/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 18:43:11 UTC
  • Revision ID: teddy@recompile.se-20241117184311-ox25kvngy62h209g
Debian package: Avoid suggesting a C compiler unnecessarily

The list of suggested packages, meant to enable the "mandos" program
to find the correct value of SO_BINDTODEVICE by using a C compiler,
are not necessary when Python 3.3 or later is used, since it has the
SO_BINDTODEVICE constant defined in the "socket" module.  Also, Python
2.6 or older has the same constant in the old "IN" module.  Therefore,
we should suggest these Python versions as alternatives to a C
compiler, so that a C compiler is not installed unnecessarily.

debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and
"python (<= 2.6)" as alternatives to "libc6-dev | libc-dev" and
"c-compiler".

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG:=-ggdb3 -fsanitize=address 
14
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
17
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
19
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
23
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
24
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
 
        -fsanitize=enum
27
 
# Check which sanitizing options can be used
28
 
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
 
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
 
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
 
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
31
34
LINK_FORTIFY_LD:=-z relro -z now
32
35
LINK_FORTIFY:=
33
36
 
39
42
#COVERAGE=--coverage
40
43
OPTIMIZE:=-Os -fno-strict-aliasing
41
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
42
46
htmldir:=man
43
 
version:=1.8.3
 
47
version:=1.8.17
44
48
SED:=sed
45
 
 
46
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
48
57
 
49
58
## Use these settings for a traditional /usr/local install
50
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# BINDIR:=$(PREFIX)/sbin
51
61
# CONFDIR:=$(DESTDIR)/etc/mandos
52
62
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
53
63
# MANDIR:=$(PREFIX)/man
54
64
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
65
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
55
66
# STATEDIR:=$(DESTDIR)/var/lib/mandos
56
67
# LIBDIR:=$(PREFIX)/lib
 
68
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
57
69
##
58
70
 
59
71
## These settings are for a package-type install
60
72
PREFIX:=$(DESTDIR)/usr
 
73
BINDIR:=$(PREFIX)/sbin
61
74
CONFDIR:=$(DESTDIR)/etc/mandos
62
75
KEYDIR:=$(DESTDIR)/etc/keys/mandos
63
76
MANDIR:=$(PREFIX)/share/man
64
77
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
78
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
65
79
STATEDIR:=$(DESTDIR)/var/lib/mandos
66
80
LIBDIR:=$(shell \
67
81
        for d in \
68
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
82
        "/usr/lib/`dpkg-architecture \
 
83
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
69
84
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
70
85
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
71
86
                        echo "$(DESTDIR)$$d"; \
72
87
                        break; \
73
88
                fi; \
74
89
        done)
 
90
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
75
91
##
76
92
 
77
 
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
78
 
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
93
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=systemdsystemunitdir)
 
95
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=tmpfilesdir)
 
97
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
98
                        --variable=sysusersdir)
79
99
 
80
 
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
81
 
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
82
 
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
83
 
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
84
 
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
85
 
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
100
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
101
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
102
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
103
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
104
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
105
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
106
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
107
        || gpgme-config --libs; getconf LFS_LIBS; \
86
108
        getconf LFS_LDFLAGS)
87
 
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
88
 
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
 
109
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
110
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
111
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
112
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
89
113
 
90
114
# Do not change these two
91
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
92
 
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
93
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
115
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
116
        $(LANGUAGE) -DVERSION='"$(version)"'
 
117
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
118
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
94
119
 
95
120
# Commands to format a DocBook <refentry> document into a manual page
96
121
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
102
127
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
103
128
        $(notdir $<); \
104
129
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
105
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
106
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
107
 
        fi >/dev/null)
 
130
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
131
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
132
        $(notdir $@); fi >/dev/null)
108
133
 
109
134
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
110
135
        --param make.year.ranges                1 \
123
148
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
124
149
        plugins.d/plymouth
125
150
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
126
 
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
151
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
152
        $(PLUGIN_HELPERS)
127
153
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
128
154
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
129
155
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
156
        dracut-module/password-agent.8mandos \
130
157
        plugins.d/mandos-client.8mandos \
131
158
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
132
159
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
136
163
 
137
164
objects:=$(addsuffix .o,$(CPROGS))
138
165
 
 
166
.PHONY: all
139
167
all: $(PROGS) mandos.lsm
140
168
 
 
169
.PHONY: doc
141
170
doc: $(DOCS)
142
171
 
 
172
.PHONY: html
143
173
html: $(htmldocs)
144
174
 
145
175
%.5: %.xml common.ent legalnotice.xml
204
234
                overview.xml legalnotice.xml
205
235
        $(DOCBOOKTOHTML)
206
236
 
 
237
dracut-module/password-agent.8mandos: \
 
238
                dracut-module/password-agent.xml common.ent \
 
239
                overview.xml legalnotice.xml
 
240
        $(DOCBOOKTOMAN)
 
241
dracut-module/password-agent.8mandos.xhtml: \
 
242
                dracut-module/password-agent.xml common.ent \
 
243
                overview.xml legalnotice.xml
 
244
        $(DOCBOOKTOHTML)
 
245
 
207
246
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
208
247
                                        common.ent \
209
248
                                        mandos-options.xml \
252
291
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
253
292
                $@)
254
293
 
255
 
# Need to add the GnuTLS, Avahi and GPGME libraries, and can't use
256
 
# -fsanitize=leak because GnuTLS and GPGME both leak memory.
257
 
plugins.d/mandos-client: plugins.d/mandos-client.c
258
 
        $(CC) $(filter-out -fsanitize=leak,$(CFLAGS)) $(strip\
259
 
        ) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) $(strip\
260
 
                ) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) $^ $(strip\
261
 
                ) -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
262
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
263
 
 
264
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
265
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
266
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
267
 
 
268
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
269
 
        check run-client run-server install install-html \
270
 
        install-server install-client-nokey install-client uninstall \
271
 
        uninstall-server uninstall-client purge purge-server \
272
 
        purge-client
273
 
 
 
294
# Does the linker support the --no-warn-execstack option?
 
295
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
 
296
# These programs use nested functions, which uses an executable stack
 
297
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
298
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
299
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
300
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
301
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
302
endif
 
303
 
 
304
# Need to add the GnuTLS, Avahi and GPGME libraries
 
305
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
306
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
307
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
308
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
309
 
 
310
# Need to add the libnl-route library
 
311
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
312
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
313
 
 
314
# Need to add the GLib and pthread libraries
 
315
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
316
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
317
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
318
 
 
319
.PHONY: clean
274
320
clean:
275
321
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
276
322
 
 
323
.PHONY: distclean
277
324
distclean: clean
 
325
.PHONY: mostlyclean
278
326
mostlyclean: clean
 
327
.PHONY: maintainer-clean
279
328
maintainer-clean: clean
280
329
        -rm --force --recursive keydir confdir statedir
281
330
 
282
 
check:  all
 
331
.PHONY: check
 
332
check: all
283
333
        ./mandos --check
284
334
        ./mandos-ctl --check
 
335
        ./mandos-keygen --version
 
336
        ./plugin-runner --version
 
337
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
338
        ./dracut-module/password-agent --test
285
339
 
286
340
# Run the client with a local config and key
287
 
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
288
 
        @echo "###################################################################"
289
 
        @echo "# The following error messages are harmless and can be safely     #"
290
 
        @echo "# ignored:                                                        #"
291
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
292
 
        @echo "#                     setuid: Operation not permitted             #"
293
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
294
 
        @echo "# From mandos-client:                                             #"
295
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
296
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
297
 
        @echo "#                                                                 #"
298
 
        @echo "# (The messages are caused by not running as root, but you should #"
299
 
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
300
 
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
301
 
        @echo "###################################################################"
 
341
.PHONY: run-client
 
342
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
343
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
344
        @echo '######################################################'
 
345
        @echo '# The following error messages are harmless and can  #'
 
346
        @echo '#  be safely ignored:                                #'
 
347
        @echo '## From plugin-runner:                               #'
 
348
        @echo '# setgid: Operation not permitted                    #'
 
349
        @echo '# setuid: Operation not permitted                    #'
 
350
        @echo '## From askpass-fifo:                                #'
 
351
        @echo '# mkfifo: Permission denied                          #'
 
352
        @echo '## From mandos-client:                               #'
 
353
        @echo '# Failed to raise privileges: Operation not permi... #'
 
354
        @echo '# Warning: network hook "*" exited with status *     #'
 
355
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
356
        @echo '# Failed to bring up interface "*": Operation not... #'
 
357
        @echo '#                                                    #'
 
358
        @echo '# (The messages are caused by not running as root,   #'
 
359
        @echo '# but you should NOT run "make run-client" as root   #'
 
360
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
361
        @echo '# root, which is also NOT recommended.)              #'
 
362
        @echo '######################################################'
302
363
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
303
364
        ./plugin-runner --plugin-dir=plugins.d \
304
365
                --plugin-helper-dir=plugin-helpers \
311
372
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
312
373
        install --directory keydir
313
374
        ./mandos-keygen --dir keydir --force
 
375
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
376
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
377
        fi
 
378
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
379
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
380
        fi
314
381
 
315
382
# Run the server with a local config
 
383
.PHONY: run-server
316
384
run-server: confdir/mandos.conf confdir/clients.conf statedir
317
385
        ./mandos --debug --no-dbus --configdir=confdir \
318
386
                --statedir=statedir $(SERVERARGS)
319
387
 
320
388
# Used by run-server
321
389
confdir/mandos.conf: mandos.conf
322
 
        install --directory confdir
323
 
        install --mode=u=rw,go=r $^ $@
 
390
        install -D --mode=u=rw,go=r $^ $@
324
391
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
325
 
        install --directory confdir
326
 
        install --mode=u=rw $< $@
 
392
        install -D --mode=u=rw $< $@
327
393
# Add a client password
328
394
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
329
395
statedir:
330
396
        install --directory statedir
331
397
 
 
398
.PHONY: install
332
399
install: install-server install-client-nokey
333
400
 
 
401
.PHONY: install-html
334
402
install-html: html
335
 
        install --directory $(htmldir)
336
 
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
403
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
337
404
                $(htmldocs)
338
405
 
 
406
.PHONY: install-server
339
407
install-server: doc
340
 
        install --directory $(CONFDIR)
341
408
        if install --directory --mode=u=rwx --owner=$(USER) \
342
409
                --group=$(GROUP) $(STATEDIR); then \
343
410
                :; \
344
411
        elif install --directory --mode=u=rwx $(STATEDIR); then \
345
412
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
346
413
        fi
347
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
348
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
414
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
415
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
349
416
                        $(TMPFILES)/mandos.conf; \
350
417
        fi
351
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
352
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
418
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
419
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
420
                        $(SYSUSERS)/mandos.conf; \
 
421
        fi
 
422
        install --directory $(BINDIR)
 
423
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
 
424
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
353
425
                mandos-ctl
354
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
426
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
355
427
                mandos-monitor
 
428
        install --directory $(CONFDIR)
356
429
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
357
430
                mandos.conf
358
431
        install --mode=u=rw --target-directory=$(CONFDIR) \
359
432
                clients.conf
360
 
        install --mode=u=rw,go=r dbus-mandos.conf \
361
 
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
362
 
        install --mode=u=rwx,go=rx init.d-mandos \
 
433
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
434
                $(DBUSPOLICYDIR)/mandos.conf
 
435
        install -D --mode=u=rwx,go=rx init.d-mandos \
363
436
                $(DESTDIR)/etc/init.d/mandos
364
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
365
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
437
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
438
                install -D --mode=u=rw,go=r mandos.service \
 
439
                        $(SYSTEMD); \
366
440
        fi
367
 
        install --mode=u=rw,go=r default-mandos \
 
441
        install -D --mode=u=rw,go=r default-mandos \
368
442
                $(DESTDIR)/etc/default/mandos
369
443
        if [ -z $(DESTDIR) ]; then \
370
444
                update-rc.d mandos defaults 25 15;\
371
445
        fi
 
446
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
372
447
        gzip --best --to-stdout mandos.8 \
373
448
                > $(MANDIR)/man8/mandos.8.gz
374
449
        gzip --best --to-stdout mandos-monitor.8 \
382
457
        gzip --best --to-stdout intro.8mandos \
383
458
                > $(MANDIR)/man8/intro.8mandos.gz
384
459
 
 
460
.PHONY: install-client-nokey
385
461
install-client-nokey: all doc
386
 
        install --directory $(LIBDIR)/mandos $(CONFDIR)
387
462
        install --directory --mode=u=rwx $(KEYDIR) \
388
463
                $(LIBDIR)/mandos/plugins.d \
389
464
                $(LIBDIR)/mandos/plugin-helpers
 
465
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
466
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
467
                        $(SYSUSERS)/mandos-client.conf; \
 
468
        fi
390
469
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
391
 
                install --mode=u=rwx \
392
 
                        --directory "$(CONFDIR)/plugins.d" \
 
470
                install --directory \
 
471
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
393
472
                        "$(CONFDIR)/plugin-helpers"; \
394
473
        fi
395
 
        install --mode=u=rwx,go=rx --directory \
 
474
        install --directory --mode=u=rwx,go=rx \
396
475
                "$(CONFDIR)/network-hooks.d"
397
476
        install --mode=u=rwx,go=rx \
398
477
                --target-directory=$(LIBDIR)/mandos plugin-runner
399
478
        install --mode=u=rwx,go=rx \
400
 
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
401
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
479
                --target-directory=$(LIBDIR)/mandos \
 
480
                mandos-to-cryptroot-unlock
 
481
        install --directory $(BINDIR)
 
482
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
402
483
                mandos-keygen
403
484
        install --mode=u=rwx,go=rx \
404
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
421
502
        install --mode=u=rwx,go=rx \
422
503
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
423
504
                plugin-helpers/mandos-client-iprouteadddel
424
 
        install initramfs-tools-hook \
 
505
        install -D initramfs-tools-hook \
425
506
                $(INITRAMFSTOOLS)/hooks/mandos
426
 
        install --mode=u=rw,go=r initramfs-tools-conf \
 
507
        install -D --mode=u=rw,go=r initramfs-tools-conf \
427
508
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
428
 
        install initramfs-tools-script \
 
509
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
510
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
511
        install -D initramfs-tools-script \
429
512
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
430
 
        install initramfs-tools-script-stop \
 
513
        install -D initramfs-tools-script-stop \
431
514
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
515
        install -D --mode=u=rw,go=r \
 
516
                --target-directory=$(DRACUTMODULE) \
 
517
                dracut-module/ask-password-mandos.path \
 
518
                dracut-module/ask-password-mandos.service
 
519
        install --mode=u=rwxs,go=rx \
 
520
                --target-directory=$(DRACUTMODULE) \
 
521
                dracut-module/module-setup.sh \
 
522
                dracut-module/cmdline-mandos.sh \
 
523
                dracut-module/password-agent
432
524
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
525
        install --directory $(MANDIR)/man8
433
526
        gzip --best --to-stdout mandos-keygen.8 \
434
527
                > $(MANDIR)/man8/mandos-keygen.8.gz
435
528
        gzip --best --to-stdout plugin-runner.8mandos \
446
539
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
447
540
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
448
541
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
542
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
543
                > $(MANDIR)/man8/password-agent.8mandos.gz
449
544
 
 
545
.PHONY: install-client
450
546
install-client: install-client-nokey
451
547
# Post-installation stuff
452
 
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
453
 
        update-initramfs -k all -u
 
548
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
 
549
        if command -v update-initramfs >/dev/null; then \
 
550
            update-initramfs -k all -u; \
 
551
        elif command -v dracut >/dev/null; then \
 
552
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
553
                if [ -w "$$initrd" ]; then \
 
554
                    chmod go-r "$$initrd"; \
 
555
                    dracut --force "$$initrd"; \
 
556
                fi; \
 
557
            done; \
 
558
        fi
454
559
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
455
560
 
 
561
.PHONY: uninstall
456
562
uninstall: uninstall-server uninstall-client
457
563
 
 
564
.PHONY: uninstall-server
458
565
uninstall-server:
459
 
        -rm --force $(PREFIX)/sbin/mandos \
460
 
                $(PREFIX)/sbin/mandos-ctl \
461
 
                $(PREFIX)/sbin/mandos-monitor \
 
566
        -rm --force $(BINDIR)/mandos \
 
567
                $(BINDIR)/mandos-ctl \
 
568
                $(BINDIR)/mandos-monitor \
462
569
                $(MANDIR)/man8/mandos.8.gz \
463
570
                $(MANDIR)/man8/mandos-monitor.8.gz \
464
571
                $(MANDIR)/man8/mandos-ctl.8.gz \
467
574
        update-rc.d -f mandos remove
468
575
        -rmdir $(CONFDIR)
469
576
 
 
577
.PHONY: uninstall-client
470
578
uninstall-client:
471
579
# Refuse to uninstall client if /etc/crypttab is explicitly configured
472
580
# to use it.
473
581
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
474
582
                $(DESTDIR)/etc/crypttab
475
 
        -rm --force $(PREFIX)/sbin/mandos-keygen \
 
583
        -rm --force $(BINDIR)/mandos-keygen \
476
584
                $(LIBDIR)/mandos/plugin-runner \
477
585
                $(LIBDIR)/mandos/plugins.d/password-prompt \
478
586
                $(LIBDIR)/mandos/plugins.d/mandos-client \
483
591
                $(INITRAMFSTOOLS)/hooks/mandos \
484
592
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
485
593
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
594
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
595
                $(DRACUTMODULE)/ask-password-mandos.path \
 
596
                $(DRACUTMODULE)/ask-password-mandos.service \
 
597
                $(DRACUTMODULE)/module-setup.sh \
 
598
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
599
                $(DRACUTMODULE)/password-agent \
486
600
                $(MANDIR)/man8/mandos-keygen.8.gz \
487
601
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
488
602
                $(MANDIR)/man8/mandos-client.8mandos.gz
491
605
                $(MANDIR)/man8/splashy.8mandos.gz \
492
606
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
493
607
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
608
                $(MANDIR)/man8/password-agent.8mandos.gz \
494
609
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
495
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
496
 
        update-initramfs -k all -u
 
610
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
611
        if command -v update-initramfs >/dev/null; then \
 
612
            update-initramfs -k all -u; \
 
613
        elif command -v dracut >/dev/null; then \
 
614
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
615
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
616
            done; \
 
617
        fi
497
618
 
 
619
.PHONY: purge
498
620
purge: purge-server purge-client
499
621
 
 
622
.PHONY: purge-server
500
623
purge-server: uninstall-server
501
624
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
502
625
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
503
626
                $(DESTDIR)/etc/default/mandos \
504
627
                $(DESTDIR)/etc/init.d/mandos \
505
 
                $(SYSTEMD)/mandos.service \
506
628
                $(DESTDIR)/run/mandos.pid \
507
629
                $(DESTDIR)/var/run/mandos.pid
 
630
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
631
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
632
        fi
508
633
        -rmdir $(CONFDIR)
509
634
 
 
635
.PHONY: purge-client
510
636
purge-client: uninstall-client
511
637
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
512
638
        -rm --force $(CONFDIR)/plugin-runner.conf \