/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 18:43:11 UTC
  • Revision ID: teddy@recompile.se-20241117184311-ox25kvngy62h209g
Debian package: Avoid suggesting a C compiler unnecessarily

The list of suggested packages, meant to enable the "mandos" program
to find the correct value of SO_BINDTODEVICE by using a C compiler,
are not necessary when Python 3.3 or later is used, since it has the
SO_BINDTODEVICE constant defined in the "socket" module.  Also, Python
2.6 or older has the same constant in the old "IN" module.  Therefore,
we should suggest these Python versions as alternatives to a C
compiler, so that a C compiler is not installed unnecessarily.

debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and
"python (<= 2.6)" as alternatives to "libc6-dev | libc-dev" and
"c-compiler".

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
#DEBUG=-ggdb3
 
13
 
 
14
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
 
15
## Check which sanitizing options can be used
 
16
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
17
#       echo 'int main(){}' | $(CC) --language=c $(option) \
 
18
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
19
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
20
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
21
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
22
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
23
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
24
        -fsanitize=bounds -fsanitize=alignment \
 
25
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
26
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
27
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
28
        -fsanitize=enum -fsanitize-address-use-after-scope
 
29
 
14
30
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
 
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
 
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
17
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
 
# The sanitizing options are available in GCC 4.9 and above.
19
 
ifeq ($(shell test $(shell $(CC) -dumpversion) \> 4.9-; echo $$?),0)
20
 
SANITIZE:=-fsanitize=address -fsanitize=undefined -fsanitize=shift \
21
 
        -fsanitize=integer-divide-by-zero -fsanitize=unreachable \
22
 
        -fsanitize=vla-bound -fsanitize=null -fsanitize=return \
23
 
        -fsanitize=signed-integer-overflow
24
 
# GCC 5.3 has some more sanitizing options
25
 
ifeq ($(shell test $(shell $(CC) -dumpversion) \> 5.3-; echo $$?),0)
26
 
SANITIZE+=-fsanitize=bounds -fsanitize=alignment \
27
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
28
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
29
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
30
 
        -fsanitize=enum
31
 
endif
32
 
else
33
 
SANITIZE:=
34
 
endif
35
 
LINK_FORTIFY_LD=-z relro -z now
36
 
LINK_FORTIFY=
 
31
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
32
FORTIFY:=-fstack-protector-all -fPIC
 
33
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
34
LINK_FORTIFY_LD:=-z relro -z now
 
35
LINK_FORTIFY:=
37
36
 
38
37
# If BROKEN_PIE is set, do not build with -pie
39
38
ifndef BROKEN_PIE
41
40
LINK_FORTIFY += -pie
42
41
endif
43
42
#COVERAGE=--coverage
44
 
OPTIMIZE=-Os -fno-strict-aliasing
45
 
LANGUAGE=-std=gnu11
46
 
htmldir=man
47
 
version=1.7.3
48
 
SED=sed
49
 
 
50
 
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
51
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
43
OPTIMIZE:=-Os -fno-strict-aliasing
 
44
LANGUAGE:=-std=gnu11
 
45
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
 
46
htmldir:=man
 
47
version:=1.8.17
 
48
SED:=sed
 
49
PKG_CONFIG?=pkg-config
 
50
 
 
51
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
 
52
        || getent passwd nobody || echo 65534)))
 
53
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
 
54
        || getent group nogroup || echo 65534)))
 
55
 
 
56
LINUXVERSION:=$(shell uname --kernel-release)
52
57
 
53
58
## Use these settings for a traditional /usr/local install
54
 
# PREFIX=$(DESTDIR)/usr/local
55
 
# CONFDIR=$(DESTDIR)/etc/mandos
56
 
# KEYDIR=$(DESTDIR)/etc/mandos/keys
57
 
# MANDIR=$(PREFIX)/man
58
 
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
59
 
# STATEDIR=$(DESTDIR)/var/lib/mandos
60
 
# LIBDIR=$(PREFIX)/lib
 
59
# PREFIX:=$(DESTDIR)/usr/local
 
60
# BINDIR:=$(PREFIX)/sbin
 
61
# CONFDIR:=$(DESTDIR)/etc/mandos
 
62
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
 
63
# MANDIR:=$(PREFIX)/man
 
64
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
 
65
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
66
# STATEDIR:=$(DESTDIR)/var/lib/mandos
 
67
# LIBDIR:=$(PREFIX)/lib
 
68
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
61
69
##
62
70
 
63
71
## These settings are for a package-type install
64
 
PREFIX=$(DESTDIR)/usr
65
 
CONFDIR=$(DESTDIR)/etc/mandos
66
 
KEYDIR=$(DESTDIR)/etc/keys/mandos
67
 
MANDIR=$(PREFIX)/share/man
68
 
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
69
 
STATEDIR=$(DESTDIR)/var/lib/mandos
70
 
LIBDIR=$(shell \
 
72
PREFIX:=$(DESTDIR)/usr
 
73
BINDIR:=$(PREFIX)/sbin
 
74
CONFDIR:=$(DESTDIR)/etc/mandos
 
75
KEYDIR:=$(DESTDIR)/etc/keys/mandos
 
76
MANDIR:=$(PREFIX)/share/man
 
77
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
 
78
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
 
79
STATEDIR:=$(DESTDIR)/var/lib/mandos
 
80
LIBDIR:=$(shell \
71
81
        for d in \
72
 
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
82
        "/usr/lib/`dpkg-architecture \
 
83
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
73
84
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
74
85
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
75
86
                        echo "$(DESTDIR)$$d"; \
76
87
                        break; \
77
88
                fi; \
78
89
        done)
 
90
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
79
91
##
80
92
 
81
 
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
93
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
94
                        --variable=systemdsystemunitdir)
 
95
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
96
                        --variable=tmpfilesdir)
 
97
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
 
98
                        --variable=sysusersdir)
82
99
 
83
 
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
84
 
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
85
 
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
86
 
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
87
 
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
88
 
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
100
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
 
101
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
 
102
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
 
103
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
 
104
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
 
105
        || gpgme-config --cflags; getconf LFS_CFLAGS)
 
106
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
 
107
        || gpgme-config --libs; getconf LFS_LIBS; \
89
108
        getconf LFS_LDFLAGS)
90
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
91
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
 
109
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
 
110
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
 
111
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
 
112
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
92
113
 
93
114
# Do not change these two
94
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
95
 
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
96
 
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
97
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
115
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
116
        $(LANGUAGE) -DVERSION='"$(version)"'
 
117
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
 
118
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
98
119
 
99
120
# Commands to format a DocBook <refentry> document into a manual page
100
121
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
106
127
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
107
128
        $(notdir $<); \
108
129
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
109
 
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
110
 
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
111
 
        fi >/dev/null)
 
130
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
 
131
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
 
132
        $(notdir $@); fi >/dev/null)
112
133
 
113
134
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
114
135
        --param make.year.ranges                1 \
120
141
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
121
142
        $<; $(HTMLPOST) $@)
122
143
# Fix citerefentry links
123
 
HTMLPOST=$(SED) --in-place \
 
144
HTMLPOST:=$(SED) --in-place \
124
145
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
125
146
 
126
 
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
 
147
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
127
148
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
128
149
        plugins.d/plymouth
129
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
130
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
131
 
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
132
 
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
150
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
 
151
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
 
152
        $(PLUGIN_HELPERS)
 
153
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
154
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
133
155
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
 
156
        dracut-module/password-agent.8mandos \
134
157
        plugins.d/mandos-client.8mandos \
135
158
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
136
159
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
137
160
        plugins.d/plymouth.8mandos intro.8mandos
138
161
 
139
 
htmldocs=$(addsuffix .xhtml,$(DOCS))
140
 
 
141
 
objects=$(addsuffix .o,$(CPROGS))
142
 
 
 
162
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
163
 
 
164
objects:=$(addsuffix .o,$(CPROGS))
 
165
 
 
166
.PHONY: all
143
167
all: $(PROGS) mandos.lsm
144
168
 
 
169
.PHONY: doc
145
170
doc: $(DOCS)
146
171
 
 
172
.PHONY: html
147
173
html: $(htmldocs)
148
174
 
149
175
%.5: %.xml common.ent legalnotice.xml
208
234
                overview.xml legalnotice.xml
209
235
        $(DOCBOOKTOHTML)
210
236
 
 
237
dracut-module/password-agent.8mandos: \
 
238
                dracut-module/password-agent.xml common.ent \
 
239
                overview.xml legalnotice.xml
 
240
        $(DOCBOOKTOMAN)
 
241
dracut-module/password-agent.8mandos.xhtml: \
 
242
                dracut-module/password-agent.xml common.ent \
 
243
                overview.xml legalnotice.xml
 
244
        $(DOCBOOKTOHTML)
 
245
 
211
246
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
212
247
                                        common.ent \
213
248
                                        mandos-options.xml \
256
291
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
257
292
                $@)
258
293
 
259
 
plugins.d/mandos-client: plugins.d/mandos-client.c
260
 
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
261
 
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
262
 
 
263
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
264
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
265
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
266
 
 
267
 
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
268
 
        check run-client run-server install install-html \
269
 
        install-server install-client-nokey install-client uninstall \
270
 
        uninstall-server uninstall-client purge purge-server \
271
 
        purge-client
272
 
 
 
294
# Does the linker support the --no-warn-execstack option?
 
295
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
 
296
# These programs use nested functions, which uses an executable stack
 
297
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
 
298
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
 
299
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
 
300
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
 
301
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
 
302
endif
 
303
 
 
304
# Need to add the GnuTLS, Avahi and GPGME libraries
 
305
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
 
306
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
 
307
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
 
308
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
 
309
 
 
310
# Need to add the libnl-route library
 
311
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
 
312
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
 
313
 
 
314
# Need to add the GLib and pthread libraries
 
315
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
 
316
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
 
317
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
 
318
 
 
319
.PHONY: clean
273
320
clean:
274
321
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
275
322
 
 
323
.PHONY: distclean
276
324
distclean: clean
 
325
.PHONY: mostlyclean
277
326
mostlyclean: clean
 
327
.PHONY: maintainer-clean
278
328
maintainer-clean: clean
279
329
        -rm --force --recursive keydir confdir statedir
280
330
 
281
 
check:  all
 
331
.PHONY: check
 
332
check: all
282
333
        ./mandos --check
283
334
        ./mandos-ctl --check
 
335
        ./mandos-keygen --version
 
336
        ./plugin-runner --version
 
337
        ./plugin-helpers/mandos-client-iprouteadddel --version
 
338
        ./dracut-module/password-agent --test
284
339
 
285
340
# Run the client with a local config and key
286
 
run-client: all keydir/seckey.txt keydir/pubkey.txt
287
 
        @echo "###################################################################"
288
 
        @echo "# The following error messages are harmless and can be safely     #"
289
 
        @echo "# ignored.  The messages are caused by not running as root, but   #"
290
 
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
291
 
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
292
 
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
293
 
        @echo "#                     setuid: Operation not permitted             #"
294
 
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
295
 
        @echo "# From mandos-client:                                             #"
296
 
        @echo "#             Failed to raise privileges: Operation not permitted #"
297
 
        @echo "#             Warning: network hook \"*\" exited with status *      #"
298
 
        @echo "###################################################################"
 
341
.PHONY: run-client
 
342
run-client: all keydir/seckey.txt keydir/pubkey.txt \
 
343
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
344
        @echo '######################################################'
 
345
        @echo '# The following error messages are harmless and can  #'
 
346
        @echo '#  be safely ignored:                                #'
 
347
        @echo '## From plugin-runner:                               #'
 
348
        @echo '# setgid: Operation not permitted                    #'
 
349
        @echo '# setuid: Operation not permitted                    #'
 
350
        @echo '## From askpass-fifo:                                #'
 
351
        @echo '# mkfifo: Permission denied                          #'
 
352
        @echo '## From mandos-client:                               #'
 
353
        @echo '# Failed to raise privileges: Operation not permi... #'
 
354
        @echo '# Warning: network hook "*" exited with status *     #'
 
355
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
 
356
        @echo '# Failed to bring up interface "*": Operation not... #'
 
357
        @echo '#                                                    #'
 
358
        @echo '# (The messages are caused by not running as root,   #'
 
359
        @echo '# but you should NOT run "make run-client" as root   #'
 
360
        @echo '# unless you also unpacked and compiled Mandos as    #'
 
361
        @echo '# root, which is also NOT recommended.)              #'
 
362
        @echo '######################################################'
299
363
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
300
364
        ./plugin-runner --plugin-dir=plugins.d \
301
365
                --plugin-helper-dir=plugin-helpers \
302
366
                --config-file=plugin-runner.conf \
303
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
367
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
304
368
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
305
369
                $(CLIENTARGS)
306
370
 
307
371
# Used by run-client
308
 
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
 
372
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
309
373
        install --directory keydir
310
374
        ./mandos-keygen --dir keydir --force
 
375
        if ! [ -e keydir/tls-privkey.pem ]; then \
 
376
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
 
377
        fi
 
378
        if ! [ -e keydir/tls-pubkey.pem ]; then \
 
379
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
 
380
        fi
311
381
 
312
382
# Run the server with a local config
 
383
.PHONY: run-server
313
384
run-server: confdir/mandos.conf confdir/clients.conf statedir
314
385
        ./mandos --debug --no-dbus --configdir=confdir \
315
386
                --statedir=statedir $(SERVERARGS)
316
387
 
317
388
# Used by run-server
318
389
confdir/mandos.conf: mandos.conf
319
 
        install --directory confdir
320
 
        install --mode=u=rw,go=r $^ $@
321
 
confdir/clients.conf: clients.conf keydir/seckey.txt
322
 
        install --directory confdir
323
 
        install --mode=u=rw $< $@
 
390
        install -D --mode=u=rw,go=r $^ $@
 
391
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
392
        install -D --mode=u=rw $< $@
324
393
# Add a client password
325
394
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
326
395
statedir:
327
396
        install --directory statedir
328
397
 
 
398
.PHONY: install
329
399
install: install-server install-client-nokey
330
400
 
 
401
.PHONY: install-html
331
402
install-html: html
332
 
        install --directory $(htmldir)
333
 
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
 
403
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
334
404
                $(htmldocs)
335
405
 
 
406
.PHONY: install-server
336
407
install-server: doc
337
 
        install --directory $(CONFDIR)
338
408
        if install --directory --mode=u=rwx --owner=$(USER) \
339
409
                --group=$(GROUP) $(STATEDIR); then \
340
410
                :; \
341
411
        elif install --directory --mode=u=rwx $(STATEDIR); then \
342
412
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
343
413
        fi
344
 
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
345
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
414
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
 
415
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
416
                        $(TMPFILES)/mandos.conf; \
 
417
        fi
 
418
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
419
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
420
                        $(SYSUSERS)/mandos.conf; \
 
421
        fi
 
422
        install --directory $(BINDIR)
 
423
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
 
424
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
346
425
                mandos-ctl
347
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
426
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
348
427
                mandos-monitor
 
428
        install --directory $(CONFDIR)
349
429
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
350
430
                mandos.conf
351
431
        install --mode=u=rw --target-directory=$(CONFDIR) \
352
432
                clients.conf
353
 
        install --mode=u=rw,go=r dbus-mandos.conf \
354
 
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
355
 
        install --mode=u=rwx,go=rx init.d-mandos \
 
433
        install -D --mode=u=rw,go=r dbus-mandos.conf \
 
434
                $(DBUSPOLICYDIR)/mandos.conf
 
435
        install -D --mode=u=rwx,go=rx init.d-mandos \
356
436
                $(DESTDIR)/etc/init.d/mandos
357
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
358
 
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
437
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
 
438
                install -D --mode=u=rw,go=r mandos.service \
 
439
                        $(SYSTEMD); \
359
440
        fi
360
 
        install --mode=u=rw,go=r default-mandos \
 
441
        install -D --mode=u=rw,go=r default-mandos \
361
442
                $(DESTDIR)/etc/default/mandos
362
443
        if [ -z $(DESTDIR) ]; then \
363
444
                update-rc.d mandos defaults 25 15;\
364
445
        fi
 
446
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
365
447
        gzip --best --to-stdout mandos.8 \
366
448
                > $(MANDIR)/man8/mandos.8.gz
367
449
        gzip --best --to-stdout mandos-monitor.8 \
375
457
        gzip --best --to-stdout intro.8mandos \
376
458
                > $(MANDIR)/man8/intro.8mandos.gz
377
459
 
 
460
.PHONY: install-client-nokey
378
461
install-client-nokey: all doc
379
 
        install --directory $(LIBDIR)/mandos $(CONFDIR)
380
462
        install --directory --mode=u=rwx $(KEYDIR) \
381
463
                $(LIBDIR)/mandos/plugins.d \
382
464
                $(LIBDIR)/mandos/plugin-helpers
 
465
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
 
466
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
 
467
                        $(SYSUSERS)/mandos-client.conf; \
 
468
        fi
383
469
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
384
 
                install --mode=u=rwx \
385
 
                        --directory "$(CONFDIR)/plugins.d"; \
386
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
 
470
                install --directory \
 
471
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
472
                        "$(CONFDIR)/plugin-helpers"; \
387
473
        fi
388
 
        install --mode=u=rwx,go=rx --directory \
 
474
        install --directory --mode=u=rwx,go=rx \
389
475
                "$(CONFDIR)/network-hooks.d"
390
476
        install --mode=u=rwx,go=rx \
391
477
                --target-directory=$(LIBDIR)/mandos plugin-runner
392
 
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
 
478
        install --mode=u=rwx,go=rx \
 
479
                --target-directory=$(LIBDIR)/mandos \
 
480
                mandos-to-cryptroot-unlock
 
481
        install --directory $(BINDIR)
 
482
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
393
483
                mandos-keygen
394
484
        install --mode=u=rwx,go=rx \
395
485
                --target-directory=$(LIBDIR)/mandos/plugins.d \
409
499
        install --mode=u=rwxs,go=rx \
410
500
                --target-directory=$(LIBDIR)/mandos/plugins.d \
411
501
                plugins.d/plymouth
412
 
        install --mode=u=rwxs,go=rx \
 
502
        install --mode=u=rwx,go=rx \
413
503
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
414
504
                plugin-helpers/mandos-client-iprouteadddel
415
 
        install initramfs-tools-hook \
 
505
        install -D initramfs-tools-hook \
416
506
                $(INITRAMFSTOOLS)/hooks/mandos
417
 
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
418
 
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
419
 
        install initramfs-tools-script \
 
507
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
508
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
 
509
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
 
510
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
511
        install -D initramfs-tools-script \
420
512
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
 
513
        install -D initramfs-tools-script-stop \
 
514
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
 
515
        install -D --mode=u=rw,go=r \
 
516
                --target-directory=$(DRACUTMODULE) \
 
517
                dracut-module/ask-password-mandos.path \
 
518
                dracut-module/ask-password-mandos.service
 
519
        install --mode=u=rwxs,go=rx \
 
520
                --target-directory=$(DRACUTMODULE) \
 
521
                dracut-module/module-setup.sh \
 
522
                dracut-module/cmdline-mandos.sh \
 
523
                dracut-module/password-agent
421
524
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
 
525
        install --directory $(MANDIR)/man8
422
526
        gzip --best --to-stdout mandos-keygen.8 \
423
527
                > $(MANDIR)/man8/mandos-keygen.8.gz
424
528
        gzip --best --to-stdout plugin-runner.8mandos \
435
539
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
436
540
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
437
541
                > $(MANDIR)/man8/plymouth.8mandos.gz
 
542
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
 
543
                > $(MANDIR)/man8/password-agent.8mandos.gz
438
544
 
 
545
.PHONY: install-client
439
546
install-client: install-client-nokey
440
547
# Post-installation stuff
441
 
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
442
 
        update-initramfs -k all -u
 
548
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
 
549
        if command -v update-initramfs >/dev/null; then \
 
550
            update-initramfs -k all -u; \
 
551
        elif command -v dracut >/dev/null; then \
 
552
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
553
                if [ -w "$$initrd" ]; then \
 
554
                    chmod go-r "$$initrd"; \
 
555
                    dracut --force "$$initrd"; \
 
556
                fi; \
 
557
            done; \
 
558
        fi
443
559
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
444
560
 
 
561
.PHONY: uninstall
445
562
uninstall: uninstall-server uninstall-client
446
563
 
 
564
.PHONY: uninstall-server
447
565
uninstall-server:
448
 
        -rm --force $(PREFIX)/sbin/mandos \
449
 
                $(PREFIX)/sbin/mandos-ctl \
450
 
                $(PREFIX)/sbin/mandos-monitor \
 
566
        -rm --force $(BINDIR)/mandos \
 
567
                $(BINDIR)/mandos-ctl \
 
568
                $(BINDIR)/mandos-monitor \
451
569
                $(MANDIR)/man8/mandos.8.gz \
452
570
                $(MANDIR)/man8/mandos-monitor.8.gz \
453
571
                $(MANDIR)/man8/mandos-ctl.8.gz \
456
574
        update-rc.d -f mandos remove
457
575
        -rmdir $(CONFDIR)
458
576
 
 
577
.PHONY: uninstall-client
459
578
uninstall-client:
460
579
# Refuse to uninstall client if /etc/crypttab is explicitly configured
461
580
# to use it.
462
581
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
463
582
                $(DESTDIR)/etc/crypttab
464
 
        -rm --force $(PREFIX)/sbin/mandos-keygen \
 
583
        -rm --force $(BINDIR)/mandos-keygen \
465
584
                $(LIBDIR)/mandos/plugin-runner \
466
585
                $(LIBDIR)/mandos/plugins.d/password-prompt \
467
586
                $(LIBDIR)/mandos/plugins.d/mandos-client \
472
591
                $(INITRAMFSTOOLS)/hooks/mandos \
473
592
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
474
593
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
 
594
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
 
595
                $(DRACUTMODULE)/ask-password-mandos.path \
 
596
                $(DRACUTMODULE)/ask-password-mandos.service \
 
597
                $(DRACUTMODULE)/module-setup.sh \
 
598
                $(DRACUTMODULE)/cmdline-mandos.sh \
 
599
                $(DRACUTMODULE)/password-agent \
475
600
                $(MANDIR)/man8/mandos-keygen.8.gz \
476
601
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
477
602
                $(MANDIR)/man8/mandos-client.8mandos.gz
480
605
                $(MANDIR)/man8/splashy.8mandos.gz \
481
606
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
482
607
                $(MANDIR)/man8/plymouth.8mandos.gz \
 
608
                $(MANDIR)/man8/password-agent.8mandos.gz \
483
609
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
484
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
485
 
        update-initramfs -k all -u
 
610
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
 
611
        if command -v update-initramfs >/dev/null; then \
 
612
            update-initramfs -k all -u; \
 
613
        elif command -v dracut >/dev/null; then \
 
614
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
 
615
                test -w "$$initrd" && dracut --force "$$initrd"; \
 
616
            done; \
 
617
        fi
486
618
 
 
619
.PHONY: purge
487
620
purge: purge-server purge-client
488
621
 
 
622
.PHONY: purge-server
489
623
purge-server: uninstall-server
490
624
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
491
625
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
492
626
                $(DESTDIR)/etc/default/mandos \
493
627
                $(DESTDIR)/etc/init.d/mandos \
494
 
                $(SYSTEMD)/mandos.service \
495
628
                $(DESTDIR)/run/mandos.pid \
496
629
                $(DESTDIR)/var/run/mandos.pid
 
630
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
631
                -rm --force -- $(SYSTEMD)/mandos.service; \
 
632
        fi
497
633
        -rmdir $(CONFDIR)
498
634
 
 
635
.PHONY: purge-client
499
636
purge-client: uninstall-client
500
 
        -shred --remove $(KEYDIR)/seckey.txt
 
637
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
501
638
        -rm --force $(CONFDIR)/plugin-runner.conf \
502
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
 
639
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
 
640
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
503
641
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)