192
                 legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
 
195
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
196
                legalnotice.xml
 
197
        $(DOCBOOKTOMAN)
 
198
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
199
                legalnotice.xml
 
200
        $(DOCBOOKTOHTML)
 
201
 
 
202
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
203
                legalnotice.xml
 
204
        $(DOCBOOKTOMAN)
 
205
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
206
                overview.xml legalnotice.xml
 
207
        $(DOCBOOKTOHTML)
 
208
 
 
209
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
210
                                        common.ent \
 
211
                                        mandos-options.xml \
 
212
                                        overview.xml legalnotice.xml
 
213
        $(DOCBOOKTOMAN)
 
214
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
215
                                        common.ent \
 
216
                                        mandos-options.xml \
 
217
                                        overview.xml legalnotice.xml
 
218
        $(DOCBOOKTOHTML)
 
219
 
 
220
# Update all these files with version number $(version)
 
221
common.ent: Makefile
 
222
        $(strip $(SED) --in-place \
 
223
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
224
                $@)
 
225
 
 
226
mandos: Makefile
 
227
        $(strip $(SED) --in-place \
 
228
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
229
                $@)
 
230
 
 
231
mandos-keygen: Makefile
 
232
        $(strip $(SED) --in-place \
 
233
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
234
                $@)
 
235
 
 
236
mandos-ctl: Makefile
 
237
        $(strip $(SED) --in-place \
 
238
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
239
                $@)
 
240
 
 
241
mandos-monitor: Makefile
 
242
        $(strip $(SED) --in-place \
 
243
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
244
                $@)
 
245
 
 
246
mandos.lsm: Makefile
 
247
        $(strip $(SED) --in-place \
 
248
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
249
                $@)
 
250
        $(strip $(SED) --in-place \
 
251
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
252
                $@)
 
253
        $(strip $(SED) --in-place \
 
254
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
255
                $@)
 
256
 
 
257
# Need to add the GnuTLS, Avahi and GPGME libraries
 
258
plugins.d/mandos-client: plugins.d/mandos-client.c
 
259
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
260
                ) $(GPGME_CFLAGS) -lrt $(GNUTLS_LIBS) $(strip\
 
261
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
262
                ) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
5
273
 
6
274
clean:
7
 
        rm -f server client client_debug
8
 
 
9
 
client_debug: client
10
 
        mv -f client client.tmp
11
 
        $(MAKE) client CXXFLAGS="$(CXXFLAGS) -DDEBUG -DCERT_ROOT=."
12
 
        mv client client_debug
13
 
        mv client.tmp client
 
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
 
276
 
 
277
distclean: clean
 
278
mostlyclean: clean
 
279
maintainer-clean: clean
 
280
        -rm --force --recursive keydir confdir statedir
 
281
 
 
282
check:  all
 
283
        ./mandos --check
 
284
        ./mandos-ctl --check
 
285
 
 
286
# Run the client with a local config and key
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
 
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
 
303
        ./plugin-runner --plugin-dir=plugins.d \
 
304
                --plugin-helper-dir=plugin-helpers \
 
305
                --config-file=plugin-runner.conf \
 
306
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
307
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
308
                $(CLIENTARGS)
 
309
 
 
310
# Used by run-client
 
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
312
        install --directory keydir
 
313
        ./mandos-keygen --dir keydir --force
 
314
 
 
315
# Run the server with a local config
 
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
317
        ./mandos --debug --no-dbus --configdir=confdir \
 
318
                --statedir=statedir $(SERVERARGS)
 
319
 
 
320
# Used by run-server
 
321
confdir/mandos.conf: mandos.conf
 
322
        install --directory confdir
 
323
        install --mode=u=rw,go=r $^ $@
 
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
325
        install --directory confdir
 
326
        install --mode=u=rw $< $@
 
327
# Add a client password
 
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
329
statedir:
 
330
        install --directory statedir
 
331
 
 
332
install: install-server install-client-nokey
 
333
 
 
334
install-html: html
 
335
        install --directory $(htmldir)
 
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
337
                $(htmldocs)
 
338
 
 
339
install-server: doc
 
340
        install --directory $(CONFDIR)
 
341
        if install --directory --mode=u=rwx --owner=$(USER) \
 
342
                --group=$(GROUP) $(STATEDIR); then \
 
343
                :; \
 
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
346
        fi
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
349
                        $(TMPFILES)/mandos.conf; \
 
350
        fi
 
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
353
                mandos-ctl
 
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
355
                mandos-monitor
 
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
 
357
                mandos.conf
 
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
 
359
                clients.conf
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
362
        install --mode=u=rwx,go=rx init.d-mandos \
 
363
                $(DESTDIR)/etc/init.d/mandos
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
366
        fi
 
367
        install --mode=u=rw,go=r default-mandos \
 
368
                $(DESTDIR)/etc/default/mandos
 
369
        if [ -z $(DESTDIR) ]; then \
 
370
                update-rc.d mandos defaults 25 15;\
 
371
        fi
 
372
        gzip --best --to-stdout mandos.8 \
 
373
                > $(MANDIR)/man8/mandos.8.gz
 
374
        gzip --best --to-stdout mandos-monitor.8 \
 
375
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
376
        gzip --best --to-stdout mandos-ctl.8 \
 
377
                > $(MANDIR)/man8/mandos-ctl.8.gz
 
378
        gzip --best --to-stdout mandos.conf.5 \
 
379
                > $(MANDIR)/man5/mandos.conf.5.gz
 
380
        gzip --best --to-stdout mandos-clients.conf.5 \
 
381
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
382
        gzip --best --to-stdout intro.8mandos \
 
383
                > $(MANDIR)/man8/intro.8mandos.gz
 
384
 
 
385
install-client-nokey: all doc
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
 
387
        install --directory --mode=u=rwx $(KEYDIR) \
 
388
                $(LIBDIR)/mandos/plugins.d \
 
389
                $(LIBDIR)/mandos/plugin-helpers
 
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
 
391
                install --mode=u=rwx \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
 
393
                        "$(CONFDIR)/plugin-helpers"; \
 
394
        fi
 
395
        install --mode=u=rwx,go=rx --directory \
 
396
                "$(CONFDIR)/network-hooks.d"
 
397
        install --mode=u=rwx,go=rx \
 
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
399
        install --mode=u=rwx,go=rx \
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
 
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
402
                mandos-keygen
 
403
        install --mode=u=rwx,go=rx \
 
404
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
405
                plugins.d/password-prompt
 
406
        install --mode=u=rwxs,go=rx \
 
407
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
408
                plugins.d/mandos-client
 
409
        install --mode=u=rwxs,go=rx \
 
410
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
411
                plugins.d/usplash
 
412
        install --mode=u=rwxs,go=rx \
 
413
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
414
                plugins.d/splashy
 
415
        install --mode=u=rwxs,go=rx \
 
416
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
417
                plugins.d/askpass-fifo
 
418
        install --mode=u=rwxs,go=rx \
 
419
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
420
                plugins.d/plymouth
 
421
        install --mode=u=rwx,go=rx \
 
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
423
                plugin-helpers/mandos-client-iprouteadddel
 
424
        install initramfs-tools-hook \
 
425
                $(INITRAMFSTOOLS)/hooks/mandos
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
 
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
428
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
429
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
430
        install initramfs-tools-script \
 
431
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
432
        install initramfs-tools-script-stop \
 
433
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
434
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
435
        gzip --best --to-stdout mandos-keygen.8 \
 
436
                > $(MANDIR)/man8/mandos-keygen.8.gz
 
437
        gzip --best --to-stdout plugin-runner.8mandos \
 
438
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
439
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
440
                > $(MANDIR)/man8/mandos-client.8mandos.gz
 
441
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
 
442
                > $(MANDIR)/man8/password-prompt.8mandos.gz
 
443
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
444
                > $(MANDIR)/man8/usplash.8mandos.gz
 
445
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
446
                > $(MANDIR)/man8/splashy.8mandos.gz
 
447
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
448
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
449
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
450
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
451
 
 
452
install-client: install-client-nokey
 
453
# Post-installation stuff
 
454
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 
455
        update-initramfs -k all -u
 
456
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
 
457
 
 
458
uninstall: uninstall-server uninstall-client
 
459
 
 
460
uninstall-server:
 
461
        -rm --force $(PREFIX)/sbin/mandos \
 
462
                $(PREFIX)/sbin/mandos-ctl \
 
463
                $(PREFIX)/sbin/mandos-monitor \
 
464
                $(MANDIR)/man8/mandos.8.gz \
 
465
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
466
                $(MANDIR)/man8/mandos-ctl.8.gz \
 
467
                $(MANDIR)/man5/mandos.conf.5.gz \
 
468
                $(MANDIR)/man5/mandos-clients.conf.5.gz
 
469
        update-rc.d -f mandos remove
 
470
        -rmdir $(CONFDIR)
 
471
 
 
472
uninstall-client:
 
473
# Refuse to uninstall client if /etc/crypttab is explicitly configured
 
474
# to use it.
 
475
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
 
476
                $(DESTDIR)/etc/crypttab
 
477
        -rm --force $(PREFIX)/sbin/mandos-keygen \
 
478
                $(LIBDIR)/mandos/plugin-runner \
 
479
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
480
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
481
                $(LIBDIR)/mandos/plugins.d/usplash \
 
482
                $(LIBDIR)/mandos/plugins.d/splashy \
 
483
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
484
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
485
                $(INITRAMFSTOOLS)/hooks/mandos \
 
486
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
487
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
488
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
489
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
 
490
                $(MANDIR)/man8/mandos-client.8mandos.gz
 
491
                $(MANDIR)/man8/password-prompt.8mandos.gz \
 
492
                $(MANDIR)/man8/usplash.8mandos.gz \
 
493
                $(MANDIR)/man8/splashy.8mandos.gz \
 
494
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
495
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
496
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
497
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
498
        update-initramfs -k all -u
 
499
 
 
500
purge: purge-server purge-client
 
501
 
 
502
purge-server: uninstall-server
 
503
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
 
504
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
505
                $(DESTDIR)/etc/default/mandos \
 
506
                $(DESTDIR)/etc/init.d/mandos \
 
507
                $(SYSTEMD)/mandos.service \
 
508
                $(DESTDIR)/run/mandos.pid \
 
509
                $(DESTDIR)/var/run/mandos.pid
 
510
        -rmdir $(CONFDIR)
 
511
 
 
512
purge-client: uninstall-client
 
513
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
514
        -rm --force $(CONFDIR)/plugin-runner.conf \
 
515
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
516
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
517
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)