xmppipe/Makefile

.PHONY: all static clean test

PROG=xmppipe
RM=rm

UNAME_SYS := $(shell uname -s)
ifeq ($(UNAME_SYS), Linux)
	LDFLAGS += -luuid -lresolv -Wl,-Bsymbolic-functions -Wl,-z,relro
	CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -fno-strict-aliasing
	XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_SECCOMP
	XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= 0
else ifeq ($(UNAME_SYS), FreeBSD)
	XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_CAPSICUM
else ifeq ($(UNAME_SYS), OpenBSD)
	XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_PLEDGE
else ifeq ($(UNAME_SYS), SunOS)
	LDFLAGS += -luuid -lresolv
else ifeq ($(UNAME_SYS), Darwin)
	LDFLAGS += -lresolv
endif

XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_RLIMIT
XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= -1
CFLAGS += -DXMPPIPE_SANDBOX=\"$(XMPPIPE_SANDBOX)\" -D$(XMPPIPE_SANDBOX) \
		  -DXMPPIPE_SANDBOX_RLIMIT_NOFILE=$(XMPPIPE_SANDBOX_RLIMIT_NOFILE)

all: $(PROG)

$(PROG):
	$(CC) -g -Wall $(CFLAGS) -o xmppipe src/*.c $(LDFLAGS) -lstrophe

static:
	$(CC) $(CFLAGS) -g -Wall -o xmppipe src/*.c -Wl,--no-as-needed -ldl -lz \
		/usr/local/lib/libstrophe.a \
		/usr/lib/*/libresolv.a \
		/usr/lib/*/libssl.a \
		/usr/lib/*/libcrypto.a \
		/usr/lib/*/libexpat.a \
		/usr/lib/*/libuuid.a

clean:
	-@$(RM) $(PROG)

test: $(PROG)
	-@PATH=.:$$PATH bats test
makefile: add target for test 2017-02-17 14:57:32 +00:00			`.PHONY: all static clean test`

makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`PROG=xmppipe`
Forward stdin over XMPP 2015-05-11 19:19:35 +00:00			`RM=rm`

Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`UNAME_SYS := $(shell uname -s)`
			`ifeq ($(UNAME_SYS), Linux)`
Add compiler hardening flags 2016-02-03 15:17:31 +00:00			`LDFLAGS += -luuid -lresolv -Wl,-Bsymbolic-functions -Wl,-z,relro`
			`CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -fno-strict-aliasing`
Enforce sandboxing 2017-02-05 14:18:56 +00:00			`XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_SECCOMP`
sandbox: set number of allowed fd's The number of file descriptors enforced by setrlimit() can now be set at compile time using a flag. The flag defaults to 0 on Linux and -1 everywhere else: XMPPIPE_SANDBOX=XMPPIPE_SANDBOX_RLIMIT \ XMPPIPE_SANDBOX_RLIMIT_NOFILE=-1 \ make The meaning of the XMPPIPE_SANDBOX_RLIMIT_NOFILE is: * -1 : set rlim_cur/rlim_max to the lowest allocated file desciptor * >=0: set rlim_cur/rlim_max to this number On some platforms, setting rlim_cur below the value of the highest allocated fd may interfere with polling. See commit a34d5766c57d for details. 2017-02-01 15:25:38 +00:00			`XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= 0`
sandbox: enable capabilities sandbox on FreeBSD 2017-02-04 14:00:49 +00:00			`else ifeq ($(UNAME_SYS), FreeBSD)`
			`XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_CAPSICUM`
sandbox: stdio mode using pledge(2) on OpenBSD 2017-01-30 15:17:54 +00:00			`else ifeq ($(UNAME_SYS), OpenBSD)`
			`XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_PLEDGE`
Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`else ifeq ($(UNAME_SYS), SunOS)`
			`LDFLAGS += -luuid -lresolv`
			`else ifeq ($(UNAME_SYS), Darwin)`
			`LDFLAGS += -lresolv`
			`endif`

Enforce sandboxing 2017-02-05 14:18:56 +00:00			`XMPPIPE_SANDBOX ?= XMPPIPE_SANDBOX_RLIMIT`
sandbox: set number of allowed fd's The number of file descriptors enforced by setrlimit() can now be set at compile time using a flag. The flag defaults to 0 on Linux and -1 everywhere else: XMPPIPE_SANDBOX=XMPPIPE_SANDBOX_RLIMIT \ XMPPIPE_SANDBOX_RLIMIT_NOFILE=-1 \ make The meaning of the XMPPIPE_SANDBOX_RLIMIT_NOFILE is: * -1 : set rlim_cur/rlim_max to the lowest allocated file desciptor * >=0: set rlim_cur/rlim_max to this number On some platforms, setting rlim_cur below the value of the highest allocated fd may interfere with polling. See commit a34d5766c57d for details. 2017-02-01 15:25:38 +00:00			`XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= -1`
Display enforced sandbox in verbose mode 2017-02-03 14:47:12 +00:00			`CFLAGS += -DXMPPIPE_SANDBOX=\"$(XMPPIPE_SANDBOX)\" -D$(XMPPIPE_SANDBOX) \`
			`-DXMPPIPE_SANDBOX_RLIMIT_NOFILE=$(XMPPIPE_SANDBOX_RLIMIT_NOFILE)`
Initial support for sandboxing Prepare for sandboxing the xmppipe process by adding a function called after all file descriptors are allocated. The intent of the sandbox is to limit the xmppipe process to the role of a component in a shell pipeline: reading from stdin, reading/writing to the XMPP socket and writing to stdout. Any activity not involved with using stdio should force the process to exit. The sandbox function will vary based on the capabilities of the platform. The default sandbox function does nothing. Limitations of the sandbox: Probably the biggest risk is in session establishment: * the TLS handshake * the XML parsing The sandbox is enforced after the TLS connection is established, i.e., after the file descriptor for the XMPP session is allocated and so has no effect on the TLS handshake or the initial XMPP handshake. Possibly an initial sandbox could be setup for the connection phase followed by a stricter sandbox for the stdio phase. 2017-01-29 14:13:18 +00:00
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`all: $(PROG)`

			`$(PROG):`
Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`$(CC) -g -Wall $(CFLAGS) -o xmppipe src/*.c $(LDFLAGS) -lstrophe`
makefile: static target, link against libresolv libresolv is required for base64 encoding. 2015-05-25 14:20:04 +00:00
			`static:`
Add compiler hardening flags 2016-02-03 15:17:31 +00:00			`$(CC) $(CFLAGS) -g -Wall -o xmppipe src/*.c -Wl,--no-as-needed -ldl -lz \`
makefile: static target, link against libresolv libresolv is required for base64 encoding. 2015-05-25 14:20:04 +00:00			`/usr/local/lib/libstrophe.a \`
			`/usr/lib/*/libresolv.a \`
			`/usr/lib/*/libssl.a \`
			`/usr/lib/*/libcrypto.a \`
			`/usr/lib/*/libexpat.a \`
			`/usr/lib/*/libuuid.a`
Forward stdin over XMPP 2015-05-11 19:19:35 +00:00
			`clean:`
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`-@$(RM) $(PROG)`
makefile: add target for test 2017-02-17 14:57:32 +00:00
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`test: $(PROG)`
test: base64 encode/decode 2017-02-18 14:56:22 +00:00			`-@PATH=.:$$PATH bats test`