Restrict read permissions of doas binary.

[opendoas.git] / Makefile

diff --git a/Makefile b/Makefile
index 7bb667e9a8927aa4be886f245bc56fd0acdec04e..7ccacea78c998e650ffdcbb54c93ab69dcfa6322 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,6 @@
 #      $OpenBSD: Makefile,v 1.9 2014/01/13 01:41:00 tedu Exp $
+#
+# Copyright 2015 Nathan Holstein
 
 SRCS=  parse.y doas.c
 
@@ -7,7 +9,7 @@ MAN=    doas.1 doas.conf.5
 
 BINOWN= root
 BINGRP= wheel
-BINMODE=4555
+BINMODE=4511
 
 COPTS+= -Wall -Wextra -Werror -pedantic -std=c11
 CFLAGS+= -I${CURDIR} -I${CURDIR}/libopenbsd ${COPTS}
@@ -17,21 +19,33 @@ MANDIR?=/usr/share/man
 
 default: ${PROG}
 
+OPENBSD:=reallocarray.c strtonum.c execvpe.c setresuid.c \
+       auth_userokay.c setusercontext.c
+OPENBSD:=$(addprefix libopenbsd/,${OPENBSD:.c=.o})
+libopenbsd.a: ${OPENBSD}
+       ${AR} -r $@ $?
+
 OBJS:=${SRCS:.y=.c}
 OBJS:=${OBJS:.c=.o}
 
-${PROG}: ${OBJS}
-       ${CC} ${COPTS} ${LDOPTS} $^ -o $@
+${PROG}: ${OBJS} libopenbsd.a
+       ${CC} ${CFLAGS} ${LDFLAGS} $^ -o $@
 
-${BINDIR}/${PROG}: ${PROG}
+.%.chmod: %
        cp $< $@
-       chown ${BINOWN}:${BINGRP} $@
        chmod ${BINMODE} $@
+       chown ${BINOWN}:${BINGRP} $@
+
+${BINDIR}/${PROG}: .${PROG}.chmod
+       mv $< $@
 
 install: ${BINDIR}/${PROG}
 
 clean:
+       rm -f libopenbsd.a
+       rm -f ${OPENBSD}
        rm -f ${OBJS}
        rm -f ${PROG}
 
 .PHONY: default clean install
+.INTERMEDIATE: .${PROG}.chmod