Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/usr.bin/su/Makefile

69 lines
1.4 KiB
Makefile
Raw Normal View History

- move grutil code to newgrp. - enable user:group and :group code.
2007-10-27 19:37:45 +04:00
# $NetBSD: Makefile,v 1.48 2007/10/27 15:37:45 christos Exp $
Sync to 4.4BSD-Lite2
1997-01-09 14:43:05 +03:00
# from: @(#)Makefile 8.1 (Berkeley) 7/19/93
initial import of 386bsd-0.1 sources
1993-03-21 12:45:37 +03:00
Add MK... variables to enable/disable various aspects of building crypto support into the system. See share/mk/bsd.README for more a full description.
2000-06-23 10:01:10 +04:00
.include <bsd.own.mk>
Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on the FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to various string and memory copy and set functions (as well as a few system calls and other miscellany) where known at function entry. RedHat has evidently built all "core system packages" with this option for some time. This option should be used at the top of Makefiles (or Makefile.inc where this is used for subdirectories) but after any setting of LIB. This is only useful for userland code, and cannot be used in libc or in any code which includes the libc internals, because it overrides certain libc functions with macros. Some effort has been made to make USE_FORT=yes work correctly for a full-system build by having the bsd.sys.mk logic disable the feature where it should not be used (libc, libssp iteself, the kernel) but no attempt has been made to build the entire system with USE_FORT and doing so will doubtless expose numerous bugs and misfeatures. Adjust the system build so that all programs and libraries that are setuid, directly handle network data (including serial comm data), perform authentication, or appear likely to have (or have a history of having) data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default, with the exception of libc, which cannot use USE_FORT and thus uses only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no per-directory or in a system build will disable if desired.
2007-05-28 16:06:17 +04:00
USE_FORT?= yes # setuid
initial import of 386bsd-0.1 sources
1993-03-21 12:45:37 +03:00
PROG= su
BINOWN= root
BINMODE=4555
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
- move grutil code to newgrp. - enable user:group and :group code.
2007-10-27 19:37:45 +04:00
.PATH.c: ${.CURDIR}/../newgrp
CPPFLAGS+=-I${.CURDIR}/../newgrp
Use LOGIN_CAP even in the pam case.
2005-12-15 17:03:34 +03:00
CPPFLAGS+=-DLOGIN_CAP
- move grutil code to newgrp. - enable user:group and :group code.
2007-10-27 19:37:45 +04:00
CPPFLAGS+=-DALLOW_GROUP_CHANGE
CPPFLAGS+=-DALLOW_EMPTY_USER
CPPFLAGS+=-DGRUTIL_SETGROUPS_MAKESPACE
Use LOGIN_CAP even in the pam case.
2005-12-15 17:03:34 +03:00
Test USE_PAM, not MKPAM.
2005-01-13 03:13:33 +03:00
.if ${USE_PAM} != "no"
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
remove PAM_DEBUG
2006-07-13 22:18:09 +04:00
CPPFLAGS+=-DUSE_PAM
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
# XXX: Need libcrypt here, because libcrypto defines it too.
Introduce PAM_STATIC_LDADD and PAM_STATIC_DPADD. When compiling with MKPIC=no, possibly because the target does not support shared libraries, these include libraries required to resolve all symbols which end up referenced from PAM-using applications. The libraries presently required are -lcrypt, -lrpcsvc and -lutil. Add use of these variables which are currently set up to use PAM, so that they compile when MKPIC=no. Also, in the telnetd case, reorder the order of the libraries, so that libtelnet.a comes before -ltermcap and -lutil, again to fix link error when MKPIC=no. Discussed with thorpej and christos.
2005-03-04 23:41:08 +03:00
DPADD+= ${LIBPAM} ${LIBCRYPT} ${LIBUTIL} ${PAM_STATIC_DPADD}
LDADD+= -lpam -lcrypt -lutil ${PAM_STATIC_LDADD}
From Anon Ymous: - general cleanup [e-funcs, lint fixes, exit values, more error checking] - add the ability to change the primary group group as login:group, or :group *disabled*, until it is discussed. - remove krb4 code since there is no more krb4 code in the tree. - also make the old su behave like the pam su: su to the same user, does not ask for a password. - split out shared code into a separate file.
2007-10-18 01:05:39 +04:00
SRCS=su_pam.c grutil.c suutil.c
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
.else
From Anon Ymous: - general cleanup [e-funcs, lint fixes, exit values, more error checking] - add the ability to change the primary group group as login:group, or :group *disabled*, until it is discussed. - remove krb4 code since there is no more krb4 code in the tree. - also make the old su behave like the pam su: su to the same user, does not ask for a password. - split out shared code into a separate file.
2007-10-18 01:05:39 +04:00
SRCS=su.c grutil.c suutil.c
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
DPADD+= ${LIBCRYPT} ${LIBUTIL}
LDADD+= -lcrypt -lutil
Fix PR/2837: su [login [args]] had the wrong usage and did not work properly. Build the correct argument list and add -c for the shells. Fix PR/2839: su will not build with Kerberos. - Also: -Don't coredump when $TERM is not set. -Add prototypes, remove local old style declarations of system functions. -Recognize shells that contain "csh" as being csh alike. -Don't build with SKEY unconditionally. Obey bsd.own.mk.
1996-10-13 03:54:38 +04:00
As per discussion with mrg, back out parts of previous change. The appropriate entry in /etc/group as returned by getgrnam() is used to determine if 'su root' may be permitted, rather than checking if membership exists in the result of getgroups(). The following changes were made regarding the behaviour of the special group for 'su root' * allow for definition of SUGROUP (defaults to "wheel") to override group name. * use getgrnam(SUGROUP) instead of getgrgid(0). * only scan getgrnam(SUGROUP)->gr_mem when checking for group membership. * be more specific as to why 'su root' failed NOTE: If a user's primary group is SUGROUP, and they're not a member of SUGROUP in /etc/group, they will not be able to su.
1997-07-02 09:42:11 +04:00
# Uncomment the following line to change the group that may su root to "sugroup"
#
Normalize the program's compilation options so they are all of the form SU_ and document them.
2003-08-20 18:11:17 +04:00
#CPPFLAGS+=-DSU_GROUP=\"sugroup\"
As per discussion with mrg, back out parts of previous change. The appropriate entry in /etc/group as returned by getgrnam() is used to determine if 'su root' may be permitted, rather than checking if membership exists in the result of getgroups(). The following changes were made regarding the behaviour of the special group for 'su root' * allow for definition of SUGROUP (defaults to "wheel") to override group name. * use getgrnam(SUGROUP) instead of getgrgid(0). * only scan getgrnam(SUGROUP)->gr_mem when checking for group membership. * be more specific as to why 'su root' failed NOTE: If a user's primary group is SUGROUP, and they're not a member of SUGROUP in /etc/group, they will not be able to su.
1997-07-02 09:42:11 +04:00
SU_INDIRECT_GROUP should not be on by default.
2001-01-11 03:54:57 +03:00
# Uncomment the following line to make su
# treat group wheel (SUGROUP) and/or ROOTAUTH as an indirect
If SU_INDIRECT_GROUP is defined (it is by default), then su will consider that SUGROUP and ROOTAUTH group contain the names of users and groups. If user is not found in the list check_ingroup() recurses on each member until either user is found or end of chain is reached. The above allows su's use of the wheel group to be extended to a large number of users without necessarily putting them in group wheel, and in a way that will work over NIS that simply extending the line length limit in getgrent.c cannot.
2001-01-11 00:33:13 +03:00
# list of groups.
SU_INDIRECT_GROUP should not be on by default.
2001-01-11 03:54:57 +03:00
#CPPFLAGS+=-DSU_INDIRECT_GROUP
If SU_INDIRECT_GROUP is defined (it is by default), then su will consider that SUGROUP and ROOTAUTH group contain the names of users and groups. If user is not found in the list check_ingroup() recurses on each member until either user is found or end of chain is reached. The above allows su's use of the wheel group to be extended to a large number of users without necessarily putting them in group wheel, and in a way that will work over NIS that simply extending the line length limit in getgrent.c cannot.
2001-01-11 00:33:13 +03:00
Fix the checkflist for builds without Kerberos 4 (MKKERBEROS4=no) and without Kerberos 4 & 5 (MKKERBEROS=no). Previously checkflist complained of missing files. * move kerberos- and kerberos 4-only files into new flists, distrib/sets/lists/*/krb.* * make the flist generators grok MKKERBEROS{,4} variables * fix Makefiles which treat MKKERBEROS=no as MKKERBEROS5=no. 9 out of 10 experts agree that it is ludicrous to build w/ KERBEROS4 and w/o KERBEROS5. * fix header files, also, which treat MKKERBEROS=no as MKKERBEROS5=no. * omit some Kerberos-only subdirectories from the build as MKKERBEROS{,4} indicate (I acknowledge the sentiment that flists are the wrong way to go, and that the makefiles should produce the metalog directly. That sounds to me like the right way to go, but I am not prepared to do revamp all the makefiles. While my approach is expedient, it fits painlessly within the current build architecture until we are delivered from flist purgatory, and it does not postpone our delivery. Fair enough?)
2003-12-11 12:46:26 +03:00
.if (${USE_KERBEROS} != "no")
Merge a bunch of things from crypto-us and crypto-intl into basesrc, adding support for Heimdal/KTH Kerberos where easy to do so. Eliminate bsd.crypto.mk. There is still a bunch more work to do, but crypto is now more-or-less fully merged into the base NetBSD distribution.
2000-06-20 10:00:24 +04:00
.ifdef AFS
DPADD+= ${LIBKAFS}
LDADD+= -lkafs
Use bsd.crypto.mk.
1999-07-13 02:11:37 +04:00
.endif
add Kerberos5 support
2000-07-10 06:09:15 +04:00
CPPFLAGS+=-DKERBEROS5 -I${DESTDIR}/usr/include/krb5
add DPADD.
2002-10-23 05:25:35 +04:00
DPADD+= ${LIBKRB5} ${LIBASN1}
Fix library order.
2000-07-24 02:23:14 +04:00
LDADD+= -lkrb5 -lasn1
add Kerberos5 support
2000-07-10 06:09:15 +04:00
add DPADD.
2002-10-23 05:25:35 +04:00
DPADD+= ${LIBCRYPTO} ${LIBROKEN} ${LIBCOM_ERR}
remove -lvers, it's not used
2000-08-04 02:56:29 +04:00
LDADD+= -lcrypto -lroken -lcom_err
Add MK... variables to enable/disable various aspects of building crypto support into the system. See share/mk/bsd.README for more a full description.
2000-06-23 10:01:10 +04:00
.endif
Merge a bunch of things from crypto-us and crypto-intl into basesrc, adding support for Heimdal/KTH Kerberos where easy to do so. Eliminate bsd.crypto.mk. There is still a bunch more work to do, but crypto is now more-or-less fully merged into the base NetBSD distribution.
2000-06-20 10:00:24 +04:00
Split the notion of building Hesiod, Kerberos, S/key, and YP infrastructure and using that infrastructure in programs. * MKHESIOD, MKKERBEROS, MKSKEY, and MKYP control building of the infratsructure (libraries, support programs, etc.) * USE_HESIOD, USE_KERBEROS, USE_SKEY, and USE_YP control building of support for using the corresponding API in various libraries/programs that can use it. As discussed on tech-toolchain.
2002-03-22 21:10:19 +03:00
.if (${USE_SKEY} != "no")
Make this compile without SKEY.
1997-10-12 16:54:20 +04:00
CPPFLAGS+=-DSKEY
DPADD+= ${LIBSKEY}
LDADD+= -lskey
Fix PR/2837: su [login [args]] had the wrong usage and did not work properly. Build the correct argument list and add -c for the shells. Fix PR/2839: su will not build with Kerberos. - Also: -Don't coredump when $TERM is not set. -Add prototypes, remove local old style declarations of system functions. -Recognize shells that contain "csh" as being csh alike. -Don't build with SKEY unconditionally. Obey bsd.own.mk.
1996-10-13 03:54:38 +04:00
.endif
Allow people in group wheel to use the ROOTAUTH group. Pick up SUROOTAUTH (presumably from /etc/mk.conf).
1999-07-12 03:41:10 +04:00
Normalize the program's compilation options so they are all of the form SU_ and document them.
2003-08-20 18:11:17 +04:00
.ifdef SU_ROOTAUTH
CPPFLAGS+=-DSU_ROOTAUTH=\"${SU_ROOTAUTH}\"
Allow people in group wheel to use the ROOTAUTH group. Pick up SUROOTAUTH (presumably from /etc/mk.conf).
1999-07-12 03:41:10 +04:00
.endif
Add PAM support to su
2005-01-08 01:34:20 +03:00
.endif
Restore su.c to version 1.58, plus minor prototyping. Split pam into su_pam.c, and turn it off by default in the Makefile until it is tested and actually works. The current pam version does not set ruid properly anymore.
2005-01-10 06:11:50 +03:00
.include <bsd.prog.mk>