/mandos/trunk : revision 768

1

-*- org -*-

2

3

* GIT

4

** General: [[https://www.atlassian.com/git/workflows][Git Workflows]], [[http://gitimmersion.com/][Git Immersion]], [[https://news.ycombinator.com/item?id=7036628][Simple git workflow is simple]]

4

** General: [[https://www.atlassian.com/git/workflows][Git Workflows]], [[http://gitimmersion.com/][Git Immersion]], [[https://news.ycombinator.com/item?id=7036628][Simple git workflow is simple]] [[https://news.ycombinator.com/item?id=9661349][On undoing, fixing, or removing commits in git]]

5

** Intro: [[http://www.eyrie.org/~eagle/notes/debian/git.html#combine][Using Git for Debian Packaging]]

6

** Use: [[https://honk.sigxcpu.org/piki/projects/git-buildpackage/][git-buildpackage]]

7

** Migration

21

22

* mandos-client

23

** TODO [#B] Use capabilities instead of seteuid().

24

https://forums.grsecurity.net/viewtopic.php?f=7&t=2522

24

25

** TODO [#B] Use getaddrinfo(hints=AI_NUMERICHOST) instead of inet_pton()

25

26

** TODO [#C] Make start_mandos_communication() take "struct server".

26

** TODO [#B] Use openat(), fstatat() etc. to avoid asprintf().

27

** TODO [#C] --interfaces=regex,eth*,noregex (bridge-utils-interfaces(5))

28

** TODO [#C] Remove code for GNU libc < 2.15

27

29

28

30

* splashy

29

31

** TODO [#B] use scandir(3) instead of readdir(3)

30

32

31

33

* usplash (Deprecated)

32

** TODO [#A] Make it work again

34

** TODO [#B] Make it work again

33

35

** TODO [#B] use scandir(3) instead of readdir(3)

34

36

35

37

* askpass-fifo

36

** TODO [#B] Drop privileges after opening FIFO.

37

38

39

* password-prompt

39

40

** TODO [#B] lock stdin (with flock()?)

45

46

* plugin-runner

46

47

** TODO handle printing for errors for plugins

47

48

*** Hook up stderr of plugins, buffer them, and prepend "Mandos Plugin [plugin name]"

48

** TODO [#B] use scandirat(3) instead of readdir(3)

49

*** Must wait until GNU libc 2.15

50

49

** TODO [#C] use same file name rules as run-parts(8)

51

50

** kernel command line option for debug info

51

** TODO [#C] Remove code for GNU libc < 2.15

52

53

* mandos (server)

54

** TODO [#B] --notify-command

55

This would allow the mandos.service to use

56

--notify-command="systemd-notify --pid READY=1"

54

57

** TODO [#B] Log level :BUGS:

55

58

*** TODO /etc/mandos/clients.d/*.conf

56

59

Watch this directory and add/remove/update clients?

65

68

+ Approve(False) -> Close client connection immediately

66

69

** TODO [#C] python-parsedatetime

67

70

** TODO Separate logging logic to own object

68

** TODO [#A] Limit approval_delay to max gnutls/tls timeout value

71

** TODO [#B] Limit approval_delay to max gnutls/tls timeout value

69

72

** TODO [#B] break the wait on approval_delay if connection dies

70

73

** TODO Generate Client.runtime_expansions from client options + extra

71

74

** TODO Allow %%(checker)s as a runtime expansion

72

75

** TODO Use python-tlslite?

73

76

** TODO D-Bus AddClient() method on server object

74

77

** TODO Use org.freedesktop.DBus.Method.NoReply annotation on async methods. :2:

75

** TODO Emit [[http://dbus.freedesktop.org/doc/dbus-specification.html#standard-interfaces-properties][org.freedesktop.DBus.Properties.PropertiesChanged]] signal :2:

76

TODO Deprecate se.recompile.Mandos.Client.PropertyChanged - annotate!

77

TODO Can use "invalidates" annotation to also emit on changed secret.

78

** TODO Support [[http://dbus.freedesktop.org/doc/dbus-specification.html#standard-interfaces-objectmanager][org.freedesktop.DBus.ObjectManager]] interface on server object :2:

79

Deprecate methods GetAllClients(), GetAllClientsWithProperties()

80

and signals ClientAdded and ClientRemoved.

83

** TODO Secret Service API?

84

http://standards.freedesktop.org/secret-service/

85

** TODO Remove D-Bus interfaces with old domain name :2:

86

** TODO Remove old string_to_delta format :2:

87

** TODO --no-zeroconf (only valid if port or socket is set)

86

** TODO Remove old string_to_delta format :2:

87

** TODO http://0pointer.de/blog/projects/stateless.html

88

*** tmpfiles snippet to create /var/lib/mandos with right user+perms

89

*** File in /usr/lib/sysusers.d to create user+group "_mandos"

90

** TODO Error handling on error parsing config files

91

** TODO init.d script error handling

92

** TODO D-Bus server properties; address, port, interface, etc. :2:

93

** TODO [#C] In Python 3.3, use shlex.quote() instead of re.escape()

88

94

89

95

* mandos.xml

90

96

** Add mandos contact info in manual pages

92

98

* mandos-ctl

93

99

*** Handle "no D-Bus server" and/or "no Mandos server found" better

94

100

*** [#B] --dump option

95

** TODO Remove old string_to_delta format :2:

101

** TODO Remove old string_to_delta format :2:

96

102

97

103

* TODO mandos-dispatch

98

104

Listens for specified D-Bus signals and spawns shell commands with

117

123

*** TODO [#C] use same file name rules as run-parts(8)

118

124

*** TODO [#C] Do not install in initrd.img if configured not to.

119

125

Use "/etc/initramfs-tools/hooksconf.d/mandos"?

120

** TODO [#C] /etc/bash_completion.d/mandos

126

** TODO [#C] $(pkg-config --variable=completionsdir bash-completion)

121

127

From XML sources directly?

122

128

123

129

* Side Stuff