/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-08-05 21:14:05 UTC
  • Revision ID: teddy@recompile.se-20190805211405-9m6hecekaihpttz9
Override lintian warnings about upgrading from old versions

There are some really things which are imperative that we fix in case
someone were to upgrade from a really old version.  We want to keep
these fixes in the postinst maintainer scripts, even though lintian
complains about such old upgrades not being supported by Debian in
general.  We prefer the code being there, for the sake of the users.

* debian/mandos-client.lintian-overrides
  (maintainer-script-supports-ancient-package-version): New.
  debian/mandos.lintian-overrides
  (maintainer-script-supports-ancient-package-version): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG:=-ggdb3 -fsanitize=address 
14
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
17
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
19
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
23
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
24
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
 
        -fsanitize=enum
27
 
# Check which sanitizing options can be used
28
 
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
 
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
 
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
31
33
LINK_FORTIFY_LD:=-z relro -z now
32
34
LINK_FORTIFY:=
33
35
 
39
41
#COVERAGE=--coverage
40
42
OPTIMIZE:=-Os -fno-strict-aliasing
41
43
LANGUAGE:=-std=gnu11
 
44
FEATURES:=-D_FILE_OFFSET_BITS=64
42
45
htmldir:=man
43
 
version:=1.8.3
 
46
version:=1.8.6
44
47
SED:=sed
45
 
 
46
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
48
PKG_CONFIG?=pkg-config
 
49
 
 
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
51
        || getent passwd nobody || echo 65534)))
 
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
53
        || getent group nogroup || echo 65534)))
 
54
 
 
55
LINUXVERSION:=$(shell uname --kernel-release)
48
56
 
49
57
## Use these settings for a traditional /usr/local install
50
58
# PREFIX:=$(DESTDIR)/usr/local
52
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
53
61
# MANDIR:=$(PREFIX)/man
54
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
55
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
56
65
# LIBDIR:=$(PREFIX)/lib
57
66
##
62
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
63
72
MANDIR:=$(PREFIX)/share/man
64
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
65
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
66
76
LIBDIR:=$(shell \
67
77
        for d in \
68
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
78
        "/usr/lib/`dpkg-architecture \
 
79
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
69
80
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
70
81
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
71
82
                        echo "$(DESTDIR)$$d"; \
74
85
        done)
75
86
##
76
87
 
77
 
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
78
 
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
89
                        --variable=systemdsystemunitdir)
 
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
91
                        --variable=tmpfilesdir)
79
92
 
80
 
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
81
 
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
82
 
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
83
 
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
93
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
94
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
95
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
96
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
84
97
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
85
98
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
86
99
        getconf LFS_LDFLAGS)
87
 
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
88
 
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
 
100
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
101
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
102
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
103
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
89
104
 
90
105
# Do not change these two
91
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
92
 
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
93
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
106
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
107
        $(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
 
108
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
109
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
94
110
 
95
111
# Commands to format a DocBook <refentry> document into a manual page
96
112
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
102
118
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
103
119
        $(notdir $<); \
104
120
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
105
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
106
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
107
 
        fi >/dev/null)
 
121
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
122
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
123
        $(notdir $@); fi >/dev/null)
108
124
 
109
125
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
110
126
        --param make.year.ranges                1 \
123
139
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
124
140
        plugins.d/plymouth
125
141
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
126
 
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
142
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
143
        $(PLUGIN_HELPERS)
127
144
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
128
145
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
129
146
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
147
        dracut-module/password-agent.8mandos \
130
148
        plugins.d/mandos-client.8mandos \
131
149
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
132
150
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
204
222
                overview.xml legalnotice.xml
205
223
        $(DOCBOOKTOHTML)
206
224
 
 
225
dracut-module/password-agent.8mandos: \
 
226
                dracut-module/password-agent.xml common.ent \
 
227
                overview.xml legalnotice.xml
 
228
        $(DOCBOOKTOMAN)
 
229
dracut-module/password-agent.8mandos.xhtml: \
 
230
                dracut-module/password-agent.xml common.ent \
 
231
                overview.xml legalnotice.xml
 
232
        $(DOCBOOKTOHTML)
 
233
 
207
234
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
208
235
                                        common.ent \
209
236
                                        mandos-options.xml \
252
279
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
253
280
                $@)
254
281
 
255
 
# Need to add the GnuTLS, Avahi and GPGME libraries, and can't use
256
 
# -fsanitize=leak because GnuTLS and GPGME both leak memory.
 
282
# Need to add the GnuTLS, Avahi and GPGME libraries
257
283
plugins.d/mandos-client: plugins.d/mandos-client.c
258
 
        $(CC) $(filter-out -fsanitize=leak,$(CFLAGS)) $(strip\
259
 
        ) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) $(strip\
260
 
                ) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) $^ $(strip\
261
 
                ) -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
262
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
284
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
 
285
                ) $(GPGME_CFLAGS) $(GNUTLS_LIBS) $(strip\
 
286
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
 
287
                ) $(LDLIBS) -o $@
263
288
 
 
289
# Need to add the libnl-route library
264
290
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
265
291
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
266
292
                ) $(LOADLIBES) $(LDLIBS) -o $@
267
293
 
 
294
# Need to add the GLib and pthread libraries
 
295
dracut-module/password-agent: dracut-module/password-agent.c
 
296
        $(LINK.c) $(GLIB_CFLAGS) $^ $(GLIB_LIBS) -lpthread $(strip\
 
297
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
298
 
268
299
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
269
300
        check run-client run-server install install-html \
270
301
        install-server install-client-nokey install-client uninstall \
279
310
maintainer-clean: clean
280
311
        -rm --force --recursive keydir confdir statedir
281
312
 
282
 
check:  all
 
313
check: all
283
314
        ./mandos --check
284
315
        ./mandos-ctl --check
 
316
        ./mandos-keygen --version
 
317
        ./plugin-runner --version
 
318
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
319
        ./dracut-module/password-agent --test
285
320
 
286
321
# Run the client with a local config and key
287
 
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
288
 
        @echo "###################################################################"
289
 
        @echo "# The following error messages are harmless and can be safely     #"
290
 
        @echo "# ignored:                                                        #"
291
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
292
 
        @echo "#                     setuid: Operation not permitted             #"
293
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
294
 
        @echo "# From mandos-client:                                             #"
295
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
296
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
297
 
        @echo "#                                                                 #"
298
 
        @echo "# (The messages are caused by not running as root, but you should #"
299
 
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
300
 
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
301
 
        @echo "###################################################################"
 
322
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
323
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
324
        @echo '######################################################'
 
325
        @echo '# The following error messages are harmless and can  #'
 
326
        @echo '#  be safely ignored:                                #'
 
327
        @echo '## From plugin-runner:                               #'
 
328
        @echo '# setgid: Operation not permitted                    #'
 
329
        @echo '# setuid: Operation not permitted                    #'
 
330
        @echo '## From askpass-fifo:                                #'
 
331
        @echo '# mkfifo: Permission denied                          #'
 
332
        @echo '## From mandos-client:                               #'
 
333
        @echo '# Failed to raise privileges: Operation not permi... #'
 
334
        @echo '# Warning: network hook "*" exited with status *     #'
 
335
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
336
        @echo '# Failed to bring up interface "*": Operation not... #'
 
337
        @echo '#                                                    #'
 
338
        @echo '# (The messages are caused by not running as root,   #'
 
339
        @echo '# but you should NOT run "make run-client" as root   #'
 
340
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
341
        @echo '# root, which is also NOT recommended.)              #'
 
342
        @echo '######################################################'
302
343
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
303
344
        ./plugin-runner --plugin-dir=plugins.d \
304
345
                --plugin-helper-dir=plugin-helpers \
344
385
        elif install --directory --mode=u=rwx $(STATEDIR); then \
345
386
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
346
387
        fi
347
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
388
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
389
                        -a -d "$(TMPFILES)" ]; then \
348
390
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
349
391
                        $(TMPFILES)/mandos.conf; \
350
392
        fi
397
439
        install --mode=u=rwx,go=rx \
398
440
                --target-directory=$(LIBDIR)/mandos plugin-runner
399
441
        install --mode=u=rwx,go=rx \
400
 
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
 
442
                --target-directory=$(LIBDIR)/mandos \
 
443
                mandos-to-cryptroot-unlock
401
444
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
402
445
                mandos-keygen
403
446
        install --mode=u=rwx,go=rx \
425
468
                $(INITRAMFSTOOLS)/hooks/mandos
426
469
        install --mode=u=rw,go=r initramfs-tools-conf \
427
470
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
471
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
472
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
428
473
        install initramfs-tools-script \
429
474
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
430
475
        install initramfs-tools-script-stop \
431
476
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
477
        install --directory $(DRACUTMODULE)
 
478
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
479
                dracut-module/ask-password-mandos.path \
 
480
                dracut-module/ask-password-mandos.service
 
481
        install --mode=u=rwxs,go=rx \
 
482
                --target-directory=$(DRACUTMODULE) \
 
483
                dracut-module/module-setup.sh \
 
484
                dracut-module/cmdline-mandos.sh \
 
485
                dracut-module/password-agent
432
486
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
433
487
        gzip --best --to-stdout mandos-keygen.8 \
434
488
                > $(MANDIR)/man8/mandos-keygen.8.gz
446
500
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
447
501
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
448
502
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
503
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
504
                > $(MANDIR)/man8/password-agent.8mandos.gz
449
505
 
450
506
install-client: install-client-nokey
451
507
# Post-installation stuff
452
508
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
453
 
        update-initramfs -k all -u
 
509
        if command -v update-initramfs >/dev/null; then \
 
510
            update-initramfs -k all -u; \
 
511
        elif command -v dracut >/dev/null; then \
 
512
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
513
                if [ -w "$$initrd" ]; then \
 
514
                    chmod go-r "$$initrd"; \
 
515
                    dracut --force "$$initrd"; \
 
516
                fi; \
 
517
            done; \
 
518
        fi
454
519
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
455
520
 
456
521
uninstall: uninstall-server uninstall-client
483
548
                $(INITRAMFSTOOLS)/hooks/mandos \
484
549
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
485
550
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
551
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
552
                $(DRACUTMODULE)/ask-password-mandos.path \
 
553
                $(DRACUTMODULE)/ask-password-mandos.service \
 
554
                $(DRACUTMODULE)/module-setup.sh \
 
555
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
556
                $(DRACUTMODULE)/password-agent \
486
557
                $(MANDIR)/man8/mandos-keygen.8.gz \
487
558
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
488
559
                $(MANDIR)/man8/mandos-client.8mandos.gz
491
562
                $(MANDIR)/man8/splashy.8mandos.gz \
492
563
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
493
564
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
565
                $(MANDIR)/man8/password-agent.8mandos.gz \
494
566
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
495
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
496
 
        update-initramfs -k all -u
 
567
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
568
        if command -v update-initramfs >/dev/null; then \
 
569
            update-initramfs -k all -u; \
 
570
        elif command -v dracut >/dev/null; then \
 
571
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
572
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
573
            done; \
 
574
        fi
497
575
 
498
576
purge: purge-server purge-client
499
577