To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to Makefile
- browse files at revision 1138
- compare with another revision
- download diff
- download tarball
- view history from revision 1138
- Committer: Teddy Hogeborn
- Date: 2019-08-02 22:16:53 UTC
- Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install
There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation. It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time. The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file. The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor). The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.
Fixing this should also make the Debian CI autopkgtest tests work.
* debian/mandos.postinst (configure): After creating (or renaming)
user & group, reload D-Bus
daemon (if present).
There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation. It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time. The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file. The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor). The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.
Fixing this should also make the Debian CI autopkgtest tests work.
* debian/mandos.postinst (configure): After creating (or renaming)
user & group, reload D-Bus
daemon (if present).
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
Makefile
1
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs -Wswitch-default -Wswitch-enum -Wunused-parameter -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow -Wunsafe-loop-optimizations -Wpointer-arith -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings -Wconversion -Wstrict-prototypes -Wold-style-definition -Wpacked -Wnested-externs -Wunreachable-code -Winline -Wvolatile-register-var
2
DEBUG=-ggdb3
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
-Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
-Wunused -Wuninitialized -Wstrict-overflow=5 \
4
-Wsuggest-attribute=pure -Wsuggest-attribute=const \
5
-Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
6
-Wunsafe-loop-optimizations -Wpointer-arith \
7
-Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
8
-Wconversion -Wlogical-op -Waggregate-return \
9
-Wstrict-prototypes -Wold-style-definition \
10
-Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
-Wredundant-decls -Wnested-externs -Winline -Wvla \
12
-Wvolatile-register-var -Woverlength-strings
13
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
## Check which sanitizing options can be used
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
# echo 'int main(){}' | $(CC) --language=c $(option) \
18
# /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
-fsanitize=shift -fsanitize=integer-divide-by-zero \
22
-fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
-fsanitize=return -fsanitize=signed-integer-overflow \
24
-fsanitize=bounds -fsanitize=alignment \
25
-fsanitize=object-size -fsanitize=float-divide-by-zero \
26
-fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
-fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
-fsanitize=enum -fsanitize-address-use-after-scope
29
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
LINK_FORTIFY_LD:=-z relro -z now
34
LINK_FORTIFY:=
35
36
# If BROKEN_PIE is set, do not build with -pie
37
ifndef BROKEN_PIE
38
FORTIFY += -fPIE
39
LINK_FORTIFY += -pie
40
endif
3
41
#COVERAGE=--coverage
4
OPTIMIZE=-Os
5
LANGUAGE=-std=gnu99
42
OPTIMIZE:=-Os -fno-strict-aliasing
43
LANGUAGE:=-std=gnu11
44
htmldir:=man
45
version:=1.8.5
46
SED:=sed
47
PKG_CONFIG?=pkg-config
48
49
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
50
|| getent passwd nobody || echo 65534)))
51
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
52
|| getent group nogroup || echo 65534)))
53
54
LINUXVERSION:=$(shell uname --kernel-release)
55
56
## Use these settings for a traditional /usr/local install
57
# PREFIX:=$(DESTDIR)/usr/local
58
# CONFDIR:=$(DESTDIR)/etc/mandos
59
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
60
# MANDIR:=$(PREFIX)/man
61
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
62
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
63
# STATEDIR:=$(DESTDIR)/var/lib/mandos
64
# LIBDIR:=$(PREFIX)/lib
65
##
66
67
## These settings are for a package-type install
68
PREFIX:=$(DESTDIR)/usr
69
CONFDIR:=$(DESTDIR)/etc/mandos
70
KEYDIR:=$(DESTDIR)/etc/keys/mandos
71
MANDIR:=$(PREFIX)/share/man
72
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
73
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
74
STATEDIR:=$(DESTDIR)/var/lib/mandos
75
LIBDIR:=$(shell \
76
for d in \
77
"/usr/lib/`dpkg-architecture \
78
-qDEB_HOST_MULTIARCH 2>/dev/null`" \
79
"`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
80
if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
81
echo "$(DESTDIR)$$d"; \
82
break; \
83
fi; \
84
done)
85
##
86
87
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
88
--variable=systemdsystemunitdir)
89
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
90
--variable=tmpfilesdir)
91
92
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
93
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
94
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
95
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
96
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
97
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
98
getconf LFS_LDFLAGS)
99
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
100
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
101
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
102
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
6
103
7
104
# Do not change these two
8
CFLAGS=$(WARN) $(COVERAGE) $(DEBUG) $(OPTIMIZE) $(LANGUAGE)
9
LDFLAGS=$(COVERAGE)
10
11
PROGS=plugbasedclient plugins.d/mandosclient plugins.d/passprompt
12
13
objects=$(shell for p in $(PROGS); do echo $${p}.o; done)
14
15
all: $(PROGS)
16
17
plugbasedclient: plugbasedclient.o
18
$(LINK.o) -lgnutls $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
19
20
plugins.d/mandosclient: plugins.d/mandosclient.o
21
$(LINK.o) -lgnutls -lavahi-core -lgpgme $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
22
23
plugins.d/passprompt: plugins.d/passprompt.o
24
$(LINK.o) $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
25
26
.PHONY : clean
105
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
106
$(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
107
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
108
) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
109
110
# Commands to format a DocBook <refentry> document into a manual page
111
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
112
--param man.charmap.use.subset 0 \
113
--param make.year.ranges 1 \
114
--param make.single.year.ranges 1 \
115
--param man.output.quietly 1 \
116
--param man.authors.section.enabled 0 \
117
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
118
$(notdir $<); \
119
if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
120
&& command -v man >/dev/null; then LANG=en_US.UTF-8 \
121
MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
122
$(notdir $@); fi >/dev/null)
123
124
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
125
--param make.year.ranges 1 \
126
--param make.single.year.ranges 1 \
127
--param man.output.quietly 1 \
128
--param man.authors.section.enabled 0 \
129
--param citerefentry.link 1 \
130
--output $@ \
131
/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
132
$<; $(HTMLPOST) $@)
133
# Fix citerefentry links
134
HTMLPOST:=$(SED) --in-place \
135
--expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
136
137
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
138
plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
139
plugins.d/plymouth
140
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
141
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
142
$(PLUGIN_HELPERS)
143
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
144
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
145
mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
146
dracut-module/password-agent.8mandos \
147
plugins.d/mandos-client.8mandos \
148
plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
149
plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
150
plugins.d/plymouth.8mandos intro.8mandos
151
152
htmldocs:=$(addsuffix .xhtml,$(DOCS))
153
154
objects:=$(addsuffix .o,$(CPROGS))
155
156
all: $(PROGS) mandos.lsm
157
158
doc: $(DOCS)
159
160
html: $(htmldocs)
161
162
%.5: %.xml common.ent legalnotice.xml
163
$(DOCBOOKTOMAN)
164
%.5.xhtml: %.xml common.ent legalnotice.xml
165
$(DOCBOOKTOHTML)
166
167
%.8: %.xml common.ent legalnotice.xml
168
$(DOCBOOKTOMAN)
169
%.8.xhtml: %.xml common.ent legalnotice.xml
170
$(DOCBOOKTOHTML)
171
172
%.8mandos: %.xml common.ent legalnotice.xml
173
$(DOCBOOKTOMAN)
174
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
175
$(DOCBOOKTOHTML)
176
177
intro.8mandos: intro.xml common.ent legalnotice.xml
178
$(DOCBOOKTOMAN)
179
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
180
$(DOCBOOKTOHTML)
181
182
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
183
legalnotice.xml
184
$(DOCBOOKTOMAN)
185
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
186
overview.xml legalnotice.xml
187
$(DOCBOOKTOHTML)
188
189
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
190
legalnotice.xml
191
$(DOCBOOKTOMAN)
192
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
193
legalnotice.xml
194
$(DOCBOOKTOHTML)
195
196
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
197
legalnotice.xml
198
$(DOCBOOKTOMAN)
199
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
200
legalnotice.xml
201
$(DOCBOOKTOHTML)
202
203
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
204
legalnotice.xml
205
$(DOCBOOKTOMAN)
206
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
207
legalnotice.xml
208
$(DOCBOOKTOHTML)
209
210
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
211
legalnotice.xml
212
$(DOCBOOKTOMAN)
213
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
214
legalnotice.xml
215
$(DOCBOOKTOHTML)
216
217
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
218
legalnotice.xml
219
$(DOCBOOKTOMAN)
220
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
221
overview.xml legalnotice.xml
222
$(DOCBOOKTOHTML)
223
224
dracut-module/password-agent.8mandos: \
225
dracut-module/password-agent.xml common.ent \
226
overview.xml legalnotice.xml
227
$(DOCBOOKTOMAN)
228
dracut-module/password-agent.8mandos.xhtml: \
229
dracut-module/password-agent.xml common.ent \
230
overview.xml legalnotice.xml
231
$(DOCBOOKTOHTML)
232
233
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
234
common.ent \
235
mandos-options.xml \
236
overview.xml legalnotice.xml
237
$(DOCBOOKTOMAN)
238
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
239
common.ent \
240
mandos-options.xml \
241
overview.xml legalnotice.xml
242
$(DOCBOOKTOHTML)
243
244
# Update all these files with version number $(version)
245
common.ent: Makefile
246
$(strip $(SED) --in-place \
247
--expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
248
$@)
249
250
mandos: Makefile
251
$(strip $(SED) --in-place \
252
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
253
$@)
254
255
mandos-keygen: Makefile
256
$(strip $(SED) --in-place \
257
--expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
258
$@)
259
260
mandos-ctl: Makefile
261
$(strip $(SED) --in-place \
262
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
263
$@)
264
265
mandos-monitor: Makefile
266
$(strip $(SED) --in-place \
267
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
268
$@)
269
270
mandos.lsm: Makefile
271
$(strip $(SED) --in-place \
272
--expression='s/^\(Version:\).*/\1\t$(version)/' \
273
$@)
274
$(strip $(SED) --in-place \
275
--expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
276
$@)
277
$(strip $(SED) --in-place \
278
--expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
279
$@)
280
281
# Need to add the GnuTLS, Avahi and GPGME libraries
282
plugins.d/mandos-client: plugins.d/mandos-client.c
283
$(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
284
) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
285
) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
286
) $(LDLIBS) -o $@
287
288
# Need to add the libnl-route library
289
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
290
$(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
291
) $(LOADLIBES) $(LDLIBS) -o $@
292
293
# Need to add the GLib and pthread libraries
294
dracut-module/password-agent: dracut-module/password-agent.c
295
$(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
296
) $(LOADLIBES) $(LDLIBS) -o $@
297
298
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
299
check run-client run-server install install-html \
300
install-server install-client-nokey install-client uninstall \
301
uninstall-server uninstall-client purge purge-server \
302
purge-client
303
27
304
clean:
28
-rm -f $(PROGS) $(objects) core
305
-rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
306
307
distclean: clean
308
mostlyclean: clean
309
maintainer-clean: clean
310
-rm --force --recursive keydir confdir statedir
311
312
check: all
313
./mandos --check
314
./mandos-ctl --check
315
./mandos-keygen --version
316
./plugin-runner --version
317
./plugin-helpers/mandos-client-iprouteadddel --version
318
./dracut-module/password-agent --test
319
320
# Run the client with a local config and key
321
run-client: all keydir/seckey.txt keydir/pubkey.txt \
322
keydir/tls-privkey.pem keydir/tls-pubkey.pem
323
@echo '######################################################'
324
@echo '# The following error messages are harmless and can #'
325
@echo '# be safely ignored: #'
326
@echo '## From plugin-runner: #'
327
@echo '# setgid: Operation not permitted #'
328
@echo '# setuid: Operation not permitted #'
329
@echo '## From askpass-fifo: #'
330
@echo '# mkfifo: Permission denied #'
331
@echo '## From mandos-client: #'
332
@echo '# Failed to raise privileges: Operation not permi... #'
333
@echo '# Warning: network hook "*" exited with status * #'
334
@echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
335
@echo '# Failed to bring up interface "*": Operation not... #'
336
@echo '# #'
337
@echo '# (The messages are caused by not running as root, #'
338
@echo '# but you should NOT run "make run-client" as root #'
339
@echo '# unless you also unpacked and compiled Mandos as #'
340
@echo '# root, which is also NOT recommended.) #'
341
@echo '######################################################'
342
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
343
./plugin-runner --plugin-dir=plugins.d \
344
--plugin-helper-dir=plugin-helpers \
345
--config-file=plugin-runner.conf \
346
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
347
--env-for=mandos-client:GNOME_KEYRING_CONTROL= \
348
$(CLIENTARGS)
349
350
# Used by run-client
351
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
352
install --directory keydir
353
./mandos-keygen --dir keydir --force
354
355
# Run the server with a local config
356
run-server: confdir/mandos.conf confdir/clients.conf statedir
357
./mandos --debug --no-dbus --configdir=confdir \
358
--statedir=statedir $(SERVERARGS)
359
360
# Used by run-server
361
confdir/mandos.conf: mandos.conf
362
install --directory confdir
363
install --mode=u=rw,go=r $^ $@
364
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
365
install --directory confdir
366
install --mode=u=rw $< $@
367
# Add a client password
368
./mandos-keygen --dir keydir --password --no-ssh >> $@
369
statedir:
370
install --directory statedir
371
372
install: install-server install-client-nokey
373
374
install-html: html
375
install --directory $(htmldir)
376
install --mode=u=rw,go=r --target-directory=$(htmldir) \
377
$(htmldocs)
378
379
install-server: doc
380
install --directory $(CONFDIR)
381
if install --directory --mode=u=rwx --owner=$(USER) \
382
--group=$(GROUP) $(STATEDIR); then \
383
:; \
384
elif install --directory --mode=u=rwx $(STATEDIR); then \
385
chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
386
fi
387
if [ "$(TMPFILES)" != "$(DESTDIR)" \
388
-a -d "$(TMPFILES)" ]; then \
389
install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
390
$(TMPFILES)/mandos.conf; \
391
fi
392
install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
393
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
394
mandos-ctl
395
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
396
mandos-monitor
397
install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
398
mandos.conf
399
install --mode=u=rw --target-directory=$(CONFDIR) \
400
clients.conf
401
install --mode=u=rw,go=r dbus-mandos.conf \
402
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
403
install --mode=u=rwx,go=rx init.d-mandos \
404
$(DESTDIR)/etc/init.d/mandos
405
if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
406
install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
407
fi
408
install --mode=u=rw,go=r default-mandos \
409
$(DESTDIR)/etc/default/mandos
410
if [ -z $(DESTDIR) ]; then \
411
update-rc.d mandos defaults 25 15;\
412
fi
413
gzip --best --to-stdout mandos.8 \
414
> $(MANDIR)/man8/mandos.8.gz
415
gzip --best --to-stdout mandos-monitor.8 \
416
> $(MANDIR)/man8/mandos-monitor.8.gz
417
gzip --best --to-stdout mandos-ctl.8 \
418
> $(MANDIR)/man8/mandos-ctl.8.gz
419
gzip --best --to-stdout mandos.conf.5 \
420
> $(MANDIR)/man5/mandos.conf.5.gz
421
gzip --best --to-stdout mandos-clients.conf.5 \
422
> $(MANDIR)/man5/mandos-clients.conf.5.gz
423
gzip --best --to-stdout intro.8mandos \
424
> $(MANDIR)/man8/intro.8mandos.gz
425
426
install-client-nokey: all doc
427
install --directory $(LIBDIR)/mandos $(CONFDIR)
428
install --directory --mode=u=rwx $(KEYDIR) \
429
$(LIBDIR)/mandos/plugins.d \
430
$(LIBDIR)/mandos/plugin-helpers
431
if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
432
install --mode=u=rwx \
433
--directory "$(CONFDIR)/plugins.d" \
434
"$(CONFDIR)/plugin-helpers"; \
435
fi
436
install --mode=u=rwx,go=rx --directory \
437
"$(CONFDIR)/network-hooks.d"
438
install --mode=u=rwx,go=rx \
439
--target-directory=$(LIBDIR)/mandos plugin-runner
440
install --mode=u=rwx,go=rx \
441
--target-directory=$(LIBDIR)/mandos \
442
mandos-to-cryptroot-unlock
443
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
444
mandos-keygen
445
install --mode=u=rwx,go=rx \
446
--target-directory=$(LIBDIR)/mandos/plugins.d \
447
plugins.d/password-prompt
448
install --mode=u=rwxs,go=rx \
449
--target-directory=$(LIBDIR)/mandos/plugins.d \
450
plugins.d/mandos-client
451
install --mode=u=rwxs,go=rx \
452
--target-directory=$(LIBDIR)/mandos/plugins.d \
453
plugins.d/usplash
454
install --mode=u=rwxs,go=rx \
455
--target-directory=$(LIBDIR)/mandos/plugins.d \
456
plugins.d/splashy
457
install --mode=u=rwxs,go=rx \
458
--target-directory=$(LIBDIR)/mandos/plugins.d \
459
plugins.d/askpass-fifo
460
install --mode=u=rwxs,go=rx \
461
--target-directory=$(LIBDIR)/mandos/plugins.d \
462
plugins.d/plymouth
463
install --mode=u=rwx,go=rx \
464
--target-directory=$(LIBDIR)/mandos/plugin-helpers \
465
plugin-helpers/mandos-client-iprouteadddel
466
install initramfs-tools-hook \
467
$(INITRAMFSTOOLS)/hooks/mandos
468
install --mode=u=rw,go=r initramfs-tools-conf \
469
$(INITRAMFSTOOLS)/conf.d/mandos-conf
470
install --mode=u=rw,go=r initramfs-tools-conf-hook \
471
$(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
472
install initramfs-tools-script \
473
$(INITRAMFSTOOLS)/scripts/init-premount/mandos
474
install initramfs-tools-script-stop \
475
$(INITRAMFSTOOLS)/scripts/local-premount/mandos
476
install --directory $(DRACUTMODULE)
477
install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
478
dracut-module/ask-password-mandos.path \
479
dracut-module/ask-password-mandos.service
480
install --mode=u=rwxs,go=rx \
481
--target-directory=$(DRACUTMODULE) \
482
dracut-module/module-setup.sh \
483
dracut-module/cmdline-mandos.sh \
484
dracut-module/password-agent
485
install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
486
gzip --best --to-stdout mandos-keygen.8 \
487
> $(MANDIR)/man8/mandos-keygen.8.gz
488
gzip --best --to-stdout plugin-runner.8mandos \
489
> $(MANDIR)/man8/plugin-runner.8mandos.gz
490
gzip --best --to-stdout plugins.d/mandos-client.8mandos \
491
> $(MANDIR)/man8/mandos-client.8mandos.gz
492
gzip --best --to-stdout plugins.d/password-prompt.8mandos \
493
> $(MANDIR)/man8/password-prompt.8mandos.gz
494
gzip --best --to-stdout plugins.d/usplash.8mandos \
495
> $(MANDIR)/man8/usplash.8mandos.gz
496
gzip --best --to-stdout plugins.d/splashy.8mandos \
497
> $(MANDIR)/man8/splashy.8mandos.gz
498
gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
499
> $(MANDIR)/man8/askpass-fifo.8mandos.gz
500
gzip --best --to-stdout plugins.d/plymouth.8mandos \
501
> $(MANDIR)/man8/plymouth.8mandos.gz
502
gzip --best --to-stdout dracut-module/password-agent.8mandos \
503
> $(MANDIR)/man8/password-agent.8mandos.gz
504
505
install-client: install-client-nokey
506
# Post-installation stuff
507
-$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
508
if command -v update-initramfs >/dev/null; then \
509
update-initramfs -k all -u; \
510
elif command -v dracut >/dev/null; then \
511
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
512
if [ -w "$$initrd" ]; then \
513
chmod go-r "$$initrd"; \
514
dracut --force "$$initrd"; \
515
fi; \
516
done; \
517
fi
518
echo "Now run mandos-keygen --password --dir $(KEYDIR)"
519
520
uninstall: uninstall-server uninstall-client
521
522
uninstall-server:
523
-rm --force $(PREFIX)/sbin/mandos \
524
$(PREFIX)/sbin/mandos-ctl \
525
$(PREFIX)/sbin/mandos-monitor \
526
$(MANDIR)/man8/mandos.8.gz \
527
$(MANDIR)/man8/mandos-monitor.8.gz \
528
$(MANDIR)/man8/mandos-ctl.8.gz \
529
$(MANDIR)/man5/mandos.conf.5.gz \
530
$(MANDIR)/man5/mandos-clients.conf.5.gz
531
update-rc.d -f mandos remove
532
-rmdir $(CONFDIR)
533
534
uninstall-client:
535
# Refuse to uninstall client if /etc/crypttab is explicitly configured
536
# to use it.
537
! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
538
$(DESTDIR)/etc/crypttab
539
-rm --force $(PREFIX)/sbin/mandos-keygen \
540
$(LIBDIR)/mandos/plugin-runner \
541
$(LIBDIR)/mandos/plugins.d/password-prompt \
542
$(LIBDIR)/mandos/plugins.d/mandos-client \
543
$(LIBDIR)/mandos/plugins.d/usplash \
544
$(LIBDIR)/mandos/plugins.d/splashy \
545
$(LIBDIR)/mandos/plugins.d/askpass-fifo \
546
$(LIBDIR)/mandos/plugins.d/plymouth \
547
$(INITRAMFSTOOLS)/hooks/mandos \
548
$(INITRAMFSTOOLS)/conf-hooks.d/mandos \
549
$(INITRAMFSTOOLS)/scripts/init-premount/mandos \
550
$(INITRAMFSTOOLS)/scripts/local-premount/mandos \
551
$(DRACUTMODULE)/ask-password-mandos.path \
552
$(DRACUTMODULE)/ask-password-mandos.service \
553
$(DRACUTMODULE)/module-setup.sh \
554
$(DRACUTMODULE)/cmdline-mandos.sh \
555
$(DRACUTMODULE)/password-agent \
556
$(MANDIR)/man8/mandos-keygen.8.gz \
557
$(MANDIR)/man8/plugin-runner.8mandos.gz \
558
$(MANDIR)/man8/mandos-client.8mandos.gz
559
$(MANDIR)/man8/password-prompt.8mandos.gz \
560
$(MANDIR)/man8/usplash.8mandos.gz \
561
$(MANDIR)/man8/splashy.8mandos.gz \
562
$(MANDIR)/man8/askpass-fifo.8mandos.gz \
563
$(MANDIR)/man8/plymouth.8mandos.gz \
564
$(MANDIR)/man8/password-agent.8mandos.gz \
565
-rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
566
$(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
567
if command -v update-initramfs >/dev/null; then \
568
update-initramfs -k all -u; \
569
elif command -v dracut >/dev/null; then \
570
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
571
test -w "$$initrd" && dracut --force "$$initrd"; \
572
done; \
573
fi
574
575
purge: purge-server purge-client
576
577
purge-server: uninstall-server
578
-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
579
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
580
$(DESTDIR)/etc/default/mandos \
581
$(DESTDIR)/etc/init.d/mandos \
582
$(SYSTEMD)/mandos.service \
583
$(DESTDIR)/run/mandos.pid \
584
$(DESTDIR)/var/run/mandos.pid
585
-rmdir $(CONFDIR)
586
587
purge-client: uninstall-client
588
-shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
589
-rm --force $(CONFDIR)/plugin-runner.conf \
590
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
591
$(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
592
-rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0