/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-08-02 22:16:53 UTC
  • Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install

There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation.  It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time.  The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file.  The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor).  The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.

Fixing this should also make the Debian CI autopkgtest tests work.

* debian/mandos.postinst (configure): After creating (or renaming)
                                      user & group, reload D-Bus
                                      daemon (if present).

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG=-ggdb3
14
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
17
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
 
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
19
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
20
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
21
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
23
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
24
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
 
        -fsanitize=enum
27
 
# Check which sanitizing options can be used
28
 
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
 
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
 
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
31
 
LINK_FORTIFY_LD=-z relro -z now
32
 
LINK_FORTIFY=
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
33
35
 
34
36
# If BROKEN_PIE is set, do not build with -pie
35
37
ifndef BROKEN_PIE
37
39
LINK_FORTIFY += -pie
38
40
endif
39
41
#COVERAGE=--coverage
40
 
OPTIMIZE=-Os -fno-strict-aliasing
41
 
LANGUAGE=-std=gnu11
42
 
htmldir=man
43
 
version=1.7.3
44
 
SED=sed
45
 
 
46
 
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
htmldir:=man
 
45
version:=1.8.5
 
46
SED:=sed
 
47
PKG_CONFIG?=pkg-config
 
48
 
 
49
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
50
        || getent passwd nobody || echo 65534)))
 
51
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
52
        || getent group nogroup || echo 65534)))
 
53
 
 
54
LINUXVERSION:=$(shell uname --kernel-release)
48
55
 
49
56
## Use these settings for a traditional /usr/local install
50
 
# PREFIX=$(DESTDIR)/usr/local
51
 
# CONFDIR=$(DESTDIR)/etc/mandos
52
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
53
 
# MANDIR=$(PREFIX)/man
54
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
55
 
# STATEDIR=$(DESTDIR)/var/lib/mandos
56
 
# LIBDIR=$(PREFIX)/lib
 
57
# PREFIX:=$(DESTDIR)/usr/local
 
58
# CONFDIR:=$(DESTDIR)/etc/mandos
 
59
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
60
# MANDIR:=$(PREFIX)/man
 
61
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
62
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
63
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
64
# LIBDIR:=$(PREFIX)/lib
57
65
##
58
66
 
59
67
## These settings are for a package-type install
60
 
PREFIX=$(DESTDIR)/usr
61
 
CONFDIR=$(DESTDIR)/etc/mandos
62
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
63
 
MANDIR=$(PREFIX)/share/man
64
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
65
 
STATEDIR=$(DESTDIR)/var/lib/mandos
66
 
LIBDIR=$(shell \
 
68
PREFIX:=$(DESTDIR)/usr
 
69
CONFDIR:=$(DESTDIR)/etc/mandos
 
70
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
71
MANDIR:=$(PREFIX)/share/man
 
72
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
73
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
74
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
75
LIBDIR:=$(shell \
67
76
        for d in \
68
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
77
        "/usr/lib/`dpkg-architecture \
 
78
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
69
79
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
70
80
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
71
81
                        echo "$(DESTDIR)$$d"; \
74
84
        done)
75
85
##
76
86
 
77
 
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
87
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
88
                        --variable=systemdsystemunitdir)
 
89
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
90
                        --variable=tmpfilesdir)
78
91
 
79
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
80
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
81
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
82
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
83
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
84
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
92
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
93
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
94
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
95
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
96
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
97
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
85
98
        getconf LFS_LDFLAGS)
86
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
87
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
 
99
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
100
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
101
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
102
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
88
103
 
89
104
# Do not change these two
90
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
91
 
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
92
 
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
93
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
105
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
 
106
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
107
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
108
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
94
109
 
95
110
# Commands to format a DocBook <refentry> document into a manual page
96
111
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
102
117
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
103
118
        $(notdir $<); \
104
119
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
105
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
106
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
107
 
        fi >/dev/null)
 
120
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
121
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
122
        $(notdir $@); fi >/dev/null)
108
123
 
109
124
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
110
125
        --param make.year.ranges                1 \
116
131
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
117
132
        $<; $(HTMLPOST) $@)
118
133
# Fix citerefentry links
119
 
HTMLPOST=$(SED) --in-place \
 
134
HTMLPOST:=$(SED) --in-place \
120
135
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
121
136
 
122
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
 
137
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
123
138
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
124
139
        plugins.d/plymouth
125
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
126
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
127
 
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
128
 
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
140
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
141
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
142
        $(PLUGIN_HELPERS)
 
143
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
144
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
129
145
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
146
        dracut-module/password-agent.8mandos \
130
147
        plugins.d/mandos-client.8mandos \
131
148
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
132
149
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
133
150
        plugins.d/plymouth.8mandos intro.8mandos
134
151
 
135
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
 
152
htmldocs:=$(addsuffix .xhtml,$(DOCS))
136
153
 
137
 
objects=$(addsuffix .o,$(CPROGS))
 
154
objects:=$(addsuffix .o,$(CPROGS))
138
155
 
139
156
all: $(PROGS) mandos.lsm
140
157
 
204
221
                overview.xml legalnotice.xml
205
222
        $(DOCBOOKTOHTML)
206
223
 
 
224
dracut-module/password-agent.8mandos: \
 
225
                dracut-module/password-agent.xml common.ent \
 
226
                overview.xml legalnotice.xml
 
227
        $(DOCBOOKTOMAN)
 
228
dracut-module/password-agent.8mandos.xhtml: \
 
229
                dracut-module/password-agent.xml common.ent \
 
230
                overview.xml legalnotice.xml
 
231
        $(DOCBOOKTOHTML)
 
232
 
207
233
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
208
234
                                        common.ent \
209
235
                                        mandos-options.xml \
252
278
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
253
279
                $@)
254
280
 
 
281
# Need to add the GnuTLS, Avahi and GPGME libraries
255
282
plugins.d/mandos-client: plugins.d/mandos-client.c
256
 
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
257
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
283
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
284
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
 
285
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
286
                ) $(LDLIBS) -o $@
258
287
 
 
288
# Need to add the libnl-route library
259
289
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
260
290
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
261
291
                ) $(LOADLIBES) $(LDLIBS) -o $@
262
292
 
 
293
# Need to add the GLib and pthread libraries
 
294
dracut-module/password-agent: dracut-module/password-agent.c
 
295
        $(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
 
296
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
297
 
263
298
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
264
299
        check run-client run-server install install-html \
265
300
        install-server install-client-nokey install-client uninstall \
274
309
maintainer-clean: clean
275
310
        -rm --force --recursive keydir confdir statedir
276
311
 
277
 
check:  all
 
312
check: all
278
313
        ./mandos --check
279
314
        ./mandos-ctl --check
 
315
        ./mandos-keygen --version
 
316
        ./plugin-runner --version
 
317
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
318
        ./dracut-module/password-agent --test
280
319
 
281
320
# Run the client with a local config and key
282
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
283
 
        @echo "###################################################################"
284
 
        @echo "# The following error messages are harmless and can be safely     #"
285
 
        @echo "# ignored.  The messages are caused by not running as root, but   #"
286
 
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
287
 
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
288
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
289
 
        @echo "#                     setuid: Operation not permitted             #"
290
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
291
 
        @echo "# From mandos-client:                                             #"
292
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
293
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
294
 
        @echo "###################################################################"
 
321
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
322
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
323
        @echo '######################################################'
 
324
        @echo '# The following error messages are harmless and can  #'
 
325
        @echo '#  be safely ignored:                                #'
 
326
        @echo '## From plugin-runner:                               #'
 
327
        @echo '# setgid: Operation not permitted                    #'
 
328
        @echo '# setuid: Operation not permitted                    #'
 
329
        @echo '## From askpass-fifo:                                #'
 
330
        @echo '# mkfifo: Permission denied                          #'
 
331
        @echo '## From mandos-client:                               #'
 
332
        @echo '# Failed to raise privileges: Operation not permi... #'
 
333
        @echo '# Warning: network hook "*" exited with status *     #'
 
334
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
335
        @echo '# Failed to bring up interface "*": Operation not... #'
 
336
        @echo '#                                                    #'
 
337
        @echo '# (The messages are caused by not running as root,   #'
 
338
        @echo '# but you should NOT run "make run-client" as root   #'
 
339
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
340
        @echo '# root, which is also NOT recommended.)              #'
 
341
        @echo '######################################################'
295
342
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
296
343
        ./plugin-runner --plugin-dir=plugins.d \
297
344
                --plugin-helper-dir=plugin-helpers \
298
345
                --config-file=plugin-runner.conf \
299
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
346
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
300
347
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
301
348
                $(CLIENTARGS)
302
349
 
303
350
# Used by run-client
304
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
351
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
305
352
        install --directory keydir
306
353
        ./mandos-keygen --dir keydir --force
307
354
 
314
361
confdir/mandos.conf: mandos.conf
315
362
        install --directory confdir
316
363
        install --mode=u=rw,go=r $^ $@
317
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
364
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
318
365
        install --directory confdir
319
366
        install --mode=u=rw $< $@
320
367
# Add a client password
337
384
        elif install --directory --mode=u=rwx $(STATEDIR); then \
338
385
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
339
386
        fi
 
387
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
388
                        -a -d "$(TMPFILES)" ]; then \
 
389
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
390
                        $(TMPFILES)/mandos.conf; \
 
391
        fi
340
392
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
341
393
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
342
394
                mandos-ctl
378
430
                $(LIBDIR)/mandos/plugin-helpers
379
431
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
380
432
                install --mode=u=rwx \
381
 
                        --directory "$(CONFDIR)/plugins.d"; \
382
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
 
433
                        --directory "$(CONFDIR)/plugins.d" \
 
434
                        "$(CONFDIR)/plugin-helpers"; \
383
435
        fi
384
436
        install --mode=u=rwx,go=rx --directory \
385
437
                "$(CONFDIR)/network-hooks.d"
386
438
        install --mode=u=rwx,go=rx \
387
439
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
440
        install --mode=u=rwx,go=rx \
 
441
                --target-directory=$(LIBDIR)/mandos \
 
442
                mandos-to-cryptroot-unlock
388
443
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
389
444
                mandos-keygen
390
445
        install --mode=u=rwx,go=rx \
405
460
        install --mode=u=rwxs,go=rx \
406
461
                --target-directory=$(LIBDIR)/mandos/plugins.d \
407
462
                plugins.d/plymouth
408
 
        install --mode=u=rwxs,go=rx \
 
463
        install --mode=u=rwx,go=rx \
409
464
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
410
465
                plugin-helpers/mandos-client-iprouteadddel
411
466
        install initramfs-tools-hook \
412
467
                $(INITRAMFSTOOLS)/hooks/mandos
413
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
414
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
468
        install --mode=u=rw,go=r initramfs-tools-conf \
 
469
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
470
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
471
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
415
472
        install initramfs-tools-script \
416
473
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
474
        install initramfs-tools-script-stop \
 
475
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
476
        install --directory $(DRACUTMODULE)
 
477
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
478
                dracut-module/ask-password-mandos.path \
 
479
                dracut-module/ask-password-mandos.service
 
480
        install --mode=u=rwxs,go=rx \
 
481
                --target-directory=$(DRACUTMODULE) \
 
482
                dracut-module/module-setup.sh \
 
483
                dracut-module/cmdline-mandos.sh \
 
484
                dracut-module/password-agent
417
485
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
418
486
        gzip --best --to-stdout mandos-keygen.8 \
419
487
                > $(MANDIR)/man8/mandos-keygen.8.gz
431
499
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
432
500
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
433
501
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
502
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
503
                > $(MANDIR)/man8/password-agent.8mandos.gz
434
504
 
435
505
install-client: install-client-nokey
436
506
# Post-installation stuff
437
507
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
438
 
        update-initramfs -k all -u
 
508
        if command -v update-initramfs >/dev/null; then \
 
509
            update-initramfs -k all -u; \
 
510
        elif command -v dracut >/dev/null; then \
 
511
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
512
                if [ -w "$$initrd" ]; then \
 
513
                    chmod go-r "$$initrd"; \
 
514
                    dracut --force "$$initrd"; \
 
515
                fi; \
 
516
            done; \
 
517
        fi
439
518
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
440
519
 
441
520
uninstall: uninstall-server uninstall-client
468
547
                $(INITRAMFSTOOLS)/hooks/mandos \
469
548
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
470
549
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
550
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
551
                $(DRACUTMODULE)/ask-password-mandos.path \
 
552
                $(DRACUTMODULE)/ask-password-mandos.service \
 
553
                $(DRACUTMODULE)/module-setup.sh \
 
554
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
555
                $(DRACUTMODULE)/password-agent \
471
556
                $(MANDIR)/man8/mandos-keygen.8.gz \
472
557
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
473
558
                $(MANDIR)/man8/mandos-client.8mandos.gz
476
561
                $(MANDIR)/man8/splashy.8mandos.gz \
477
562
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
478
563
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
564
                $(MANDIR)/man8/password-agent.8mandos.gz \
479
565
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
480
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
481
 
        update-initramfs -k all -u
 
566
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
567
        if command -v update-initramfs >/dev/null; then \
 
568
            update-initramfs -k all -u; \
 
569
        elif command -v dracut >/dev/null; then \
 
570
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
571
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
572
            done; \
 
573
        fi
482
574
 
483
575
purge: purge-server purge-client
484
576
 
493
585
        -rmdir $(CONFDIR)
494
586
 
495
587
purge-client: uninstall-client
496
 
        -shred --remove $(KEYDIR)/seckey.txt
 
588
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
497
589
        -rm --force $(CONFDIR)/plugin-runner.conf \
498
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
590
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
591
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
499
592
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)