/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.4.1
 
43
version=1.7.6
27
44
SED=sed
28
45
 
 
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
48
 
29
49
## Use these settings for a traditional /usr/local install
30
50
# PREFIX=$(DESTDIR)/usr/local
31
51
# CONFDIR=$(DESTDIR)/etc/mandos
32
52
# KEYDIR=$(DESTDIR)/etc/mandos/keys
33
53
# MANDIR=$(PREFIX)/man
34
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
 
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
35
57
##
36
58
 
37
59
## These settings are for a package-type install
40
62
KEYDIR=$(DESTDIR)/etc/keys/mandos
41
63
MANDIR=$(PREFIX)/share/man
42
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
 
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
43
75
##
44
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
45
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
46
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
47
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
49
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
50
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
51
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
52
88
 
53
89
# Do not change these two
54
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
55
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
56
 
        -DVERSION='"$(version)"'
57
 
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
58
94
 
59
95
# Commands to format a DocBook <refentry> document into a manual page
60
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
63
99
        --param make.single.year.ranges         1 \
64
100
        --param man.output.quietly              1 \
65
101
        --param man.authors.section.enabled     0 \
66
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
67
103
        $(notdir $<); \
68
 
        $(MANPOST) $(notdir $@);\
69
 
        LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
70
 
        --local-file $(notdir $@) >/dev/null)
71
 
# DocBook-to-man post-processing to fix a '\n' escape bug
72
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
73
108
 
74
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
75
110
        --param make.year.ranges                1 \
87
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
88
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
89
124
        plugins.d/plymouth
90
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
91
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
92
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
93
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
220
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
221
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
222
258
 
223
 
.PHONY : all doc html clean distclean run-client run-server install \
224
 
        install-server install-client uninstall uninstall-server \
225
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
226
268
 
227
269
clean:
228
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
230
272
distclean: clean
231
273
mostlyclean: clean
232
274
maintainer-clean: clean
233
 
        -rm --force --recursive keydir confdir
 
275
        -rm --force --recursive keydir confdir statedir
234
276
 
235
277
check:  all
236
278
        ./mandos --check
 
279
        ./mandos-ctl --check
237
280
 
238
281
# Run the client with a local config and key
239
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
242
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
243
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
244
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
245
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
246
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
247
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
248
 
        @echo "#                     seteuid: Operation not permitted            #"
249
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
250
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
251
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
252
298
                --config-file=plugin-runner.conf \
253
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
254
301
                $(CLIENTARGS)
255
302
 
256
303
# Used by run-client
259
306
        ./mandos-keygen --dir keydir --force
260
307
 
261
308
# Run the server with a local config
262
 
run-server: confdir/mandos.conf confdir/clients.conf
263
 
        @echo "#################################################################"
264
 
        @echo "# NOTE: Please IGNORE the error about \"Could not open file      #"
265
 
        @echo "# u'/var/run/mandos.pid'\" -  it is harmless and is caused by    #"
266
 
        @echo "# the server not running as root.  Do NOT run \"make run-server\" #"
267
 
        @echo "# server as root if you didn't also unpack and compile it thus. #"
268
 
        @echo "#################################################################"
269
 
        ./mandos --debug --no-dbus --configdir=confdir $(SERVERARGS)
 
309
run-server: confdir/mandos.conf confdir/clients.conf statedir
 
310
        ./mandos --debug --no-dbus --configdir=confdir \
 
311
                --statedir=statedir $(SERVERARGS)
270
312
 
271
313
# Used by run-server
272
314
confdir/mandos.conf: mandos.conf
276
318
        install --directory confdir
277
319
        install --mode=u=rw $< $@
278
320
# Add a client password
279
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
 
322
statedir:
 
323
        install --directory statedir
280
324
 
281
325
install: install-server install-client-nokey
282
326
 
287
331
 
288
332
install-server: doc
289
333
        install --directory $(CONFDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
290
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
291
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
292
342
                mandos-ctl
300
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
301
351
        install --mode=u=rwx,go=rx init.d-mandos \
302
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
303
356
        install --mode=u=rw,go=r default-mandos \
304
357
                $(DESTDIR)/etc/default/mandos
305
358
        if [ -z $(DESTDIR) ]; then \
315
368
                > $(MANDIR)/man5/mandos.conf.5.gz
316
369
        gzip --best --to-stdout mandos-clients.conf.5 \
317
370
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
371
        gzip --best --to-stdout intro.8mandos \
 
372
                > $(MANDIR)/man8/intro.8mandos.gz
318
373
 
319
374
install-client-nokey: all doc
320
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
321
376
        install --directory --mode=u=rwx $(KEYDIR) \
322
 
                $(PREFIX)/lib/mandos/plugins.d
323
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
324
380
                install --mode=u=rwx \
325
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
326
383
        fi
 
384
        install --mode=u=rwx,go=rx --directory \
 
385
                "$(CONFDIR)/network-hooks.d"
327
386
        install --mode=u=rwx,go=rx \
328
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
329
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
330
389
                mandos-keygen
331
390
        install --mode=u=rwx,go=rx \
332
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
333
392
                plugins.d/password-prompt
334
393
        install --mode=u=rwxs,go=rx \
335
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
336
395
                plugins.d/mandos-client
337
396
        install --mode=u=rwxs,go=rx \
338
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
339
398
                plugins.d/usplash
340
399
        install --mode=u=rwxs,go=rx \
341
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
342
401
                plugins.d/splashy
343
402
        install --mode=u=rwxs,go=rx \
344
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
345
404
                plugins.d/askpass-fifo
346
405
        install --mode=u=rwxs,go=rx \
347
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
348
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
349
411
        install initramfs-tools-hook \
350
412
                $(INITRAMFSTOOLS)/hooks/mandos
351
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
396
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
397
459
                $(DESTDIR)/etc/crypttab
398
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
399
 
                $(PREFIX)/lib/mandos/plugin-runner \
400
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
401
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
402
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
403
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
404
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
405
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
406
468
                $(INITRAMFSTOOLS)/hooks/mandos \
407
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
408
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
414
476
                $(MANDIR)/man8/splashy.8mandos.gz \
415
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
416
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
417
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
418
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
419
481
        update-initramfs -k all -u
420
482
 
421
483
purge: purge-server purge-client
425
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
426
488
                $(DESTDIR)/etc/default/mandos \
427
489
                $(DESTDIR)/etc/init.d/mandos \
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
428
492
                $(DESTDIR)/var/run/mandos.pid
429
493
        -rmdir $(CONFDIR)
430
494