/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2021-02-03 23:10:42 UTC
  • Revision ID: teddy@recompile.se-20210203231042-2z3egrvpo1zt7nej
mandos-ctl: Fix bad test for command.Remove and related minor issues

The test for command.Remove removes all clients from the spy server,
and then loops over all clients, looking for the corresponding Remove
command as recorded by the spy server.  But since since there aren't
any clients left after they were removed, no assertions are made, and
the test therefore does nothing.  Fix this.

In tests for command.Approve and command.Deny, add checks that clients
were not somehow removed by the command (in which case, likewise, no
assertions are made).

Add related checks to TestPropertySetterCmd.runTest; i.e. test that a
sequence is not empty before looping over it and making assertions.

* mandos-ctl (TestBaseCommands.test_Remove): Save a copy of the
  original "clients" dict, and loop over those instead.  Add assertion
  that all clients were indeed removed.  Also fix the code which looks
  for the Remove command, which now needs to actually work.
  (TestBaseCommands.test_Approve, TestBaseCommands.test_Deny): Add
  assertion that there are still clients before looping over them.
  (TestPropertySetterCmd.runTest): Add assertion that the list of
  values to get is not empty before looping over them.  Also add check
  that there are still clients before looping over clients.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG=-ggdb3
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
14
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
17
 
LINK_FORTIFY_LD=-z relro -z now
18
 
LINK_FORTIFY=
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
33
LINK_FORTIFY_LD:=-z relro -z now
 
34
LINK_FORTIFY:=
19
35
 
20
36
# If BROKEN_PIE is set, do not build with -pie
21
37
ifndef BROKEN_PIE
23
39
LINK_FORTIFY += -pie
24
40
endif
25
41
#COVERAGE=--coverage
26
 
OPTIMIZE=-Os -fno-strict-aliasing
27
 
LANGUAGE=-std=gnu99
28
 
htmldir=man
29
 
version=1.6.4
30
 
SED=sed
31
 
 
32
 
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
33
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
42
OPTIMIZE:=-Os -fno-strict-aliasing
 
43
LANGUAGE:=-std=gnu11
 
44
FEATURES:=-D_FILE_OFFSET_BITS=64
 
45
htmldir:=man
 
46
version:=1.8.14
 
47
SED:=sed
 
48
PKG_CONFIG?=pkg-config
 
49
 
 
50
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
51
        || getent passwd nobody || echo 65534)))
 
52
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
53
        || getent group nogroup || echo 65534)))
 
54
 
 
55
LINUXVERSION:=$(shell uname --kernel-release)
34
56
 
35
57
## Use these settings for a traditional /usr/local install
36
 
# PREFIX=$(DESTDIR)/usr/local
37
 
# CONFDIR=$(DESTDIR)/etc/mandos
38
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
39
 
# MANDIR=$(PREFIX)/man
40
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
41
 
# STATEDIR=$(DESTDIR)/var/lib/mandos
42
 
# LIBDIR=$(PREFIX)/lib
 
58
# PREFIX:=$(DESTDIR)/usr/local
 
59
# CONFDIR:=$(DESTDIR)/etc/mandos
 
60
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
61
# MANDIR:=$(PREFIX)/man
 
62
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
63
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
64
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
65
# LIBDIR:=$(PREFIX)/lib
43
66
##
44
67
 
45
68
## These settings are for a package-type install
46
 
PREFIX=$(DESTDIR)/usr
47
 
CONFDIR=$(DESTDIR)/etc/mandos
48
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
49
 
MANDIR=$(PREFIX)/share/man
50
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
51
 
STATEDIR=$(DESTDIR)/var/lib/mandos
52
 
LIBDIR=$(shell \
 
69
PREFIX:=$(DESTDIR)/usr
 
70
CONFDIR:=$(DESTDIR)/etc/mandos
 
71
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
72
MANDIR:=$(PREFIX)/share/man
 
73
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
74
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
75
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
76
LIBDIR:=$(shell \
53
77
        for d in \
54
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
78
        "/usr/lib/`dpkg-architecture \
 
79
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
55
80
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
56
81
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
57
82
                        echo "$(DESTDIR)$$d"; \
60
85
        done)
61
86
##
62
87
 
63
 
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
88
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
89
                        --variable=systemdsystemunitdir)
 
90
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
91
                        --variable=tmpfilesdir)
 
92
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
93
                        --variable=sysusersdir)
64
94
 
65
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
66
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
67
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
68
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
69
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
70
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
95
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
96
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
97
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
98
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
99
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
100
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
71
101
        getconf LFS_LDFLAGS)
 
102
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
103
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
104
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
105
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
72
106
 
73
107
# Do not change these two
74
108
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
75
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
76
 
        -DVERSION='"$(version)"'
77
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
109
        $(LANGUAGE) $(FEATURES) -DVERSION='"$(version)"'
 
110
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
111
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
78
112
 
79
113
# Commands to format a DocBook <refentry> document into a manual page
80
114
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
85
119
        --param man.authors.section.enabled     0 \
86
120
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
87
121
        $(notdir $<); \
88
 
        $(MANPOST) $(notdir $@);\
89
122
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
90
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
91
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
92
 
        fi >/dev/null)
93
 
# DocBook-to-man post-processing to fix a '\n' escape bug
94
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
123
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
124
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
125
        $(notdir $@); fi >/dev/null)
95
126
 
96
127
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
97
128
        --param make.year.ranges                1 \
103
134
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
104
135
        $<; $(HTMLPOST) $@)
105
136
# Fix citerefentry links
106
 
HTMLPOST=$(SED) --in-place \
 
137
HTMLPOST:=$(SED) --in-place \
107
138
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
108
139
 
109
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
 
140
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
110
141
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
111
142
        plugins.d/plymouth
112
 
CPROGS=plugin-runner $(PLUGINS)
113
 
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
114
 
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
143
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
144
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
145
        $(PLUGIN_HELPERS)
 
146
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
147
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
115
148
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
149
        dracut-module/password-agent.8mandos \
116
150
        plugins.d/mandos-client.8mandos \
117
151
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
118
152
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
119
153
        plugins.d/plymouth.8mandos intro.8mandos
120
154
 
121
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
122
 
 
123
 
objects=$(addsuffix .o,$(CPROGS))
124
 
 
 
155
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
156
 
 
157
objects:=$(addsuffix .o,$(CPROGS))
 
158
 
 
159
.PHONY: all
125
160
all: $(PROGS) mandos.lsm
126
161
 
 
162
.PHONY: doc
127
163
doc: $(DOCS)
128
164
 
 
165
.PHONY: html
129
166
html: $(htmldocs)
130
167
 
131
168
%.5: %.xml common.ent legalnotice.xml
190
227
                overview.xml legalnotice.xml
191
228
        $(DOCBOOKTOHTML)
192
229
 
 
230
dracut-module/password-agent.8mandos: \
 
231
                dracut-module/password-agent.xml common.ent \
 
232
                overview.xml legalnotice.xml
 
233
        $(DOCBOOKTOMAN)
 
234
dracut-module/password-agent.8mandos.xhtml: \
 
235
                dracut-module/password-agent.xml common.ent \
 
236
                overview.xml legalnotice.xml
 
237
        $(DOCBOOKTOHTML)
 
238
 
193
239
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
194
240
                                        common.ent \
195
241
                                        mandos-options.xml \
238
284
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
239
285
                $@)
240
286
 
241
 
plugins.d/mandos-client: plugins.d/mandos-client.c
242
 
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
243
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
244
 
 
245
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
246
 
        check run-client run-server install install-html \
247
 
        install-server install-client-nokey install-client uninstall \
248
 
        uninstall-server uninstall-client purge purge-server \
249
 
        purge-client
250
 
 
 
287
# Need to add the GnuTLS, Avahi and GPGME libraries
 
288
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
289
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
290
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
291
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
292
 
 
293
# Need to add the libnl-route library
 
294
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
295
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
296
 
 
297
# Need to add the GLib and pthread libraries
 
298
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
299
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
300
 
 
301
.PHONY: clean
251
302
clean:
252
303
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
253
304
 
 
305
.PHONY: distclean
254
306
distclean: clean
 
307
.PHONY: mostlyclean
255
308
mostlyclean: clean
 
309
.PHONY: maintainer-clean
256
310
maintainer-clean: clean
257
311
        -rm --force --recursive keydir confdir statedir
258
312
 
259
 
check:  all
 
313
.PHONY: check
 
314
check: all
260
315
        ./mandos --check
261
316
        ./mandos-ctl --check
 
317
        ./mandos-keygen --version
 
318
        ./plugin-runner --version
 
319
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
320
        ./dracut-module/password-agent --test
262
321
 
263
322
# Run the client with a local config and key
264
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
265
 
        @echo "###################################################################"
266
 
        @echo "# The following error messages are harmless and can be safely     #"
267
 
        @echo "# ignored.  The messages are caused by not running as root, but   #"
268
 
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
269
 
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
270
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
271
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
272
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
273
 
        @echo "#                     seteuid: Operation not permitted            #"
274
 
        @echo "#                     klogctl: Operation not permitted            #"
275
 
        @echo "###################################################################"
 
323
.PHONY: run-client
 
324
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
325
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
326
        @echo '######################################################'
 
327
        @echo '# The following error messages are harmless and can  #'
 
328
        @echo '#  be safely ignored:                                #'
 
329
        @echo '## From plugin-runner:                               #'
 
330
        @echo '# setgid: Operation not permitted                    #'
 
331
        @echo '# setuid: Operation not permitted                    #'
 
332
        @echo '## From askpass-fifo:                                #'
 
333
        @echo '# mkfifo: Permission denied                          #'
 
334
        @echo '## From mandos-client:                               #'
 
335
        @echo '# Failed to raise privileges: Operation not permi... #'
 
336
        @echo '# Warning: network hook "*" exited with status *     #'
 
337
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
338
        @echo '# Failed to bring up interface "*": Operation not... #'
 
339
        @echo '#                                                    #'
 
340
        @echo '# (The messages are caused by not running as root,   #'
 
341
        @echo '# but you should NOT run "make run-client" as root   #'
 
342
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
343
        @echo '# root, which is also NOT recommended.)              #'
 
344
        @echo '######################################################'
 
345
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
276
346
        ./plugin-runner --plugin-dir=plugins.d \
 
347
                --plugin-helper-dir=plugin-helpers \
277
348
                --config-file=plugin-runner.conf \
278
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
349
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
350
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
279
351
                $(CLIENTARGS)
280
352
 
281
353
# Used by run-client
282
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
354
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
283
355
        install --directory keydir
284
356
        ./mandos-keygen --dir keydir --force
 
357
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
358
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
359
        fi
 
360
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
361
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
362
        fi
285
363
 
286
364
# Run the server with a local config
 
365
.PHONY: run-server
287
366
run-server: confdir/mandos.conf confdir/clients.conf statedir
288
367
        ./mandos --debug --no-dbus --configdir=confdir \
289
368
                --statedir=statedir $(SERVERARGS)
292
371
confdir/mandos.conf: mandos.conf
293
372
        install --directory confdir
294
373
        install --mode=u=rw,go=r $^ $@
295
 
confdir/clients.conf: clients.conf keydir/seckey.txt
 
374
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
296
375
        install --directory confdir
297
376
        install --mode=u=rw $< $@
298
377
# Add a client password
299
 
        ./mandos-keygen --dir keydir --password >> $@
 
378
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
300
379
statedir:
301
380
        install --directory statedir
302
381
 
 
382
.PHONY: install
303
383
install: install-server install-client-nokey
304
384
 
 
385
.PHONY: install-html
305
386
install-html: html
306
387
        install --directory $(htmldir)
307
388
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
308
389
                $(htmldocs)
309
390
 
 
391
.PHONY: install-server
310
392
install-server: doc
311
393
        install --directory $(CONFDIR)
312
394
        if install --directory --mode=u=rwx --owner=$(USER) \
315
397
        elif install --directory --mode=u=rwx $(STATEDIR); then \
316
398
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
317
399
        fi
 
400
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
 
401
                        -a -d "$(TMPFILES)" ]; then \
 
402
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
403
                        $(TMPFILES)/mandos.conf; \
 
404
        fi
 
405
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
 
406
                        -a -d "$(SYSUSERS)" ]; then \
 
407
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
 
408
                        $(SYSUSERS)/mandos.conf; \
 
409
        fi
318
410
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
319
411
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
320
412
                mandos-ctl
349
441
        gzip --best --to-stdout intro.8mandos \
350
442
                > $(MANDIR)/man8/intro.8mandos.gz
351
443
 
 
444
.PHONY: install-client-nokey
352
445
install-client-nokey: all doc
353
446
        install --directory $(LIBDIR)/mandos $(CONFDIR)
354
447
        install --directory --mode=u=rwx $(KEYDIR) \
355
 
                $(LIBDIR)/mandos/plugins.d
 
448
                $(LIBDIR)/mandos/plugins.d \
 
449
                $(LIBDIR)/mandos/plugin-helpers
 
450
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
 
451
                        -a -d "$(SYSUSERS)" ]; then \
 
452
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
 
453
                        $(SYSUSERS)/mandos-client.conf; \
 
454
        fi
356
455
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
357
456
                install --mode=u=rwx \
358
 
                        --directory "$(CONFDIR)/plugins.d"; \
 
457
                        --directory "$(CONFDIR)/plugins.d" \
 
458
                        "$(CONFDIR)/plugin-helpers"; \
359
459
        fi
360
460
        install --mode=u=rwx,go=rx --directory \
361
461
                "$(CONFDIR)/network-hooks.d"
362
462
        install --mode=u=rwx,go=rx \
363
463
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
464
        install --mode=u=rwx,go=rx \
 
465
                --target-directory=$(LIBDIR)/mandos \
 
466
                mandos-to-cryptroot-unlock
364
467
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
365
468
                mandos-keygen
366
469
        install --mode=u=rwx,go=rx \
381
484
        install --mode=u=rwxs,go=rx \
382
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
383
486
                plugins.d/plymouth
 
487
        install --mode=u=rwx,go=rx \
 
488
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
489
                plugin-helpers/mandos-client-iprouteadddel
384
490
        install initramfs-tools-hook \
385
491
                $(INITRAMFSTOOLS)/hooks/mandos
386
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
387
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
 
492
        install --mode=u=rw,go=r initramfs-tools-conf \
 
493
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
494
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
 
495
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
388
496
        install initramfs-tools-script \
389
497
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
498
        install initramfs-tools-script-stop \
 
499
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
500
        install --directory $(DRACUTMODULE)
 
501
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
 
502
                dracut-module/ask-password-mandos.path \
 
503
                dracut-module/ask-password-mandos.service
 
504
        install --mode=u=rwxs,go=rx \
 
505
                --target-directory=$(DRACUTMODULE) \
 
506
                dracut-module/module-setup.sh \
 
507
                dracut-module/cmdline-mandos.sh \
 
508
                dracut-module/password-agent
390
509
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
391
510
        gzip --best --to-stdout mandos-keygen.8 \
392
511
                > $(MANDIR)/man8/mandos-keygen.8.gz
404
523
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
405
524
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
406
525
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
526
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
527
                > $(MANDIR)/man8/password-agent.8mandos.gz
407
528
 
 
529
.PHONY: install-client
408
530
install-client: install-client-nokey
409
531
# Post-installation stuff
410
532
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
411
 
        update-initramfs -k all -u
 
533
        if command -v update-initramfs >/dev/null; then \
 
534
            update-initramfs -k all -u; \
 
535
        elif command -v dracut >/dev/null; then \
 
536
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
537
                if [ -w "$$initrd" ]; then \
 
538
                    chmod go-r "$$initrd"; \
 
539
                    dracut --force "$$initrd"; \
 
540
                fi; \
 
541
            done; \
 
542
        fi
412
543
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
413
544
 
 
545
.PHONY: uninstall
414
546
uninstall: uninstall-server uninstall-client
415
547
 
 
548
.PHONY: uninstall-server
416
549
uninstall-server:
417
550
        -rm --force $(PREFIX)/sbin/mandos \
418
551
                $(PREFIX)/sbin/mandos-ctl \
425
558
        update-rc.d -f mandos remove
426
559
        -rmdir $(CONFDIR)
427
560
 
 
561
.PHONY: uninstall-client
428
562
uninstall-client:
429
563
# Refuse to uninstall client if /etc/crypttab is explicitly configured
430
564
# to use it.
441
575
                $(INITRAMFSTOOLS)/hooks/mandos \
442
576
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
443
577
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
578
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
579
                $(DRACUTMODULE)/ask-password-mandos.path \
 
580
                $(DRACUTMODULE)/ask-password-mandos.service \
 
581
                $(DRACUTMODULE)/module-setup.sh \
 
582
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
583
                $(DRACUTMODULE)/password-agent \
444
584
                $(MANDIR)/man8/mandos-keygen.8.gz \
445
585
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
446
586
                $(MANDIR)/man8/mandos-client.8mandos.gz
449
589
                $(MANDIR)/man8/splashy.8mandos.gz \
450
590
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
451
591
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
592
                $(MANDIR)/man8/password-agent.8mandos.gz \
452
593
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
453
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
454
 
        update-initramfs -k all -u
 
594
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
595
        if command -v update-initramfs >/dev/null; then \
 
596
            update-initramfs -k all -u; \
 
597
        elif command -v dracut >/dev/null; then \
 
598
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
599
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
600
            done; \
 
601
        fi
455
602
 
 
603
.PHONY: purge
456
604
purge: purge-server purge-client
457
605
 
 
606
.PHONY: purge-server
458
607
purge-server: uninstall-server
459
608
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
460
609
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
465
614
                $(DESTDIR)/var/run/mandos.pid
466
615
        -rmdir $(CONFDIR)
467
616
 
 
617
.PHONY: purge-client
468
618
purge-client: uninstall-client
469
 
        -shred --remove $(KEYDIR)/seckey.txt
 
619
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
470
620
        -rm --force $(CONFDIR)/plugin-runner.conf \
471
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
621
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
622
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
472
623
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)