1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
-*- org -*-
* Use _attribute_((nonnull)) wherever possible.
* mandos-applet
* Convert README into intro(8mandos) man page
* mandos-client
** TODO [#B] Use capabilities instead of seteuid().
** TODO [#B] Use struct sockaddr_storage instead of a union
** TODO [#B] Use getaddrinfo(hints=AI_NUMERICHOST) instead of inet_pton()
** TODO [#B] Use getnameinfo(serv=NULL, NI_NUMERICHOST) instead of inet_ntop()
** TODO [#B] Accept [] around IPv6 address in --connect option; see [[http://tools.ietf.org/html/rfc5952][RFC 5952 - A Recommendation for IPv6 Address Text Representation]]
* splashy
** TODO [#B] use scandir(3) instead of readdir(3)
* usplash
** TODO [#A] Make it work again
** TODO [#B] use scandir(3) instead of readdir(3)
** TODO Use [[info:libc:Argz%20Functions][argz_extract]]
* askpass-fifo
** TODO [#B] Drop privileges after opening FIFO.
* password-prompt
** TODO [#B] lock stdin (with flock()?)
** TODO [#A] Free direntries after scandir()
* plymouth
** TODO [#A] Free direntries after scandir()
* TODO [#B] passdev
* plugin-runner
** TODO handle printing for errors for plugins
*** Hook up stderr of plugins, buffer them, and prepend mandos pluig [plugin name]
** TODO [#B] use scandir(3) instead of readdir(3)
** TODO [#C] use same file name rules as run-parts(8)
** kernel command line option for debug info
** TODO [#B] Use openat()
* mandos (server)
** TODO [#B] Log level :BUGS:
** TODO Persistent state :BUGS:
/var/lib/mandos/*
*** TODO /etc/mandos/clients.d/*.conf
Watch this directory and add/remove/update clients?
** TODO [#C] config for TXT record
** TODO Log level option
syslogger.setLevel(logging.WARNING)
+ SetLogLevel D-Bus call
** TODO Implement --foreground :BUGS:
[[info:standards:Option%20Table][Table of Long Options]]
** TODO Implement --socket
[[info:standards:Option%20Table][Table of Long Options]]
** TODO Date+time on console log messages :BUGS:
Is this the default?
** TODO [#C] DBusServiceObjectUsingSuper
** TODO [#B] Global enable/disable flag
** TODO [#B] By-client countdown on secrets given
** TODO [#B] Fix problem with fsck taking a really long time
Whenever a client successfully gets a secret it could get a
one-time timeout boost to allow for an fsck-incurred delay
** TODO [#A] Delay before client receives key
This would give an operator opportunity to cancel the request if
desired.
** TODO [#A] Client manual approval mode
A client needs manual approval on the server before it gets the
secret
** TODO [#B] Support RFC 3339 time duration syntax
** More D-Bus methods
*** NeedsApproval(50, True) -> timeout, default approve
Default approval is configurable, but True by default
+ Approve(True) -> approve sending saved
+ Approve(False) -> Close client connection immediately
*** NeedsPassword(50) - Timeout, default disapprove
+ SetPass(u"gazonk", True) -> Approval, persistent
+ Approve(False) -> Close client connection immediately
** TODO [#C] python-parsedatetime
** TODO [#C] systemd/launchd
http://0pointer.de/blog/projects/systemd.html
** TODO Separate logging logic to own object
** TODO make clients to a dict!
** TODO [#A] Limit approval_delay to max gnutls/tls timeout value
** TODO [#B] break the wait on approval_delay if connection dies
** TODO Generate Client.runtime_expansions from client options + extra
** TODO Allow %%(checker)s as a runtime expansion
** TODO Use python-tlslite?
* mandos.xml
** Add mandos contact info in manual pages
* mandos-ctl
*** Handle "no D-Bus server" and/or "no Mandos server found" better
*** [#B] --dump option
** TODO Support RFC 3339 time duration syntax
* TODO mandos-dispatch
Listens for specified D-Bus signals and spawns shell commands with
arguments.
* mandos-monitor
** TODO help should be toggleable
** Urwid client data displayer
Better view of client data in the listing
*** Properties popup
** Nicer crashes. Stack traces Messes up shell.
*** Print a nice "We are sorry" message, save stack trace to log.
** Show timeout countdown for approval
* mandos-keygen
** TODO Loop until passwords match when run interactively
** TODO "--secfile" option
Using the "secfile" option instead of "secret"
** TODO [#B] "--test" option
For testing decryption before rebooting.
* Makefile
** TODO Add "--Xlinker --as-needed"
http://udrepper.livejournal.com/19395.html
** TODO [#C] Implement DEB_BUILD_OPTIONS
http://www.debian.org/doc/debian-policy/ch-source.html#s-debianrules-options
* Package
** /usr/share/initramfs-tools/hooks/mandos
*** TODO [#C] use same file name rules as run-parts(8)
*** TODO [#C] Do not install in initrd.img if configured not to.
Use "/etc/initramfs-tools/hooksconf.d/mandos"?
** TODO [#C] /etc/bash_completion.d/mandos
From XML sources directly?
* Side Stuff
** TODO Locate which packet move the other bin/sh when busy box is deactivated
** TODO contact owner of packet, and ask them to have that shell static in position regardless of busybox
#+STARTUP: showall
|