/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var
8
 
#       -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
 
# For info about _FORTIFY_SOURCE, see
11
 
# <http://www.kernel.org/doc/man-pages/online/pages/man7/feature_test_macros.7.html>
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
12
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
13
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
14
31
LINK_FORTIFY_LD=-z relro -z now
15
32
LINK_FORTIFY=
16
33
 
20
37
LINK_FORTIFY += -pie
21
38
endif
22
39
#COVERAGE=--coverage
23
 
OPTIMIZE=-Os
24
 
LANGUAGE=-std=gnu99
 
40
OPTIMIZE=-Os -fno-strict-aliasing
 
41
LANGUAGE=-std=gnu11
25
42
htmldir=man
26
 
version=1.6.1
 
43
version=1.7.6
27
44
SED=sed
28
45
 
29
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
30
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
31
48
 
32
49
## Use these settings for a traditional /usr/local install
33
50
# PREFIX=$(DESTDIR)/usr/local
36
53
# MANDIR=$(PREFIX)/man
37
54
# INITRAMFSTOOLS=$(DESTDIR)/etc/initramfs-tools
38
55
# STATEDIR=$(DESTDIR)/var/lib/mandos
 
56
# LIBDIR=$(PREFIX)/lib
39
57
##
40
58
 
41
59
## These settings are for a package-type install
45
63
MANDIR=$(PREFIX)/share/man
46
64
INITRAMFSTOOLS=$(DESTDIR)/usr/share/initramfs-tools
47
65
STATEDIR=$(DESTDIR)/var/lib/mandos
 
66
LIBDIR=$(shell \
 
67
        for d in \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
 
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
 
71
                        echo "$(DESTDIR)$$d"; \
 
72
                        break; \
 
73
                fi; \
 
74
        done)
48
75
##
49
76
 
 
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
 
50
79
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
51
80
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
52
81
AVAHI_CFLAGS=$(shell pkg-config --cflags-only-I avahi-core)
54
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
55
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
56
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
57
88
 
58
89
# Do not change these two
59
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
60
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
61
 
        -DVERSION='"$(version)"'
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
62
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
63
94
 
64
95
# Commands to format a DocBook <refentry> document into a manual page
70
101
        --param man.authors.section.enabled     0 \
71
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
72
103
        $(notdir $<); \
73
 
        $(MANPOST) $(notdir $@);\
74
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
75
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
76
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
77
107
        fi >/dev/null)
78
 
# DocBook-to-man post-processing to fix a '\n' escape bug
79
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
80
108
 
81
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
82
110
        --param make.year.ranges                1 \
94
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
95
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
96
124
        plugins.d/plymouth
97
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
98
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
99
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
100
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
227
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
228
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
229
258
 
230
 
.PHONY : all doc html clean distclean run-client run-server install \
231
 
        install-server install-client uninstall uninstall-server \
232
 
        uninstall-client purge purge-server purge-client
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
 
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
264
        check run-client run-server install install-html \
 
265
        install-server install-client-nokey install-client uninstall \
 
266
        uninstall-server uninstall-client purge purge-server \
 
267
        purge-client
233
268
 
234
269
clean:
235
270
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
250
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
251
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
252
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
253
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
254
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
255
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
256
 
        @echo "#                     seteuid: Operation not permitted            #"
257
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
258
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
259
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
260
298
                --config-file=plugin-runner.conf \
261
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
262
301
                $(CLIENTARGS)
263
302
 
264
303
# Used by run-client
279
318
        install --directory confdir
280
319
        install --mode=u=rw $< $@
281
320
# Add a client password
282
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
283
322
statedir:
284
323
        install --directory statedir
285
324
 
292
331
 
293
332
install-server: doc
294
333
        install --directory $(CONFDIR)
295
 
        install --directory --mode=u=rwx --owner=$(USER) \
296
 
                --group=$(GROUP) $(STATEDIR)
 
334
        if install --directory --mode=u=rwx --owner=$(USER) \
 
335
                --group=$(GROUP) $(STATEDIR); then \
 
336
                :; \
 
337
        elif install --directory --mode=u=rwx $(STATEDIR); then \
 
338
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
 
339
        fi
297
340
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
298
341
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
299
342
                mandos-ctl
307
350
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
308
351
        install --mode=u=rwx,go=rx init.d-mandos \
309
352
                $(DESTDIR)/etc/init.d/mandos
 
353
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
354
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
 
355
        fi
310
356
        install --mode=u=rw,go=r default-mandos \
311
357
                $(DESTDIR)/etc/default/mandos
312
358
        if [ -z $(DESTDIR) ]; then \
326
372
                > $(MANDIR)/man8/intro.8mandos.gz
327
373
 
328
374
install-client-nokey: all doc
329
 
        install --directory $(PREFIX)/lib/mandos $(CONFDIR)
 
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
330
376
        install --directory --mode=u=rwx $(KEYDIR) \
331
 
                $(PREFIX)/lib/mandos/plugins.d
332
 
        if [ "$(CONFDIR)" != "$(PREFIX)/lib/mandos" ]; then \
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
 
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
333
380
                install --mode=u=rwx \
334
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
335
383
        fi
336
384
        install --mode=u=rwx,go=rx --directory \
337
385
                "$(CONFDIR)/network-hooks.d"
338
386
        install --mode=u=rwx,go=rx \
339
 
                --target-directory=$(PREFIX)/lib/mandos plugin-runner
 
387
                --target-directory=$(LIBDIR)/mandos plugin-runner
340
388
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
341
389
                mandos-keygen
342
390
        install --mode=u=rwx,go=rx \
343
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
391
                --target-directory=$(LIBDIR)/mandos/plugins.d \
344
392
                plugins.d/password-prompt
345
393
        install --mode=u=rwxs,go=rx \
346
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
394
                --target-directory=$(LIBDIR)/mandos/plugins.d \
347
395
                plugins.d/mandos-client
348
396
        install --mode=u=rwxs,go=rx \
349
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
397
                --target-directory=$(LIBDIR)/mandos/plugins.d \
350
398
                plugins.d/usplash
351
399
        install --mode=u=rwxs,go=rx \
352
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
400
                --target-directory=$(LIBDIR)/mandos/plugins.d \
353
401
                plugins.d/splashy
354
402
        install --mode=u=rwxs,go=rx \
355
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
403
                --target-directory=$(LIBDIR)/mandos/plugins.d \
356
404
                plugins.d/askpass-fifo
357
405
        install --mode=u=rwxs,go=rx \
358
 
                --target-directory=$(PREFIX)/lib/mandos/plugins.d \
 
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
359
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
360
411
        install initramfs-tools-hook \
361
412
                $(INITRAMFSTOOLS)/hooks/mandos
362
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
407
458
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
408
459
                $(DESTDIR)/etc/crypttab
409
460
        -rm --force $(PREFIX)/sbin/mandos-keygen \
410
 
                $(PREFIX)/lib/mandos/plugin-runner \
411
 
                $(PREFIX)/lib/mandos/plugins.d/password-prompt \
412
 
                $(PREFIX)/lib/mandos/plugins.d/mandos-client \
413
 
                $(PREFIX)/lib/mandos/plugins.d/usplash \
414
 
                $(PREFIX)/lib/mandos/plugins.d/splashy \
415
 
                $(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
416
 
                $(PREFIX)/lib/mandos/plugins.d/plymouth \
 
461
                $(LIBDIR)/mandos/plugin-runner \
 
462
                $(LIBDIR)/mandos/plugins.d/password-prompt \
 
463
                $(LIBDIR)/mandos/plugins.d/mandos-client \
 
464
                $(LIBDIR)/mandos/plugins.d/usplash \
 
465
                $(LIBDIR)/mandos/plugins.d/splashy \
 
466
                $(LIBDIR)/mandos/plugins.d/askpass-fifo \
 
467
                $(LIBDIR)/mandos/plugins.d/plymouth \
417
468
                $(INITRAMFSTOOLS)/hooks/mandos \
418
469
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
419
470
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
425
476
                $(MANDIR)/man8/splashy.8mandos.gz \
426
477
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
427
478
                $(MANDIR)/man8/plymouth.8mandos.gz \
428
 
        -rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
429
 
                 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)
 
479
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
 
480
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
430
481
        update-initramfs -k all -u
431
482
 
432
483
purge: purge-server purge-client
436
487
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
437
488
                $(DESTDIR)/etc/default/mandos \
438
489
                $(DESTDIR)/etc/init.d/mandos \
439
 
                $(DESTDIR)/run/mandos.pid
 
490
                $(SYSTEMD)/mandos.service \
 
491
                $(DESTDIR)/run/mandos.pid \
 
492
                $(DESTDIR)/var/run/mandos.pid
440
493
        -rmdir $(CONFDIR)
441
494
 
442
495
purge-client: uninstall-client