/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
19
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
 
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
 
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
22
 
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
 
        -fsanitize=return -fsanitize=signed-integer-overflow \
24
 
        -fsanitize=bounds -fsanitize=alignment \
25
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
 
13
#DEBUG=-ggdb3
30
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-fstack-protector-all -fPIC
33
 
CPPFLAGS+=-D_FORTIFY_SOURCE=3
34
 
LINK_FORTIFY_LD:=-z relro -z now
35
 
LINK_FORTIFY:=
 
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
LINK_FORTIFY_LD=-z relro -z now
 
18
LINK_FORTIFY=
36
19
 
37
20
# If BROKEN_PIE is set, do not build with -pie
38
21
ifndef BROKEN_PIE
40
23
LINK_FORTIFY += -pie
41
24
endif
42
25
#COVERAGE=--coverage
43
 
OPTIMIZE:=-Os -fno-strict-aliasing
44
 
LANGUAGE:=-std=gnu11
45
 
CPPFLAGS+=-D_FILE_OFFSET_BITS=64
46
 
htmldir:=man
47
 
version:=1.8.16
48
 
SED:=sed
49
 
PKG_CONFIG?=pkg-config
50
 
 
51
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
52
 
        || getent passwd nobody || echo 65534)))
53
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
54
 
        || getent group nogroup || echo 65534)))
55
 
 
56
 
LINUXVERSION:=$(shell uname --kernel-release)
 
26
OPTIMIZE=-Os -fno-strict-aliasing
 
27
LANGUAGE=-std=gnu99
 
28
htmldir=man
 
29
version=1.6.9
 
30
SED=sed
 
31
 
 
32
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
33
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
57
34
 
58
35
## Use these settings for a traditional /usr/local install
59
 
# PREFIX:=$(DESTDIR)/usr/local
60
 
# CONFDIR:=$(DESTDIR)/etc/mandos
61
 
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
62
 
# MANDIR:=$(PREFIX)/man
63
 
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
64
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
65
 
# STATEDIR:=$(DESTDIR)/var/lib/mandos
66
 
# LIBDIR:=$(PREFIX)/lib
 
36
# PREFIX=$(DESTDIR)/usr/local
 
37
# CONFDIR=$(DESTDIR)/etc/mandos
 
38
# KEYDIR=$(DESTDIR)/etc/mandos/keys
 
39
# MANDIR=$(PREFIX)/man
 
40
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
41
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
42
# LIBDIR=$(PREFIX)/lib
67
43
##
68
44
 
69
45
## These settings are for a package-type install
70
 
PREFIX:=$(DESTDIR)/usr
71
 
CONFDIR:=$(DESTDIR)/etc/mandos
72
 
KEYDIR:=$(DESTDIR)/etc/keys/mandos
73
 
MANDIR:=$(PREFIX)/share/man
74
 
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
75
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
76
 
STATEDIR:=$(DESTDIR)/var/lib/mandos
77
 
LIBDIR:=$(shell \
 
46
PREFIX=$(DESTDIR)/usr
 
47
CONFDIR=$(DESTDIR)/etc/mandos
 
48
KEYDIR=$(DESTDIR)/etc/keys/mandos
 
49
MANDIR=$(PREFIX)/share/man
 
50
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
51
STATEDIR=$(DESTDIR)/var/lib/mandos
 
52
LIBDIR=$(shell \
78
53
        for d in \
79
 
        "/usr/lib/`dpkg-architecture \
80
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
54
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
81
55
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
82
56
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
83
57
                        echo "$(DESTDIR)$$d"; \
86
60
        done)
87
61
##
88
62
 
89
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
90
 
                        --variable=systemdsystemunitdir)
91
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
92
 
                        --variable=tmpfilesdir)
93
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
94
 
                        --variable=sysusersdir)
 
63
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
95
64
 
96
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
97
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
98
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
99
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
100
 
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
101
 
        || gpgme-config --cflags; getconf LFS_CFLAGS)
102
 
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
103
 
        || gpgme-config --libs; getconf LFS_LIBS; \
 
65
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
 
66
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
 
67
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
 
68
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
 
69
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
70
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
104
71
        getconf LFS_LDFLAGS)
105
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
106
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
107
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
108
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
109
72
 
110
73
# Do not change these two
111
74
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
112
 
        $(LANGUAGE) -DVERSION='"$(version)"'
113
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
114
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
75
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 
76
        -DVERSION='"$(version)"'
 
77
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
115
78
 
116
79
# Commands to format a DocBook <refentry> document into a manual page
117
80
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
123
86
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
124
87
        $(notdir $<); \
125
88
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
126
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
127
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
128
 
        $(notdir $@); fi >/dev/null)
 
89
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
90
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
91
        fi >/dev/null)
129
92
 
130
93
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
131
94
        --param make.year.ranges                1 \
137
100
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
138
101
        $<; $(HTMLPOST) $@)
139
102
# Fix citerefentry links
140
 
HTMLPOST:=$(SED) --in-place \
 
103
HTMLPOST=$(SED) --in-place \
141
104
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
142
105
 
143
 
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
106
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
144
107
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
145
108
        plugins.d/plymouth
146
 
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
147
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
148
 
        $(PLUGIN_HELPERS)
149
 
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
150
 
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
109
CPROGS=plugin-runner $(PLUGINS)
 
110
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
111
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
151
112
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
152
 
        dracut-module/password-agent.8mandos \
153
113
        plugins.d/mandos-client.8mandos \
154
114
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
155
115
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
156
116
        plugins.d/plymouth.8mandos intro.8mandos
157
117
 
158
 
htmldocs:=$(addsuffix .xhtml,$(DOCS))
159
 
 
160
 
objects:=$(addsuffix .o,$(CPROGS))
161
 
 
162
 
.PHONY: all
 
118
htmldocs=$(addsuffix .xhtml,$(DOCS))
 
119
 
 
120
objects=$(addsuffix .o,$(CPROGS))
 
121
 
163
122
all: $(PROGS) mandos.lsm
164
123
 
165
 
.PHONY: doc
166
124
doc: $(DOCS)
167
125
 
168
 
.PHONY: html
169
126
html: $(htmldocs)
170
127
 
171
128
%.5: %.xml common.ent legalnotice.xml
230
187
                overview.xml legalnotice.xml
231
188
        $(DOCBOOKTOHTML)
232
189
 
233
 
dracut-module/password-agent.8mandos: \
234
 
                dracut-module/password-agent.xml common.ent \
235
 
                overview.xml legalnotice.xml
236
 
        $(DOCBOOKTOMAN)
237
 
dracut-module/password-agent.8mandos.xhtml: \
238
 
                dracut-module/password-agent.xml common.ent \
239
 
                overview.xml legalnotice.xml
240
 
        $(DOCBOOKTOHTML)
241
 
 
242
190
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
243
191
                                        common.ent \
244
192
                                        mandos-options.xml \
287
235
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
288
236
                $@)
289
237
 
290
 
# Need to add the GnuTLS, Avahi and GPGME libraries
291
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
292
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
293
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
294
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
295
 
 
296
 
# Need to add the libnl-route library
297
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
298
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
299
 
 
300
 
# Need to add the GLib and pthread libraries
301
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
302
 
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
303
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
304
 
 
305
 
.PHONY: clean
 
238
plugins.d/mandos-client: plugins.d/mandos-client.c
 
239
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
240
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
241
 
 
242
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
243
        check run-client run-server install install-html \
 
244
        install-server install-client-nokey install-client uninstall \
 
245
        uninstall-server uninstall-client purge purge-server \
 
246
        purge-client
 
247
 
306
248
clean:
307
249
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
308
250
 
309
 
.PHONY: distclean
310
251
distclean: clean
311
 
.PHONY: mostlyclean
312
252
mostlyclean: clean
313
 
.PHONY: maintainer-clean
314
253
maintainer-clean: clean
315
254
        -rm --force --recursive keydir confdir statedir
316
255
 
317
 
.PHONY: check
318
 
check: all
 
256
check:  all
319
257
        ./mandos --check
320
258
        ./mandos-ctl --check
321
 
        ./mandos-keygen --version
322
 
        ./plugin-runner --version
323
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
324
 
        ./dracut-module/password-agent --test
325
259
 
326
260
# Run the client with a local config and key
327
 
.PHONY: run-client
328
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
329
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
330
 
        @echo '######################################################'
331
 
        @echo '# The following error messages are harmless and can  #'
332
 
        @echo '#  be safely ignored:                                #'
333
 
        @echo '## From plugin-runner:                               #'
334
 
        @echo '# setgid: Operation not permitted                    #'
335
 
        @echo '# setuid: Operation not permitted                    #'
336
 
        @echo '## From askpass-fifo:                                #'
337
 
        @echo '# mkfifo: Permission denied                          #'
338
 
        @echo '## From mandos-client:                               #'
339
 
        @echo '# Failed to raise privileges: Operation not permi... #'
340
 
        @echo '# Warning: network hook "*" exited with status *     #'
341
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
342
 
        @echo '# Failed to bring up interface "*": Operation not... #'
343
 
        @echo '#                                                    #'
344
 
        @echo '# (The messages are caused by not running as root,   #'
345
 
        @echo '# but you should NOT run "make run-client" as root   #'
346
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
347
 
        @echo '# root, which is also NOT recommended.)              #'
348
 
        @echo '######################################################'
 
261
run-client: all keydir/seckey.txt keydir/pubkey.txt
 
262
        @echo "###################################################################"
 
263
        @echo "# The following error messages are harmless and can be safely     #"
 
264
        @echo "# ignored.  The messages are caused by not running as root, but   #"
 
265
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
 
266
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
 
267
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
268
        @echo "#                     setuid: Operation not permitted             #"
 
269
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
270
        @echo "# From mandos-client:                                             #"
 
271
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
272
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
273
        @echo "###################################################################"
349
274
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
350
275
        ./plugin-runner --plugin-dir=plugins.d \
351
 
                --plugin-helper-dir=plugin-helpers \
352
276
                --config-file=plugin-runner.conf \
353
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
277
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
354
278
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
355
279
                $(CLIENTARGS)
356
280
 
357
281
# Used by run-client
358
 
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
282
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
359
283
        install --directory keydir
360
284
        ./mandos-keygen --dir keydir --force
361
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
362
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
363
 
        fi
364
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
365
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
366
 
        fi
367
285
 
368
286
# Run the server with a local config
369
 
.PHONY: run-server
370
287
run-server: confdir/mandos.conf confdir/clients.conf statedir
371
288
        ./mandos --debug --no-dbus --configdir=confdir \
372
289
                --statedir=statedir $(SERVERARGS)
375
292
confdir/mandos.conf: mandos.conf
376
293
        install --directory confdir
377
294
        install --mode=u=rw,go=r $^ $@
378
 
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
295
confdir/clients.conf: clients.conf keydir/seckey.txt
379
296
        install --directory confdir
380
297
        install --mode=u=rw $< $@
381
298
# Add a client password
383
300
statedir:
384
301
        install --directory statedir
385
302
 
386
 
.PHONY: install
387
303
install: install-server install-client-nokey
388
304
 
389
 
.PHONY: install-html
390
305
install-html: html
391
306
        install --directory $(htmldir)
392
307
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
393
308
                $(htmldocs)
394
309
 
395
 
.PHONY: install-server
396
310
install-server: doc
397
311
        install --directory $(CONFDIR)
398
312
        if install --directory --mode=u=rwx --owner=$(USER) \
401
315
        elif install --directory --mode=u=rwx $(STATEDIR); then \
402
316
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
403
317
        fi
404
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" \
405
 
                        -a -d "$(TMPFILES)" ]; then \
406
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
407
 
                        $(TMPFILES)/mandos.conf; \
408
 
        fi
409
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
410
 
                        -a -d "$(SYSUSERS)" ]; then \
411
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
412
 
                        $(SYSUSERS)/mandos.conf; \
413
 
        fi
414
318
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
415
319
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
416
320
                mandos-ctl
445
349
        gzip --best --to-stdout intro.8mandos \
446
350
                > $(MANDIR)/man8/intro.8mandos.gz
447
351
 
448
 
.PHONY: install-client-nokey
449
352
install-client-nokey: all doc
450
353
        install --directory $(LIBDIR)/mandos $(CONFDIR)
451
354
        install --directory --mode=u=rwx $(KEYDIR) \
452
 
                $(LIBDIR)/mandos/plugins.d \
453
 
                $(LIBDIR)/mandos/plugin-helpers
454
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" \
455
 
                        -a -d "$(SYSUSERS)" ]; then \
456
 
                install --mode=u=rw,go=r sysusers.d-mandos.conf \
457
 
                        $(SYSUSERS)/mandos-client.conf; \
458
 
        fi
 
355
                $(LIBDIR)/mandos/plugins.d
459
356
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
460
357
                install --mode=u=rwx \
461
 
                        --directory "$(CONFDIR)/plugins.d" \
462
 
                        "$(CONFDIR)/plugin-helpers"; \
 
358
                        --directory "$(CONFDIR)/plugins.d"; \
463
359
        fi
464
360
        install --mode=u=rwx,go=rx --directory \
465
361
                "$(CONFDIR)/network-hooks.d"
466
362
        install --mode=u=rwx,go=rx \
467
363
                --target-directory=$(LIBDIR)/mandos plugin-runner
468
 
        install --mode=u=rwx,go=rx \
469
 
                --target-directory=$(LIBDIR)/mandos \
470
 
                mandos-to-cryptroot-unlock
471
364
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
472
365
                mandos-keygen
473
366
        install --mode=u=rwx,go=rx \
488
381
        install --mode=u=rwxs,go=rx \
489
382
                --target-directory=$(LIBDIR)/mandos/plugins.d \
490
383
                plugins.d/plymouth
491
 
        install --mode=u=rwx,go=rx \
492
 
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
493
 
                plugin-helpers/mandos-client-iprouteadddel
494
384
        install initramfs-tools-hook \
495
385
                $(INITRAMFSTOOLS)/hooks/mandos
496
 
        install --mode=u=rw,go=r initramfs-tools-conf \
497
 
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
498
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
499
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
386
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
 
387
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
500
388
        install initramfs-tools-script \
501
389
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
502
 
        install initramfs-tools-script-stop \
503
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
504
 
        install --directory $(DRACUTMODULE)
505
 
        install --mode=u=rw,go=r --target-directory=$(DRACUTMODULE) \
506
 
                dracut-module/ask-password-mandos.path \
507
 
                dracut-module/ask-password-mandos.service
508
 
        install --mode=u=rwxs,go=rx \
509
 
                --target-directory=$(DRACUTMODULE) \
510
 
                dracut-module/module-setup.sh \
511
 
                dracut-module/cmdline-mandos.sh \
512
 
                dracut-module/password-agent
513
390
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
514
391
        gzip --best --to-stdout mandos-keygen.8 \
515
392
                > $(MANDIR)/man8/mandos-keygen.8.gz
527
404
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
528
405
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
529
406
                > $(MANDIR)/man8/plymouth.8mandos.gz
530
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
531
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
532
407
 
533
 
.PHONY: install-client
534
408
install-client: install-client-nokey
535
409
# Post-installation stuff
536
410
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
537
 
        if command -v update-initramfs >/dev/null; then \
538
 
            update-initramfs -k all -u; \
539
 
        elif command -v dracut >/dev/null; then \
540
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
541
 
                if [ -w "$$initrd" ]; then \
542
 
                    chmod go-r "$$initrd"; \
543
 
                    dracut --force "$$initrd"; \
544
 
                fi; \
545
 
            done; \
546
 
        fi
 
411
        update-initramfs -k all -u
547
412
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
548
413
 
549
 
.PHONY: uninstall
550
414
uninstall: uninstall-server uninstall-client
551
415
 
552
 
.PHONY: uninstall-server
553
416
uninstall-server:
554
417
        -rm --force $(PREFIX)/sbin/mandos \
555
418
                $(PREFIX)/sbin/mandos-ctl \
562
425
        update-rc.d -f mandos remove
563
426
        -rmdir $(CONFDIR)
564
427
 
565
 
.PHONY: uninstall-client
566
428
uninstall-client:
567
429
# Refuse to uninstall client if /etc/crypttab is explicitly configured
568
430
# to use it.
579
441
                $(INITRAMFSTOOLS)/hooks/mandos \
580
442
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
581
443
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
582
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
583
 
                $(DRACUTMODULE)/ask-password-mandos.path \
584
 
                $(DRACUTMODULE)/ask-password-mandos.service \
585
 
                $(DRACUTMODULE)/module-setup.sh \
586
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
587
 
                $(DRACUTMODULE)/password-agent \
588
444
                $(MANDIR)/man8/mandos-keygen.8.gz \
589
445
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
590
446
                $(MANDIR)/man8/mandos-client.8mandos.gz
593
449
                $(MANDIR)/man8/splashy.8mandos.gz \
594
450
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
595
451
                $(MANDIR)/man8/plymouth.8mandos.gz \
596
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
597
452
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
598
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
599
 
        if command -v update-initramfs >/dev/null; then \
600
 
            update-initramfs -k all -u; \
601
 
        elif command -v dracut >/dev/null; then \
602
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
603
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
604
 
            done; \
605
 
        fi
 
453
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
454
        update-initramfs -k all -u
606
455
 
607
 
.PHONY: purge
608
456
purge: purge-server purge-client
609
457
 
610
 
.PHONY: purge-server
611
458
purge-server: uninstall-server
612
459
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
613
460
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
618
465
                $(DESTDIR)/var/run/mandos.pid
619
466
        -rmdir $(CONFDIR)
620
467
 
621
 
.PHONY: purge-client
622
468
purge-client: uninstall-client
623
 
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
469
        -shred --remove $(KEYDIR)/seckey.txt
624
470
        -rm --force $(CONFDIR)/plugin-runner.conf \
625
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
626
 
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
471
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
627
472
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)