/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-09-09 04:24:39 UTC
  • Revision ID: teddy@recompile.se-20240909042439-j85mr20uli2hnyis
Eliminate compiler warnings

Many programs use nested functions, which now result in a linker
warning about executable stack.  Hide this warning.  Also, rewrite a
loop in the plymouth plugin to avoid warning about signed overflow.
This change also makes the plugin pick the alphabetically first
process entry instead of the last, in case many plymouth processes are
found (which should be unlikely).

* Makefile (plugin-runner, dracut-module/password-agent,
  plugins.d/password-prompt, plugins.d/mandos-client,
  plugins.d/plymouth): New target; set LDFLAGS to add "-Xlinker
  --no-warn-execstack".
* plugins.d/plymouth.c (get_pid): When no pid files are found, and we
  are looking through the process list, go though it from the start
  instead of from the end, i.e. in normal alphabetical order and not
  in reverse order.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG=-ggdb3
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
14
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
17
 
LINK_FORTIFY_LD=-z relro -z now
18
 
LINK_FORTIFY=
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
34
LINK_FORTIFY_LD:=-z relro -z now
 
35
LINK_FORTIFY:=
19
36
 
20
37
# If BROKEN_PIE is set, do not build with -pie
21
38
ifndef BROKEN_PIE
23
40
LINK_FORTIFY += -pie
24
41
endif
25
42
#COVERAGE=--coverage
26
 
OPTIMIZE=-Os -fno-strict-aliasing
27
 
LANGUAGE=-std=gnu99
28
 
htmldir=man
29
 
version=1.6.9
30
 
SED=sed
31
 
 
32
 
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
33
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
43
OPTIMIZE:=-Os -fno-strict-aliasing
 
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
 
46
htmldir:=man
 
47
version:=1.8.16
 
48
SED:=sed
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
34
57
 
35
58
## Use these settings for a traditional /usr/local install
36
 
# PREFIX=$(DESTDIR)/usr/local
37
 
# CONFDIR=$(DESTDIR)/etc/mandos
38
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
39
 
# MANDIR=$(PREFIX)/man
40
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
41
 
# STATEDIR=$(DESTDIR)/var/lib/mandos
42
 
# LIBDIR=$(PREFIX)/lib
 
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# CONFDIR:=$(DESTDIR)/etc/mandos
 
61
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
62
# MANDIR:=$(PREFIX)/man
 
63
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
64
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
65
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
66
# LIBDIR:=$(PREFIX)/lib
 
67
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
43
68
##
44
69
 
45
70
## These settings are for a package-type install
46
 
PREFIX=$(DESTDIR)/usr
47
 
CONFDIR=$(DESTDIR)/etc/mandos
48
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
49
 
MANDIR=$(PREFIX)/share/man
50
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
51
 
STATEDIR=$(DESTDIR)/var/lib/mandos
52
 
LIBDIR=$(shell \
 
71
PREFIX:=$(DESTDIR)/usr
 
72
CONFDIR:=$(DESTDIR)/etc/mandos
 
73
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
74
MANDIR:=$(PREFIX)/share/man
 
75
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
76
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
77
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
78
LIBDIR:=$(shell \
53
79
        for d in \
54
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
80
        "/usr/lib/`dpkg-architecture \
 
81
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
55
82
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
56
83
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
57
84
                        echo "$(DESTDIR)$$d"; \
58
85
                        break; \
59
86
                fi; \
60
87
        done)
 
88
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
61
89
##
62
90
 
63
 
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
91
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
92
                        --variable=systemdsystemunitdir)
 
93
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=tmpfilesdir)
 
95
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=sysusersdir)
64
97
 
65
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
66
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
67
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
68
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
69
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
70
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
98
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
99
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
100
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
101
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
102
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
103
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
104
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
105
        || gpgme-config --libs; getconf LFS_LIBS; \
71
106
        getconf LFS_LDFLAGS)
72
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
73
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
 
107
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
108
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
109
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
110
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
74
111
 
75
112
# Do not change these two
76
113
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
77
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
78
 
        -DVERSION='"$(version)"'
79
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
114
        $(LANGUAGE) -DVERSION='"$(version)"'
 
115
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
116
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
80
117
 
81
118
# Commands to format a DocBook <refentry> document into a manual page
82
119
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
88
125
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
89
126
        $(notdir $<); \
90
127
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
91
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
92
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
93
 
        fi >/dev/null)
 
128
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
129
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
130
        $(notdir $@); fi >/dev/null)
94
131
 
95
132
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
96
133
        --param make.year.ranges                1 \
102
139
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
103
140
        $<; $(HTMLPOST) $@)
104
141
# Fix citerefentry links
105
 
HTMLPOST=$(SED) --in-place \
 
142
HTMLPOST:=$(SED) --in-place \
106
143
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
107
144
 
108
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
 
145
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
109
146
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
110
147
        plugins.d/plymouth
111
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
112
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
113
 
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
114
 
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
148
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
149
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
150
        $(PLUGIN_HELPERS)
 
151
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
152
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
115
153
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
154
        dracut-module/password-agent.8mandos \
116
155
        plugins.d/mandos-client.8mandos \
117
156
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
118
157
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
119
158
        plugins.d/plymouth.8mandos intro.8mandos
120
159
 
121
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
122
 
 
123
 
objects=$(addsuffix .o,$(CPROGS))
124
 
 
 
160
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
161
 
 
162
objects:=$(addsuffix .o,$(CPROGS))
 
163
 
 
164
.PHONY: all
125
165
all: $(PROGS) mandos.lsm
126
166
 
 
167
.PHONY: doc
127
168
doc: $(DOCS)
128
169
 
 
170
.PHONY: html
129
171
html: $(htmldocs)
130
172
 
131
173
%.5: %.xml common.ent legalnotice.xml
190
232
                overview.xml legalnotice.xml
191
233
        $(DOCBOOKTOHTML)
192
234
 
 
235
dracut-module/password-agent.8mandos: \
 
236
                dracut-module/password-agent.xml common.ent \
 
237
                overview.xml legalnotice.xml
 
238
        $(DOCBOOKTOMAN)
 
239
dracut-module/password-agent.8mandos.xhtml: \
 
240
                dracut-module/password-agent.xml common.ent \
 
241
                overview.xml legalnotice.xml
 
242
        $(DOCBOOKTOHTML)
 
243
 
193
244
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
194
245
                                        common.ent \
195
246
                                        mandos-options.xml \
238
289
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
239
290
                $@)
240
291
 
241
 
plugins.d/mandos-client: plugins.d/mandos-client.c
242
 
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
243
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
244
 
 
245
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
246
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
247
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
248
 
 
249
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
250
 
        check run-client run-server install install-html \
251
 
        install-server install-client-nokey install-client uninstall \
252
 
        uninstall-server uninstall-client purge purge-server \
253
 
        purge-client
254
 
 
 
292
# Uses nested functions
 
293
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
294
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
295
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
296
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
297
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
298
 
 
299
# Need to add the GnuTLS, Avahi and GPGME libraries
 
300
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
301
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
302
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
303
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
304
 
 
305
# Need to add the libnl-route library
 
306
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
307
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
308
 
 
309
# Need to add the GLib and pthread libraries
 
310
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
311
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
312
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
313
 
 
314
.PHONY: clean
255
315
clean:
256
316
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
257
317
 
 
318
.PHONY: distclean
258
319
distclean: clean
 
320
.PHONY: mostlyclean
259
321
mostlyclean: clean
 
322
.PHONY: maintainer-clean
260
323
maintainer-clean: clean
261
324
        -rm --force --recursive keydir confdir statedir
262
325
 
263
 
check:  all
 
326
.PHONY: check
 
327
check: all
264
328
        ./mandos --check
265
329
        ./mandos-ctl --check
 
330
        ./mandos-keygen --version
 
331
        ./plugin-runner --version
 
332
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
333
        ./dracut-module/password-agent --test
266
334
 
267
335
# Run the client with a local config and key
268
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
269
 
        @echo "###################################################################"
270
 
        @echo "# The following error messages are harmless and can be safely     #"
271
 
        @echo "# ignored.  The messages are caused by not running as root, but   #"
272
 
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
273
 
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
274
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
275
 
        @echo "#                     setuid: Operation not permitted             #"
276
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
277
 
        @echo "# From mandos-client:                                             #"
278
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
279
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
280
 
        @echo "###################################################################"
 
336
.PHONY: run-client
 
337
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
338
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
339
        @echo '######################################################'
 
340
        @echo '# The following error messages are harmless and can  #'
 
341
        @echo '#  be safely ignored:                                #'
 
342
        @echo '## From plugin-runner:                               #'
 
343
        @echo '# setgid: Operation not permitted                    #'
 
344
        @echo '# setuid: Operation not permitted                    #'
 
345
        @echo '## From askpass-fifo:                                #'
 
346
        @echo '# mkfifo: Permission denied                          #'
 
347
        @echo '## From mandos-client:                               #'
 
348
        @echo '# Failed to raise privileges: Operation not permi... #'
 
349
        @echo '# Warning: network hook "*" exited with status *     #'
 
350
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
351
        @echo '# Failed to bring up interface "*": Operation not... #'
 
352
        @echo '#                                                    #'
 
353
        @echo '# (The messages are caused by not running as root,   #'
 
354
        @echo '# but you should NOT run "make run-client" as root   #'
 
355
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
356
        @echo '# root, which is also NOT recommended.)              #'
 
357
        @echo '######################################################'
281
358
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
282
359
        ./plugin-runner --plugin-dir=plugins.d \
283
360
                --plugin-helper-dir=plugin-helpers \
284
361
                --config-file=plugin-runner.conf \
285
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
362
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
286
363
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
287
364
                $(CLIENTARGS)
288
365
 
289
366
# Used by run-client
290
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
367
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
291
368
        install --directory keydir
292
369
        ./mandos-keygen --dir keydir --force
 
370
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
371
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
372
        fi
 
373
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
374
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
375
        fi
293
376
 
294
377
# Run the server with a local config
 
378
.PHONY: run-server
295
379
run-server: confdir/mandos.conf confdir/clients.conf statedir
296
380
        ./mandos --debug --no-dbus --configdir=confdir \
297
381
                --statedir=statedir $(SERVERARGS)
298
382
 
299
383
# Used by run-server
300
384
confdir/mandos.conf: mandos.conf
301
 
        install --directory confdir
302
 
        install --mode=u=rw,go=r $^ $@
303
 
confdir/clients.conf: clients.conf keydir/seckey.txt
304
 
        install --directory confdir
305
 
        install --mode=u=rw $< $@
 
385
        install -D --mode=u=rw,go=r $^ $@
 
386
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
387
        install -D --mode=u=rw $< $@
306
388
# Add a client password
307
389
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
308
390
statedir:
309
391
        install --directory statedir
310
392
 
 
393
.PHONY: install
311
394
install: install-server install-client-nokey
312
395
 
 
396
.PHONY: install-html
313
397
install-html: html
314
 
        install --directory $(htmldir)
315
 
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
398
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
316
399
                $(htmldocs)
317
400
 
 
401
.PHONY: install-server
318
402
install-server: doc
319
 
        install --directory $(CONFDIR)
320
403
        if install --directory --mode=u=rwx --owner=$(USER) \
321
404
                --group=$(GROUP) $(STATEDIR); then \
322
405
                :; \
323
406
        elif install --directory --mode=u=rwx $(STATEDIR); then \
324
407
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
325
408
        fi
326
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
409
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
410
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
411
                        $(TMPFILES)/mandos.conf; \
 
412
        fi
 
413
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
414
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
415
                        $(SYSUSERS)/mandos.conf; \
 
416
        fi
 
417
        install --directory $(PREFIX)/sbin
 
418
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
419
                mandos
327
420
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
328
421
                mandos-ctl
329
422
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
330
423
                mandos-monitor
 
424
        install --directory $(CONFDIR)
331
425
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
332
426
                mandos.conf
333
427
        install --mode=u=rw --target-directory=$(CONFDIR) \
334
428
                clients.conf
335
 
        install --mode=u=rw,go=r dbus-mandos.conf \
336
 
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
337
 
        install --mode=u=rwx,go=rx init.d-mandos \
 
429
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
430
                $(DBUSPOLICYDIR)/mandos.conf
 
431
        install -D --mode=u=rwx,go=rx init.d-mandos \
338
432
                $(DESTDIR)/etc/init.d/mandos
339
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
340
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
433
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
434
                install -D --mode=u=rw,go=r mandos.service \
 
435
                        $(SYSTEMD); \
341
436
        fi
342
 
        install --mode=u=rw,go=r default-mandos \
 
437
        install -D --mode=u=rw,go=r default-mandos \
343
438
                $(DESTDIR)/etc/default/mandos
344
439
        if [ -z $(DESTDIR) ]; then \
345
440
                update-rc.d mandos defaults 25 15;\
346
441
        fi
 
442
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
347
443
        gzip --best --to-stdout mandos.8 \
348
444
                > $(MANDIR)/man8/mandos.8.gz
349
445
        gzip --best --to-stdout mandos-monitor.8 \
357
453
        gzip --best --to-stdout intro.8mandos \
358
454
                > $(MANDIR)/man8/intro.8mandos.gz
359
455
 
 
456
.PHONY: install-client-nokey
360
457
install-client-nokey: all doc
361
 
        install --directory $(LIBDIR)/mandos $(CONFDIR)
362
458
        install --directory --mode=u=rwx $(KEYDIR) \
363
459
                $(LIBDIR)/mandos/plugins.d \
364
460
                $(LIBDIR)/mandos/plugin-helpers
 
461
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
462
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
463
                        $(SYSUSERS)/mandos-client.conf; \
 
464
        fi
365
465
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
366
 
                install --mode=u=rwx \
367
 
                        --directory "$(CONFDIR)/plugins.d"; \
368
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
 
466
                install --directory \
 
467
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
468
                        "$(CONFDIR)/plugin-helpers"; \
369
469
        fi
370
 
        install --mode=u=rwx,go=rx --directory \
 
470
        install --directory --mode=u=rwx,go=rx \
371
471
                "$(CONFDIR)/network-hooks.d"
372
472
        install --mode=u=rwx,go=rx \
373
473
                --target-directory=$(LIBDIR)/mandos plugin-runner
 
474
        install --mode=u=rwx,go=rx \
 
475
                --target-directory=$(LIBDIR)/mandos \
 
476
                mandos-to-cryptroot-unlock
 
477
        install --directory $(PREFIX)/sbin
374
478
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
375
479
                mandos-keygen
376
480
        install --mode=u=rwx,go=rx \
391
495
        install --mode=u=rwxs,go=rx \
392
496
                --target-directory=$(LIBDIR)/mandos/plugins.d \
393
497
                plugins.d/plymouth
394
 
        install --mode=u=rwxs,go=rx \
 
498
        install --mode=u=rwx,go=rx \
395
499
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
396
500
                plugin-helpers/mandos-client-iprouteadddel
397
 
        install initramfs-tools-hook \
 
501
        install -D initramfs-tools-hook \
398
502
                $(INITRAMFSTOOLS)/hooks/mandos
399
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
400
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
401
 
        install initramfs-tools-script \
 
503
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
504
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
505
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
506
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
507
        install -D initramfs-tools-script \
402
508
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
509
        install -D initramfs-tools-script-stop \
 
510
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
511
        install -D --mode=u=rw,go=r \
 
512
                --target-directory=$(DRACUTMODULE) \
 
513
                dracut-module/ask-password-mandos.path \
 
514
                dracut-module/ask-password-mandos.service
 
515
        install --mode=u=rwxs,go=rx \
 
516
                --target-directory=$(DRACUTMODULE) \
 
517
                dracut-module/module-setup.sh \
 
518
                dracut-module/cmdline-mandos.sh \
 
519
                dracut-module/password-agent
403
520
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
521
        install --directory $(MANDIR)/man8
404
522
        gzip --best --to-stdout mandos-keygen.8 \
405
523
                > $(MANDIR)/man8/mandos-keygen.8.gz
406
524
        gzip --best --to-stdout plugin-runner.8mandos \
417
535
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
418
536
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
419
537
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
538
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
539
                > $(MANDIR)/man8/password-agent.8mandos.gz
420
540
 
 
541
.PHONY: install-client
421
542
install-client: install-client-nokey
422
543
# Post-installation stuff
423
544
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
424
 
        update-initramfs -k all -u
 
545
        if command -v update-initramfs >/dev/null; then \
 
546
            update-initramfs -k all -u; \
 
547
        elif command -v dracut >/dev/null; then \
 
548
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
549
                if [ -w "$$initrd" ]; then \
 
550
                    chmod go-r "$$initrd"; \
 
551
                    dracut --force "$$initrd"; \
 
552
                fi; \
 
553
            done; \
 
554
        fi
425
555
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
426
556
 
 
557
.PHONY: uninstall
427
558
uninstall: uninstall-server uninstall-client
428
559
 
 
560
.PHONY: uninstall-server
429
561
uninstall-server:
430
562
        -rm --force $(PREFIX)/sbin/mandos \
431
563
                $(PREFIX)/sbin/mandos-ctl \
438
570
        update-rc.d -f mandos remove
439
571
        -rmdir $(CONFDIR)
440
572
 
 
573
.PHONY: uninstall-client
441
574
uninstall-client:
442
575
# Refuse to uninstall client if /etc/crypttab is explicitly configured
443
576
# to use it.
454
587
                $(INITRAMFSTOOLS)/hooks/mandos \
455
588
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
456
589
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
590
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
591
                $(DRACUTMODULE)/ask-password-mandos.path \
 
592
                $(DRACUTMODULE)/ask-password-mandos.service \
 
593
                $(DRACUTMODULE)/module-setup.sh \
 
594
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
595
                $(DRACUTMODULE)/password-agent \
457
596
                $(MANDIR)/man8/mandos-keygen.8.gz \
458
597
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
459
598
                $(MANDIR)/man8/mandos-client.8mandos.gz
462
601
                $(MANDIR)/man8/splashy.8mandos.gz \
463
602
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
464
603
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
604
                $(MANDIR)/man8/password-agent.8mandos.gz \
465
605
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
466
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
467
 
        update-initramfs -k all -u
 
606
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
607
        if command -v update-initramfs >/dev/null; then \
 
608
            update-initramfs -k all -u; \
 
609
        elif command -v dracut >/dev/null; then \
 
610
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
611
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
612
            done; \
 
613
        fi
468
614
 
 
615
.PHONY: purge
469
616
purge: purge-server purge-client
470
617
 
 
618
.PHONY: purge-server
471
619
purge-server: uninstall-server
472
620
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
473
621
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
474
622
                $(DESTDIR)/etc/default/mandos \
475
623
                $(DESTDIR)/etc/init.d/mandos \
476
 
                $(SYSTEMD)/mandos.service \
477
624
                $(DESTDIR)/run/mandos.pid \
478
625
                $(DESTDIR)/var/run/mandos.pid
 
626
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
627
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
628
        fi
479
629
        -rmdir $(CONFDIR)
480
630
 
 
631
.PHONY: purge-client
481
632
purge-client: uninstall-client
482
 
        -shred --remove $(KEYDIR)/seckey.txt
 
633
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
483
634
        -rm --force $(CONFDIR)/plugin-runner.conf \
484
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
635
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
636
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
485
637
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)