/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2019-02-09 23:23:26 UTC
  • Revision ID: teddy@recompile.se-20190209232326-z1z2kzpgfixz7iaj
Add support for using raw public keys in TLS (RFC 7250)

Since GnuTLS removed support for OpenPGP keys in TLS (RFC 6091), and
no other library supports it, we have to change the protocol to use
something else.  We choose to use "raw public keys" (RFC 7250).  Since
we still use OpenPGP keys to decrypt the secret password, this means
that each client will have two keys: One OpenPGP key and one TLS
public/private key, and the key ID of the latter key is used to
identify clients instead of the fingerprint of the OpenPGP key.

Note that this code is still compatible with GnuTLS before version
3.6.0 (when OpenPGP key support was removed).  This commit merely adds
support for using raw pulic keys instead with GnuTLS 3.6.6. or later.

* DBUS-API (Signals/ClientNotFound): Change name of first parameter
                                     from "Fingerprint" to "KeyID".
  (Mandos Client Interface/Properties/KeyID): New.
* INSTALL: Document conflict with GnuTLS 3.6.0 (which removed OpenPGP
           key support) up until 3.6.6, when support for raw public
           keys was added.  Also document new dependency of client on
           "gnutls-bin" package (for certtool).
* Makefile (run-client): Depend on TLS key files, and also pass them
                         as arguments to client.
  (keydir/tls-privkey.pem, keydir/tls-pubkey.pem): New.
  (confdir/clients.conf): Add dependency on TLS public key.
  (purge-client): Add removal of TLS key files.
* clients.conf ([foo]/key_id, [bar]/key_id): New.
* debian/control (Source: mandos/Build-Depends): Also allow
                                                 libgnutls30 (>= 3.6.6)
  (Package: mandos/Depends): - '' -
  (Package: mandos/Description): Alter description to match new
                                 design.
  (Package: mandos-client/Description): - '' -
  (Package: mandos-client/Depends): Move "gnutls-bin | openssl" to
                                    here from "Recommends".
* debian/mandos-client.README.Debian: Add --tls-privkey and
                                      --tls-pubkey options to test
                                      command.
* debian/mandos-client.postinst (create_key): Renamed to "create_keys"
                                             (all callers changed),
                                             and also create TLS key.
* debian/mandos-client.postrm (purge): Also remove TLS key files.
* intro.xml (DESCRIPTION): Describe new dual-key design.
* mandos (GnuTLS): Define different functions depending on whether
                   support for raw public keys is detected.
  (Client.key_id): New attribute.
  (ClientDBus.KeyID_dbus_property): New method.
  (ProxyClient.__init__): Take new "key_id" parameter.
  (ClientHandler.handle): Use key IDs when using raw public keys and
                          use fingerprints when using OpenPGP keys.
  (ClientHandler.peer_certificate): Also handle raw public keys.
  (ClientHandler.key_id): New.
  (MandosServer.handle_ipc): Pass key ID over the pipe IPC.  Also
                             check for key ID matches when looking up
                             clients.
  (main): Default GnuTLS priority string depends on whether we are
          using raw public keys or not.  When unpickling clients, set
          key_id if not set in the pickle.
  (main/MandosDBusService.ClientNotFound): Change name of first
                                           parameter from
                                           "Fingerprint" to "KeyID".
* mandos-clients.conf.xml (OPTIONS): Document new "key_id" option.
  (OPTIONS/secret): Mention new key ID matchning.
  (EXPANSION/RUNTIME EXPANSION): Add new "key_id" option.
  (EXAMPLE): - '' -
* mandos-ctl (tablewords, main/keywords): Add new "KeyID" property.
* mandos-keygen: Create TLS key files.  New "--tls-keytype" (-T)
                 option.  Alter help text to be more clear about key
                 types.  When in password mode, also output "key_id"
                 option.
* mandos-keygen.xml (SYNOPSIS): Add new "--tls-keytype" (-T) option.
  (DESCRIPTION): Alter to match new dual-key design.
  (OVERVIEW): - '' -
  (FILES): Add TLS key files.
* mandos-options.xml (priority): Document new default priority string
                                 when using raw public keys.
* mandos.xml (NETWORK PROTOCOL): Describe new protocol using key ID.
  (BUGS): Remove issue about checking expire times of OpenPGP keys,
          since TLS public keys do not have expiration times.
  (SECURITY/CLIENT): Alter description to match new design.
  (SEE ALSO/GnuTLS): - '' -
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.
* overview.xml: Alter text to match new design.
* plugin-runner.xml (EXAMPLE): Add --tls-pubkey and --tls-privkey
                               options to mandos-client options.
* plugins.d/mandos-client.c: Use raw public keys when compiling with
                             supporting GnuTLS versions. Add new
                             "--tls-pubkey" and "--tls-privkey"
                             options (which do nothing if GnuTLS
                             library does not support raw public
                             keys).  Alter text throughout to reflect
                             new design.  Only generate new DH
                             parameters (based on size of OpenPGP key)
                             when using OpenPGP in TLS.  Default
                             GnuTLS priority string depends on whether
                             we are using raw public keys or not.
* plugins.d/mandos-client.xml (SYNOPSIS): Add new "--tls-privkey" (-t)
                                          and "--tls-pubkey" (-T)
                                          options.
  (DESCRIPTION): Describe new dual-key design.
  (OPTIONS): Document new "--tls-privkey" (-t) and "--tls-pubkey" (-T)
             options.
  (OPTIONS/--dh-bits): No longer necessarily depends on OpenPGP key
                       size.
  (FILES): Add default locations for TLS public and private key files.
  (EXAMPLE): Use new --tls-pubkey and --tls-privkey options.
  (SECURITY): Alter wording slightly to reflect new dual-key design.
  (SEE ALSO/GnuTLS): Alter description to match new design.
  (SEE ALSO): Add reference to RFC 7250, and alter description of when
              RFC 6091 is used.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
10
10
        -Wmissing-format-attribute -Wnormalized=nfc -Wpacked \
11
11
        -Wredundant-decls -Wnested-externs -Winline -Wvla \
12
12
        -Wvolatile-register-var -Woverlength-strings
13
 
 
14
 
#DEBUG:=-ggdb3 -fsanitize=address $(SANITIZE)
15
 
## Check which sanitizing options can be used
16
 
#SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
17
 
#       echo 'int main(){}' | $(CC) --language=c $(option) \
18
 
#       /dev/stdin -o /dev/null >/dev/null 2>&1 && echo $(option)))
 
13
#DEBUG:=-ggdb3 -fsanitize=address 
 
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
 
15
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
 
16
FORTIFY:=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
19
17
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
20
18
ALL_SANITIZE_OPTIONS:=-fsanitize=leak -fsanitize=undefined \
21
19
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
25
23
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
26
24
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
27
25
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
28
 
        -fsanitize=enum -fsanitize-address-use-after-scope
29
 
 
30
 
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
31
 
# and <https://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
32
 
FORTIFY:=-fstack-protector-all -fPIC
33
 
CPPFLAGS+=-D_FORTIFY_SOURCE=3
 
26
        -fsanitize=enum
 
27
# Check which sanitizing options can be used
 
28
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
 
29
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
 
30
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
34
31
LINK_FORTIFY_LD:=-z relro -z now
35
32
LINK_FORTIFY:=
36
33
 
42
39
#COVERAGE=--coverage
43
40
OPTIMIZE:=-Os -fno-strict-aliasing
44
41
LANGUAGE:=-std=gnu11
45
 
CPPFLAGS+=-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64
46
42
htmldir:=man
47
 
version:=1.8.17
 
43
version:=1.7.20
48
44
SED:=sed
49
 
PKG_CONFIG?=pkg-config
50
 
 
51
 
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos \
52
 
        || getent passwd nobody || echo 65534)))
53
 
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos \
54
 
        || getent group nogroup || echo 65534)))
55
 
 
56
 
LINUXVERSION:=$(shell uname --kernel-release)
 
45
 
 
46
USER:=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
 
47
GROUP:=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
57
48
 
58
49
## Use these settings for a traditional /usr/local install
59
50
# PREFIX:=$(DESTDIR)/usr/local
60
 
# BINDIR:=$(PREFIX)/sbin
61
51
# CONFDIR:=$(DESTDIR)/etc/mandos
62
52
# KEYDIR:=$(DESTDIR)/etc/mandos/keys
63
53
# MANDIR:=$(PREFIX)/man
64
54
# INITRAMFSTOOLS:=$(DESTDIR)/etc/initramfs-tools
65
 
# DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
66
55
# STATEDIR:=$(DESTDIR)/var/lib/mandos
67
56
# LIBDIR:=$(PREFIX)/lib
68
 
# DBUSPOLICYDIR:=$(DESTDIR)/etc/dbus-1/system.d
69
57
##
70
58
 
71
59
## These settings are for a package-type install
72
60
PREFIX:=$(DESTDIR)/usr
73
 
BINDIR:=$(PREFIX)/sbin
74
61
CONFDIR:=$(DESTDIR)/etc/mandos
75
62
KEYDIR:=$(DESTDIR)/etc/keys/mandos
76
63
MANDIR:=$(PREFIX)/share/man
77
64
INITRAMFSTOOLS:=$(DESTDIR)/usr/share/initramfs-tools
78
 
DRACUTMODULE:=$(DESTDIR)/usr/lib/dracut/modules.d/90mandos
79
65
STATEDIR:=$(DESTDIR)/var/lib/mandos
80
66
LIBDIR:=$(shell \
81
67
        for d in \
82
 
        "/usr/lib/`dpkg-architecture \
83
 
                        -qDEB_HOST_MULTIARCH 2>/dev/null`" \
 
68
        "/usr/lib/`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`" \
84
69
        "`rpm --eval='%{_libdir}' 2>/dev/null`" /usr/lib; do \
85
70
                if [ -d "$$d" -a "$$d" = "$${d%/}" ]; then \
86
71
                        echo "$(DESTDIR)$$d"; \
87
72
                        break; \
88
73
                fi; \
89
74
        done)
90
 
DBUSPOLICYDIR:=$(DESTDIR)/usr/share/dbus-1/system.d
91
75
##
92
76
 
93
 
SYSTEMD:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
94
 
                        --variable=systemdsystemunitdir)
95
 
TMPFILES:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
96
 
                        --variable=tmpfilesdir)
97
 
SYSUSERS:=$(DESTDIR)$(shell $(PKG_CONFIG) systemd \
98
 
                        --variable=sysusersdir)
 
77
SYSTEMD:=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
 
78
TMPFILES:=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
99
79
 
100
 
GNUTLS_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gnutls)
101
 
GNUTLS_LIBS:=$(shell $(PKG_CONFIG) --libs gnutls)
102
 
AVAHI_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I avahi-core)
103
 
AVAHI_LIBS:=$(shell $(PKG_CONFIG) --libs avahi-core)
104
 
GPGME_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I gpgme 2>/dev/null \
105
 
        || gpgme-config --cflags; getconf LFS_CFLAGS)
106
 
GPGME_LIBS:=$(shell $(PKG_CONFIG) --libs gpgme 2>/dev/null \
107
 
        || gpgme-config --libs; getconf LFS_LIBS; \
 
80
GNUTLS_CFLAGS:=$(shell pkg-config --cflags-only-I gnutls)
 
81
GNUTLS_LIBS:=$(shell pkg-config --libs gnutls)
 
82
AVAHI_CFLAGS:=$(shell pkg-config --cflags-only-I avahi-core)
 
83
AVAHI_LIBS:=$(shell pkg-config --libs avahi-core)
 
84
GPGME_CFLAGS:=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
 
85
GPGME_LIBS:=$(shell gpgme-config --libs; getconf LFS_LIBS; \
108
86
        getconf LFS_LDFLAGS)
109
 
LIBNL3_CFLAGS:=$(shell $(PKG_CONFIG) --cflags-only-I libnl-route-3.0)
110
 
LIBNL3_LIBS:=$(shell $(PKG_CONFIG) --libs libnl-route-3.0)
111
 
GLIB_CFLAGS:=$(shell $(PKG_CONFIG) --cflags glib-2.0)
112
 
GLIB_LIBS:=$(shell $(PKG_CONFIG) --libs glib-2.0)
 
87
LIBNL3_CFLAGS:=$(shell pkg-config --cflags-only-I libnl-route-3.0)
 
88
LIBNL3_LIBS:=$(shell pkg-config --libs libnl-route-3.0)
113
89
 
114
90
# Do not change these two
115
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
116
 
        $(LANGUAGE) -DVERSION='"$(version)"'
117
 
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(strip \
118
 
        ) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
 
91
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
 
92
        $(OPTIMIZE) $(LANGUAGE) -DVERSION='"$(version)"'
 
93
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
119
94
 
120
95
# Commands to format a DocBook <refentry> document into a manual page
121
96
DOCBOOKTOMAN=$(strip cd $(dir $<); xsltproc --nonet --xinclude \
127
102
        /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
128
103
        $(notdir $<); \
129
104
        if locale --all 2>/dev/null | grep --regexp='^en_US\.utf8$$' \
130
 
        && command -v man >/dev/null; then LANG=en_US.UTF-8 \
131
 
        MANWIDTH=80 man --warnings --encoding=UTF-8 --local-file \
132
 
        $(notdir $@); fi >/dev/null)
 
105
        && type man 2>/dev/null; then LANG=en_US.UTF-8 MANWIDTH=80 \
 
106
        man --warnings --encoding=UTF-8 --local-file $(notdir $@); \
 
107
        fi >/dev/null)
133
108
 
134
109
DOCBOOKTOHTML=$(strip xsltproc --nonet --xinclude \
135
110
        --param make.year.ranges                1 \
148
123
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
149
124
        plugins.d/plymouth
150
125
PLUGIN_HELPERS:=plugin-helpers/mandos-client-iprouteadddel
151
 
CPROGS:=plugin-runner dracut-module/password-agent $(PLUGINS) \
152
 
        $(PLUGIN_HELPERS)
 
126
CPROGS:=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
153
127
PROGS:=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
154
128
DOCS:=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
155
129
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
156
 
        dracut-module/password-agent.8mandos \
157
130
        plugins.d/mandos-client.8mandos \
158
131
        plugins.d/password-prompt.8mandos plugins.d/usplash.8mandos \
159
132
        plugins.d/splashy.8mandos plugins.d/askpass-fifo.8mandos \
163
136
 
164
137
objects:=$(addsuffix .o,$(CPROGS))
165
138
 
166
 
.PHONY: all
167
139
all: $(PROGS) mandos.lsm
168
140
 
169
 
.PHONY: doc
170
141
doc: $(DOCS)
171
142
 
172
 
.PHONY: html
173
143
html: $(htmldocs)
174
144
 
175
145
%.5: %.xml common.ent legalnotice.xml
234
204
                overview.xml legalnotice.xml
235
205
        $(DOCBOOKTOHTML)
236
206
 
237
 
dracut-module/password-agent.8mandos: \
238
 
                dracut-module/password-agent.xml common.ent \
239
 
                overview.xml legalnotice.xml
240
 
        $(DOCBOOKTOMAN)
241
 
dracut-module/password-agent.8mandos.xhtml: \
242
 
                dracut-module/password-agent.xml common.ent \
243
 
                overview.xml legalnotice.xml
244
 
        $(DOCBOOKTOHTML)
245
 
 
246
207
plugins.d/mandos-client.8mandos: plugins.d/mandos-client.xml \
247
208
                                        common.ent \
248
209
                                        mandos-options.xml \
291
252
                --expression='s/\(mandos_\)[0-9.]\+\(\.orig\.tar\.gz\)/\1$(version)\2/' \
292
253
                $@)
293
254
 
294
 
# Does the linker support the --no-warn-execstack option?
295
 
ifeq ($(shell echo 'int main(){}'|$(CC) --language=c /dev/stdin -o /dev/null -Xlinker --no-warn-execstack >/dev/null 2>&1 && echo yes),yes)
296
 
# These programs use nested functions, which uses an executable stack
297
 
plugin-runner: LDFLAGS += -Xlinker --no-warn-execstack
298
 
dracut-module/password-agent: LDFLAGS += -Xlinker --no-warn-execstack
299
 
plugins.d/password-prompt: LDFLAGS += -Xlinker --no-warn-execstack
300
 
plugins.d/mandos-client: LDFLAGS += -Xlinker --no-warn-execstack
301
 
plugins.d/plymouth: LDFLAGS += -Xlinker --no-warn-execstack
302
 
endif
303
 
 
304
 
# Need to add the GnuTLS, Avahi and GPGME libraries
305
 
plugins.d/mandos-client: CFLAGS += $(GNUTLS_CFLAGS) $(strip \
306
 
        ) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
307
 
plugins.d/mandos-client: LDLIBS += $(GNUTLS_LIBS) $(strip \
308
 
        ) $(AVAHI_LIBS) $(GPGME_LIBS)
309
 
 
310
 
# Need to add the libnl-route library
311
 
plugin-helpers/mandos-client-iprouteadddel: CFLAGS += $(LIBNL3_CFLAGS)
312
 
plugin-helpers/mandos-client-iprouteadddel: LDLIBS += $(LIBNL3_LIBS)
313
 
 
314
 
# Need to add the GLib and pthread libraries
315
 
dracut-module/password-agent: CFLAGS += $(GLIB_CFLAGS)
316
 
# Note: -lpthread is unnecessary with the GNU C library 2.34 or later
317
 
dracut-module/password-agent: LDLIBS += $(GLIB_LIBS) -lpthread
318
 
 
319
 
.PHONY: clean
 
255
# Need to add the GnuTLS, Avahi and GPGME libraries, and can't use
 
256
# -fsanitize=leak because GnuTLS and GPGME both leak memory.
 
257
plugins.d/mandos-client: plugins.d/mandos-client.c
 
258
        $(CC) $(filter-out -fsanitize=leak,$(CFLAGS)) $(strip\
 
259
        ) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) $(strip\
 
260
                ) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) $^ $(strip\
 
261
                ) -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
 
262
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
 
263
 
 
264
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
 
265
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
 
266
                ) $(LOADLIBES) $(LDLIBS) -o $@
 
267
 
 
268
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
 
269
        check run-client run-server install install-html \
 
270
        install-server install-client-nokey install-client uninstall \
 
271
        uninstall-server uninstall-client purge purge-server \
 
272
        purge-client
 
273
 
320
274
clean:
321
275
        -rm --force $(CPROGS) $(objects) $(htmldocs) $(DOCS) core
322
276
 
323
 
.PHONY: distclean
324
277
distclean: clean
325
 
.PHONY: mostlyclean
326
278
mostlyclean: clean
327
 
.PHONY: maintainer-clean
328
279
maintainer-clean: clean
329
280
        -rm --force --recursive keydir confdir statedir
330
281
 
331
 
.PHONY: check
332
 
check: all
 
282
check:  all
333
283
        ./mandos --check
334
284
        ./mandos-ctl --check
335
 
        ./mandos-keygen --version
336
 
        ./plugin-runner --version
337
 
        ./plugin-helpers/mandos-client-iprouteadddel --version
338
 
        ./dracut-module/password-agent --test
339
285
 
340
286
# Run the client with a local config and key
341
 
.PHONY: run-client
342
 
run-client: all keydir/seckey.txt keydir/pubkey.txt \
343
 
                        keydir/tls-privkey.pem keydir/tls-pubkey.pem
344
 
        @echo '######################################################'
345
 
        @echo '# The following error messages are harmless and can  #'
346
 
        @echo '#  be safely ignored:                                #'
347
 
        @echo '## From plugin-runner:                               #'
348
 
        @echo '# setgid: Operation not permitted                    #'
349
 
        @echo '# setuid: Operation not permitted                    #'
350
 
        @echo '## From askpass-fifo:                                #'
351
 
        @echo '# mkfifo: Permission denied                          #'
352
 
        @echo '## From mandos-client:                               #'
353
 
        @echo '# Failed to raise privileges: Operation not permi... #'
354
 
        @echo '# Warning: network hook "*" exited with status *     #'
355
 
        @echo '# ioctl SIOCSIFFLAGS +IFF_UP: Operation not permi... #'
356
 
        @echo '# Failed to bring up interface "*": Operation not... #'
357
 
        @echo '#                                                    #'
358
 
        @echo '# (The messages are caused by not running as root,   #'
359
 
        @echo '# but you should NOT run "make run-client" as root   #'
360
 
        @echo '# unless you also unpacked and compiled Mandos as    #'
361
 
        @echo '# root, which is also NOT recommended.)              #'
362
 
        @echo '######################################################'
 
287
run-client: all keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem
 
288
        @echo "###################################################################"
 
289
        @echo "# The following error messages are harmless and can be safely     #"
 
290
        @echo "# ignored:                                                        #"
 
291
        @echo "# From plugin-runner: setgid: Operation not permitted             #"
 
292
        @echo "#                     setuid: Operation not permitted             #"
 
293
        @echo "# From askpass-fifo:  mkfifo: Permission denied                   #"
 
294
        @echo "# From mandos-client:                                             #"
 
295
        @echo "#             Failed to raise privileges: Operation not permitted #"
 
296
        @echo "#             Warning: network hook \"*\" exited with status *      #"
 
297
        @echo "#                                                                 #"
 
298
        @echo "# (The messages are caused by not running as root, but you should #"
 
299
        @echo "# NOT run \"make run-client\" as root unless you also unpacked and  #"
 
300
        @echo "# compiled Mandos as root, which is also NOT recommended.)        #"
 
301
        @echo "###################################################################"
363
302
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
364
303
        ./plugin-runner --plugin-dir=plugins.d \
365
304
                --plugin-helper-dir=plugin-helpers \
372
311
keydir/seckey.txt keydir/pubkey.txt keydir/tls-privkey.pem keydir/tls-pubkey.pem: mandos-keygen
373
312
        install --directory keydir
374
313
        ./mandos-keygen --dir keydir --force
375
 
        if ! [ -e keydir/tls-privkey.pem ]; then \
376
 
                install --mode=u=rw /dev/null keydir/tls-privkey.pem; \
377
 
        fi
378
 
        if ! [ -e keydir/tls-pubkey.pem ]; then \
379
 
                install --mode=u=rw /dev/null keydir/tls-pubkey.pem; \
380
 
        fi
381
314
 
382
315
# Run the server with a local config
383
 
.PHONY: run-server
384
316
run-server: confdir/mandos.conf confdir/clients.conf statedir
385
317
        ./mandos --debug --no-dbus --configdir=confdir \
386
318
                --statedir=statedir $(SERVERARGS)
387
319
 
388
320
# Used by run-server
389
321
confdir/mandos.conf: mandos.conf
390
 
        install -D --mode=u=rw,go=r $^ $@
 
322
        install --directory confdir
 
323
        install --mode=u=rw,go=r $^ $@
391
324
confdir/clients.conf: clients.conf keydir/seckey.txt keydir/tls-pubkey.pem
392
 
        install -D --mode=u=rw $< $@
 
325
        install --directory confdir
 
326
        install --mode=u=rw $< $@
393
327
# Add a client password
394
328
        ./mandos-keygen --dir keydir --password --no-ssh >> $@
395
329
statedir:
396
330
        install --directory statedir
397
331
 
398
 
.PHONY: install
399
332
install: install-server install-client-nokey
400
333
 
401
 
.PHONY: install-html
402
334
install-html: html
403
 
        install -D --mode=u=rw,go=r --target-directory=$(htmldir) \
 
335
        install --directory $(htmldir)
 
336
        install --mode=u=rw,go=r --target-directory=$(htmldir) \
404
337
                $(htmldocs)
405
338
 
406
 
.PHONY: install-server
407
339
install-server: doc
 
340
        install --directory $(CONFDIR)
408
341
        if install --directory --mode=u=rwx --owner=$(USER) \
409
342
                --group=$(GROUP) $(STATEDIR); then \
410
343
                :; \
411
344
        elif install --directory --mode=u=rwx $(STATEDIR); then \
412
345
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
413
346
        fi
414
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" ]; then \
415
 
                install -D --mode=u=rw,go=r tmpfiles.d-mandos.conf \
 
347
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
 
348
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
416
349
                        $(TMPFILES)/mandos.conf; \
417
350
        fi
418
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
419
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
420
 
                        $(SYSUSERS)/mandos.conf; \
421
 
        fi
422
 
        install --directory $(BINDIR)
423
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) mandos
424
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
351
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
 
352
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
425
353
                mandos-ctl
426
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
354
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
427
355
                mandos-monitor
428
 
        install --directory $(CONFDIR)
429
356
        install --mode=u=rw,go=r --target-directory=$(CONFDIR) \
430
357
                mandos.conf
431
358
        install --mode=u=rw --target-directory=$(CONFDIR) \
432
359
                clients.conf
433
 
        install -D --mode=u=rw,go=r dbus-mandos.conf \
434
 
                $(DBUSPOLICYDIR)/mandos.conf
435
 
        install -D --mode=u=rwx,go=rx init.d-mandos \
 
360
        install --mode=u=rw,go=r dbus-mandos.conf \
 
361
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
 
362
        install --mode=u=rwx,go=rx init.d-mandos \
436
363
                $(DESTDIR)/etc/init.d/mandos
437
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" ]; then \
438
 
                install -D --mode=u=rw,go=r mandos.service \
439
 
                        $(SYSTEMD); \
 
364
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
 
365
                install --mode=u=rw,go=r mandos.service $(SYSTEMD); \
440
366
        fi
441
 
        install -D --mode=u=rw,go=r default-mandos \
 
367
        install --mode=u=rw,go=r default-mandos \
442
368
                $(DESTDIR)/etc/default/mandos
443
369
        if [ -z $(DESTDIR) ]; then \
444
370
                update-rc.d mandos defaults 25 15;\
445
371
        fi
446
 
        install --directory $(MANDIR)/man8 $(MANDIR)/man5
447
372
        gzip --best --to-stdout mandos.8 \
448
373
                > $(MANDIR)/man8/mandos.8.gz
449
374
        gzip --best --to-stdout mandos-monitor.8 \
457
382
        gzip --best --to-stdout intro.8mandos \
458
383
                > $(MANDIR)/man8/intro.8mandos.gz
459
384
 
460
 
.PHONY: install-client-nokey
461
385
install-client-nokey: all doc
 
386
        install --directory $(LIBDIR)/mandos $(CONFDIR)
462
387
        install --directory --mode=u=rwx $(KEYDIR) \
463
388
                $(LIBDIR)/mandos/plugins.d \
464
389
                $(LIBDIR)/mandos/plugin-helpers
465
 
        if [ "$(SYSUSERS)" != "$(DESTDIR)" ]; then \
466
 
                install -D --mode=u=rw,go=r sysusers.d-mandos.conf \
467
 
                        $(SYSUSERS)/mandos-client.conf; \
468
 
        fi
469
390
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
470
 
                install --directory \
471
 
                        --mode=u=rwx "$(CONFDIR)/plugins.d" \
 
391
                install --mode=u=rwx \
 
392
                        --directory "$(CONFDIR)/plugins.d" \
472
393
                        "$(CONFDIR)/plugin-helpers"; \
473
394
        fi
474
 
        install --directory --mode=u=rwx,go=rx \
 
395
        install --mode=u=rwx,go=rx --directory \
475
396
                "$(CONFDIR)/network-hooks.d"
476
397
        install --mode=u=rwx,go=rx \
477
398
                --target-directory=$(LIBDIR)/mandos plugin-runner
478
399
        install --mode=u=rwx,go=rx \
479
 
                --target-directory=$(LIBDIR)/mandos \
480
 
                mandos-to-cryptroot-unlock
481
 
        install --directory $(BINDIR)
482
 
        install --mode=u=rwx,go=rx --target-directory=$(BINDIR) \
 
400
                --target-directory=$(LIBDIR)/mandos mandos-to-cryptroot-unlock
 
401
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
483
402
                mandos-keygen
484
403
        install --mode=u=rwx,go=rx \
485
404
                --target-directory=$(LIBDIR)/mandos/plugins.d \
502
421
        install --mode=u=rwx,go=rx \
503
422
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
504
423
                plugin-helpers/mandos-client-iprouteadddel
505
 
        install -D initramfs-tools-hook \
 
424
        install initramfs-tools-hook \
506
425
                $(INITRAMFSTOOLS)/hooks/mandos
507
 
        install -D --mode=u=rw,go=r initramfs-tools-conf \
 
426
        install --mode=u=rw,go=r initramfs-tools-conf \
508
427
                $(INITRAMFSTOOLS)/conf.d/mandos-conf
509
 
        install -D --mode=u=rw,go=r initramfs-tools-conf-hook \
510
 
                $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos
511
 
        install -D initramfs-tools-script \
 
428
        install initramfs-tools-script \
512
429
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos
513
 
        install -D initramfs-tools-script-stop \
 
430
        install initramfs-tools-script-stop \
514
431
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos
515
 
        install -D --mode=u=rw,go=r \
516
 
                --target-directory=$(DRACUTMODULE) \
517
 
                dracut-module/ask-password-mandos.path \
518
 
                dracut-module/ask-password-mandos.service
519
 
        install --mode=u=rwxs,go=rx \
520
 
                --target-directory=$(DRACUTMODULE) \
521
 
                dracut-module/module-setup.sh \
522
 
                dracut-module/cmdline-mandos.sh \
523
 
                dracut-module/password-agent
524
432
        install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR)
525
 
        install --directory $(MANDIR)/man8
526
433
        gzip --best --to-stdout mandos-keygen.8 \
527
434
                > $(MANDIR)/man8/mandos-keygen.8.gz
528
435
        gzip --best --to-stdout plugin-runner.8mandos \
539
446
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
540
447
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
541
448
                > $(MANDIR)/man8/plymouth.8mandos.gz
542
 
        gzip --best --to-stdout dracut-module/password-agent.8mandos \
543
 
                > $(MANDIR)/man8/password-agent.8mandos.gz
544
449
 
545
 
.PHONY: install-client
546
450
install-client: install-client-nokey
547
451
# Post-installation stuff
548
 
        -$(BINDIR)/mandos-keygen --dir "$(KEYDIR)"
549
 
        if command -v update-initramfs >/dev/null; then \
550
 
            update-initramfs -k all -u; \
551
 
        elif command -v dracut >/dev/null; then \
552
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
553
 
                if [ -w "$$initrd" ]; then \
554
 
                    chmod go-r "$$initrd"; \
555
 
                    dracut --force "$$initrd"; \
556
 
                fi; \
557
 
            done; \
558
 
        fi
 
452
        -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)"
 
453
        update-initramfs -k all -u
559
454
        echo "Now run mandos-keygen --password --dir $(KEYDIR)"
560
455
 
561
 
.PHONY: uninstall
562
456
uninstall: uninstall-server uninstall-client
563
457
 
564
 
.PHONY: uninstall-server
565
458
uninstall-server:
566
 
        -rm --force $(BINDIR)/mandos \
567
 
                $(BINDIR)/mandos-ctl \
568
 
                $(BINDIR)/mandos-monitor \
 
459
        -rm --force $(PREFIX)/sbin/mandos \
 
460
                $(PREFIX)/sbin/mandos-ctl \
 
461
                $(PREFIX)/sbin/mandos-monitor \
569
462
                $(MANDIR)/man8/mandos.8.gz \
570
463
                $(MANDIR)/man8/mandos-monitor.8.gz \
571
464
                $(MANDIR)/man8/mandos-ctl.8.gz \
574
467
        update-rc.d -f mandos remove
575
468
        -rmdir $(CONFDIR)
576
469
 
577
 
.PHONY: uninstall-client
578
470
uninstall-client:
579
471
# Refuse to uninstall client if /etc/crypttab is explicitly configured
580
472
# to use it.
581
473
        ! grep --regexp='^ *[^ #].*keyscript=[^,=]*/mandos/' \
582
474
                $(DESTDIR)/etc/crypttab
583
 
        -rm --force $(BINDIR)/mandos-keygen \
 
475
        -rm --force $(PREFIX)/sbin/mandos-keygen \
584
476
                $(LIBDIR)/mandos/plugin-runner \
585
477
                $(LIBDIR)/mandos/plugins.d/password-prompt \
586
478
                $(LIBDIR)/mandos/plugins.d/mandos-client \
591
483
                $(INITRAMFSTOOLS)/hooks/mandos \
592
484
                $(INITRAMFSTOOLS)/conf-hooks.d/mandos \
593
485
                $(INITRAMFSTOOLS)/scripts/init-premount/mandos \
594
 
                $(INITRAMFSTOOLS)/scripts/local-premount/mandos \
595
 
                $(DRACUTMODULE)/ask-password-mandos.path \
596
 
                $(DRACUTMODULE)/ask-password-mandos.service \
597
 
                $(DRACUTMODULE)/module-setup.sh \
598
 
                $(DRACUTMODULE)/cmdline-mandos.sh \
599
 
                $(DRACUTMODULE)/password-agent \
600
486
                $(MANDIR)/man8/mandos-keygen.8.gz \
601
487
                $(MANDIR)/man8/plugin-runner.8mandos.gz \
602
488
                $(MANDIR)/man8/mandos-client.8mandos.gz
605
491
                $(MANDIR)/man8/splashy.8mandos.gz \
606
492
                $(MANDIR)/man8/askpass-fifo.8mandos.gz \
607
493
                $(MANDIR)/man8/plymouth.8mandos.gz \
608
 
                $(MANDIR)/man8/password-agent.8mandos.gz \
609
494
        -rmdir $(LIBDIR)/mandos/plugins.d $(CONFDIR)/plugins.d \
610
 
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR) $(DRACUTMODULE)
611
 
        if command -v update-initramfs >/dev/null; then \
612
 
            update-initramfs -k all -u; \
613
 
        elif command -v dracut >/dev/null; then \
614
 
            for initrd in $(DESTDIR)/boot/initr*-$(LINUXVERSION); do \
615
 
                test -w "$$initrd" && dracut --force "$$initrd"; \
616
 
            done; \
617
 
        fi
 
495
                 $(LIBDIR)/mandos $(CONFDIR) $(KEYDIR)
 
496
        update-initramfs -k all -u
618
497
 
619
 
.PHONY: purge
620
498
purge: purge-server purge-client
621
499
 
622
 
.PHONY: purge-server
623
500
purge-server: uninstall-server
624
501
        -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \
625
502
                $(DESTDIR)/etc/dbus-1/system.d/mandos.conf
626
503
                $(DESTDIR)/etc/default/mandos \
627
504
                $(DESTDIR)/etc/init.d/mandos \
 
505
                $(SYSTEMD)/mandos.service \
628
506
                $(DESTDIR)/run/mandos.pid \
629
507
                $(DESTDIR)/var/run/mandos.pid
630
 
        if [ "$(SYSTEMD)" != "$(DESTDIR)" -a -d "$(SYSTEMD)" ]; then \
631
 
                -rm --force -- $(SYSTEMD)/mandos.service; \
632
 
        fi
633
508
        -rmdir $(CONFDIR)
634
509
 
635
 
.PHONY: purge-client
636
510
purge-client: uninstall-client
637
511
        -shred --remove $(KEYDIR)/seckey.txt $(KEYDIR)/tls-privkey.pem
638
512
        -rm --force $(CONFDIR)/plugin-runner.conf \