apparmor/changehat/pam_apparmor/Makefile

90 lines
3.3 KiB
Makefile
Raw Normal View History

# ----------------------------------------------------------------------
# Copyright (c) 1999, 2004, 2005 NOVELL (All rights reserved)
# Copyright (c) 2016 Canonical, Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ----------------------------------------------------------------------
NAME=pam_apparmor
all:
COMMONDIR=../../common/
include $(COMMONDIR)/Make.rules
ifdef USE_SYSTEM
LIBAPPARMOR = $(shell if pkg-config --exists libapparmor ; then \
pkg-config --silence-errors --libs libapparmor ; \
elif ldconfig -p | grep -q libapparmor\.so$$ ; then \
echo -lapparmor ; \
fi )
ifeq ($(strip $(LIBAPPARMOR)),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
Unable to find libapparmor installed on this system; either${nl}\
install libapparmor devel packages, set the LIBAPPARMOR variable${nl}\
manually, or build against in-tree libapparmor.${nl}\
************************************************************************${nl})
endif
LIBAPPARMOR_INCLUDE =
AA_LDLIBS = $(LIBAPPARMOR)
AA_LINK_FLAGS =
else
LIBAPPARMOR_SRC := ../../libraries/libapparmor/
LIBAPPARMOR_INCLUDE_PATH = $(LIBAPPARMOR_SRC)/include
LIBAPPARMOR_PATH := $(LIBAPPARMOR_SRC)/src/.libs/
ifeq ($(realpath $(LIBAPPARMOR_PATH)/libapparmor.a),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
$(LIBAPPARMOR_PATH)/libapparmor.a is missing; either build against${nl}\
the in-tree libapparmor by building it first and then trying again${nl}\
(see the top-level README for help) or build against the system${nl}\
libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
************************************************************************${nl})
endif
LIBAPPARMOR_INCLUDE = -I$(LIBAPPARMOR_INCLUDE_PATH)
AA_LINK_FLAGS = -L$(LIBAPPARMOR_PATH)
AA_LDLIBS = -lapparmor
endif
EXTRA_CFLAGS=$(CFLAGS) $(CPPFLAGS) -fPIC -shared -Wall $(EXTRA_WARNINGS) $(LIBAPPARMOR_INCLUDE)
LINK_FLAGS=-Xlinker -x $(AA_LINK_FLAGS) $(LDFLAGS)
LIBS=-lpam $(AA_LDLIBS)
This (updated) patch provides some limited configurability for pam_apparmor pam module. The default behavior is to use the user's primary groupname, and to fall back to the DEFAULT hat. You can change this behavior by appending order=type1[,type2,type3] to the pam_apparmor session line in the pam config for the application you're applying pam_apparmor to. The available types are 'user' for username, 'group' for groupname, and 'default' for DEFAULT. Thus, adding a configuration entry like: session optional pam_apparmor.so order=group,default is equivalent to the default behavior for pam_apparmor. The parse_option code got a little more complicated than I'd hoped it would be; I could have just had types by space delimited options to module, but I thought I'd leave open the possibility of adding additional options to the module ('debug' immediately comes to mind). I disabled the short-circuit that occurs if EPERM is returned by change_hat, as we can't detect that this is because there's no hats or that the application is entirely undefined; if ECHILD makes it in then we can re-enable this. I am less convinced now that pam_apparmor needs to be 'optional' than 'required'; killing the session if none of the change_hats succeeds is starting to feel like reasonable behavior. --- changehat/pam_apparmor/Makefile | 11 + changehat/pam_apparmor/README | 74 +++++++++++++ changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++ changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++-------- changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++ changehat/pam_apparmor/pam_apparmor.spec.in | 2 6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
OBJECTS=${NAME}.o get_options.o
.PHONY: libapparmor_check
.SILENT: libapparmor_check
libapparmor_check: ; $(ERROR_MESSAGE)
all: libapparmor_check $(NAME).so docs
.PHONY: docs
# docs: we should have some
docs:
This (updated) patch provides some limited configurability for pam_apparmor pam module. The default behavior is to use the user's primary groupname, and to fall back to the DEFAULT hat. You can change this behavior by appending order=type1[,type2,type3] to the pam_apparmor session line in the pam config for the application you're applying pam_apparmor to. The available types are 'user' for username, 'group' for groupname, and 'default' for DEFAULT. Thus, adding a configuration entry like: session optional pam_apparmor.so order=group,default is equivalent to the default behavior for pam_apparmor. The parse_option code got a little more complicated than I'd hoped it would be; I could have just had types by space delimited options to module, but I thought I'd leave open the possibility of adding additional options to the module ('debug' immediately comes to mind). I disabled the short-circuit that occurs if EPERM is returned by change_hat, as we can't detect that this is because there's no hats or that the application is entirely undefined; if ECHILD makes it in then we can re-enable this. I am less convinced now that pam_apparmor needs to be 'optional' than 'required'; killing the session if none of the change_hats succeeds is starting to feel like reasonable behavior. --- changehat/pam_apparmor/Makefile | 11 + changehat/pam_apparmor/README | 74 +++++++++++++ changehat/pam_apparmor/get_options.c | 157 ++++++++++++++++++++++++++++ changehat/pam_apparmor/pam_apparmor.c | 155 +++++++++++++++++++-------- changehat/pam_apparmor/pam_apparmor.h | 56 +++++++++ changehat/pam_apparmor/pam_apparmor.spec.in | 2 6 files changed, 406 insertions(+), 49 deletions(-)
2006-10-31 15:54:47 +00:00
$(NAME).so: ${OBJECTS}
$(CC) $(EXTRA_CFLAGS) $(LINK_FLAGS) -o $@ ${OBJECTS} $(LIBS)
%.o: %.c
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
# need some better way of determining this
DESTDIR=/
SECDIR ?= ${DESTDIR}/lib/security
.PHONY: install
install: $(NAME).so
install -m 755 -d $(SECDIR)
install -m 755 $(NAME).so $(SECDIR)/
.PHONY: clean
clean:
rm -f core core.* *.so *.o *.s *.a *~