To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to Makefile
- browse files at revision 1213
- compare with another revision
- download diff
- download tarball
- view history from revision 1213
- Committer: teddy at recompile
- Date: 2020-04-05 21:30:59 UTC
- Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk
Fix file descriptor leak in mandos-client
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.) The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.
This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route. If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.
Fix this by eliminating the file descriptor leak in the client.
* plugins.d/mandos-client.c (add_delete_local_route): Do
close(devnull) also in parent process, also if fork() fails, and on
any failure in child process.
- files added:
- bugs.xml
- debian/tests
- debian/upstream
- dracut-module
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
Makefile
1
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
-Wswitch-default -Wswitch-enum -Wunused-parameter \
3
-Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
-Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
-Wunused -Wuninitialized -Wstrict-overflow=5 \
4
-Wsuggest-attribute=pure -Wsuggest-attribute=const \
5
-Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
-Wunsafe-loop-optimizations -Wpointer-arith \
5
7
-Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
-Wconversion -Wstrict-prototypes -Wold-style-definition \
7
-Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
# -Wunreachable-code
9
#DEBUG=-ggdb3
10
# For info about _FORTIFY_SOURCE, see
11
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
12
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
14
LINK_FORTIFY_LD=-z relro -z now
15
LINK_FORTIFY=
8
-Wconversion -Wlogical-op -Waggregate-return \
9
-Wstrict-prototypes -Wold-style-definition \
10
-Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
-Wredundant-decls -Wnested-externs -Winline -Wvla \
12
-Wvolatile-register-var -Woverlength-strings
13
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
## Check which sanitizing options can be used
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
# echo 'int main(){}' | $(CC) --language=c $(option) \
18
# /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
-fsanitize=shift -fsanitize=integer-divide-by-zero \
22
-fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
-fsanitize=return -fsanitize=signed-integer-overflow \
24
-fsanitize=bounds -fsanitize=alignment \
25
-fsanitize=object-size -fsanitize=float-divide-by-zero \
26
-fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
-fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
-fsanitize=enum -fsanitize-address-use-after-scope
29
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
LINK_FORTIFY_LD:=-z relro -z now
34
LINK_FORTIFY:=
16
35
17
36
# If BROKEN_PIE is set, do not build with -pie
18
37
ifndef BROKEN_PIE
20
39
LINK_FORTIFY += -pie
21
40
endif
22
41
#COVERAGE=--coverage
23
OPTIMIZE=-Os
24
LANGUAGE=-std=gnu99
25
htmldir=man
26
version=1.4.1
27
SED=sed
28
29
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
42
OPTIMIZE:=-Os -fno-strict-aliasing
43
LANGUAGE:=-std=gnu11
44
FEATURES:=-D_FILE_OFFSET_BITS=64
45
htmldir:=man
46
version:=1.8.10
47
SED:=sed
48
PKG_CONFIG?=pkg-config
49
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
51
|| getent passwd nobody || echo 65534)))
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
53
|| getent group nogroup || echo 65534)))
54
55
LINUXVERSION:=$(shell uname --kernel-release)
31
56
32
57
## Use these settings for a traditional /usr/local install
33
# PREFIX=$(DESTDIR)/usr/local
34
# CONFDIR=$(DESTDIR)/etc/mandos
35
# KEYDIR=$(DESTDIR)/etc/mandos/keys
36
# MANDIR=$(PREFIX)/man
37
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
# STATEDIR=$(DESTDIR)/var/lib/mandos
58
# PREFIX:=$(DESTDIR)/usr/local
59
# CONFDIR:=$(DESTDIR)/etc/mandos
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
61
# MANDIR:=$(PREFIX)/man
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
65
# LIBDIR:=$(PREFIX)/lib
39
66
##
40
67
41
68
## These settings are for a package-type install
42
PREFIX=$(DESTDIR)/usr
43
CONFDIR=$(DESTDIR)/etc/mandos
44
KEYDIR=$(DESTDIR)/etc/keys/mandos
45
MANDIR=$(PREFIX)/share/man
46
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
STATEDIR=$(DESTDIR)/var/lib/mandos
69
PREFIX:=$(DESTDIR)/usr
70
CONFDIR:=$(DESTDIR)/etc/mandos
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
72
MANDIR:=$(PREFIX)/share/man
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
76
LIBDIR:=$(shell \
77
for d in \
78
"/usr/lib/`dpkg-architecture \
79
-qDEB_HOST_MULTIARCH 2>/dev/null`" \
80
"`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
81
if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
82
echo "$(DESTDIR)$$d"; \
83
break; \
84
fi; \
85
done)
48
86
##
49
87
50
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
51
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
52
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
53
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
54
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
55
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
89
--variable=systemdsystemunitdir)
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
91
--variable=tmpfilesdir)
92
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
93
--variable=sysusersdir)
94
95
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
96
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
97
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
98
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
99
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
100
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
56
101
getconf LFS_LDFLAGS)
102
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
103
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
104
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
105
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
57
106
58
107
# Do not change these two
59
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
60
$(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
61
-DVERSION='"$(version)"'
62
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
108
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
109
$(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
110
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
111
) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
63
112
64
113
# Commands to format a DocBook <refentry> document into a manual page
65
114
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
68
117
--param make.single.year.ranges 1 \
69
118
--param man.output.quietly 1 \
70
119
--param man.authors.section.enabled 0 \
71
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
120
/usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
72
121
$(notdir $<); \
73
$(MANPOST) $(notdir $@);\
74
LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
75
--local-file $(notdir $@) >/dev/null)
76
# DocBook-to-man post-processing to fix a '\n' escape bug
77
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
122
if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
123
&& command -v man >/dev/null; then LANG=en_US.UTF-8 \
124
MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
125
$(notdir $@); fi >/dev/null)
78
126
79
127
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
80
128
--param make.year.ranges 1 \
86
134
/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
87
135
$<; $(HTMLPOST) $@)
88
136
# Fix citerefentry links
89
HTMLPOST=$(SED) --in-place \
137
HTMLPOST:=$(SED) --in-place \
90
138
--expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
91
139
92
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
140
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
93
141
plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
94
142
plugins.d/plymouth
95
CPROGS=plugin-runner $(PLUGINS)
96
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
97
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
143
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
144
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
145
$(PLUGIN_HELPERS)
146
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
147
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
98
148
mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
149
dracut-module/password-agent.8mandos \
99
150
plugins.d/mandos-client.8mandos \
100
151
plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
101
152
plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
102
153
plugins.d/plymouth.8mandos intro.8mandos
103
154
104
htmldocs=$(addsuffix .xhtml,$(DOCS))
105
106
objects=$(addsuffix .o,$(CPROGS))
107
155
htmldocs:=$(addsuffix .xhtml,$(DOCS))
156
157
objects:=$(addsuffix .o,$(CPROGS))
158
159
.PHONY: all
108
160
all: $(PROGS) mandos.lsm
109
161
162
.PHONY: doc
110
163
doc: $(DOCS)
111
164
165
.PHONY: html
112
166
html: $(htmldocs)
113
167
114
168
%.5: %.xml common.ent legalnotice.xml
173
227
overview.xml legalnotice.xml
174
228
$(DOCBOOKTOHTML)
175
229
230
dracut-module/password-agent.8mandos: \
231
dracut-module/password-agent.xml common.ent \
232
overview.xml legalnotice.xml
233
$(DOCBOOKTOMAN)
234
dracut-module/password-agent.8mandos.xhtml: \
235
dracut-module/password-agent.xml common.ent \
236
overview.xml legalnotice.xml
237
$(DOCBOOKTOHTML)
238
176
239
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
177
240
common.ent \
178
241
mandos-options.xml \
221
284
--expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
222
285
$@)
223
286
224
plugins.d/mandos-client: plugins.d/mandos-client.c
225
$(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
226
) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
227
228
.PHONY : all doc html clean distclean run-client run-server install \
229
install-server install-client uninstall uninstall-server \
230
uninstall-client purge purge-server purge-client
231
287
# Need to add the GnuTLS, Avahi and GPGME libraries
288
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
289
) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
290
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
291
) $(AVAHI_LIBS) $(GPGME_LIBS)
292
293
# Need to add the libnl-route library
294
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
295
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
296
297
# Need to add the GLib and pthread libraries
298
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
299
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
300
301
.PHONY: clean
232
302
clean:
233
303
-rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
234
304
305
.PHONY: distclean
235
306
distclean: clean
307
.PHONY: mostlyclean
236
308
mostlyclean: clean
309
.PHONY: maintainer-clean
237
310
maintainer-clean: clean
238
311
-rm --force --recursive keydir confdir statedir
239
312
240
check: all
313
.PHONY: check
314
check: all
241
315
./mandos --check
316
./mandos-ctl --check
317
./mandos-keygen --version
318
./plugin-runner --version
319
./plugin-helpers/mandos-client-iprouteadddel --version
320
./dracut-module/password-agent --test
242
321
243
322
# Run the client with a local config and key
244
run-client: all keydir/seckey.txt keydir/pubkey.txt
245
@echo "###################################################################"
246
@echo "# The following error messages are harmless and can be safely #"
247
@echo "# ignored. The messages are caused by not running as root, but #"
248
@echo "# you should NOT run \"make run-client\" as root unless you also #"
249
@echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
250
@echo "# From plugin-runner: setuid: Operation not permitted #"
251
@echo "# From askpass-fifo: mkfifo: Permission denied #"
252
@echo "# From mandos-client: setuid: Operation not permitted #"
253
@echo "# seteuid: Operation not permitted #"
254
@echo "# klogctl: Operation not permitted #"
255
@echo "###################################################################"
323
.PHONY: run-client
324
run-client: all keydir/seckey.txt keydir/pubkey.txt \
325
keydir/tls-privkey.pem keydir/tls-pubkey.pem
326
@echo '######################################################'
327
@echo '# The following error messages are harmless and can #'
328
@echo '# be safely ignored: #'
329
@echo '## From plugin-runner: #'
330
@echo '# setgid: Operation not permitted #'
331
@echo '# setuid: Operation not permitted #'
332
@echo '## From askpass-fifo: #'
333
@echo '# mkfifo: Permission denied #'
334
@echo '## From mandos-client: #'
335
@echo '# Failed to raise privileges: Operation not permi... #'
336
@echo '# Warning: network hook "*" exited with status * #'
337
@echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
338
@echo '# Failed to bring up interface "*": Operation not... #'
339
@echo '# #'
340
@echo '# (The messages are caused by not running as root, #'
341
@echo '# but you should NOT run "make run-client" as root #'
342
@echo '# unless you also unpacked and compiled Mandos as #'
343
@echo '# root, which is also NOT recommended.) #'
344
@echo '######################################################'
345
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
256
346
./plugin-runner --plugin-dir=plugins.d \
347
--plugin-helper-dir=plugin-helpers \
257
348
--config-file=plugin-runner.conf \
258
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
349
--options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
350
--env-for=mandos-client:GNOME_KEYRING_CONTROL= \
259
351
$(CLIENTARGS)
260
352
261
353
# Used by run-client
262
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
354
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
263
355
install --directory keydir
264
356
./mandos-keygen --dir keydir --force
357
if ! [ -e keydir/tls-privkey.pem ]; then \
358
install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
359
fi
360
if ! [ -e keydir/tls-pubkey.pem ]; then \
361
install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
362
fi
265
363
266
364
# Run the server with a local config
267
run-server: confdir/mandos.conf confdir/clients.conf
365
.PHONY: run-server
366
run-server: confdir/mandos.conf confdir/clients.conf statedir
268
367
./mandos --debug --no-dbus --configdir=confdir \
269
368
--statedir=statedir $(SERVERARGS)
270
369
272
371
confdir/mandos.conf: mandos.conf
273
372
install --directory confdir
274
373
install --mode=u=rw,go=r $^ $@
275
confdir/clients.conf: clients.conf keydir/seckey.txt
374
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
276
375
install --directory confdir
277
376
install --mode=u=rw $< $@
278
377
# Add a client password
279
./mandos-keygen --dir keydir --password >> $@
378
./mandos-keygen --dir keydir --password --no-ssh >> $@
280
379
statedir:
281
380
install --directory statedir
282
381
382
.PHONY: install
283
383
install: install-server install-client-nokey
284
384
385
.PHONY: install-html
285
386
install-html: html
286
387
install --directory $(htmldir)
287
388
install --mode=u=rw,go=r --target-directory=$(htmldir) \
288
389
$(htmldocs)
289
390
391
.PHONY: install-server
290
392
install-server: doc
291
393
install --directory $(CONFDIR)
292
install --directory --mode=u=rwx --owner=$(USER) \
293
--group=$(GROUP) $(STATEDIR)
394
if install --directory --mode=u=rwx --owner=$(USER) \
395
--group=$(GROUP) $(STATEDIR); then \
396
:; \
397
elif install --directory --mode=u=rwx $(STATEDIR); then \
398
chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
399
fi
400
if [ "$(TMPFILES)" != "$(DESTDIR)" \
401
-a -d "$(TMPFILES)" ]; then \
402
install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
403
$(TMPFILES)/mandos.conf; \
404
fi
405
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
406
-a -d "$(SYSUSERS)" ]; then \
407
install --mode=u=rw,go=r sysusers.d-mandos.conf \
408
$(SYSUSERS)/mandos.conf; \
409
fi
294
410
install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
295
411
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
296
412
mandos-ctl
304
420
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
305
421
install --mode=u=rwx,go=rx init.d-mandos \
306
422
$(DESTDIR)/etc/init.d/mandos
423
if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
424
install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
425
fi
307
426
install --mode=u=rw,go=r default-mandos \
308
427
$(DESTDIR)/etc/default/mandos
309
428
if [ -z $(DESTDIR) ]; then \
319
438
> $(MANDIR)/man5/mandos.conf.5.gz
320
439
gzip --best --to-stdout mandos-clients.conf.5 \
321
440
> $(MANDIR)/man5/mandos-clients.conf.5.gz
441
gzip --best --to-stdout intro.8mandos \
442
> $(MANDIR)/man8/intro.8mandos.gz
322
443
444
.PHONY: install-client-nokey
323
445
install-client-nokey: all doc
324
install --directory $(PREFIX)/lib/mandos $(CONFDIR)
446
install --directory $(LIBDIR)/mandos $(CONFDIR)
325
447
install --directory --mode=u=rwx $(KEYDIR) \
326
$(PREFIX)/lib/mandos/plugins.d
327
if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
448
$(LIBDIR)/mandos/plugins.d \
449
$(LIBDIR)/mandos/plugin-helpers
450
if [ "$(SYSUSERS)" != "$(DESTDIR)" \
451
-a -d "$(SYSUSERS)" ]; then \
452
install --mode=u=rw,go=r sysusers.d-mandos.conf \
453
$(SYSUSERS)/mandos-client.conf; \
454
fi
455
if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
328
456
install --mode=u=rwx \
329
--directory "$(CONFDIR)/plugins.d"; \
457
--directory "$(CONFDIR)/plugins.d" \
458
"$(CONFDIR)/plugin-helpers"; \
330
459
fi
331
460
install --mode=u=rwx,go=rx --directory \
332
461
"$(CONFDIR)/network-hooks.d"
333
462
install --mode=u=rwx,go=rx \
334
--target-directory=$(PREFIX)/lib/mandos plugin-runner
463
--target-directory=$(LIBDIR)/mandos plugin-runner
464
install --mode=u=rwx,go=rx \
465
--target-directory=$(LIBDIR)/mandos \
466
mandos-to-cryptroot-unlock
335
467
install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
336
468
mandos-keygen
337
469
install --mode=u=rwx,go=rx \
338
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
470
--target-directory=$(LIBDIR)/mandos/plugins.d \
339
471
plugins.d/password-prompt
340
472
install --mode=u=rwxs,go=rx \
341
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
473
--target-directory=$(LIBDIR)/mandos/plugins.d \
342
474
plugins.d/mandos-client
343
475
install --mode=u=rwxs,go=rx \
344
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
476
--target-directory=$(LIBDIR)/mandos/plugins.d \
345
477
plugins.d/usplash
346
478
install --mode=u=rwxs,go=rx \
347
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
479
--target-directory=$(LIBDIR)/mandos/plugins.d \
348
480
plugins.d/splashy
349
481
install --mode=u=rwxs,go=rx \
350
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
482
--target-directory=$(LIBDIR)/mandos/plugins.d \
351
483
plugins.d/askpass-fifo
352
484
install --mode=u=rwxs,go=rx \
353
--target-directory=$(PREFIX)/lib/mandos/plugins.d \
485
--target-directory=$(LIBDIR)/mandos/plugins.d \
354
486
plugins.d/plymouth
487
install --mode=u=rwx,go=rx \
488
--target-directory=$(LIBDIR)/mandos/plugin-helpers \
489
plugin-helpers/mandos-client-iprouteadddel
355
490
install initramfs-tools-hook \
356
491
$(INITRAMFSTOOLS)/hooks/mandos
357
install --mode=u=rw,go=r initramfs-tools-hook-conf \
358
$(INITRAMFSTOOLS)/conf-hooks.d/mandos
492
install --mode=u=rw,go=r initramfs-tools-conf \
493
$(INITRAMFSTOOLS)/conf.d/mandos-conf
494
install --mode=u=rw,go=r initramfs-tools-conf-hook \
495
$(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
359
496
install initramfs-tools-script \
360
497
$(INITRAMFSTOOLS)/scripts/init-premount/mandos
498
install initramfs-tools-script-stop \
499
$(INITRAMFSTOOLS)/scripts/local-premount/mandos
500
install --directory $(DRACUTMODULE)
501
install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
502
dracut-module/ask-password-mandos.path \
503
dracut-module/ask-password-mandos.service
504
install --mode=u=rwxs,go=rx \
505
--target-directory=$(DRACUTMODULE) \
506
dracut-module/module-setup.sh \
507
dracut-module/cmdline-mandos.sh \
508
dracut-module/password-agent
361
509
install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
362
510
gzip --best --to-stdout mandos-keygen.8 \
363
511
> $(MANDIR)/man8/mandos-keygen.8.gz
375
523
> $(MANDIR)/man8/askpass-fifo.8mandos.gz
376
524
gzip --best --to-stdout plugins.d/plymouth.8mandos \
377
525
> $(MANDIR)/man8/plymouth.8mandos.gz
526
gzip --best --to-stdout dracut-module/password-agent.8mandos \
527
> $(MANDIR)/man8/password-agent.8mandos.gz
378
528
529
.PHONY: install-client
379
530
install-client: install-client-nokey
380
531
# Post-installation stuff
381
532
-$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
382
update-initramfs -k all -u
533
if command -v update-initramfs >/dev/null; then \
534
update-initramfs -k all -u; \
535
elif command -v dracut >/dev/null; then \
536
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
537
if [ -w "$$initrd" ]; then \
538
chmod go-r "$$initrd"; \
539
dracut --force "$$initrd"; \
540
fi; \
541
done; \
542
fi
383
543
echo "Now run mandos-keygen --password --dir $(KEYDIR)"
384
544
545
.PHONY: uninstall
385
546
uninstall: uninstall-server uninstall-client
386
547
548
.PHONY: uninstall-server
387
549
uninstall-server:
388
550
-rm --force $(PREFIX)/sbin/mandos \
389
551
$(PREFIX)/sbin/mandos-ctl \
396
558
update-rc.d -f mandos remove
397
559
-rmdir $(CONFDIR)
398
560
561
.PHONY: uninstall-client
399
562
uninstall-client:
400
563
# Refuse to uninstall client if /etc/crypttab is explicitly configured
401
564
# to use it.
402
565
! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
403
566
$(DESTDIR)/etc/crypttab
404
567
-rm --force $(PREFIX)/sbin/mandos-keygen \
405
$(PREFIX)/lib/mandos/plugin-runner \
406
$(PREFIX)/lib/mandos/plugins.d/password-prompt \
407
$(PREFIX)/lib/mandos/plugins.d/mandos-client \
408
$(PREFIX)/lib/mandos/plugins.d/usplash \
409
$(PREFIX)/lib/mandos/plugins.d/splashy \
410
$(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
411
$(PREFIX)/lib/mandos/plugins.d/plymouth \
568
$(LIBDIR)/mandos/plugin-runner \
569
$(LIBDIR)/mandos/plugins.d/password-prompt \
570
$(LIBDIR)/mandos/plugins.d/mandos-client \
571
$(LIBDIR)/mandos/plugins.d/usplash \
572
$(LIBDIR)/mandos/plugins.d/splashy \
573
$(LIBDIR)/mandos/plugins.d/askpass-fifo \
574
$(LIBDIR)/mandos/plugins.d/plymouth \
412
575
$(INITRAMFSTOOLS)/hooks/mandos \
413
576
$(INITRAMFSTOOLS)/conf-hooks.d/mandos \
414
577
$(INITRAMFSTOOLS)/scripts/init-premount/mandos \
578
$(INITRAMFSTOOLS)/scripts/local-premount/mandos \
579
$(DRACUTMODULE)/ask-password-mandos.path \
580
$(DRACUTMODULE)/ask-password-mandos.service \
581
$(DRACUTMODULE)/module-setup.sh \
582
$(DRACUTMODULE)/cmdline-mandos.sh \
583
$(DRACUTMODULE)/password-agent \
415
584
$(MANDIR)/man8/mandos-keygen.8.gz \
416
585
$(MANDIR)/man8/plugin-runner.8mandos.gz \
417
586
$(MANDIR)/man8/mandos-client.8mandos.gz
420
589
$(MANDIR)/man8/splashy.8mandos.gz \
421
590
$(MANDIR)/man8/askpass-fifo.8mandos.gz \
422
591
$(MANDIR)/man8/plymouth.8mandos.gz \
423
-rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
424
$(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
425
update-initramfs -k all -u
592
$(MANDIR)/man8/password-agent.8mandos.gz \
593
-rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
594
$(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
595
if command -v update-initramfs >/dev/null; then \
596
update-initramfs -k all -u; \
597
elif command -v dracut >/dev/null; then \
598
for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
599
test -w "$$initrd" && dracut --force "$$initrd"; \
600
done; \
601
fi
426
602
603
.PHONY: purge
427
604
purge: purge-server purge-client
428
605
606
.PHONY: purge-server
429
607
purge-server: uninstall-server
430
608
-rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
431
609
$(DESTDIR)/etc/dbus-1/system.d/mandos.conf
432
610
$(DESTDIR)/etc/default/mandos \
433
611
$(DESTDIR)/etc/init.d/mandos \
612
$(SYSTEMD)/mandos.service \
613
$(DESTDIR)/run/mandos.pid \
434
614
$(DESTDIR)/var/run/mandos.pid
435
615
-rmdir $(CONFDIR)
436
616
617
.PHONY: purge-client
437
618
purge-client: uninstall-client
438
-shred --remove $(KEYDIR)/seckey.txt
619
-shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
439
620
-rm --force $(CONFDIR)/plugin-runner.conf \
440
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
621
$(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
622
$(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
441
623
-rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0