/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: teddy at recompile
  • Date: 2020-04-05 21:30:59 UTC
  • Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk
Fix file descriptor leak in mandos-client

When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.)  The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.

This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route.  If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.

Fix this by eliminating the file descriptor leak in the client.

* plugins.d/mandos-client.c (add_delete_local_route): Do
  close(devnull) also in parent process, also if fork() fails, and on
  any failure in child process.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Wunreachable-code -Winline \
8
 
        -Wvolatile-register-var
9
 
DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
 
FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
 
35
 
 
36
# If BROKEN_PIE is set, do not build with -pie
 
37
ifndef BROKEN_PIE
 
38
FORTIFY += -fPIE
 
39
LINK_FORTIFY += -pie
 
40
endif
13
41
#COVERAGE=--coverage
14
 
OPTIMIZE=-Os
15
 
LANGUAGE=-std=gnu99
16
 
# PREFIX=/usr/local
17
 
PREFIX=$(DESTDIR)/usr
18
 
# CONFDIR=/usr/local/lib/mandos
19
 
CONFDIR=$(DESTDIR)/etc/mandos
20
 
# KEYDIR=/usr/local/lib/mandos/keys
21
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
22
 
# MANDIR=/usr/local/man
23
 
MANDIR=$(DESTDIR)/usr/share/man
24
 
 
25
 
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
26
 
GNUTLS_LIBS=$(shell libgnutls-config --libs)
27
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
28
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
29
 
GPGME_CFLAGS=$(shell gpgme-config --cflags)
30
 
GPGME_LIBS=$(shell gpgme-config --libs)
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
FEATURES:=-D_FILE_OFFSET_BITS=64
 
45
htmldir:=man
 
46
version:=1.8.10
 
47
SED:=sed
 
48
PKG_CONFIG?=pkg-config
 
49
 
 
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
51
        || getent passwd nobody || echo 65534)))
 
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
53
        || getent group nogroup || echo 65534)))
 
54
 
 
55
LINUXVERSION:=$(shell uname --kernel-release)
 
56
 
 
57
## Use these settings for a traditional /usr/local install
 
58
# PREFIX:=$(DESTDIR)/usr/local
 
59
# CONFDIR:=$(DESTDIR)/etc/mandos
 
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
61
# MANDIR:=$(PREFIX)/man
 
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
65
# LIBDIR:=$(PREFIX)/lib
 
66
##
 
67
 
 
68
## These settings are for a package-type install
 
69
PREFIX:=$(DESTDIR)/usr
 
70
CONFDIR:=$(DESTDIR)/etc/mandos
 
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
72
MANDIR:=$(PREFIX)/share/man
 
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
76
LIBDIR:=$(shell \
 
77
        for d in \
 
78
        "/usr/lib/`dpkg-architecture \
 
79
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
80
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
81
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
82
                        echo "$(DESTDIR)$$d"; \
 
83
                        break; \
 
84
                fi; \
 
85
        done)
 
86
##
 
87
 
 
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
89
                        --variable=systemdsystemunitdir)
 
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
91
                        --variable=tmpfilesdir)
 
92
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
93
                        --variable=sysusersdir)
 
94
 
 
95
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
96
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
97
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
98
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
99
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
100
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
101
        getconf LFS_LDFLAGS)
 
102
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
103
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
104
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
105
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
31
106
 
32
107
# Do not change these two
33
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
34
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
35
 
LDFLAGS=$(COVERAGE)
 
108
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
109
        $(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
 
110
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
111
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
36
112
 
37
 
# Commands to format a DocBook refentry document into a manual page
38
 
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
 
113
# Commands to format a DocBook <refentry> document into a manual page
 
114
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
39
115
        --param man.charmap.use.subset          0 \
40
116
        --param make.year.ranges                1 \
41
117
        --param make.single.year.ranges         1 \
42
118
        --param man.output.quietly              1 \
43
119
        --param man.authors.section.enabled     0 \
44
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
120
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
45
121
        $(notdir $<); \
46
 
        $(MANPOST) $(notdir $@)
47
 
# DocBook-to-man post-processing to fix a \n escape bug
48
 
MANPOST=sed --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
49
 
 
50
 
PLUGINS=plugins.d/password-prompt plugins.d/password-request
51
 
PROGS=plugin-runner $(PLUGINS)
52
 
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
53
 
        plugins.d/password-request.8mandos \
54
 
        plugins.d/password-prompt.8mandos mandos.conf.5 \
55
 
        mandos-clients.conf.5
56
 
 
57
 
objects=$(addsuffix .o,$(PROGS))
58
 
 
59
 
all: $(PROGS)
60
 
 
 
122
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
123
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
124
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
125
        $(notdir $@); fi >/dev/null)
 
126
 
 
127
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
 
128
        --param make.year.ranges                1 \
 
129
        --param make.single.year.ranges         1 \
 
130
        --param man.output.quietly              1 \
 
131
        --param man.authors.section.enabled     0 \
 
132
        --param citerefentry.link               1 \
 
133
        --output $@ \
 
134
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
 
135
        $<; $(HTMLPOST) $@)
 
136
# Fix citerefentry links
 
137
HTMLPOST:=$(SED) --in-place \
 
138
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
 
139
 
 
140
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
141
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
 
142
        plugins.d/plymouth
 
143
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
144
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
145
        $(PLUGIN_HELPERS)
 
146
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
147
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
148
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
149
        dracut-module/password-agent.8mandos \
 
150
        plugins.d/mandos-client.8mandos \
 
151
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
 
152
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
 
153
        plugins.d/plymouth.8mandos intro.8mandos
 
154
 
 
155
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
156
 
 
157
objects:=$(addsuffix .o,$(CPROGS))
 
158
 
 
159
.PHONY: all
 
160
all: $(PROGS) mandos.lsm
 
161
 
 
162
.PHONY: doc
61
163
doc: $(DOCS)
62
164
 
63
 
%.5: %.xml legalnotice.xml
64
 
        $(DOCBOOKTOMAN)
65
 
 
66
 
%.8: %.xml legalnotice.xml
67
 
        $(DOCBOOKTOMAN)
68
 
 
69
 
%.8mandos: %.xml legalnotice.xml
70
 
        $(DOCBOOKTOMAN)
71
 
 
72
 
mandos.8: mandos.xml mandos-options.xml overview.xml legalnotice.xml
73
 
        $(DOCBOOKTOMAN)
74
 
 
75
 
mandos-keygen.8: mandos-keygen.xml overview.xml legalnotice.xml
76
 
        $(DOCBOOKTOMAN)
77
 
 
78
 
mandos.conf.5: mandos.conf.xml mandos-options.xml legalnotice.xml
79
 
        $(DOCBOOKTOMAN)
80
 
 
81
 
plugin-runner.8mandos: plugin-runner.xml overview.xml legalnotice.xml
82
 
        $(DOCBOOKTOMAN)
83
 
 
84
 
plugins.d/password-request.8mandos: plugins.d/password-request.xml \
85
 
                                        mandos-options.xml \
86
 
                                        overview.xml legalnotice.xml
87
 
        $(DOCBOOKTOMAN)
88
 
 
89
 
plugins.d/password-request: plugins.d/password-request.o
90
 
        $(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
91
 
                $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
92
 
 
93
 
.PHONY : all doc clean distclean run-client run-server install \
94
 
        install-server install-client uninstall uninstall-server \
95
 
        uninstall-client purge purge-server purge-client
96
 
 
 
165
.PHONY: html
 
166
html: $(htmldocs)
 
167
 
 
168
%.5: %.xml common.ent legalnotice.xml
 
169
        $(DOCBOOKTOMAN)
 
170
%.5.xhtml: %.xml common.ent legalnotice.xml
 
171
        $(DOCBOOKTOHTML)
 
172
 
 
173
%.8: %.xml common.ent legalnotice.xml
 
174
        $(DOCBOOKTOMAN)
 
175
%.8.xhtml: %.xml common.ent legalnotice.xml
 
176
        $(DOCBOOKTOHTML)
 
177
 
 
178
%.8mandos: %.xml common.ent legalnotice.xml
 
179
        $(DOCBOOKTOMAN)
 
180
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
 
181
        $(DOCBOOKTOHTML)
 
182
 
 
183
intro.8mandos: intro.xml common.ent legalnotice.xml
 
184
        $(DOCBOOKTOMAN)
 
185
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
186
        $(DOCBOOKTOHTML)
 
187
 
 
188
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
 
189
                legalnotice.xml
 
190
        $(DOCBOOKTOMAN)
 
191
mandos.8.xhtml: mandos.xml common.ent mandos-options.xml \
 
192
                overview.xml legalnotice.xml
 
193
        $(DOCBOOKTOHTML)
 
194
 
 
195
mandos-keygen.8: mandos-keygen.xml common.ent overview.xml \
 
196
                legalnotice.xml
 
197
        $(DOCBOOKTOMAN)
 
198
mandos-keygen.8.xhtml: mandos-keygen.xml common.ent overview.xml \
 
199
                 legalnotice.xml
 
200
        $(DOCBOOKTOHTML)
 
201
 
 
202
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
 
203
                legalnotice.xml
 
204
        $(DOCBOOKTOMAN)
 
205
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
 
206
                 legalnotice.xml
 
207
        $(DOCBOOKTOHTML)
 
208
 
 
209
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
 
210
                legalnotice.xml
 
211
        $(DOCBOOKTOMAN)
 
212
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
 
213
                 legalnotice.xml
 
214
        $(DOCBOOKTOHTML)
 
215
 
 
216
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
 
217
                legalnotice.xml
 
218
        $(DOCBOOKTOMAN)
 
219
mandos.conf.5.xhtml: mandos.conf.xml common.ent mandos-options.xml \
 
220
                legalnotice.xml
 
221
        $(DOCBOOKTOHTML)
 
222
 
 
223
plugin-runner.8mandos: plugin-runner.xml common.ent overview.xml \
 
224
                legalnotice.xml
 
225
        $(DOCBOOKTOMAN)
 
226
plugin-runner.8mandos.xhtml: plugin-runner.xml common.ent \
 
227
                overview.xml legalnotice.xml
 
228
        $(DOCBOOKTOHTML)
 
229
 
 
230
dracut-module/password-agent.8mandos: \
 
231
                dracut-module/password-agent.xml common.ent \
 
232
                overview.xml legalnotice.xml
 
233
        $(DOCBOOKTOMAN)
 
234
dracut-module/password-agent.8mandos.xhtml: \
 
235
                dracut-module/password-agent.xml common.ent \
 
236
                overview.xml legalnotice.xml
 
237
        $(DOCBOOKTOHTML)
 
238
 
 
239
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
 
240
                                        common.ent \
 
241
                                        mandos-options.xml \
 
242
                                        overview.xml legalnotice.xml
 
243
        $(DOCBOOKTOMAN)
 
244
plugins.d/mandos-client.8mandos.xhtml: plugins.d/mandos-client.xml \
 
245
                                        common.ent \
 
246
                                        mandos-options.xml \
 
247
                                        overview.xml legalnotice.xml
 
248
        $(DOCBOOKTOHTML)
 
249
 
 
250
# Update all these files with version number $(version)
 
251
common.ent: Makefile
 
252
        $(strip $(SED) --in-place \
 
253
                --expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
 
254
                $@)
 
255
 
 
256
mandos: Makefile
 
257
        $(strip $(SED) --in-place \
 
258
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
259
                $@)
 
260
 
 
261
mandos-keygen: Makefile
 
262
        $(strip $(SED) --in-place \
 
263
                --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
 
264
                $@)
 
265
 
 
266
mandos-ctl: Makefile
 
267
        $(strip $(SED) --in-place \
 
268
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
269
                $@)
 
270
 
 
271
mandos-monitor: Makefile
 
272
        $(strip $(SED) --in-place \
 
273
                --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
 
274
                $@)
 
275
 
 
276
mandos.lsm: Makefile
 
277
        $(strip $(SED) --in-place \
 
278
                --expression='s/^\(Version:\).*/\1\t$(version)/' \
 
279
                $@)
 
280
        $(strip $(SED) --in-place \
 
281
                --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
 
282
                $@)
 
283
        $(strip $(SED) --in-place \
 
284
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
 
285
                $@)
 
286
 
 
287
# Need to add the GnuTLS, Avahi and GPGME libraries
 
288
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
289
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
290
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
291
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
292
 
 
293
# Need to add the libnl-route library
 
294
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
295
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
296
 
 
297
# Need to add the GLib and pthread libraries
 
298
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
299
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
300
 
 
301
.PHONY: clean
97
302
clean:
98
 
        -rm --force $(PROGS) $(objects) $(DOCS) core
 
303
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
99
304
 
 
305
.PHONY: distclean
100
306
distclean: clean
 
307
.PHONY: mostlyclean
101
308
mostlyclean: clean
 
309
.PHONY: maintainer-clean
102
310
maintainer-clean: clean
103
 
        -rm --force --recursive keydir confdir
 
311
        -rm --force --recursive keydir confdir statedir
104
312
 
105
 
check:
 
313
.PHONY: check
 
314
check: all
106
315
        ./mandos --check
 
316
        ./mandos-ctl --check
 
317
        ./mandos-keygen --version
 
318
        ./plugin-runner --version
 
319
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
320
        ./dracut-module/password-agent --test
107
321
 
108
322
# Run the client with a local config and key
109
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
323
.PHONY: run-client
 
324
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
325
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
326
        @echo '######################################################'
 
327
        @echo '# The following error messages are harmless and can  #'
 
328
        @echo '#  be safely ignored:                                #'
 
329
        @echo '## From plugin-runner:                               #'
 
330
        @echo '# setgid: Operation not permitted                    #'
 
331
        @echo '# setuid: Operation not permitted                    #'
 
332
        @echo '## From askpass-fifo:                                #'
 
333
        @echo '# mkfifo: Permission denied                          #'
 
334
        @echo '## From mandos-client:                               #'
 
335
        @echo '# Failed to raise privileges: Operation not permi... #'
 
336
        @echo '# Warning: network hook "*" exited with status *     #'
 
337
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
338
        @echo '# Failed to bring up interface "*": Operation not... #'
 
339
        @echo '#                                                    #'
 
340
        @echo '# (The messages are caused by not running as root,   #'
 
341
        @echo '# but you should NOT run "make run-client" as root   #'
 
342
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
343
        @echo '# root, which is also NOT recommended.)              #'
 
344
        @echo '######################################################'
 
345
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
110
346
        ./plugin-runner --plugin-dir=plugins.d \
 
347
                --plugin-helper-dir=plugin-helpers \
111
348
                --config-file=plugin-runner.conf \
112
 
                --options-for=password-request:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt
 
349
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
350
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
 
351
                $(CLIENTARGS)
113
352
 
114
353
# Used by run-client
115
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
354
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
116
355
        install --directory keydir
117
356
        ./mandos-keygen --dir keydir --force
 
357
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
358
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
359
        fi
 
360
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
361
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
362
        fi
118
363
 
119
364
# Run the server with a local config
120
 
run-server: confdir/mandos.conf confdir/clients.conf
121
 
        ./mandos --debug --configdir=confdir
 
365
.PHONY: run-server
 
366
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
367
        ./mandos --debug --no-dbus --configdir=confdir \
 
368
                --statedir=statedir $(SERVERARGS)
122
369
 
123
370
# Used by run-server
124
371
confdir/mandos.conf: mandos.conf
125
372
        install --directory confdir
126
373
        install --mode=u=rw,go=r $^ $@
127
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
374
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
128
375
        install --directory confdir
129
376
        install --mode=u=rw $< $@
130
377
# Add a client password
131
 
        ./mandos-keygen --dir keydir --password >> $@
132
 
 
133
 
install: install-server install-client
134
 
 
 
378
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
379
statedir:
 
380
        install --directory statedir
 
381
 
 
382
.PHONY: install
 
383
install: install-server install-client-nokey
 
384
 
 
385
.PHONY: install-html
 
386
install-html: html
 
387
        install --directory $(htmldir)
 
388
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
389
                $(htmldocs)
 
390
 
 
391
.PHONY: install-server
135
392
install-server: doc
136
 
        install --directory $(CONFDIR) $(MANDIR)/man5 \
137
 
                $(MANDIR)/man8
 
393
        install --directory $(CONFDIR)
 
394
        if install --directory --mode=u=rwx --owner=$(USER) \
 
395
                --group=$(GROUP) $(STATEDIR); then \
 
396
                :; \
 
397
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
398
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
399
        fi
 
400
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
401
                        -a -d "$(TMPFILES)" ]; then \
 
402
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
403
                        $(TMPFILES)/mandos.conf; \
 
404
        fi
 
405
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
 
406
                        -a -d "$(SYSUSERS)" ]; then \
 
407
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
 
408
                        $(SYSUSERS)/mandos.conf; \
 
409
        fi
138
410
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
411
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
412
                mandos-ctl
 
413
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
414
                mandos-monitor
139
415
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
140
416
                mandos.conf
141
417
        install --mode=u=rw --target-directory=$(CONFDIR) \
142
418
                clients.conf
143
 
        install --mode=u=rwx,go=rx init.d-mandos /etc/init.d/mandos
144
 
        install --mode=u=rw,go=r default-mandos /etc/default/mandos
145
 
        update-rc.d mandos defaults
 
419
        install --mode=u=rw,go=r dbus-mandos.conf \
 
420
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
421
        install --mode=u=rwx,go=rx init.d-mandos \
 
422
                $(DESTDIR)/etc/init.d/mandos
 
423
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
424
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
425
        fi
 
426
        install --mode=u=rw,go=r default-mandos \
 
427
                $(DESTDIR)/etc/default/mandos
 
428
        if [ -z $(DESTDIR) ]; then \
 
429
                update-rc.d mandos defaults 25 15;\
 
430
        fi
146
431
        gzip --best --to-stdout mandos.8 \
147
432
                > $(MANDIR)/man8/mandos.8.gz
 
433
        gzip --best --to-stdout mandos-monitor.8 \
 
434
                > $(MANDIR)/man8/mandos-monitor.8.gz
 
435
        gzip --best --to-stdout mandos-ctl.8 \
 
436
                > $(MANDIR)/man8/mandos-ctl.8.gz
148
437
        gzip --best --to-stdout mandos.conf.5 \
149
438
                > $(MANDIR)/man5/mandos.conf.5.gz
150
439
        gzip --best --to-stdout mandos-clients.conf.5 \
151
440
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
441
        gzip --best --to-stdout intro.8mandos \
 
442
                > $(MANDIR)/man8/intro.8mandos.gz
152
443
 
153
 
install-client: all doc /usr/share/initramfs-tools/hooks/.
154
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR) \
155
 
                $(MANDIR)/man8
156
 
        install --directory --mode=u=rwx $(KEYDIR)
157
 
        install --directory --mode=u=rwx \
158
 
                $(PREFIX)/lib/mandos/plugins.d
159
 
        if [ "$(CONFDIR)/plugins.d" \
160
 
                        != "$(PREFIX)/lib/mandos/plugins.d" ]; then \
 
444
.PHONY: install-client-nokey
 
445
install-client-nokey: all doc
 
446
        install --directory $(LIBDIR)/mandos $(CONFDIR)
 
447
        install --directory --mode=u=rwx $(KEYDIR) \
 
448
                $(LIBDIR)/mandos/plugins.d \
 
449
                $(LIBDIR)/mandos/plugin-helpers
 
450
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
 
451
                        -a -d "$(SYSUSERS)" ]; then \
 
452
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
 
453
                        $(SYSUSERS)/mandos-client.conf; \
 
454
        fi
 
455
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
161
456
                install --mode=u=rwx \
162
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
457
                        --directory "$(CONFDIR)/plugins.d" \
 
458
                        "$(CONFDIR)/plugin-helpers"; \
163
459
        fi
164
 
        install --mode=u=rwx,go=rx \
165
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
460
        install --mode=u=rwx,go=rx --directory \
 
461
                "$(CONFDIR)/network-hooks.d"
 
462
        install --mode=u=rwx,go=rx \
 
463
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
464
        install --mode=u=rwx,go=rx \
 
465
                --target-directory=$(LIBDIR)/mandos \
 
466
                mandos-to-cryptroot-unlock
166
467
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
167
468
                mandos-keygen
168
469
        install --mode=u=rwx,go=rx \
169
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
470
                --target-directory=$(LIBDIR)/mandos/plugins.d \
170
471
                plugins.d/password-prompt
171
472
        install --mode=u=rwxs,go=rx \
172
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
173
 
                plugins.d/password-request
174
 
        install --mode=u=rwx,go=rx \
175
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
473
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
474
                plugins.d/mandos-client
 
475
        install --mode=u=rwxs,go=rx \
 
476
                --target-directory=$(LIBDIR)/mandos/plugins.d \
176
477
                plugins.d/usplash
 
478
        install --mode=u=rwxs,go=rx \
 
479
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
480
                plugins.d/splashy
 
481
        install --mode=u=rwxs,go=rx \
 
482
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
483
                plugins.d/askpass-fifo
 
484
        install --mode=u=rwxs,go=rx \
 
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
 
486
                plugins.d/plymouth
 
487
        install --mode=u=rwx,go=rx \
 
488
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
489
                plugin-helpers/mandos-client-iprouteadddel
177
490
        install initramfs-tools-hook \
178
 
                /usr/share/initramfs-tools/hooks/mandos
179
 
        install initramfs-tools-hook-conf \
180
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos
 
491
                $(INITRAMFSTOOLS)/hooks/mandos
 
492
        install --mode=u=rw,go=r initramfs-tools-conf \
 
493
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
494
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
495
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
181
496
        install initramfs-tools-script \
182
 
                /usr/share/initramfs-tools/scripts/local-top/mandos
 
497
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
498
        install initramfs-tools-script-stop \
 
499
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
500
        install --directory $(DRACUTMODULE)
 
501
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
502
                dracut-module/ask-password-mandos.path \
 
503
                dracut-module/ask-password-mandos.service
 
504
        install --mode=u=rwxs,go=rx \
 
505
                --target-directory=$(DRACUTMODULE) \
 
506
                dracut-module/module-setup.sh \
 
507
                dracut-module/cmdline-mandos.sh \
 
508
                dracut-module/password-agent
183
509
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
184
510
        gzip --best --to-stdout mandos-keygen.8 \
185
511
                > $(MANDIR)/man8/mandos-keygen.8.gz
186
512
        gzip --best --to-stdout plugin-runner.8mandos \
187
513
                > $(MANDIR)/man8/plugin-runner.8mandos.gz
 
514
        gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 
515
                > $(MANDIR)/man8/mandos-client.8mandos.gz
188
516
        gzip --best --to-stdout plugins.d/password-prompt.8mandos \
189
517
                > $(MANDIR)/man8/password-prompt.8mandos.gz
190
 
        gzip --best --to-stdout plugins.d/password-request.8mandos \
191
 
                > $(MANDIR)/man8/password-request.8mandos.gz
 
518
        gzip --best --to-stdout plugins.d/usplash.8mandos \
 
519
                > $(MANDIR)/man8/usplash.8mandos.gz
 
520
        gzip --best --to-stdout plugins.d/splashy.8mandos \
 
521
                > $(MANDIR)/man8/splashy.8mandos.gz
 
522
        gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
 
523
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
524
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
 
525
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
526
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
527
                > $(MANDIR)/man8/password-agent.8mandos.gz
 
528
 
 
529
.PHONY: install-client
 
530
install-client: install-client-nokey
192
531
# Post-installation stuff
193
532
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
194
 
        update-initramfs -k all -u
 
533
        if command -v update-initramfs >/dev/null; then \
 
534
            update-initramfs -k all -u; \
 
535
        elif command -v dracut >/dev/null; then \
 
536
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
537
                if [ -w "$$initrd" ]; then \
 
538
                    chmod go-r "$$initrd"; \
 
539
                    dracut --force "$$initrd"; \
 
540
                fi; \
 
541
            done; \
 
542
        fi
195
543
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
196
544
 
 
545
.PHONY: uninstall
197
546
uninstall: uninstall-server uninstall-client
198
547
 
 
548
.PHONY: uninstall-server
199
549
uninstall-server:
200
550
        -rm --force $(PREFIX)/sbin/mandos \
 
551
                $(PREFIX)/sbin/mandos-ctl \
 
552
                $(PREFIX)/sbin/mandos-monitor \
201
553
                $(MANDIR)/man8/mandos.8.gz \
 
554
                $(MANDIR)/man8/mandos-monitor.8.gz \
 
555
                $(MANDIR)/man8/mandos-ctl.8.gz \
202
556
                $(MANDIR)/man5/mandos.conf.5.gz \
203
557
                $(MANDIR)/man5/mandos-clients.conf.5.gz
204
558
        update-rc.d -f mandos remove
205
559
        -rmdir $(CONFDIR)
206
560
 
 
561
.PHONY: uninstall-client
207
562
uninstall-client:
208
563
# Refuse to uninstall client if /etc/crypttab is explicitly configured
209
564
# to use it.
210
565
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
211
 
                /etc/crypttab
 
566
                $(DESTDIR)/etc/crypttab
212
567
        -rm --force $(PREFIX)/sbin/mandos-keygen \
213
 
                $(PREFIX)/lib/mandos/plugin-runner \
214
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
215
 
                $(PREFIX)/lib/mandos/plugins.d/password-request \
216
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
217
 
                /usr/share/initramfs-tools/hooks/mandos \
218
 
                /usr/share/initramfs-tools/conf-hooks.d/mandos \
219
 
                /usr/share/initramfs-tools/scripts/local-top/mandos \
 
568
                $(LIBDIR)/mandos/plugin-runner \
 
569
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
570
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
571
                $(LIBDIR)/mandos/plugins.d/usplash \
 
572
                $(LIBDIR)/mandos/plugins.d/splashy \
 
573
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
574
                $(LIBDIR)/mandos/plugins.d/plymouth \
 
575
                $(INITRAMFSTOOLS)/hooks/mandos \
 
576
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 
577
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
578
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
579
                $(DRACUTMODULE)/ask-password-mandos.path \
 
580
                $(DRACUTMODULE)/ask-password-mandos.service \
 
581
                $(DRACUTMODULE)/module-setup.sh \
 
582
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
583
                $(DRACUTMODULE)/password-agent \
 
584
                $(MANDIR)/man8/mandos-keygen.8.gz \
220
585
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
221
 
                $(MANDIR)/man8/mandos-keygen.8.gz \
 
586
                $(MANDIR)/man8/mandos-client.8mandos.gz
222
587
                $(MANDIR)/man8/password-prompt.8mandos.gz \
223
 
                $(MANDIR)/man8/password-request.8mandos.gz
224
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
225
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
226
 
        update-initramfs -k all -u
 
588
                $(MANDIR)/man8/usplash.8mandos.gz \
 
589
                $(MANDIR)/man8/splashy.8mandos.gz \
 
590
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
 
591
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
592
                $(MANDIR)/man8/password-agent.8mandos.gz \
 
593
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
594
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
595
        if command -v update-initramfs >/dev/null; then \
 
596
            update-initramfs -k all -u; \
 
597
        elif command -v dracut >/dev/null; then \
 
598
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
599
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
600
            done; \
 
601
        fi
227
602
 
 
603
.PHONY: purge
228
604
purge: purge-server purge-client
229
605
 
 
606
.PHONY: purge-server
230
607
purge-server: uninstall-server
231
608
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
232
 
                /etc/default/mandos /etc/init.d/mandos \
233
 
                /var/run/mandos.pid
 
609
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
610
                $(DESTDIR)/etc/default/mandos \
 
611
                $(DESTDIR)/etc/init.d/mandos \
 
612
                $(SYSTEMD)/mandos.service \
 
613
                $(DESTDIR)/run/mandos.pid \
 
614
                $(DESTDIR)/var/run/mandos.pid
234
615
        -rmdir $(CONFDIR)
235
616
 
 
617
.PHONY: purge-client
236
618
purge-client: uninstall-client
237
 
        -shred --remove $(KEYDIR)/seckey.txt
 
619
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
238
620
        -rm --force $(CONFDIR)/plugin-runner.conf \
239
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
621
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
622
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
240
623
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)