/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN:=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
2
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
3
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
4
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
13
#DEBUG=-ggdb3
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
19
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
 
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
21
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
22
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
23
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
26
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
26
        -fsanitize=enum
29
 
 
30
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
33
 
LINK_FORTIFY_LD:=-z relro -z now
34
 
LINK_FORTIFY:=
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
31
LINK_FORTIFY_LD=-z relro -z now
 
32
LINK_FORTIFY=
35
33
 
36
34
# If BROKEN_PIE is set, do not build with -pie
37
35
ifndef BROKEN_PIE
39
37
LINK_FORTIFY += -pie
40
38
endif
41
39
#COVERAGE=--coverage
42
 
OPTIMIZE:=-Os -fno-strict-aliasing
43
 
LANGUAGE:=-std=gnu11
44
 
htmldir:=man
45
 
version:=1.8.4
46
 
SED:=sed
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
 
42
htmldir=man
 
43
version=1.7.6
 
44
SED=sed
47
45
 
48
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
49
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
50
48
 
51
49
## Use these settings for a traditional /usr/local install
52
 
# PREFIX:=$(DESTDIR)/usr/local
53
 
# CONFDIR:=$(DESTDIR)/etc/mandos
54
 
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
55
 
# MANDIR:=$(PREFIX)/man
56
 
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
57
 
# STATEDIR:=$(DESTDIR)/var/lib/mandos
58
 
# LIBDIR:=$(PREFIX)/lib
 
50
# PREFIX=$(DESTDIR)/usr/local
 
51
# CONFDIR=$(DESTDIR)/etc/mandos
 
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
 
53
# MANDIR=$(PREFIX)/man
 
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
59
57
##
60
58
 
61
59
## These settings are for a package-type install
62
 
PREFIX:=$(DESTDIR)/usr
63
 
CONFDIR:=$(DESTDIR)/etc/mandos
64
 
KEYDIR:=$(DESTDIR)/etc/keys/mandos
65
 
MANDIR:=$(PREFIX)/share/man
66
 
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
67
 
STATEDIR:=$(DESTDIR)/var/lib/mandos
68
 
LIBDIR:=$(shell \
 
60
PREFIX=$(DESTDIR)/usr
 
61
CONFDIR=$(DESTDIR)/etc/mandos
 
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
 
63
MANDIR=$(PREFIX)/share/man
 
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
69
67
        for d in \
70
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
71
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
76
74
        done)
77
75
##
78
76
 
79
 
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
80
 
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
81
78
 
82
 
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
83
 
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
84
 
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
85
 
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
86
 
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
87
 
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
 
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
 
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
 
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
 
82
AVAHI_LIBS=$(shell pkg-config --libs avahi-core)
 
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
88
85
        getconf LFS_LDFLAGS)
89
 
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
90
 
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
91
88
 
92
89
# Do not change these two
93
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) \
94
 
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
95
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
96
94
 
97
95
# Commands to format a DocBook <refentry> document into a manual page
118
116
        /usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl \
119
117
        $<; $(HTMLPOST) $@)
120
118
# Fix citerefentry links
121
 
HTMLPOST:=$(SED) --in-place \
 
119
HTMLPOST=$(SED) --in-place \
122
120
        --expression='s/\(<a class="citerefentry" href="\)\("><span class="citerefentry"><span class="refentrytitle">\)\([^<]*\)\(<\/span>(\)\([^)]*\)\()<\/span><\/a>\)/\1\3.\5\2\3\4\5\6/g'
123
121
 
124
 
PLUGINS:=plugins.d/password-prompt plugins.d/mandos-client \
 
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
125
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
126
124
        plugins.d/plymouth
127
 
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
128
 
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
129
 
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
130
 
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
 
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
131
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
132
130
        plugins.d/mandos-client.8mandos \
133
131
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
134
132
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
135
133
        plugins.d/plymouth.8mandos intro.8mandos
136
134
 
137
 
htmldocs:=$(addsuffix .xhtml,$(DOCS))
 
135
htmldocs=$(addsuffix .xhtml,$(DOCS))
138
136
 
139
 
objects:=$(addsuffix .o,$(CPROGS))
 
137
objects=$(addsuffix .o,$(CPROGS))
140
138
 
141
139
all: $(PROGS) mandos.lsm
142
140
 
254
252
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
255
253
                $@)
256
254
 
257
 
# Need to add the GnuTLS, Avahi and GPGME libraries
258
255
plugins.d/mandos-client: plugins.d/mandos-client.c
259
 
        $(LINK.c) $^ $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(strip\
260
 
                ) $(GPGME_CFLAGS) -lrt $(GNUTLS_LIBS) $(strip\
261
 
                ) $(AVAHI_LIBS) $(GPGME_LIBS) $(LOADLIBES) $(strip\
262
 
                ) $(LDLIBS) -o $@
 
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
263
258
 
264
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
265
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
284
279
        ./mandos-ctl --check
285
280
 
286
281
# Run the client with a local config and key
287
 
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
288
283
        @echo "###################################################################"
289
284
        @echo "# The following error messages are harmless and can be safely     #"
290
 
        @echo "# ignored:                                                        #"
 
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
 
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
 
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
291
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
292
289
        @echo "#                     setuid: Operation not permitted             #"
293
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
294
291
        @echo "# From mandos-client:                                             #"
295
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
296
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
297
 
        @echo "#                                                                 #"
298
 
        @echo "# (The messages are caused by not running as root, but you should #"
299
 
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
300
 
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
301
294
        @echo "###################################################################"
302
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
303
296
        ./plugin-runner --plugin-dir=plugins.d \
304
297
                --plugin-helper-dir=plugin-helpers \
305
298
                --config-file=plugin-runner.conf \
306
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--tls-privkey=keydir/tls-privkey.pem,--tls-pubkey=keydir/tls-pubkey.pem,--network-hook-dir=network-hooks.d \
 
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
307
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
308
301
                $(CLIENTARGS)
309
302
 
310
303
# Used by run-client
311
 
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
 
304
keydir/seckey.txt keydir/pubkey.txt: mandos-keygen
312
305
        install --directory keydir
313
306
        ./mandos-keygen --dir keydir --force
314
307
 
321
314
confdir/mandos.conf: mandos.conf
322
315
        install --directory confdir
323
316
        install --mode=u=rw,go=r $^ $@
324
 
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
 
317
confdir/clients.conf: clients.conf keydir/seckey.txt
325
318
        install --directory confdir
326
319
        install --mode=u=rw $< $@
327
320
# Add a client password
344
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
345
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
346
339
        fi
347
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
348
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
349
 
                        $(TMPFILES)/mandos.conf; \
350
 
        fi
351
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
352
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
353
342
                mandos-ctl
389
378
                $(LIBDIR)/mandos/plugin-helpers
390
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
391
380
                install --mode=u=rwx \
392
 
                        --directory "$(CONFDIR)/plugins.d" \
393
 
                        "$(CONFDIR)/plugin-helpers"; \
 
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
394
383
        fi
395
384
        install --mode=u=rwx,go=rx --directory \
396
385
                "$(CONFDIR)/network-hooks.d"
397
386
        install --mode=u=rwx,go=rx \
398
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
399
 
        install --mode=u=rwx,go=rx \
400
 
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
401
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
402
389
                mandos-keygen
403
390
        install --mode=u=rwx,go=rx \
418
405
        install --mode=u=rwxs,go=rx \
419
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
420
407
                plugins.d/plymouth
421
 
        install --mode=u=rwx,go=rx \
 
408
        install --mode=u=rwxs,go=rx \
422
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
423
410
                plugin-helpers/mandos-client-iprouteadddel
424
411
        install initramfs-tools-hook \
425
412
                $(INITRAMFSTOOLS)/hooks/mandos
426
 
        install --mode=u=rw,go=r initramfs-tools-conf \
427
 
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
428
 
        install --mode=u=rw,go=r initramfs-tools-conf-hook \
429
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
 
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
 
414
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos
430
415
        install initramfs-tools-script \
431
416
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
432
 
        install initramfs-tools-script-stop \
433
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
434
417
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
435
418
        gzip --best --to-stdout mandos-keygen.8 \
436
419
                > $(MANDIR)/man8/mandos-keygen.8.gz
510
493
        -rmdir $(CONFDIR)
511
494
 
512
495
purge-client: uninstall-client
513
 
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
 
496
        -shred --remove $(KEYDIR)/seckey.txt
514
497
        -rm --force $(CONFDIR)/plugin-runner.conf \
515
 
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt \
516
 
                $(KEYDIR)/tls-pubkey.txt $(KEYDIR)/tls-privkey.txt
 
498
                $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt
517
499
        -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR)