To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to Makefile
- browse files at revision 1213
- compare with another revision
- download diff
- download tarball
- view history from revision 1213
- Committer: teddy at recompile
- Date: 2020-04-05 21:30:59 UTC
- Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk
Fix file descriptor leak in mandos-client
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
- files added:
- DBUS-API
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
Makefile
1
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
-Wswitch-default -Wswitch-enum -Wunused-parameter \
3
-Wstrict-aliasing=2 -Wextra -Wfloat-equal -Wundef -Wshadow \
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
-Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
-Wunused -Wuninitialized -Wstrict-overflow=5 \
4
-Wsuggest-attribute=pure -Wsuggest-attribute=const \
5
-Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
-Wunsafe-loop-optimizations -Wpointer-arith \
5
7
-Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
-Wconversion -Wstrict-prototypes -Wold-style-definition \
7
-Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
# -Wunreachable-code
9
#DEBUG=-ggdb3
10
# For info about _FORTIFY_SOURCE, see
11
# <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
12
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC -fPIE
13
LINK_FORTIFY_LD=-z relro -fPIE
14
LINK_FORTIFY=-pie
8
-Wconversion -Wlogical-op -Waggregate-return \
9
-Wstrict-prototypes -Wold-style-definition \
10
-Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
-Wredundant-decls -Wnested-externs -Winline -Wvla \
12
-Wvolatile-register-var -Woverlength-strings
13
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
## Check which sanitizing options can be used
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
# echo 'int main(){}' | $(CC) --language=c $(option) \
18
# /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
-fsanitize=shift -fsanitize=integer-divide-by-zero \
22
-fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
-fsanitize=return -fsanitize=signed-integer-overflow \
24
-fsanitize=bounds -fsanitize=alignment \
25
-fsanitize=object-size -fsanitize=float-divide-by-zero \
26
-fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
-fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
-fsanitize=enum -fsanitize-address-use-after-scope
29
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
LINK_FORTIFY_LD:=-z relro -z now
34
LINK_FORTIFY:=
35
36
# If BROKEN_PIE is set, do not build with -pie
37
ifndef BROKEN_PIE
38
FORTIFY += -fPIE
39
LINK_FORTIFY += -pie
40
endif
15
41
#COVERAGE=--coverage
16
OPTIMIZE=-Os
17
LANGUAGE=-std=gnu99
18
htmldir=man
19
version=1.0.5
20
SED=sed
42
OPTIMIZE:=-Os -fno-strict-aliasing
43
LANGUAGE:=-std=gnu11
44
FEATURES:=-D_FILE_OFFSET_BITS=64
45
htmldir:=man
46
version:=1.8.10
47
SED:=sed
48
PKG_CONFIG?=pkg-config
49
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
51
|| getent passwd nobody || echo 65534)))
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
53
|| getent group nogroup || echo 65534)))
54
55
LINUXVERSION:=$(shell uname --kernel-release)
21
56
22
57
## Use these settings for a traditional /usr/local install
23
# PREFIX=$(DESTDIR)/usr/local
24
# CONFDIR=$(DESTDIR)/etc/mandos
25
# KEYDIR=$(DESTDIR)/etc/mandos/keys
26
# MANDIR=$(PREFIX)/man
27
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
58
# PREFIX:=$(DESTDIR)/usr/local
59
# CONFDIR:=$(DESTDIR)/etc/mandos
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
61
# MANDIR:=$(PREFIX)/man
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
65
# LIBDIR:=$(PREFIX)/lib
28
66
##
29
67
30
68
## These settings are for a package-type install
31
PREFIX=$(DESTDIR)/usr
32
CONFDIR=$(DESTDIR)/etc/mandos
33
KEYDIR=$(DESTDIR)/etc/keys/mandos
34
MANDIR=$(PREFIX)/share/man
35
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
69
PREFIX:=$(DESTDIR)/usr
70
CONFDIR:=$(DESTDIR)/etc/mandos
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
72
MANDIR:=$(PREFIX)/share/man
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
76
LIBDIR:=$(shell \
77
for d in \
78
"/usr/lib/`dpkg-architecture \
79
-qDEB_HOST_MULTIARCH 2>/dev/null`" \
80
"`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
81
if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
82
echo "$(DESTDIR)$$d"; \
83
break; \
84
fi; \
85
done)
36
86
##
37
87
38
GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
39
GNUTLS_LIBS=$(shell libgnutls-config --libs)
40
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
41
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
42
GPGME_CFLAGS=$(shell gpgme-config --cflags)
43
GPGME_LIBS=$(shell gpgme-config --libs)
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
89
--variable=systemdsystemunitdir)
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
91
--variable=tmpfilesdir)
92
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
93
--variable=sysusersdir)
94
95
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
96
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
97
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
98
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
99
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
100
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
101
getconf LFS_LDFLAGS)
102
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
103
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
104
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
105
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
44
106
45
107
# Do not change these two
46
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
47
$(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
48
-DVERSION='"$(version)"'
49
LDFLAGS=$(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
108
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
109
$(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
110
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
111
) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
50
112
51
113
# Commands to format a DocBook <refentry> document into a manual page
52
DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
114
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
53
115
--param man.charmap.use.subset 0 \
54
116
--param make.year.ranges 1 \
55
117
--param make.single.year.ranges 1 \
56
118
--param man.output.quietly 1 \
57
119
--param man.authors.section.enabled 0 \
58
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
120
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
59
121
$(notdir $<); \
60
$(MANPOST) $(notdir $@)
61
# DocBook-to-man post-processing to fix a '\n' escape bug
62
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
122
if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
123
&& command -v man >/dev/null; then LANG=en_US.UTF-8 \
124
MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
125
$(notdir $@); fi >/dev/null)
63
126
64
DOCBOOKTOHTML=xsltproc --nonet --xinclude \
127
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
65
128
--param make.year.ranges 1 \
66
129
--param make.single.year.ranges 1 \
67
130
--param man.output.quietly 1 \
69
132
--param citerefentry.link 1 \
70
133
--output $@ \
71
134
/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
72
$<; $(HTMLPOST) $@
135
$<; $(HTMLPOST) $@)
73
136
# Fix citerefentry links
74
HTMLPOST=$(SED) --in-place \
137
HTMLPOST:=$(SED) --in-place \
75
138
--expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
76
139
77
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
78
plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo
79
CPROGS=plugin-runner $(PLUGINS)
80
PROGS=mandos mandos-keygen mandos-ctl $(CPROGS)
81
DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
140
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
141
plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
142
plugins.d/plymouth
143
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
144
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
145
$(PLUGIN_HELPERS)
146
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
147
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
148
mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
149
dracut-module/password-agent.8mandos \
82
150
plugins.d/mandos-client.8mandos \
83
plugins.d/password-prompt.8mandos mandos.conf.5 \
84
plugins.d/usplash.8mandos plugins.d/splashy.8mandos \
85
plugins.d/askpass-fifo.8mandos mandos-clients.conf.5
86
87
htmldocs=$(addsuffix .xhtml,$(DOCS))
88
89
objects=$(addsuffix .o,$(CPROGS))
90
151
plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
152
plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
153
plugins.d/plymouth.8mandos intro.8mandos
154
155
htmldocs:=$(addsuffix .xhtml,$(DOCS))
156
157
objects:=$(addsuffix .o,$(CPROGS))
158
159
.PHONY: all
91
160
all: $(PROGS) mandos.lsm
92
161
162
.PHONY: doc
93
163
doc: $(DOCS)
94
164
165
.PHONY: html
95
166
html: $(htmldocs)
96
167
97
168
%.5: %.xml common.ent legalnotice.xml
109
180
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
110
181
$(DOCBOOKTOHTML)
111
182
183
intro.8mandos: intro.xml common.ent legalnotice.xml
184
$(DOCBOOKTOMAN)
185
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
186
$(DOCBOOKTOHTML)
187
112
188
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
113
189
legalnotice.xml
114
190
$(DOCBOOKTOMAN)
123
199
legalnotice.xml
124
200
$(DOCBOOKTOHTML)
125
201
202
mandos-monitor.8: mandos-monitor.xml common.ent overview.xml \
203
legalnotice.xml
204
$(DOCBOOKTOMAN)
205
mandos-monitor.8.xhtml: mandos-monitor.xml common.ent overview.xml \
206
legalnotice.xml
207
$(DOCBOOKTOHTML)
208
209
mandos-ctl.8: mandos-ctl.xml common.ent overview.xml \
210
legalnotice.xml
211
$(DOCBOOKTOMAN)
212
mandos-ctl.8.xhtml: mandos-ctl.xml common.ent overview.xml \
213
legalnotice.xml
214
$(DOCBOOKTOHTML)
215
126
216
mandos.conf.5: mandos.conf.xml common.ent mandos-options.xml \
127
217
legalnotice.xml
128
218
$(DOCBOOKTOMAN)
137
227
overview.xml legalnotice.xml
138
228
$(DOCBOOKTOHTML)
139
229
230
dracut-module/password-agent.8mandos: \
231
dracut-module/password-agent.xml common.ent \
232
overview.xml legalnotice.xml
233
$(DOCBOOKTOMAN)
234
dracut-module/password-agent.8mandos.xhtml: \
235
dracut-module/password-agent.xml common.ent \
236
overview.xml legalnotice.xml
237
$(DOCBOOKTOHTML)
238
140
239
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
141
240
common.ent \
142
241
mandos-options.xml \
150
249
151
250
# Update all these files with version number $(version)
152
251
common.ent: Makefile
153
$(SED) --in-place \
154
--expression='s/^\(<ENTITY VERSION "\)[^"]*">$$/\1$(version)"/' \
155
$@
252
$(strip $(SED) --in-place \
253
--expression='s/^\(<!ENTITY version "\)[^"]*">$$/\1$(version)">/' \
254
$@)
156
255
157
256
mandos: Makefile
158
$(SED) --in-place \
257
$(strip $(SED) --in-place \
159
258
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
160
$@
259
$@)
161
260
162
261
mandos-keygen: Makefile
163
$(SED) --in-place \
262
$(strip $(SED) --in-place \
164
263
--expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' \
165
$@
264
$@)
166
265
167
266
mandos-ctl: Makefile
168
$(SED) --in-place \
169
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
170
$@
267
$(strip $(SED) --in-place \
268
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
269
$@)
270
271
mandos-monitor: Makefile
272
$(strip $(SED) --in-place \
273
--expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' \
274
$@)
171
275
172
276
mandos.lsm: Makefile
173
$(SED) --in-place \
277
$(strip $(SED) --in-place \
174
278
--expression='s/^\(Version:\).*/\1\t$(version)/' \
175
$@
176
$(SED) --in-place \
279
$@)
280
$(strip $(SED) --in-place \
177
281
--expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' \
178
$@
179
$(SED) --in-place \
282
$@)
283
$(strip $(SED) --in-place \
180
284
--expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
181
$@
182
183
plugins.d/mandos-client: plugins.d/mandos-client.o
184
$(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
185
$(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
186
187
.PHONY : all doc html clean distclean run-client run-server install \
188
install-server install-client uninstall uninstall-server \
189
uninstall-client purge purge-server purge-client
190
285
$@)
286
287
# Need to add the GnuTLS, Avahi and GPGME libraries
288
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
289
) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
290
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
291
) $(AVAHI_LIBS) $(GPGME_LIBS)
292
293
# Need to add the libnl-route library
294
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
295
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
296
297
# Need to add the GLib and pthread libraries
298
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
299
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
300
301
.PHONY: clean
191
302
clean:
192
303
-rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
193
304
305
.PHONY: distclean
194
306
distclean: clean
307
.PHONY: mostlyclean
195
308
mostlyclean: clean
309
.PHONY: maintainer-clean
196
310
maintainer-clean: clean
197
-rm --force --recursive keydir confdir
311
-rm --force --recursive keydir confdir statedir
198
312
199
check: all
313
.PHONY: check
314
check: all
200
315
./mandos --check
316
./mandos-ctl --check
317
./mandos-keygen --version
318
./plugin-runner --version
319
./plugin-helpers/mandos-client-iprouteadddel --version
320
./dracut-module/password-agent --test
201
321
202
322
# Run the client with a local config and key
203
run-client: all keydir/seckey.txt keydir/pubkey.txt
323
.PHONY: run-client
324
run-client: all keydir/seckey.txt keydir/pubkey.txt \
325
keydir/tls-privkey.pem keydir/tls-pubkey.pem
326
@echo '######################################################'
327
@echo '# The following error messages are harmless and can #'
328
@echo '# be safely ignored: #'
329
@echo '## From plugin-runner: #'
330
@echo '# setgid: Operation not permitted #'
331
@echo '# setuid: Operation not permitted #'
332
@echo '## From askpass-fifo: #'
333
@echo '# mkfifo: Permission denied #'
334
@echo '## From mandos-client: #'
335
@echo '# Failed to raise privileges: Operation not permi... #'
336
@echo '# Warning: network hook "*" exited with status * #'
337
@echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
338
@echo '# Failed to bring up interface "*": Operation not... #'
339
@echo '# #'
340
@echo '# (The messages are caused by not running as root, #'
341
@echo '# but you should NOT run "make run-client" as root #'
342
@echo '# unless you also unpacked and compiled Mandos as #'
343
@echo '# root, which is also NOT recommended.) #'
344
@echo '######################################################'
345
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
204
346
./plugin-runner --plugin-dir=plugins.d \
347
--plugin-helper-dir=plugin-helpers \
205
348
--config-file=plugin-runner.conf \
206
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
349
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
350
--env-for=mandos-client:GNOME_KEYRING_CONTROL= \
207
351
$(CLIENTARGS)
208
352
209
353
# Used by run-client
210
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
354
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
211
355
install --directory keydir
212
356
./mandos-keygen --dir keydir --force
357
if ! [ -e keydir/tls-privkey.pem ]; then \
358
install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
359
fi
360
if ! [ -e keydir/tls-pubkey.pem ]; then \
361
install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
362
fi
213
363
214
364
# Run the server with a local config
215
run-server: confdir/mandos.conf confdir/clients.conf
216
./mandos --debug --no-dbus --configdir=confdir $(SERVERARGS)
365
.PHONY: run-server
366
run-server: confdir/mandos.conf confdir/clients.conf statedir
367
./mandos --debug --no-dbus --configdir=confdir \
368
--statedir=statedir $(SERVERARGS)
217
369
218
370
# Used by run-server
219
371
confdir/mandos.conf: mandos.conf
220
372
install --directory confdir
221
373
install --mode=u=rw,go=r $^ $@
222
confdir/clients.conf: clients.conf keydir/seckey.txt
374
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
223
375
install --directory confdir
224
376
install --mode=u=rw $< $@
225
377
# Add a client password
226
./mandos-keygen --dir keydir --password >> $@
378
./mandos-keygen --dir keydir --password --no-ssh >> $@
379
statedir:
380
install --directory statedir
227
381
382
.PHONY: install
228
383
install: install-server install-client-nokey
229
384
385
.PHONY: install-html
230
386
install-html: html
231
387
install --directory $(htmldir)
232
388
install --mode=u=rw,go=r --target-directory=$(htmldir) \
233
389
$(htmldocs)
234
390
391
.PHONY: install-server
235
392
install-server: doc
236
393
install --directory $(CONFDIR)
394
if install --directory --mode=u=rwx --owner=$(USER) \
395
--group=$(GROUP) $(STATEDIR); then \
396
:; \
397
elif install --directory --mode=u=rwx $(STATEDIR); then \
398
chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
399
fi
400
if [ "$(TMPFILES)" != "$(DESTDIR)" \
401
-a -d "$(TMPFILES)" ]; then \
402
install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
403
$(TMPFILES)/mandos.conf; \
404
fi
405
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
406
-a -d "$(SYSUSERS)" ]; then \
407
install --mode=u=rw,go=r sysusers.d-mandos.conf \
408
$(SYSUSERS)/mandos.conf; \
409
fi
237
410
install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
411
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
412
mandos-ctl
413
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
414
mandos-monitor
238
415
install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
239
416
mandos.conf
240
417
install --mode=u=rw --target-directory=$(CONFDIR) \
241
418
clients.conf
419
install --mode=u=rw,go=r dbus-mandos.conf \
420
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
242
421
install --mode=u=rwx,go=rx init.d-mandos \
243
422
$(DESTDIR)/etc/init.d/mandos
423
if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
424
install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
425
fi
244
426
install --mode=u=rw,go=r default-mandos \
245
427
$(DESTDIR)/etc/default/mandos
246
428
if [ -z $(DESTDIR) ]; then \
248
430
fi
249
431
gzip --best --to-stdout mandos.8 \
250
432
> $(MANDIR)/man8/mandos.8.gz
433
gzip --best --to-stdout mandos-monitor.8 \
434
> $(MANDIR)/man8/mandos-monitor.8.gz
435
gzip --best --to-stdout mandos-ctl.8 \
436
> $(MANDIR)/man8/mandos-ctl.8.gz
251
437
gzip --best --to-stdout mandos.conf.5 \
252
438
> $(MANDIR)/man5/mandos.conf.5.gz
253
439
gzip --best --to-stdout mandos-clients.conf.5 \
254
440
> $(MANDIR)/man5/mandos-clients.conf.5.gz
441
gzip --best --to-stdout intro.8mandos \
442
> $(MANDIR)/man8/intro.8mandos.gz
255
443
444
.PHONY: install-client-nokey
256
445
install-client-nokey: all doc
257
install --directory $(PREFIX)/lib/mandos $(CONFDIR)
446
install --directory $(LIBDIR)/mandos $(CONFDIR)
258
447
install --directory --mode=u=rwx $(KEYDIR) \
259
$(PREFIX)/lib/mandos/plugins.d
260
if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
448
$(LIBDIR)/mandos/plugins.d \
449
$(LIBDIR)/mandos/plugin-helpers
450
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
451
-a -d "$(SYSUSERS)" ]; then \
452
install --mode=u=rw,go=r sysusers.d-mandos.conf \
453
$(SYSUSERS)/mandos-client.conf; \
454
fi
455
if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
261
456
install --mode=u=rwx \
262
--directory "$(CONFDIR)/plugins.d"; \
457
--directory "$(CONFDIR)/plugins.d" \
458
"$(CONFDIR)/plugin-helpers"; \
263
459
fi
264
install --mode=u=rwx,go=rx \
265
--target-directory=$(PREFIX)/lib/mandos plugin-runner
460
install --mode=u=rwx,go=rx --directory \
461
"$(CONFDIR)/network-hooks.d"
462
install --mode=u=rwx,go=rx \
463
--target-directory=$(LIBDIR)/mandos plugin-runner
464
install --mode=u=rwx,go=rx \
465
--target-directory=$(LIBDIR)/mandos \
466
mandos-to-cryptroot-unlock
266
467
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
267
468
mandos-keygen
268
469
install --mode=u=rwx,go=rx \
269
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
470
--target-directory=$(LIBDIR)/mandos/plugins.d \
270
471
plugins.d/password-prompt
271
472
install --mode=u=rwxs,go=rx \
272
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
473
--target-directory=$(LIBDIR)/mandos/plugins.d \
273
474
plugins.d/mandos-client
274
475
install --mode=u=rwxs,go=rx \
275
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
476
--target-directory=$(LIBDIR)/mandos/plugins.d \
276
477
plugins.d/usplash
277
478
install --mode=u=rwxs,go=rx \
278
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
479
--target-directory=$(LIBDIR)/mandos/plugins.d \
279
480
plugins.d/splashy
280
481
install --mode=u=rwxs,go=rx \
281
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
482
--target-directory=$(LIBDIR)/mandos/plugins.d \
282
483
plugins.d/askpass-fifo
484
install --mode=u=rwxs,go=rx \
485
--target-directory=$(LIBDIR)/mandos/plugins.d \
486
plugins.d/plymouth
487
install --mode=u=rwx,go=rx \
488
--target-directory=$(LIBDIR)/mandos/plugin-helpers \
489
plugin-helpers/mandos-client-iprouteadddel
283
490
install initramfs-tools-hook \
284
491
$(INITRAMFSTOOLS)/hooks/mandos
285
install --mode=u=rw,go=r initramfs-tools-hook-conf \
286
$(INITRAMFSTOOLS)/conf-hooks.d/mandos
492
install --mode=u=rw,go=r initramfs-tools-conf \
493
$(INITRAMFSTOOLS)/conf.d/mandos-conf
494
install --mode=u=rw,go=r initramfs-tools-conf-hook \
495
$(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
287
496
install initramfs-tools-script \
288
$(INITRAMFSTOOLS)/scripts/local-top/mandos
497
$(INITRAMFSTOOLS)/scripts/init-premount/mandos
498
install initramfs-tools-script-stop \
499
$(INITRAMFSTOOLS)/scripts/local-premount/mandos
500
install --directory $(DRACUTMODULE)
501
install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
502
dracut-module/ask-password-mandos.path \
503
dracut-module/ask-password-mandos.service
504
install --mode=u=rwxs,go=rx \
505
--target-directory=$(DRACUTMODULE) \
506
dracut-module/module-setup.sh \
507
dracut-module/cmdline-mandos.sh \
508
dracut-module/password-agent
289
509
install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
290
510
gzip --best --to-stdout mandos-keygen.8 \
291
511
> $(MANDIR)/man8/mandos-keygen.8.gz
292
512
gzip --best --to-stdout plugin-runner.8mandos \
293
513
> $(MANDIR)/man8/plugin-runner.8mandos.gz
514
gzip --best --to-stdout plugins.d/mandos-client.8mandos \
515
> $(MANDIR)/man8/mandos-client.8mandos.gz
294
516
gzip --best --to-stdout plugins.d/password-prompt.8mandos \
295
517
> $(MANDIR)/man8/password-prompt.8mandos.gz
296
gzip --best --to-stdout plugins.d/mandos-client.8mandos \
297
> $(MANDIR)/man8/mandos-client.8mandos.gz
298
518
gzip --best --to-stdout plugins.d/usplash.8mandos \
299
519
> $(MANDIR)/man8/usplash.8mandos.gz
300
520
gzip --best --to-stdout plugins.d/splashy.8mandos \
301
521
> $(MANDIR)/man8/splashy.8mandos.gz
302
522
gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
303
523
> $(MANDIR)/man8/askpass-fifo.8mandos.gz
524
gzip --best --to-stdout plugins.d/plymouth.8mandos \
525
> $(MANDIR)/man8/plymouth.8mandos.gz
526
gzip --best --to-stdout dracut-module/password-agent.8mandos \
527
> $(MANDIR)/man8/password-agent.8mandos.gz
304
528
529
.PHONY: install-client
305
530
install-client: install-client-nokey
306
531
# Post-installation stuff
307
532
-$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
308
update-initramfs -k all -u
533
if command -v update-initramfs >/dev/null; then \
534
update-initramfs -k all -u; \
535
elif command -v dracut >/dev/null; then \
536
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
537
if [ -w "$$initrd" ]; then \
538
chmod go-r "$$initrd"; \
539
dracut --force "$$initrd"; \
540
fi; \
541
done; \
542
fi
309
543
echo "Now run mandos-keygen --password --dir $(KEYDIR)"
310
544
545
.PHONY: uninstall
311
546
uninstall: uninstall-server uninstall-client
312
547
548
.PHONY: uninstall-server
313
549
uninstall-server:
314
550
-rm --force $(PREFIX)/sbin/mandos \
551
$(PREFIX)/sbin/mandos-ctl \
552
$(PREFIX)/sbin/mandos-monitor \
315
553
$(MANDIR)/man8/mandos.8.gz \
554
$(MANDIR)/man8/mandos-monitor.8.gz \
555
$(MANDIR)/man8/mandos-ctl.8.gz \
316
556
$(MANDIR)/man5/mandos.conf.5.gz \
317
557
$(MANDIR)/man5/mandos-clients.conf.5.gz
318
558
update-rc.d -f mandos remove
319
559
-rmdir $(CONFDIR)
320
560
561
.PHONY: uninstall-client
321
562
uninstall-client:
322
563
# Refuse to uninstall client if /etc/crypttab is explicitly configured
323
564
# to use it.
324
565
! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
325
566
$(DESTDIR)/etc/crypttab
326
567
-rm --force $(PREFIX)/sbin/mandos-keygen \
327
$(PREFIX)/lib/mandos/plugin-runner \
328
$(PREFIX)/lib/mandos/plugins.d/password-prompt \
329
$(PREFIX)/lib/mandos/plugins.d/mandos-client \
330
$(PREFIX)/lib/mandos/plugins.d/usplash \
331
$(PREFIX)/lib/mandos/plugins.d/splashy \
332
$(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
568
$(LIBDIR)/mandos/plugin-runner \
569
$(LIBDIR)/mandos/plugins.d/password-prompt \
570
$(LIBDIR)/mandos/plugins.d/mandos-client \
571
$(LIBDIR)/mandos/plugins.d/usplash \
572
$(LIBDIR)/mandos/plugins.d/splashy \
573
$(LIBDIR)/mandos/plugins.d/askpass-fifo \
574
$(LIBDIR)/mandos/plugins.d/plymouth \
333
575
$(INITRAMFSTOOLS)/hooks/mandos \
334
576
$(INITRAMFSTOOLS)/conf-hooks.d/mandos \
335
$(INITRAMFSTOOLS)/scripts/local-top/mandos \
577
$(INITRAMFSTOOLS)/scripts/init-premount/mandos \
578
$(INITRAMFSTOOLS)/scripts/local-premount/mandos \
579
$(DRACUTMODULE)/ask-password-mandos.path \
580
$(DRACUTMODULE)/ask-password-mandos.service \
581
$(DRACUTMODULE)/module-setup.sh \
582
$(DRACUTMODULE)/cmdline-mandos.sh \
583
$(DRACUTMODULE)/password-agent \
584
$(MANDIR)/man8/mandos-keygen.8.gz \
336
585
$(MANDIR)/man8/plugin-runner.8mandos.gz \
337
$(MANDIR)/man8/mandos-keygen.8.gz \
586
$(MANDIR)/man8/mandos-client.8mandos.gz
338
587
$(MANDIR)/man8/password-prompt.8mandos.gz \
339
588
$(MANDIR)/man8/usplash.8mandos.gz \
340
589
$(MANDIR)/man8/splashy.8mandos.gz \
341
590
$(MANDIR)/man8/askpass-fifo.8mandos.gz \
342
$(MANDIR)/man8/mandos-client.8mandos.gz
343
-rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
344
$(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
345
update-initramfs -k all -u
591
$(MANDIR)/man8/plymouth.8mandos.gz \
592
$(MANDIR)/man8/password-agent.8mandos.gz \
593
-rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
594
$(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
595
if command -v update-initramfs >/dev/null; then \
596
update-initramfs -k all -u; \
597
elif command -v dracut >/dev/null; then \
598
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
599
test -w "$$initrd" && dracut --force "$$initrd"; \
600
done; \
601
fi
346
602
603
.PHONY: purge
347
604
purge: purge-server purge-client
348
605
606
.PHONY: purge-server
349
607
purge-server: uninstall-server
350
608
-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
609
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
351
610
$(DESTDIR)/etc/default/mandos \
352
611
$(DESTDIR)/etc/init.d/mandos \
612
$(SYSTEMD)/mandos.service \
613
$(DESTDIR)/run/mandos.pid \
353
614
$(DESTDIR)/var/run/mandos.pid
354
615
-rmdir $(CONFDIR)
355
616
617
.PHONY: purge-client
356
618
purge-client: uninstall-client
357
-shred --remove $(KEYDIR)/seckey.txt
619
-shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
358
620
-rm --force $(CONFDIR)/plugin-runner.conf \
359
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
621
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
622
$(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
360
623
-rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0