/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.xml

  • Committer: Teddy Hogeborn
  • Date: 2018-08-15 09:18:22 UTC
  • Revision ID: teddy@recompile.se-20180815091822-tmmqryi0gqnzq6ab
mandos: Better error message if self-signature verification fails

* mandos (ClientHandler.fingerprint): If the verification of the
  self-signature fails, report the actual error message instead of a
  generic message.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "plugin-runner">
6
 
<!ENTITY TIMESTAMP "2008-09-05">
 
5
<!ENTITY TIMESTAMP "2018-02-08">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- Nwalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
 
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
34
45
      <holder>Teddy Hogeborn</holder>
35
46
      <holder>Björn Påhlsson</holder>
36
47
    </copyright>
37
48
    <xi:include href="legalnotice.xml"/>
38
49
  </refentryinfo>
39
 
 
 
50
  
40
51
  <refmeta>
41
52
    <refentrytitle>&COMMANDNAME;</refentrytitle>
42
53
    <manvolnum>8mandos</manvolnum>
48
59
      Run Mandos plugins, pass data from first to succeed.
49
60
    </refpurpose>
50
61
  </refnamediv>
51
 
 
 
62
  
52
63
  <refsynopsisdiv>
53
64
    <cmdsynopsis>
54
65
      <command>&COMMANDNAME;</command>
55
66
      <group rep="repeat">
56
67
        <arg choice="plain"><option>--global-env=<replaceable
57
 
        >VAR</replaceable><literal>=</literal><replaceable
 
68
        >ENV</replaceable><literal>=</literal><replaceable
58
69
        >value</replaceable></option></arg>
59
70
        <arg choice="plain"><option>-G
60
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
71
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
61
72
        >value</replaceable> </option></arg>
62
73
      </group>
63
74
      <sbr/>
111
122
      <arg><option>--plugin-dir=<replaceable
112
123
      >DIRECTORY</replaceable></option></arg>
113
124
      <sbr/>
 
125
      <arg><option>--plugin-helper-dir=<replaceable
 
126
      >DIRECTORY</replaceable></option></arg>
 
127
      <sbr/>
114
128
      <arg><option>--config-file=<replaceable
115
129
      >FILE</replaceable></option></arg>
116
130
      <sbr/>
170
184
    <variablelist>
171
185
      <varlistentry>
172
186
        <term><option>--global-env
173
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
187
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
174
188
        >value</replaceable></option></term>
175
189
        <term><option>-G
176
 
        <replaceable>VAR</replaceable><literal>=</literal><replaceable
 
190
        <replaceable>ENV</replaceable><literal>=</literal><replaceable
177
191
        >value</replaceable></option></term>
178
192
        <listitem>
179
193
          <para>
247
261
          </para>
248
262
        </listitem>
249
263
      </varlistentry>
250
 
 
 
264
      
251
265
      <varlistentry>
252
266
        <term><option>--disable
253
267
        <replaceable>PLUGIN</replaceable></option></term>
258
272
            Disable the plugin named
259
273
            <replaceable>PLUGIN</replaceable>.  The plugin will not be
260
274
            started.
261
 
          </para>       
 
275
          </para>
262
276
        </listitem>
263
277
      </varlistentry>
264
 
 
 
278
      
265
279
      <varlistentry>
266
280
        <term><option>--enable
267
281
        <replaceable>PLUGIN</replaceable></option></term>
276
290
          </para>
277
291
        </listitem>
278
292
      </varlistentry>
279
 
 
 
293
      
280
294
      <varlistentry>
281
295
        <term><option>--groupid
282
296
        <replaceable>ID</replaceable></option></term>
289
303
          </para>
290
304
        </listitem>
291
305
      </varlistentry>
292
 
 
 
306
      
293
307
      <varlistentry>
294
308
        <term><option>--userid
295
309
        <replaceable>ID</replaceable></option></term>
302
316
          </para>
303
317
        </listitem>
304
318
      </varlistentry>
305
 
 
 
319
      
306
320
      <varlistentry>
307
321
        <term><option>--plugin-dir
308
322
        <replaceable>DIRECTORY</replaceable></option></term>
317
331
      </varlistentry>
318
332
      
319
333
      <varlistentry>
 
334
        <term><option>--plugin-helper-dir
 
335
        <replaceable>DIRECTORY</replaceable></option></term>
 
336
        <listitem>
 
337
          <para>
 
338
            Specify a different plugin helper directory.  The default
 
339
            is <filename>/lib/mandos/plugin-helpers</filename>, which
 
340
            will exist in the initial <acronym>RAM</acronym> disk
 
341
            environment.  (This will simply be passed to all plugins
 
342
            via the <envar>MANDOSPLUGINHELPERDIR</envar> environment
 
343
            variable.  See <xref linkend="writing_plugins"/>)
 
344
          </para>
 
345
        </listitem>
 
346
      </varlistentry>
 
347
      
 
348
      <varlistentry>
320
349
        <term><option>--config-file
321
350
        <replaceable>FILE</replaceable></option></term>
322
351
        <listitem>
365
394
          </para>
366
395
        </listitem>
367
396
      </varlistentry>
368
 
 
 
397
      
369
398
      <varlistentry>
370
399
        <term><option>--version</option></term>
371
400
        <term><option>-V</option></term>
377
406
      </varlistentry>
378
407
    </variablelist>
379
408
  </refsect1>
380
 
 
 
409
  
381
410
  <refsect1 id="overview">
382
411
    <title>OVERVIEW</title>
383
412
    <xi:include href="overview.xml"/>
403
432
      code will make this plugin-runner output the password from that
404
433
      plugin, stop any other plugins, and exit.
405
434
    </para>
406
 
 
 
435
    
407
436
    <refsect2 id="writing_plugins">
408
437
      <title>WRITING PLUGINS</title>
409
438
      <para>
416
445
        console.
417
446
      </para>
418
447
      <para>
 
448
        If the password is a single-line, manually entered passprase,
 
449
        a final trailing newline character should
 
450
        <emphasis>not</emphasis> be printed.
 
451
      </para>
 
452
      <para>
419
453
        The plugin will run in the initial RAM disk environment, so
420
454
        care must be taken not to depend on any files or running
421
 
        services not available there.
 
455
        services not available there.  Any helper executables required
 
456
        by the plugin (which are not in the <envar>PATH</envar>) can
 
457
        be placed in the plugin helper directory, the name of which
 
458
        will be made available to the plugin via the
 
459
        <envar>MANDOSPLUGINHELPERDIR</envar> environment variable.
422
460
      </para>
423
461
      <para>
424
462
        The plugin must exit cleanly and free all allocated resources
467
505
      only passes on its environment to all the plugins.  The
468
506
      environment passed to plugins can be modified using the
469
507
      <option>--global-env</option> and <option>--env-for</option>
470
 
      options.
 
508
      options.  Also, the <option>--plugin-helper-dir</option> option
 
509
      will affect the environment variable
 
510
      <envar>MANDOSPLUGINHELPERDIR</envar> for the plugins.
471
511
    </para>
472
512
  </refsect1>
473
513
  
506
546
            </para>
507
547
          </listitem>
508
548
        </varlistentry>
 
549
        <varlistentry>
 
550
          <term><filename class="directory"
 
551
          >/lib/mandos/plugins.d</filename></term>
 
552
          <listitem>
 
553
            <para>
 
554
              The default plugin directory; can be changed by the
 
555
              <option>--plugin-dir</option> option.
 
556
            </para>
 
557
          </listitem>
 
558
        </varlistentry>
 
559
        <varlistentry>
 
560
          <term><filename class="directory"
 
561
          >/lib/mandos/plugin-helpers</filename></term>
 
562
          <listitem>
 
563
            <para>
 
564
              The default plugin helper directory; can be changed by
 
565
              the <option>--plugin-helper-dir</option> option.
 
566
            </para>
 
567
          </listitem>
 
568
        </varlistentry>
509
569
      </variablelist>
510
570
    </para>
511
571
  </refsect1>
516
576
      The <option>--config-file</option> option is ignored when
517
577
      specified from within a configuration file.
518
578
    </para>
 
579
    <xi:include href="bugs.xml"/>
519
580
  </refsect1>
520
581
  
521
582
  <refsect1 id="examples">
564
625
    </informalexample>
565
626
    <informalexample>
566
627
      <para>
567
 
        Run plugins from a different directory, read a different
568
 
        configuration file, and add two options to the
569
 
        <citerefentry><refentrytitle >password-request</refentrytitle>
 
628
        Read a different configuration file, run plugins from a
 
629
        different directory, specify an alternate plugin helper
 
630
        directory and add two options to the
 
631
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
570
632
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
571
633
      </para>
572
634
      <para>
573
635
 
574
636
<!-- do not wrap this line -->
575
 
<userinput>&COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=password-request:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt</userinput>
 
637
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
576
638
 
577
639
      </para>
578
640
    </informalexample>
586
648
      non-privileged.  This user and group is then what all plugins
587
649
      will be started as.  Therefore, the only way to run a plugin as
588
650
      a privileged user is to have the set-user-ID or set-group-ID bit
589
 
      set on the plugin executable files (see <citerefentry>
 
651
      set on the plugin executable file (see <citerefentry>
590
652
      <refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
591
653
      </citerefentry>).
592
654
    </para>
610
672
  <refsect1 id="see_also">
611
673
    <title>SEE ALSO</title>
612
674
    <para>
 
675
      <citerefentry><refentrytitle>intro</refentrytitle>
 
676
      <manvolnum>8mandos</manvolnum></citerefentry>,
613
677
      <citerefentry><refentrytitle>cryptsetup</refentrytitle>
614
678
      <manvolnum>8</manvolnum></citerefentry>,
615
679
      <citerefentry><refentrytitle>crypttab</refentrytitle>
620
684
      <manvolnum>8</manvolnum></citerefentry>,
621
685
      <citerefentry><refentrytitle>password-prompt</refentrytitle>
622
686
      <manvolnum>8mandos</manvolnum></citerefentry>,
623
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
687
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
624
688
      <manvolnum>8mandos</manvolnum></citerefentry>
625
689
    </para>
626
690
  </refsect1>