/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-17 20:40:55 UTC
  • Revision ID: teddy@recompile.se-20160317204055-bhsh5xsidq7w5cxu
Client: Fix plymouth agent; broken since 1.7.2.

Fix an very old memory bug in the plymouth agent (which has been
present since its apperance in version 1.2), but which was only
recently detected at run time due to the new -fsanitize=address
compile- time flag, which has been used since version 1.7.2.  This
detection of a memory access violation causes the program to abort,
making the Plymouth graphical boot system unable to accept interactive
input of passwords when using the Mandos client.

* plugins.d/plymouth.c (exec_and_wait): Fix memory allocation bug when
  allocating new_argv.  Also tolerate a zero-length argv.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
1
 
WARN=-O -Wall -Wformat=2 -Winit-self -Wmissing-include-dirs \
2
 
        -Wswitch-default -Wswitch-enum -Wunused-parameter \
3
 
        -Wstrict-aliasing=1 -Wextra -Wfloat-equal -Wundef -Wshadow \
 
1
WARN=-O -Wall -Wextra -Wdouble-promotion -Wformat=2 -Winit-self \
 
2
        -Wmissing-include-dirs -Wswitch-default -Wswitch-enum \
 
3
        -Wunused -Wuninitialized -Wstrict-overflow=5 \
 
4
        -Wsuggest-attribute=pure -Wsuggest-attribute=const \
 
5
        -Wsuggest-attribute=noreturn -Wfloat-equal -Wundef -Wshadow \
4
6
        -Wunsafe-loop-optimizations -Wpointer-arith \
5
7
        -Wbad-function-cast -Wcast-qual -Wcast-align -Wwrite-strings \
6
 
        -Wconversion -Wstrict-prototypes -Wold-style-definition \
7
 
        -Wpacked -Wnested-externs -Winline -Wvolatile-register-var \
8
 
        -Wunreachable-code
 
8
        -Wconversion -Wlogical-op -Waggregate-return \
 
9
        -Wstrict-prototypes -Wold-style-definition \
 
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
 
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
 
12
        -Wvolatile-register-var -Woverlength-strings
9
13
#DEBUG=-ggdb3
10
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
11
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
12
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
 
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
 
18
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
 
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
 
20
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
 
21
        -fsanitize=return -fsanitize=signed-integer-overflow \
 
22
        -fsanitize=bounds -fsanitize=alignment \
 
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
 
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
 
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
13
31
LINK_FORTIFY_LD=-z relro -z now
14
32
LINK_FORTIFY=
15
33
 
20
38
endif
21
39
#COVERAGE=--coverage
22
40
OPTIMIZE=-Os -fno-strict-aliasing
23
 
LANGUAGE=-std=gnu99
 
41
LANGUAGE=-std=gnu11
24
42
htmldir=man
25
 
version=1.6.4
 
43
version=1.7.6
26
44
SED=sed
27
45
 
28
46
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
29
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
 
47
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
30
48
 
31
49
## Use these settings for a traditional /usr/local install
32
50
# PREFIX=$(DESTDIR)/usr/local
65
83
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
66
84
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
67
85
        getconf LFS_LDFLAGS)
 
86
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
87
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
68
88
 
69
89
# Do not change these two
70
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
71
 
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
72
 
        -DVERSION='"$(version)"'
 
90
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
91
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
 
92
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
73
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
74
94
 
75
95
# Commands to format a DocBook <refentry> document into a manual page
81
101
        --param man.authors.section.enabled     0 \
82
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
83
103
        $(notdir $<); \
84
 
        $(MANPOST) $(notdir $@);\
85
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
86
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
87
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
88
107
        fi >/dev/null)
89
 
# DocBook-to-man post-processing to fix a '\n' escape bug
90
 
MANPOST=$(SED) --in-place --expression='s,\\\\en,\\en,g;s,\\n,\\en,g'
91
108
 
92
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
93
110
        --param make.year.ranges                1 \
105
122
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
106
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
107
124
        plugins.d/plymouth
108
 
CPROGS=plugin-runner $(PLUGINS)
 
125
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
 
126
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
109
127
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
110
128
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
111
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
238
256
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
239
257
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
240
258
 
 
259
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
260
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
261
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
262
 
241
263
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
242
264
        check run-client run-server install install-html \
243
265
        install-server install-client-nokey install-client uninstall \
263
285
        @echo "# ignored.  The messages are caused by not running as root, but   #"
264
286
        @echo "# you should NOT run \"make run-client\" as root unless you also    #"
265
287
        @echo "# unpacked and compiled Mandos as root, which is NOT recommended. #"
266
 
        @echo "# From plugin-runner: setuid: Operation not permitted             #"
 
288
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
289
        @echo "#                     setuid: Operation not permitted             #"
267
290
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
268
 
        @echo "# From mandos-client: setuid: Operation not permitted             #"
269
 
        @echo "#                     seteuid: Operation not permitted            #"
270
 
        @echo "#                     klogctl: Operation not permitted            #"
 
291
        @echo "# From mandos-client:                                             #"
 
292
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
293
        @echo "#             Warning: network hook \"*\" exited with status *      #"
271
294
        @echo "###################################################################"
 
295
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
272
296
        ./plugin-runner --plugin-dir=plugins.d \
 
297
                --plugin-helper-dir=plugin-helpers \
273
298
                --config-file=plugin-runner.conf \
274
299
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
 
300
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
275
301
                $(CLIENTARGS)
276
302
 
277
303
# Used by run-client
292
318
        install --directory confdir
293
319
        install --mode=u=rw $< $@
294
320
# Add a client password
295
 
        ./mandos-keygen --dir keydir --password >> $@
 
321
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
296
322
statedir:
297
323
        install --directory statedir
298
324
 
348
374
install-client-nokey: all doc
349
375
        install --directory $(LIBDIR)/mandos $(CONFDIR)
350
376
        install --directory --mode=u=rwx $(KEYDIR) \
351
 
                $(LIBDIR)/mandos/plugins.d
 
377
                $(LIBDIR)/mandos/plugins.d \
 
378
                $(LIBDIR)/mandos/plugin-helpers
352
379
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
353
380
                install --mode=u=rwx \
354
381
                        --directory "$(CONFDIR)/plugins.d"; \
 
382
                install --directory "$(CONFDIR)/plugin-helpers"; \
355
383
        fi
356
384
        install --mode=u=rwx,go=rx --directory \
357
385
                "$(CONFDIR)/network-hooks.d"
377
405
        install --mode=u=rwxs,go=rx \
378
406
                --target-directory=$(LIBDIR)/mandos/plugins.d \
379
407
                plugins.d/plymouth
 
408
        install --mode=u=rwxs,go=rx \
 
409
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
 
410
                plugin-helpers/mandos-client-iprouteadddel
380
411
        install initramfs-tools-hook \
381
412
                $(INITRAMFSTOOLS)/hooks/mandos
382
413
        install --mode=u=rw,go=r initramfs-tools-hook-conf \