/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code 
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.3.0
 
43
version=1.7.6
27
44
SED=sed
28
45
 
 
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
48
 
29
49
## Use these settings for a traditional /usr/local install
30
50
# PREFIX=$(DESTDIR)/usr/local
31
51
# CONFDIR=$(DESTDIR)/etc/mandos
32
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
33
53
# MANDIR=$(PREFIX)/man
34
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
35
57
##
36
58
 
37
59
## These settings are for a package-type install
40
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
41
63
MANDIR=$(PREFIX)/share/man
42
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
43
75
##
44
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
45
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
46
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
47
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
49
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
50
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
51
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
52
88
 
53
89
# Do not change these two
54
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
55
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
56
 
        -DVERSION='"$(version)"'
57
 
LDFLAGS=$(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
58
94
 
59
95
# Commands to format a DocBook <refentry> document into a manual page
60
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
63
99
        --param make.single.year.ranges         1 \
64
100
        --param man.output.quietly              1 \
65
101
        --param man.authors.section.enabled     0 \
66
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
67
103
        $(notdir $<); \
68
 
        $(MANPOST) $(notdir $@))
69
 
# DocBook-to-man post-processing to fix a '\n' escape bug
70
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
71
108
 
72
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
73
110
        --param make.year.ranges                1 \
85
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
86
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
87
124
        plugins.d/plymouth
88
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
89
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
90
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
91
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
92
130
        plugins.d/mandos-client.8mandos \
93
131
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
94
132
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
95
 
        plugins.d/plymouth.8mandos
 
133
        plugins.d/plymouth.8mandos intro.8mandos
96
134
 
97
135
htmldocs=$(addsuffix .xhtml,$(DOCS))
98
136
 
119
157
%.8mandos.xhtml: %.xml common.ent legalnotice.xml
120
158
        $(DOCBOOKTOHTML)
121
159
 
 
160
intro.8mandos: intro.xml common.ent legalnotice.xml
 
161
        $(DOCBOOKTOMAN)
 
162
intro.8mandos.xhtml: intro.xml common.ent legalnotice.xml
 
163
        $(DOCBOOKTOHTML)
 
164
 
122
165
mandos.8: mandos.xml common.ent mandos-options.xml overview.xml \
123
166
                legalnotice.xml
124
167
        $(DOCBOOKTOMAN)
210
253
                $@)
211
254
 
212
255
plugins.d/mandos-client: plugins.d/mandos-client.c
213
 
        $(LINK.c) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) $(strip\
214
 
                ) $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@
215
 
 
216
 
.PHONY : all doc html clean distclean run-client run-server install \
217
 
        install-server install-client uninstall uninstall-server \
218
 
        uninstall-client purge purge-server purge-client
 
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
258
 
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
219
268
 
220
269
clean:
221
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
223
272
distclean: clean
224
273
mostlyclean: clean
225
274
maintainer-clean: clean
226
 
        -rm --force --recursive keydir confdir
 
275
        -rm --force --recursive keydir confdir statedir
227
276
 
228
277
check:  all
229
278
        ./mandos --check
 
279
        ./mandos-ctl --check
230
280
 
231
281
# Run the client with a local config and key
232
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
235
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
236
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
237
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
238
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
239
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
240
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
241
 
        @echo "#                     seteuid: Operation not permitted            #"
242
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
243
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
244
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
245
298
                --config-file=plugin-runner.conf \
246
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
247
301
                $(CLIENTARGS)
248
302
 
249
303
# Used by run-client
252
306
        ./mandos-keygen --dir keydir --force
253
307
 
254
308
# Run the server with a local config
255
 
run-server: confdir/mandos.conf confdir/clients.conf
256
 
        @echo "#################################################################"
257
 
        @echo "# NOTE: Please IGNORE the error about \"Could not open file      #"
258
 
        @echo "# u'/var/run/mandos.pid'\" -  it is harmless and is caused by    #"
259
 
        @echo "# the server not running as root.  Do NOT run \"make run-server\" #"
260
 
        @echo "# server as root if you didn't also unpack and compile it thus. #"
261
 
        @echo "#################################################################"
262
 
        ./mandos --debug --no-dbus --configdir=confdir $(SERVERARGS)
 
309
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
310
        ./mandos --debug --no-dbus --configdir=confdir \
 
311
                --statedir=statedir $(SERVERARGS)
263
312
 
264
313
# Used by run-server
265
314
confdir/mandos.conf: mandos.conf
269
318
        install --directory confdir
270
319
        install --mode=u=rw $< $@
271
320
# Add a client password
272
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
322
statedir:
 
323
        install --directory statedir
273
324
 
274
325
install: install-server install-client-nokey
275
326
 
280
331
 
281
332
install-server: doc
282
333
        install --directory $(CONFDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
283
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
284
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
285
342
                mandos-ctl
293
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
294
351
        install --mode=u=rwx,go=rx init.d-mandos \
295
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
296
356
        install --mode=u=rw,go=r default-mandos \
297
357
                $(DESTDIR)/etc/default/mandos
298
358
        if [ -z $(DESTDIR) ]; then \
308
368
                > $(MANDIR)/man5/mandos.conf.5.gz
309
369
        gzip --best --to-stdout mandos-clients.conf.5 \
310
370
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
371
        gzip --best --to-stdout intro.8mandos \
 
372
                > $(MANDIR)/man8/intro.8mandos.gz
311
373
 
312
374
install-client-nokey: all doc
313
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
314
376
        install --directory --mode=u=rwx $(KEYDIR) \
315
 
                $(PREFIX)/lib/mandos/plugins.d
316
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
317
380
                install --mode=u=rwx \
318
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
319
383
        fi
 
384
        install --mode=u=rwx,go=rx --directory \
 
385
                "$(CONFDIR)/network-hooks.d"
320
386
        install --mode=u=rwx,go=rx \
321
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
322
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
323
389
                mandos-keygen
324
390
        install --mode=u=rwx,go=rx \
325
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
326
392
                plugins.d/password-prompt
327
393
        install --mode=u=rwxs,go=rx \
328
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
329
395
                plugins.d/mandos-client
330
396
        install --mode=u=rwxs,go=rx \
331
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
332
398
                plugins.d/usplash
333
399
        install --mode=u=rwxs,go=rx \
334
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
335
401
                plugins.d/splashy
336
402
        install --mode=u=rwxs,go=rx \
337
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
338
404
                plugins.d/askpass-fifo
339
405
        install --mode=u=rwxs,go=rx \
340
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
341
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
342
411
        install initramfs-tools-hook \
343
412
                $(INITRAMFSTOOLS)/hooks/mandos
344
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
389
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
390
459
                $(DESTDIR)/etc/crypttab
391
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
392
 
                $(PREFIX)/lib/mandos/plugin-runner \
393
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
394
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
395
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
396
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
397
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
398
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
399
468
                $(INITRAMFSTOOLS)/hooks/mandos \
400
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
401
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
407
476
                $(MANDIR)/man8/splashy.8mandos.gz \
408
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
409
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
410
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
411
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
412
481
        update-initramfs -k all -u
413
482
 
414
483
purge: purge-server purge-client
418
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
419
488
                $(DESTDIR)/etc/default/mandos \
420
489
                $(DESTDIR)/etc/init.d/mandos \
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
421
492
                $(DESTDIR)/var/run/mandos.pid
422
493
        -rmdir $(CONFDIR)
423
494