/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2016-03-19 04:21:00 UTC
  • Revision ID: teddy@recompile.se-20160319042100-i581cfv65r934dnl
Client: Make plugin helper override directory mode u=rwx,go=

Even though it currently is not used, a local administrator might use
setuid (or setcap) executables as plugin helpers.  Thus, the plugin
helper override directory (/etc/mandos/plugin-helpers) must be
secured, just as the plugin override directory (/etc/mandos/plugins.d)
is.

* Makefile (install-client-nokey): Install plugin-helper directory as
                                   mode u=rwx.
* debian/mandos-client.lintian-overrides: Do not warn about
                               permissions on plugin helper directory.
* debian/mandos-client.postinst (configure): Fix permissions on plugin
  helper local override directory (/etc/mandos/plugin-helpers), but
  only if not listed by "dpkg-statoverride".

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
75
75
##
76
76
 
77
77
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
TMPFILES=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
78
79
 
79
80
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
80
81
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
337
338
        elif install --directory --mode=u=rwx $(STATEDIR); then \
338
339
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
339
340
        fi
 
341
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
342
                install --mode=u=rwx,go=r tmpfiles.d-mandos.conf \
 
343
                        $(TMPFILES)/mandos.conf; \
 
344
        fi
340
345
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
341
346
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
342
347
                mandos-ctl
378
383
                $(LIBDIR)/mandos/plugin-helpers
379
384
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
380
385
                install --mode=u=rwx \
381
 
                        --directory "$(CONFDIR)/plugins.d"; \
382
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
 
386
                        --directory "$(CONFDIR)/plugins.d" \
 
387
                        "$(CONFDIR)/plugin-helpers"; \
383
388
        fi
384
389
        install --mode=u=rwx,go=rx --directory \
385
390
                "$(CONFDIR)/network-hooks.d"
405
410
        install --mode=u=rwxs,go=rx \
406
411
                --target-directory=$(LIBDIR)/mandos/plugins.d \
407
412
                plugins.d/plymouth
408
 
        install --mode=u=rwxs,go=rx \
 
413
        install --mode=u=rwx,go=rx \
409
414
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
410
415
                plugin-helpers/mandos-client-iprouteadddel
411
416
        install initramfs-tools-hook \