/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-09-07 09:36:35 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080907093635-yg1y272yv53dijhp
* Makefile (CONFDIR): Changed to be the same ("/etc/mandos") in both a
                      /usr/local install and a package install.
  (KEYDIR): Changed /usr/local install value to be "/etc/mandos/keys".
  (INITRAMFSTOOLS): Use $(DESTDIR) in /usr/local value too.

* initramfs-tools-hook: Look in "/etc/mandos/keys" too.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.xml
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "plugin-runner">
6
 
<!ENTITY TIMESTAMP "2008-09-04">
 
6
<!ENTITY TIMESTAMP "2008-09-06">
7
7
]>
8
8
 
9
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
416
416
        console.
417
417
      </para>
418
418
      <para>
 
419
        If the password is a single-line, manually entered passprase,
 
420
        a final trailing newline character should
 
421
        <emphasis>not</emphasis> be printed.
 
422
      </para>
 
423
      <para>
419
424
        The plugin will run in the initial RAM disk environment, so
420
425
        care must be taken not to depend on any files or running
421
426
        services not available there.
564
569
    </informalexample>
565
570
    <informalexample>
566
571
      <para>
567
 
        Run plugins from a different directory and add two
568
 
        options to the <citerefentry><refentrytitle
569
 
        >password-request</refentrytitle>
 
572
        Run plugins from a different directory, read a different
 
573
        configuration file, and add two options to the
 
574
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
570
575
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
571
576
      </para>
572
577
      <para>
573
578
 
574
579
<!-- do not wrap this line -->
575
 
<userinput>&COMMANDNAME;  --plugin-dir=plugins.d --options-for=password-request:--pubkey=keydir/pubkey.txt,--seckey=keydir/seckey.txt</userinput>
 
580
<userinput>&COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt</userinput>
576
581
 
577
582
      </para>
578
583
    </informalexample>
586
591
      non-privileged.  This user and group is then what all plugins
587
592
      will be started as.  Therefore, the only way to run a plugin as
588
593
      a privileged user is to have the set-user-ID or set-group-ID bit
589
 
      set on the plugin executable files (see <citerefentry>
 
594
      set on the plugin executable file (see <citerefentry>
590
595
      <refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
591
596
      </citerefentry>).
592
597
    </para>
620
625
      <manvolnum>8</manvolnum></citerefentry>,
621
626
      <citerefentry><refentrytitle>password-prompt</refentrytitle>
622
627
      <manvolnum>8mandos</manvolnum></citerefentry>,
623
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
628
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
624
629
      <manvolnum>8mandos</manvolnum></citerefentry>
625
630
    </para>
626
631
  </refsect1>