/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-01 20:01:26 UTC
  • mto: This revision was merged to the branch mainline in revision 759.
  • Revision ID: teddy@recompile.se-20150701200126-qb3f6c3jcas2f4og
mandos-client: Try to start a plugin to add and remove a local route.

* debian/mandos-client.README.Debian: Add setting of environment
                                      variable MANDOSPLUGINHELPERDIR
                                      to command line testing
                                      mandos-client.
* mandos-client.c (raise_privileges): Moved to top of file.
                  (raise_privileges_permanently): - '' -
                  (lower_privileges): - '' -
                  (lower_privileges_permanently): - '' -
  (add_remove_local_route, add_local_route, remove_local_route): New.
  (start_mandos_communication): Set SOCK_CLOEXEC flag on socket.  Run
                                the above functions to add (and
                                remove) local route, if the conditions
                                indicates it could help.
  (run_network_hooks): Use O_DIRECTORY, O_PATH, and O_CLOEXEC flags
                       when opening network hook directory. Do
                       TEMP_FAILURE_RETRY around opening of /dev/null
                       and network hook executables.  Move redirecting
                       of stdout and stderr to as late as possible
                       before fexecve().
  (main): Use O_DIRECTORY and O_PATH when opening temporary directory.
* plugins.d/mandos-client.xml (ENVIRONMENT): Document usage of the
                                             MANDOSPLUGINHELPERDIR
                                             environment variable.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "plugin-runner">
5
 
<!ENTITY TIMESTAMP "2023-04-30">
 
5
<!ENTITY TIMESTAMP "2015-06-28">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
36
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
 
      <year>2018</year>
45
 
      <year>2019</year>
46
37
      <holder>Teddy Hogeborn</holder>
47
38
      <holder>Björn Påhlsson</holder>
48
39
    </copyright>
423
414
    <title>PLUGINS</title>
424
415
    <para>
425
416
      This program will get a password by running a number of
426
 
      <firstterm>plugins</firstterm>, which are executable programs in
427
 
      a directory in the initial <acronym>RAM</acronym> disk
428
 
      environment.  The default directory is
 
417
      <firstterm>plugins</firstterm>, which are simply executable
 
418
      programs in a directory in the initial <acronym>RAM</acronym>
 
419
      disk environment.  The default directory is
429
420
      <filename>/lib/mandos/plugins.d</filename>, but this can be
430
421
      changed with the <option>--plugin-dir</option> option.  The
431
422
      plugins are started in parallel, and the first plugin to output
437
428
    <refsect2 id="writing_plugins">
438
429
      <title>WRITING PLUGINS</title>
439
430
      <para>
440
 
        A plugin is an executable program which prints a password to
441
 
        its standard output and then exits with a successful (zero)
442
 
        exit status.  If the exit status is not zero, any output on
 
431
        A plugin is simply a program which prints a password to its
 
432
        standard output and then exits with a successful (zero) exit
 
433
        status.  If the exit status is not zero, any output on
443
434
        standard output will be ignored by the plugin runner.  Any
444
435
        output on its standard error channel will simply be passed to
445
436
        the standard error of the plugin runner, usually the system
547
538
            </para>
548
539
          </listitem>
549
540
        </varlistentry>
550
 
        <varlistentry>
551
 
          <term><filename class="directory"
552
 
          >/lib/mandos/plugins.d</filename></term>
553
 
          <listitem>
554
 
            <para>
555
 
              The default plugin directory; can be changed by the
556
 
              <option>--plugin-dir</option> option.
557
 
            </para>
558
 
          </listitem>
559
 
        </varlistentry>
560
 
        <varlistentry>
561
 
          <term><filename class="directory"
562
 
          >/lib/mandos/plugin-helpers</filename></term>
563
 
          <listitem>
564
 
            <para>
565
 
              The default plugin helper directory; can be changed by
566
 
              the <option>--plugin-helper-dir</option> option.
567
 
            </para>
568
 
          </listitem>
569
 
        </varlistentry>
570
541
      </variablelist>
571
542
    </para>
572
543
  </refsect1>
577
548
      The <option>--config-file</option> option is ignored when
578
549
      specified from within a configuration file.
579
550
    </para>
580
 
    <xi:include href="bugs.xml"/>
581
551
  </refsect1>
582
552
  
583
553
  <refsect1 id="examples">
626
596
    </informalexample>
627
597
    <informalexample>
628
598
      <para>
629
 
        Read a different configuration file, run plugins from a
630
 
        different directory, specify an alternate plugin helper
631
 
        directory and add four options to the
 
599
        Run plugins from a different directory, read a different
 
600
        configuration file, and add two options to the
632
601
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
633
602
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
634
603
      </para>
635
604
      <para>
636
605
 
637
606
<!-- do not wrap this line -->
638
 
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,&#x200b;--seckey=seckey.txt,&#x200b;--tls-pubkey=tls-pubkey.pem,&#x200b;--tls-privkey=tls-privkey.pem</userinput>
 
607
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
639
608
 
640
609
      </para>
641
610
    </informalexample>