/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.4.1
 
43
version=1.7.6
27
44
SED=sed
28
45
 
29
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
31
48
 
32
49
## Use these settings for a traditional /usr/local install
33
50
# PREFIX=$(DESTDIR)/usr/local
36
53
# MANDIR=$(PREFIX)/man
37
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
39
57
##
40
58
 
41
59
## These settings are for a package-type install
45
63
MANDIR=$(PREFIX)/share/man
46
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
48
75
##
49
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
50
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
51
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
52
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
54
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
55
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
56
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
57
88
 
58
89
# Do not change these two
59
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
60
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
61
 
        -DVERSION='"$(version)"'
62
 
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
63
94
 
64
95
# Commands to format a DocBook <refentry> document into a manual page
65
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
68
99
        --param make.single.year.ranges         1 \
69
100
        --param man.output.quietly              1 \
70
101
        --param man.authors.section.enabled     0 \
71
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
72
103
        $(notdir $<); \
73
 
        $(MANPOST) $(notdir $@);\
74
 
        LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
75
 
        --local-file $(notdir $@) >/dev/null)
76
 
# DocBook-to-man post-processing to fix a '\n' escape bug
77
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
78
108
 
79
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
80
110
        --param make.year.ranges                1 \
92
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
93
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
94
124
        plugins.d/plymouth
95
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
96
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
97
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
98
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
225
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
226
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
227
258
 
228
 
.PHONY : all doc html clean distclean run-client run-server install \
229
 
        install-server install-client uninstall uninstall-server \
230
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
231
268
 
232
269
clean:
233
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
239
276
 
240
277
check:  all
241
278
        ./mandos --check
 
279
        ./mandos-ctl --check
242
280
 
243
281
# Run the client with a local config and key
244
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
247
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
248
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
249
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
250
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
251
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
252
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
253
 
        @echo "#                     seteuid: Operation not permitted            #"
254
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
255
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
256
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
257
298
                --config-file=plugin-runner.conf \
258
 
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt \
 
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
259
301
                $(CLIENTARGS)
260
302
 
261
303
# Used by run-client
264
306
        ./mandos-keygen --dir keydir --force
265
307
 
266
308
# Run the server with a local config
267
 
run-server: confdir/mandos.conf confdir/clients.conf
 
309
run-server: confdir/mandos.conf confdir/clients.conf statedir
268
310
        ./mandos --debug --no-dbus --configdir=confdir \
269
311
                --statedir=statedir $(SERVERARGS)
270
312
 
276
318
        install --directory confdir
277
319
        install --mode=u=rw $< $@
278
320
# Add a client password
279
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
280
322
statedir:
281
323
        install --directory statedir
282
324
 
289
331
 
290
332
install-server: doc
291
333
        install --directory $(CONFDIR)
292
 
        install --directory --mode=u=rwx --owner=$(USER) \
293
 
                --group=$(GROUP) $(STATEDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
294
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
295
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
296
342
                mandos-ctl
304
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
305
351
        install --mode=u=rwx,go=rx init.d-mandos \
306
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
307
356
        install --mode=u=rw,go=r default-mandos \
308
357
                $(DESTDIR)/etc/default/mandos
309
358
        if [ -z $(DESTDIR) ]; then \
319
368
                > $(MANDIR)/man5/mandos.conf.5.gz
320
369
        gzip --best --to-stdout mandos-clients.conf.5 \
321
370
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
371
        gzip --best --to-stdout intro.8mandos \
 
372
                > $(MANDIR)/man8/intro.8mandos.gz
322
373
 
323
374
install-client-nokey: all doc
324
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
325
376
        install --directory --mode=u=rwx $(KEYDIR) \
326
 
                $(PREFIX)/lib/mandos/plugins.d
327
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
328
380
                install --mode=u=rwx \
329
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
330
383
        fi
 
384
        install --mode=u=rwx,go=rx --directory \
 
385
                "$(CONFDIR)/network-hooks.d"
331
386
        install --mode=u=rwx,go=rx \
332
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
333
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
334
389
                mandos-keygen
335
390
        install --mode=u=rwx,go=rx \
336
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
337
392
                plugins.d/password-prompt
338
393
        install --mode=u=rwxs,go=rx \
339
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
340
395
                plugins.d/mandos-client
341
396
        install --mode=u=rwxs,go=rx \
342
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
343
398
                plugins.d/usplash
344
399
        install --mode=u=rwxs,go=rx \
345
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
346
401
                plugins.d/splashy
347
402
        install --mode=u=rwxs,go=rx \
348
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
349
404
                plugins.d/askpass-fifo
350
405
        install --mode=u=rwxs,go=rx \
351
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
352
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
353
411
        install initramfs-tools-hook \
354
412
                $(INITRAMFSTOOLS)/hooks/mandos
355
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
400
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
401
459
                $(DESTDIR)/etc/crypttab
402
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
403
 
                $(PREFIX)/lib/mandos/plugin-runner \
404
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
405
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
406
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
407
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
408
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
409
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
410
468
                $(INITRAMFSTOOLS)/hooks/mandos \
411
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
412
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
418
476
                $(MANDIR)/man8/splashy.8mandos.gz \
419
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
420
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
421
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
422
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
423
481
        update-initramfs -k all -u
424
482
 
425
483
purge: purge-server purge-client
429
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
430
488
                $(DESTDIR)/etc/default/mandos \
431
489
                $(DESTDIR)/etc/init.d/mandos \
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
432
492
                $(DESTDIR)/var/run/mandos.pid
433
493
        -rmdir $(CONFDIR)
434
494