/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.4.1
 
43
version=1.7.6
27
44
SED=sed
28
45
 
29
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
31
48
 
32
49
## Use these settings for a traditional /usr/local install
33
50
# PREFIX=$(DESTDIR)/usr/local
36
53
# MANDIR=$(PREFIX)/man
37
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
39
57
##
40
58
 
41
59
## These settings are for a package-type install
45
63
MANDIR=$(PREFIX)/share/man
46
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
48
75
##
49
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
50
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
51
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
52
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
54
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
55
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
56
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
57
88
 
58
89
# Do not change these two
59
 
CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
60
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
61
 
        -DVERSION='"$(version)"'
62
 
LDFLAGS=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
63
94
 
64
95
# Commands to format a DocBook <refentry> document into a manual page
65
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
68
99
        --param make.single.year.ranges         1 \
69
100
        --param man.output.quietly              1 \
70
101
        --param man.authors.section.enabled     0 \
71
 
         /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
 
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
72
103
        $(notdir $<); \
73
 
        $(MANPOST) $(notdir $@);\
74
 
        LANG=en_US.UTF-8 MANWIDTH=80 man --warnings --encoding=UTF-8 \
75
 
        --local-file $(notdir $@) >/dev/null)
76
 
# DocBook-to-man post-processing to fix a '\n' escape bug
77
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
 
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
78
108
 
79
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
80
110
        --param make.year.ranges                1 \
92
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
93
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
94
124
        plugins.d/plymouth
95
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
96
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
97
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
98
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
225
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
226
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
227
258
 
228
 
.PHONY : all doc html clean distclean run-client run-server install \
229
 
        install-server install-client uninstall uninstall-server \
230
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
231
268
 
232
269
clean:
233
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
239
276
 
240
277
check:  all
241
278
        ./mandos --check
 
279
        ./mandos-ctl --check
242
280
 
243
281
# Run the client with a local config and key
244
282
run-client: all keydir/seckey.txt keydir/pubkey.txt
247
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
248
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
249
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
250
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
251
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
252
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
253
 
        @echo "#                     seteuid: Operation not permitted            #"
254
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
255
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
256
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
257
298
                --config-file=plugin-runner.conf \
258
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
259
301
                $(CLIENTARGS)
260
302
 
261
303
# Used by run-client
264
306
        ./mandos-keygen --dir keydir --force
265
307
 
266
308
# Run the server with a local config
267
 
run-server: confdir/mandos.conf confdir/clients.conf
 
309
run-server: confdir/mandos.conf confdir/clients.conf statedir
268
310
        ./mandos --debug --no-dbus --configdir=confdir \
269
311
                --statedir=statedir $(SERVERARGS)
270
312
 
276
318
        install --directory confdir
277
319
        install --mode=u=rw $< $@
278
320
# Add a client password
279
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
280
322
statedir:
281
323
        install --directory statedir
282
324
 
289
331
 
290
332
install-server: doc
291
333
        install --directory $(CONFDIR)
292
 
        install --directory --mode=u=rwx --owner=$(USER) \
293
 
                --group=$(GROUP) $(STATEDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
294
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
295
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
296
342
                mandos-ctl
304
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
305
351
        install --mode=u=rwx,go=rx init.d-mandos \
306
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
307
356
        install --mode=u=rw,go=r default-mandos \
308
357
                $(DESTDIR)/etc/default/mandos
309
358
        if [ -z $(DESTDIR) ]; then \
319
368
                > $(MANDIR)/man5/mandos.conf.5.gz
320
369
        gzip --best --to-stdout mandos-clients.conf.5 \
321
370
                > $(MANDIR)/man5/mandos-clients.conf.5.gz
 
371
        gzip --best --to-stdout intro.8mandos \
 
372
                > $(MANDIR)/man8/intro.8mandos.gz
322
373
 
323
374
install-client-nokey: all doc
324
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
325
376
        install --directory --mode=u=rwx $(KEYDIR) \
326
 
                $(PREFIX)/lib/mandos/plugins.d
327
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
328
380
                install --mode=u=rwx \
329
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
330
383
        fi
331
384
        install --mode=u=rwx,go=rx --directory \
332
385
                "$(CONFDIR)/network-hooks.d"
333
386
        install --mode=u=rwx,go=rx \
334
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
335
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
336
389
                mandos-keygen
337
390
        install --mode=u=rwx,go=rx \
338
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
339
392
                plugins.d/password-prompt
340
393
        install --mode=u=rwxs,go=rx \
341
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
342
395
                plugins.d/mandos-client
343
396
        install --mode=u=rwxs,go=rx \
344
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
345
398
                plugins.d/usplash
346
399
        install --mode=u=rwxs,go=rx \
347
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
348
401
                plugins.d/splashy
349
402
        install --mode=u=rwxs,go=rx \
350
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
351
404
                plugins.d/askpass-fifo
352
405
        install --mode=u=rwxs,go=rx \
353
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
354
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
355
411
        install initramfs-tools-hook \
356
412
                $(INITRAMFSTOOLS)/hooks/mandos
357
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
402
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
403
459
                $(DESTDIR)/etc/crypttab
404
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
405
 
                $(PREFIX)/lib/mandos/plugin-runner \
406
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
407
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
408
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
409
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
410
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
411
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
412
468
                $(INITRAMFSTOOLS)/hooks/mandos \
413
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
414
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
420
476
                $(MANDIR)/man8/splashy.8mandos.gz \
421
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
422
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
423
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
424
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
425
481
        update-initramfs -k all -u
426
482
 
427
483
purge: purge-server purge-client
431
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
432
488
                $(DESTDIR)/etc/default/mandos \
433
489
                $(DESTDIR)/etc/init.d/mandos \
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
434
492
                $(DESTDIR)/var/run/mandos.pid
435
493
        -rmdir $(CONFDIR)
436
494