=== modified file '.bzrignore'
--- .bzrignore	2008-09-30 07:23:39 +0000
+++ .bzrignore	2008-10-03 09:32:30 +0000
@@ -7,6 +7,7 @@
 keydir
 man
 plugin-runner
+plugins.d/askpass-fifo
 plugins.d/mandos-client
 plugins.d/password-prompt
 plugins.d/splashy

=== modified file 'INSTALL'
--- INSTALL	2008-09-08 18:54:47 +0000
+++ INSTALL	2008-10-05 17:38:31 +0000
@@ -97,10 +97,28 @@
      and append this to the file "/etc/mandos/clients.conf" *on the
      server computer*.
   
-  4. On the server computer, start the server by running the command
+  4. Configure the client to use the correct network interface.  The
+     default is "eth0", and if this needs to be adjusted, it will be
+     necessary to edit /etc/mandos/plugin-runner.conf to uncomment and
+     change the line there.  If that file is changed, the initrd.img
+     file must be updated, possibly using the following command:
+     
+	# update-initramfs -k all -u
+  
+  5. On the server computer, start the server by running the command
      For Debian: su -c 'invoke-rc.d mandos start'
      For Ubuntu: sudo invoke-rc.d mandos start
      
+     At this point, it is possible to verify that the correct password
+     will be received by the client by running the command:
+     
+	# /usr/lib/mandos/plugins.d/mandos-client \
+		--pubkey=/etc/keys/mandos/pubkey.txt \
+		--seckey=/etc/keys/mandos/seckey.txt; echo
+     
+     This command should retrieve the password from the server,
+     decrypt it, and output it to standard output.
+     
      After this, the client computer should be able to reboot without
      needing a password entered on the console, as long as it does not
      take more than an hour to reboot.

=== modified file 'Makefile'
--- Makefile	2008-09-30 18:59:44 +0000
+++ Makefile	2008-10-18 10:58:29 +0000
@@ -9,12 +9,13 @@
 #DEBUG=-ggdb3
 # For info about _FORTIFY_SOURCE, see
 # <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>
-FORTIFY=-D_FORTIFY_SOURCE=2 # -fstack-protector-all
+FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIE -pie
+LINK_FORTIFY=-z relro -pie
 #COVERAGE=--coverage
 OPTIMIZE=-Os
 LANGUAGE=-std=gnu99
 htmldir=man
-version=1.0
+version=1.0.2
 SED=sed
 
 ## Use these settings for a traditional /usr/local install
@@ -44,7 +45,7 @@
 CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 	$(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 	-DVERSION='"$(version)"'
-LDFLAGS=$(COVERAGE)
+LDFLAGS=$(COVERAGE) $(LINK_FORTIFY)
 
 # Commands to format a DocBook <refentry> document into a manual page
 DOCBOOKTOMAN=cd $(dir $<); xsltproc --nonet --xinclude \
@@ -78,13 +79,14 @@
 DOCS=mandos.8 plugin-runner.8mandos mandos-keygen.8 \
 	plugins.d/mandos-client.8mandos \
 	plugins.d/password-prompt.8mandos mandos.conf.5 \
-	mandos-clients.conf.5
+	plugins.d/usplash.8mandos plugins.d/splashy.8mandos \
+	plugins.d/askpass-fifo.8mandos mandos-clients.conf.5
 
 htmldocs=$(addsuffix .xhtml,$(DOCS))
 
 objects=$(addsuffix .o,$(CPROGS))
 
-all: $(PROGS)
+all: $(PROGS) mandos.lsm
 
 doc: $(DOCS)
 
@@ -149,10 +151,14 @@
 	$(SED) --in-place --expression='s/^\(<ENTITY VERSION "\)[^"]*">$$/\1$(version)"/' $@
 
 mandos: Makefile
-	$(SED) --in-place --expression='s/^\(version = "\)[^"]*"/\1$(version)"/' $@
+	$(SED) --in-place --expression='s/^\(version = "\)[^"]*"$$/\1$(version)"/' $@
 
 mandos-keygen: Makefile
-	$(SED) --in-place --expression='s/^\(VERSION="\)[^"]*"/\1$(version)"/' $@
+	$(SED) --in-place --expression='s/^\(VERSION="\)[^"]*"$$/\1$(version)"/' $@
+
+mandos.lsm: Makefile
+	$(SED) --in-place --expression='s/^\(Version:\).*/\1\t$(version)/' $@
+	$(SED) --in-place --expression='s/^\(Entered-date:\).*/\1\t$(shell date --rfc-3339=date --reference=Makefile)/' $@
 
 plugins.d/mandos-client: plugins.d/mandos-client.o
 	$(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
@@ -268,6 +274,12 @@
 		> $(MANDIR)/man8/password-prompt.8mandos.gz
 	gzip --best --to-stdout plugins.d/mandos-client.8mandos \
 		> $(MANDIR)/man8/mandos-client.8mandos.gz
+	gzip --best --to-stdout plugins.d/usplash.8mandos \
+		> $(MANDIR)/man8/usplash.8mandos.gz
+	gzip --best --to-stdout plugins.d/splashy.8mandos \
+		> $(MANDIR)/man8/splashy.8mandos.gz
+	gzip --best --to-stdout plugins.d/askpass-fifo.8mandos \
+		> $(MANDIR)/man8/askpass-fifo.8mandos.gz
 
 install-client: install-client-nokey
 # Post-installation stuff
@@ -296,12 +308,16 @@
 		$(PREFIX)/lib/mandos/plugins.d/mandos-client \
 		$(PREFIX)/lib/mandos/plugins.d/usplash \
 		$(PREFIX)/lib/mandos/plugins.d/splashy \
+		$(PREFIX)/lib/mandos/plugins.d/askpass-fifo \
 		$(INITRAMFSTOOLS)/hooks/mandos \
 		$(INITRAMFSTOOLS)/conf-hooks.d/mandos \
 		$(INITRAMFSTOOLS)/scripts/local-top/mandos \
 		$(MANDIR)/man8/plugin-runner.8mandos.gz \
 		$(MANDIR)/man8/mandos-keygen.8.gz \
 		$(MANDIR)/man8/password-prompt.8mandos.gz \
+		$(MANDIR)/man8/usplash.8mandos.gz \
+		$(MANDIR)/man8/splashy.8mandos.gz \
+		$(MANDIR)/man8/askpass-fifo.8mandos.gz \
 		$(MANDIR)/man8/mandos-client.8mandos.gz
 	-rmdir $(PREFIX)/lib/mandos/plugins.d $(CONFDIR)/plugins.d \
 		 $(PREFIX)/lib/mandos $(CONFDIR) $(KEYDIR)

=== added file 'NEWS'
--- NEWS	1970-01-01 00:00:00 +0000
+++ NEWS	2008-10-17 18:56:25 +0000
@@ -0,0 +1,23 @@
+This NEWS file records noteworthy changes, very tersely.
+See the manual for detailed information.
+
+Version 1.0.2 (2008-10-17)
+* mandos-keygen now signs the encrypted key blobs.  This signature is
+  not currently verified by mandos-client, but this may change in the
+  future.
+
+Version 1.0.1 (2008-10-07)
+* Server
+** Expand environment variables and ~user in clients.conf's "secfile"
+   The "secfile" option in /etc/mandos/clients.conf now expands
+   "~user/foo" and "$ENVVAR" strings.
+
+* Client (plugin-runner, plugins, etc.)
+** Manual pages for the usplash, splashy, and askpass-fifo plugins.
+   All plugins now have man pages.
+** More secure compilation and linking flags.
+   All programs are now compiled with "-fstack-protector-all -fPIE
+   -pie", and linked using "-z relro -pie" for additional security.
+
+* There is now a "NEWS" file (this one), giving a history of
+  noteworthy changes.

=== modified file 'README'
--- README	2008-09-30 03:19:39 +0000
+++ README	2008-10-12 07:27:43 +0000
@@ -143,11 +143,11 @@
   first to find a password and provide it to the plugin runner.
   
   Three additional plugins are provided:
-  * usplash
+  * usplash(8mandos)
     This prompts for a password when using usplash(8).
-  * splashy
+  * splashy(8mandos)
     This prompts for a password when using splashy(8).
-  * askpass-fifo
+  * askpass-fifo(8mandos)
     To provide compatibility with the "askpass" program from
     cryptsetup, this plugin listens to the same FIFO as askpass would
     do.

=== modified file 'TODO'
--- TODO	2008-09-30 19:37:06 +0000
+++ TODO	2008-11-12 05:46:07 +0000
@@ -1,14 +1,10 @@
 -*- org -*-
 
-* DONE plugin-runner
-
 * mandos-client
 ** TODO [#B] Temporarily lower kernel log level
    for less printouts during sucessfull boot.
 ** TODO [#C] IPv4 support
 
-* DONE password-prompt
-
 * mandos (server)
 ** TODO [#B] Log level				:bugs:
 ** TODO /etc/mandos/clients.d/*.conf
@@ -32,19 +28,11 @@
 ** TODO Enable client
 ** TODO Reset timer
 
-* Man pages
-** TODO Use xinclude for all common sections
-   Like authors, etc.
-
-
-* Installer
-** Client-side
-*** mandos-keygen
-**** TODO "--secfile" option
-     Using the "secfile" option instead of "secret"
-**** TODO [#B] "--test" option
-     For testing decryption before rebooting.
-
+* mandos-keygen
+** TODO "--secfile" option
+   Using the "secfile" option instead of "secret"
+** TODO [#B] "--test" option
+   For testing decryption before rebooting.
 
 * [#A] Package
 ** /usr/share/initramfs-tools/hooks/mandos
@@ -53,20 +41,6 @@
     question.
 ** TODO /etc/bash_completion.d/mandos
    From XML sources directly?
-** TODO unperish
-
-* TODO Web site
-** DONE http://www.fukt.bsnet.se/mandos
-   Redirects to the wiki page
-** TODO http://wiki.fukt.bsnet.se/wiki/Mandos
-   http://liw.fi/free-software-website/
-
-* Mailing list
-** DONE mandos-dev
-*** TODO http://gmane.org/subscribe.php
-
-* TODO Announce project on Usenet
-  [[news:comp.os.linux.announce]]
 
 
 #+STARTUP: showall

=== modified file 'debian/changelog'
--- debian/changelog	2008-09-17 00:34:09 +0000
+++ debian/changelog	2008-10-17 18:56:25 +0000
@@ -1,5 +1,29 @@
-mandos (1.0) unstable; urgency=low
-
-  * Initial Release.
-
- -- Mandos Maintainers <mandos@fukt.bsnet.se>  Sun, 07 Sep 2008 11:55:51 +0200
+mandos (1.0.2-1) unstable; urgency=low
+
+  * New upstream release.
+  * debian/copyright: Rewritten to conform to
+    <http://wiki.debian.org/Proposals/CopyrightFormat?action=recall&rev=233>.
+
+ -- Teddy Hogeborn <teddy@fukt.bsnet.se>  Fri, 17 Oct 2008 20:42:12 +0200
+
+mandos (1.0.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * Separate /usr/share/doc/mandos-client/README.Debian into sections with
+    headlines.  Add instructions on how to test the server and verify the
+    password.
+
+ -- Teddy Hogeborn <teddy@fukt.bsnet.se>  Tue, 07 Oct 2008 23:07:23 +0200
+
+mandos (1.0-2) unstable; urgency=low
+
+  * Added comments in debian/*.lintian-overrides files.  Added Debian
+    revison number to version number.
+
+ -- Teddy Hogeborn <teddy@fukt.bsnet.se>  Wed, 01 Oct 2008 17:23:35 +0200
+
+mandos (1.0-1) unstable; urgency=low
+
+  * Initial Release. (Closes: #500727).
+
+ -- Teddy Hogeborn <teddy@fukt.bsnet.se>  Tue, 30 Sep 2008 21:58:43 +0200

=== modified file 'debian/copyright'
--- debian/copyright	2008-09-17 00:34:09 +0000
+++ debian/copyright	2008-10-15 19:54:11 +0000
@@ -1,27 +1,26 @@
-Authors: Teddy Hogeborn, Björn Påhlsson
-
-Homepage: <http://www.fukt.bsnet.se/mandos>
-
-Copyright:
-
-    Copyright © 2008 Teddy Hogeborn
-                2008 Björn Påhlsson
-
-License:
-
+Format-Specification:
+ http://wiki.debian.org/Proposals/CopyrightFormat?action=recall&rev=233
+Upstream-Name: Mandos
+Upstream-Maintainer: Mandos Maintainers <mandos@fukt.bsnet.se>
+Upstream-Source: <http://www.fukt.bsnet.se/mandos>
+
+Files: *
+Copyright: Copyright © 2008 Teddy Hogeborn
+Copyright: Copyright © 2008 Björn Påhlsson
+License: GPL-3+
     This program is free software: you can redistribute it and/or
     modify it under the terms of the GNU General Public License as
     published by the Free Software Foundation, either version 3 of the
     License, or (at your option) any later version.
-
+    .
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     General Public License for more details.
-
+    .
     You should have received a copy of the GNU General Public License
     along with this program.  If not, see
     <http://www.gnu.org/licenses/>.
-
-On Debian systems, the complete text of the GNU General Public License
-can be found in "/usr/share/common-licenses/GPL".
+    .
+    On Debian systems, the complete text of the GNU General Public
+    License can be found in "/usr/share/common-licenses/GPL".

=== modified file 'debian/mandos-client.README.Debian'
--- debian/mandos-client.README.Debian	2008-09-19 20:54:58 +0000
+++ debian/mandos-client.README.Debian	2008-10-05 17:38:31 +0000
@@ -1,23 +1,45 @@
-A client key has been automatically created in /etc/keys/mandos.  The
-next step is to run "mandos-keygen --password" to get a config file
-stanza to copy and paste into /etc/mandos/clients.conf on the Mandos
-server.
-
-Also, if some other network interface than "eth0" is used, it will be
-necessary to edit /etc/mandos/plugin-runner.conf to uncomment and
-change the line there.  If this file is changed, it will be necessary
-to update the initrd image by doing "update-initramfs -k all -u".
-
-Any plugins found in /etc/mandos/plugins.d will override and add to
-the normal Mandos plugins.  When adding or changing plugins, do not
-forget to update the initital RAM disk image:
-
-# update-initramfs -k all -u
-
-It is NOT necessary to edit /etc/crypttab to specify
-/usr/lib/mandos/plugin-runner as a keyscript for the root file system;
-if no keyscript is given for the root file system, the Mandos client
-will be the new default way for getting a password for the root file
-system when booting.
-
- -- Teddy Hogeborn <teddy@fukt.bsnet.se>, Fri, 19 Sep 2008 22:50:16 +0200
+* Configure The Server
+  
+  A client key has been automatically created in /etc/keys/mandos.
+  The next step is to run "mandos-keygen --password" to get a config
+  file section.  This should be appended to /etc/mandos/clients.conf
+  on the Mandos server.
+
+* Use the Correct Network Interface
+  
+  If some other network interface than "eth0" is used, it will be
+  necessary to edit /etc/mandos/plugin-runner.conf to uncomment and
+  change the line there.  If this is done, it will be necessary to
+  update the initrd image by doing "update-initramfs -k all -u".
+
+* Test the Server
+  
+  After the server has been started and this client's key added, it is
+  possible to verify that the correct password will be received by
+  this client by running the command, on the client:
+  
+	# /usr/lib/mandos/plugins.d/mandos-client \
+		--pubkey=/etc/keys/mandos/pubkey.txt \
+		--seckey=/etc/keys/mandos/seckey.txt; echo
+  
+  This command should retrieve the password from the server, decrypt
+  it, and output it to standard output.  It is now possible to verify
+  the correctness of the password before rebooting.
+
+* User-Supplied Plugins
+
+  Any plugins found in /etc/mandos/plugins.d will override and add to
+  the normal Mandos plugins.  When adding or changing plugins, do not
+  forget to update the initital RAM disk image:
+
+	# update-initramfs -k all -u
+
+* Do *NOT* Edit /etc/crypttab
+
+  It is NOT necessary to edit /etc/crypttab to specify
+  /usr/lib/mandos/plugin-runner as a keyscript for the root file
+  system; if no keyscript is given for the root file system, the
+  Mandos client will be the new default way for getting a password for
+  the root file system when booting.
+
+ -- Teddy Hogeborn <teddy@fukt.bsnet.se>, Sun,  5 Oct 2008 19:04:26 +0200

=== modified file 'debian/mandos-client.docs'
--- debian/mandos-client.docs	2008-09-19 13:50:22 +0000
+++ debian/mandos-client.docs	2008-10-18 11:17:22 +0000
@@ -1,2 +1,3 @@
+NEWS
 README
 TODO

=== modified file 'debian/mandos-client.lintian-overrides'
--- debian/mandos-client.lintian-overrides	2008-09-30 19:05:13 +0000
+++ debian/mandos-client.lintian-overrides	2008-10-01 15:29:01 +0000
@@ -1,8 +1,32 @@
+# This example command line is long without spaces, but it must be
+# that way; it's part of the point of showing it.
+#
 mandos-client binary: manpage-has-errors-from-man usr/share/man/man8/plugin-runner.8mandos.gz 297: warning [p 4, 5.8i]: can't break line
+
+# This directory contains secret client key files.
+#
 mandos-client binary: non-standard-dir-perm etc/keys/mandos/ 0700 != 0755
-mandos-client binary: non-standard-dir-perm etc/mandos/plugins.d/ 0700 != 0755
+
+# The directory /usr/lib/mandos/plugins.d contains setuid binaries
+# which are not meant to be run outside an initial RAM disk
+# environment (except for test purposes).  It would be insecure to
+# allow anyone to run them.
+#
+mandos-client binary: non-standard-dir-perm usr/lib/mandos/plugins.d/ 0700 != 0755
+
+# These binaries must be setuid root, since they need root powers, but
+# are started by plugin-runner(8mandos), which runs all plugins as
+# user/group "mandos".  These binaries are not run in a running
+# system, but in an initial RAM disk environment.  Here they are
+# protected from non-root access by the directory permissions, above.
+#
 mandos-client binary: setuid-binary usr/lib/mandos/plugins.d/mandos-client 4755 root/root
 mandos-client binary: setuid-binary usr/lib/mandos/plugins.d/askpass-fifo 4755 root/root
 mandos-client binary: setuid-binary usr/lib/mandos/plugins.d/splashy 4755 root/root
 mandos-client binary: setuid-binary usr/lib/mandos/plugins.d/usplash 4755 root/root
-mandos-client binary: non-standard-dir-perm usr/lib/mandos/plugins.d/ 0700 != 0755
+
+# The directory /etc/mandos/plugins.d can be used by local system
+# administrators to place plugins in, overriding and complementing
+# /usr/lib/mandos/plugins.d, and must be likewise protected.
+#
+mandos-client binary: non-standard-dir-perm etc/mandos/plugins.d/ 0700 != 0755

=== modified file 'debian/mandos.docs'
--- debian/mandos.docs	2008-09-19 13:50:22 +0000
+++ debian/mandos.docs	2008-10-18 11:17:22 +0000
@@ -1,2 +1,3 @@
+NEWS
 README
 TODO

=== modified file 'debian/mandos.lintian-overrides'
--- debian/mandos.lintian-overrides	2008-09-17 00:34:09 +0000
+++ debian/mandos.lintian-overrides	2008-10-01 15:29:01 +0000
@@ -1,1 +1,4 @@
+# This config file will normally have encrypted secret client keys in
+# it, so it must be kept unreadable for non-root users.
+#
 mandos binary: non-standard-file-perm etc/mandos/clients.conf 0600 != 0644

=== modified file 'mandos'
--- mandos	2008-09-26 21:54:54 +0000
+++ mandos	2008-10-17 18:56:25 +0000
@@ -63,7 +63,7 @@
 import ctypes
 import ctypes.util
 
-version = "1.0"
+version = "1.0.2"
 
 logger = logging.Logger('mandos')
 syslogger = logging.handlers.SysLogHandler\
@@ -240,7 +240,8 @@
         if "secret" in config:
             self.secret = config["secret"].decode(u"base64")
         elif "secfile" in config:
-            secfile = open(config["secfile"])
+            secfile = open(os.path.expanduser(os.path.expandvars
+                                              (config["secfile"])))
             self.secret = secfile.read()
             secfile.close()
         else:

=== modified file 'mandos-clients.conf.xml'
--- mandos-clients.conf.xml	2008-09-30 07:23:39 +0000
+++ mandos-clients.conf.xml	2008-10-07 21:31:09 +0000
@@ -3,7 +3,7 @@
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY CONFNAME "mandos-clients.conf">
 <!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
-<!ENTITY TIMESTAMP "2008-09-30">
+<!ENTITY TIMESTAMP "2008-10-07">
 <!ENTITY % common SYSTEM "common.ent">
 %common;
 ]>
@@ -240,6 +240,11 @@
 	    should <emphasis>not</emphasis> be base64-encoded, but
 	    will be sent to clients verbatim.
 	  </para>
+	  <para>
+	    File names of the form <filename>~user/foo/bar</filename>
+	    and <filename>$<envar>ENVVAR</envar>/foo/bar</filename>
+	    are supported.
+	  </para>
 	</listitem>
       </varlistentry>
       

=== modified file 'mandos-keygen'
--- mandos-keygen	2008-09-23 15:21:27 +0000
+++ mandos-keygen	2008-11-12 05:46:07 +0000
@@ -20,7 +20,7 @@
 # Contact the authors at <mandos@fukt.bsnet.se>.
 # 
 
-VERSION="1.0"
+VERSION="1.0.2"
 
 KEYDIR="/etc/keys/mandos"
 KEYTYPE=DSA
@@ -289,7 +289,7 @@
 	fi
     fi | gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
 	--homedir "$RINGDIR" --trust-model always --armor --encrypt \
-	--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
+	--sign --recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
 	> "$SECFILE"
     status="${PIPESTATUS[0]}"
     if [ "$status" -ne 0 ]; then

=== modified file 'mandos-keygen.xml'
--- mandos-keygen.xml	2008-09-30 07:23:39 +0000
+++ mandos-keygen.xml	2008-10-04 01:55:56 +0000
@@ -2,7 +2,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY COMMANDNAME "mandos-keygen">
-<!ENTITY TIMESTAMP "2008-09-30">
+<!ENTITY TIMESTAMP "2008-10-03">
 <!ENTITY % common SYSTEM "common.ent">
 %common;
 ]>
@@ -382,7 +382,7 @@
     </variablelist>
   </refsect1>
   
-  <refsect1 id="file">
+  <refsect1 id="files">
     <title>FILES</title>
     <para>
       Use the <option>--dir</option> option to change where

=== added file 'mandos.lsm'
--- mandos.lsm	1970-01-01 00:00:00 +0000
+++ mandos.lsm	2008-10-18 10:58:29 +0000
@@ -0,0 +1,22 @@
+Begin4
+Title:		Mandos
+Version:	1.0.2
+Entered-date:	2008-10-18
+Description:	The Mandos system allows computers to have encrypted
+root file systems and at the same time be capable of remote and/or
+unattended reboots.
+Keywords:	boot, encryption, luks, cryptsetup, network, openpgp,
+tls, dm-crypt
+Author:		teddy@fukt.bsnet.se (Teddy Hogeborn),
+		belorn@fukt.bsnet.se (Björn Påhlsson)
+Maintained-by:	teddy@fukt.bsnet.se (Teddy Hogeborn),
+		belorn@fukt.bsnet.se (Björn Påhlsson)
+Primary-site: http://www.fukt.bsnet.se/mandos
+	      89K mandos_1.0.2.orig.tar.gz
+Alternate-site: ftp://ftp.fukt.bsnet.se/pub/mandos
+		89K mandos_1.0.2.orig.tar.gz
+Platforms:	Requires GCC, GNU libC, Avahi, GnuPG, Python 2.4, and
+various other libraries.  While made for Debian GNU/Linux, it is
+probably portable to other distributions, but not other Unixes.
+Copying-policy: GNU General Public License version 3.0 or later
+End

=== modified file 'mandos.xml'
--- mandos.xml	2008-09-30 07:23:39 +0000
+++ mandos.xml	2008-10-04 01:55:56 +0000
@@ -2,7 +2,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY COMMANDNAME "mandos">
-<!ENTITY TIMESTAMP "2008-09-30">
+<!ENTITY TIMESTAMP "2008-10-03">
 <!ENTITY % common SYSTEM "common.ent">
 %common;
 ]>
@@ -351,7 +351,7 @@
     </variablelist>
   </refsect1>
   
-  <refsect1 id="file">
+  <refsect1 id="files">
     <title>FILES</title>
     <para>
       Use the <option>--configdir</option> option to change where
@@ -421,7 +421,7 @@
       Currently, if a client is declared <quote>invalid</quote> due to
       having timed out, the server does not record this fact onto
       permanent storage.  This has some security implications, see
-      <xref linkend="CLIENTS"/>.
+      <xref linkend="clients"/>.
     </para>
     <para>
       There is currently no way of querying the server of the current
@@ -483,7 +483,7 @@
   
   <refsect1 id="security">
     <title>SECURITY</title>
-    <refsect2 id="SERVER">
+    <refsect2 id="server">
       <title>SERVER</title>
       <para>
 	Running this <command>&COMMANDNAME;</command> server program
@@ -492,7 +492,7 @@
 	soon after startup.
       </para>
     </refsect2>
-    <refsect2 id="CLIENTS">
+    <refsect2 id="clients">
       <title>CLIENTS</title>
       <para>
 	The server only gives out its stored data to clients which

=== modified file 'plugin-runner.conf'
--- plugin-runner.conf	2008-09-06 16:31:49 +0000
+++ plugin-runner.conf	2008-10-05 17:38:31 +0000
@@ -1,9 +1,11 @@
 ## This is the configuration file for plugin-runner.  It should be
 ## installed as "/etc/mandos/plugin-runner.conf", which will be copied
 ## to "/conf/conf.d/mandos/plugin-runner.conf" in the initrd.img file.
+##
+## After editing this file, the initrd image file must be updated for
+## the changes to take effect!
 ## 
 ## The default network interface for mandos-client(8mandos) is
 ## "eth0".  Uncomment this line and change it if necessary.
 ## 
-
 #--options-for=mandos-client:--interface=eth0

=== added file 'plugins.d/askpass-fifo.xml'
--- plugins.d/askpass-fifo.xml	1970-01-01 00:00:00 +0000
+++ plugins.d/askpass-fifo.xml	2008-10-04 20:09:53 +0000
@@ -0,0 +1,161 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY COMMANDNAME "askpass-fifo">
+<!ENTITY TIMESTAMP "2008-10-04">
+<!ENTITY % common SYSTEM "../common.ent">
+%common;
+]>
+
+<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>Mandos Manual</title>
+    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
+    <productname>Mandos</productname>
+    <productnumber>&version;</productnumber>
+    <date>&TIMESTAMP;</date>
+    <authorgroup>
+      <author>
+	<firstname>Björn</firstname>
+	<surname>Påhlsson</surname>
+	<address>
+	  <email>belorn@fukt.bsnet.se</email>
+	</address>
+      </author>
+      <author>
+	<firstname>Teddy</firstname>
+	<surname>Hogeborn</surname>
+	<address>
+	  <email>teddy@fukt.bsnet.se</email>
+	</address>
+      </author>
+    </authorgroup>
+    <copyright>
+      <year>2008</year>
+      <holder>Teddy Hogeborn</holder>
+      <holder>Björn Påhlsson</holder>
+    </copyright>
+    <xi:include href="../legalnotice.xml"/>
+  </refentryinfo>
+  
+  <refmeta>
+    <refentrytitle>&COMMANDNAME;</refentrytitle>
+    <manvolnum>8mandos</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname><command>&COMMANDNAME;</command></refname>
+    <refpurpose>Mandos plugin to get a password from a
+    FIFO.</refpurpose>
+  </refnamediv>
+  
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+  
+  <refsect1 id="description">
+    <title>DESCRIPTION</title>
+    <para>
+      This program reads a password from a <acronym>FIFO</acronym> and
+      outputs it to standard output.
+    </para>
+    <para>
+      This program is not very useful on its own.  This program is
+      really meant to run as a plugin in the <application
+      >Mandos</application> client-side system, where it is used as a
+      fallback and alternative to retrieving passwords from a
+      <application >Mandos</application> server.
+    </para>
+    <para>
+      This program is meant to be imitate a feature of the
+      <command>askpass</command> program, so that programs written to
+      interface with it can keep working under the
+      <application>Mandos</application> system.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="options">
+    <title>OPTIONS</title>
+    <para>
+      This program takes no options.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="exit_status">
+    <title>EXIT STATUS</title>
+    <para>
+      If exit status is 0, the output from the program is the password
+      as it was read.  Otherwise, if exit status is other than 0, the
+      program was interrupted or encountered an error, and any output
+      so far could be corrupt and/or truncated, and should therefore
+      be ignored.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="files">
+    <title>FILES</title>
+    <variablelist>
+      <varlistentry>
+	<term><filename>/lib/cryptsetup/passfifo</filename></term>
+	<listitem>
+	  <para>
+	    This is the <acronym>FIFO</acronym> where this program
+	    will read the password.  If it does not exist, it will be
+	    created.
+	  </para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+  
+  <refsect1 id="example">
+    <title>EXAMPLE</title>
+    <para>
+      Note that normally, this program will not be invoked directly,
+      but instead started by the Mandos <citerefentry><refentrytitle
+      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
+      </citerefentry>.
+    </para>
+    <informalexample>
+      <para>
+	This program takes no options.
+      </para>
+      <para>
+	<userinput>&COMMANDNAME;</userinput>
+      </para>
+    </informalexample>
+  </refsect1>
+  
+  <refsect1 id="security">
+    <title>SECURITY</title>
+    <para>
+      The only thing that could be considered worthy of note is
+      this:  This program is meant to be run by <citerefentry>
+      <refentrytitle>plugin-runner</refentrytitle><manvolnum
+      >8mandos</manvolnum></citerefentry>, and will, when run
+      standalone, outside, in a normal environment, immediately output
+      on its standard output any presumably secret password it just
+      received.  Therefore, when running this program standalone
+      (which should never normally be done), take care not to type in
+      any real secret password by force of habit, since it would then
+      immediately be shown as output.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="see_also">
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry><refentrytitle>fifo</refentrytitle>
+      <manvolnum>7</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+</refentry>
+<!-- Local Variables: -->
+<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
+<!-- time-stamp-end: "[\"']>" -->
+<!-- time-stamp-format: "%:y-%02m-%02d" -->
+<!-- End: -->

=== modified file 'plugins.d/mandos-client.xml'
--- plugins.d/mandos-client.xml	2008-09-30 07:23:39 +0000
+++ plugins.d/mandos-client.xml	2008-10-04 01:55:56 +0000
@@ -2,7 +2,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY COMMANDNAME "mandos-client">
-<!ENTITY TIMESTAMP "2008-09-30">
+<!ENTITY TIMESTAMP "2008-10-03">
 <!ENTITY % common SYSTEM "../common.ent">
 %common;
 ]>
@@ -344,7 +344,7 @@
     </para>
   </refsect1>
   
-  <refsect1 id="file">
+  <refsect1 id="files">
     <title>FILES</title>
     <variablelist>
       <varlistentry>

=== modified file 'plugins.d/password-prompt.xml'
--- plugins.d/password-prompt.xml	2008-09-30 07:23:39 +0000
+++ plugins.d/password-prompt.xml	2008-10-04 01:55:56 +0000
@@ -2,7 +2,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY COMMANDNAME "password-prompt">
-<!ENTITY TIMESTAMP "2008-09-30">
+<!ENTITY TIMESTAMP "2008-10-04">
 <!ENTITY % common SYSTEM "../common.ent">
 %common;
 ]>
@@ -84,12 +84,14 @@
     <title>DESCRIPTION</title>
     <para>
       All <command>&COMMANDNAME;</command> does is prompt for a
-      password and output any given password to standard output.  This
-      is not very useful on its own.  This program is really meant to
-      run as a plugin in the <application>Mandos</application>
-      client-side system, where it is used as a fallback and
-      alternative to retrieving passwords from a <application
-      >Mandos</application> server.
+      password and output any given password to standard output.
+    </para>
+    <para>
+      This program is not very useful on its own.  This program is
+      really meant to run as a plugin in the <application
+      >Mandos</application> client-side system, where it is used as a
+      fallback and alternative to retrieving passwords from a
+      <application >Mandos</application> server.
     </para>
     <para>
       This program is little more than a <citerefentry><refentrytitle

=== modified file 'plugins.d/splashy.c'
--- plugins.d/splashy.c	2008-09-24 23:03:31 +0000
+++ plugins.d/splashy.c	2008-10-03 09:32:30 +0000
@@ -1,20 +1,22 @@
 #define _GNU_SOURCE		/* asprintf() */
 #include <signal.h>		/* sig_atomic_t, struct sigaction,
-				   sigemptyset(), sigaddset(),
-				   sigaction, SIGINT, SIG_IGN, SIGHUP,
-				   SIGTERM, kill(), SIGKILL */
+				   sigemptyset(), sigaddset(), SIGINT,
+				   SIGHUP, SIGTERM, sigaction,
+				   SIG_IGN, kill(), SIGKILL */
 #include <stddef.h>		/* NULL */
 #include <stdlib.h>		/* getenv() */
 #include <stdio.h>		/* asprintf(), perror() */
-#include <stdlib.h>		/* EXIT_FAILURE, EXIT_SUCCESS,
-				   strtoul(), free() */
+#include <stdlib.h>		/* EXIT_FAILURE, free(), strtoul(),
+				   EXIT_SUCCESS */
 #include <sys/types.h>		/* pid_t, DIR, struct dirent,
 				   ssize_t */
 #include <dirent.h>		/* opendir(), readdir(), closedir() */
+#include <sys/stat.h>		/* struct stat, lstat(), S_ISLNK */
+#include <iso646.h>		/* not, or, and */
 #include <unistd.h>		/* readlink(), fork(), execl(),
-				   _exit */
+				   sleep(), dup2() STDERR_FILENO,
+				   STDOUT_FILENO, _exit() */
 #include <string.h>		/* memcmp() */
-#include <iso646.h>		/* and */
 #include <errno.h>		/* errno */
 #include <sys/wait.h>		/* waitpid(), WIFEXITED(),
 				   WEXITSTATUS() */
@@ -88,6 +90,24 @@
 	  closedir(proc_dir);
 	  return EXIT_FAILURE;
 	}
+	
+	/* Check that it refers to a symlink owned by root:root */
+	struct stat exe_stat;
+	ret = lstat(exe_link, &exe_stat);
+	if(ret == -1){
+	  perror("lstat");
+	  free(exe_link);
+	  free(prompt);
+	  closedir(proc_dir);
+	  return EXIT_FAILURE;
+	}
+	if(not S_ISLNK(exe_stat.st_mode)
+	   or exe_stat.st_uid != 0
+	   or exe_stat.st_gid != 0){
+	  free(exe_link);
+	  continue;
+	}
+	
 	sret = readlink(exe_link, exe_target, sizeof(exe_target));
 	free(exe_link);
       }
@@ -120,7 +140,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGINT, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -134,7 +154,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGHUP, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -148,7 +168,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGTERM, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -173,13 +193,11 @@
       const char splashy_command[] = "/sbin/splashy_update";
       ret = execl(splashy_command, splashy_command, prompt,
 		  (char *)NULL);
-      if(not interrupted_by_signal and errno != ENOENT){
-	/* Don't report "File not found", since splashy might not be
-	   installed. */
+      if(not interrupted_by_signal){
 	perror("execl");
       }
       free(prompt);
-      return EXIT_FAILURE;
+      _exit(EXIT_FAILURE);
     }
   }
   
@@ -187,33 +205,61 @@
   free(prompt);
   
   /* Wait for command to complete */
-  int status;
-  while(not interrupted_by_signal){
-    waitpid(splashy_command_pid, &status, 0);
-    if(not interrupted_by_signal
-       and WIFEXITED(status) and WEXITSTATUS(status)==0){
-      return EXIT_SUCCESS;
+  if(not interrupted_by_signal and splashy_command_pid != 0){
+    int status;
+    ret = waitpid(splashy_command_pid, &status, 0);
+    if(ret == -1){
+      if(errno != EINTR){
+	perror("waitpid");
+      }
+      if(errno == ECHILD){
+	splashy_command_pid = 0;
+      }
+    } else {
+      /* The child process has exited */
+      splashy_command_pid = 0;
+      if(not interrupted_by_signal and WIFEXITED(status)
+	 and WEXITSTATUS(status)==0){
+	return EXIT_SUCCESS;
+      }
     }
   }
   kill(splashy_pid, SIGTERM);
-  if(interrupted_by_signal){
+  if(interrupted_by_signal and splashy_command_pid != 0){
     kill(splashy_command_pid, SIGTERM);
   }
-  
+  sleep(2);
+  while(kill(splashy_pid, 0) == 0){
+    kill(splashy_pid, SIGKILL);
+    sleep(1);
+  }
   pid_t new_splashy_pid = fork();
   if(new_splashy_pid == 0){
     /* Child; will become new splashy process */
-    while(kill(splashy_pid, 0)){
-      sleep(2);
-      kill(splashy_pid, SIGKILL);
-      sleep(1);
+    
+    /* Make the effective user ID (root) the only user ID instead of
+       the real user ID (mandos) */
+    ret = setuid(geteuid());
+    if(ret == -1){
+      perror("setuid");
     }
+    
+    setsid();
+    ret = chdir("/");
+/*     if(fork() != 0){ */
+/*       _exit(EXIT_SUCCESS); */
+/*     } */
     ret = dup2(STDERR_FILENO, STDOUT_FILENO); /* replace our stdout */
     if(ret == -1){
       perror("dup2");
       _exit(EXIT_FAILURE);
     }
+    
     execl("/sbin/splashy", "/sbin/splashy", "boot", (char *)NULL);
+    if(not interrupted_by_signal){
+      perror("execl");
+    }
+    _exit(EXIT_FAILURE);
   }
   
   return EXIT_FAILURE;

=== added file 'plugins.d/splashy.xml'
--- plugins.d/splashy.xml	1970-01-01 00:00:00 +0000
+++ plugins.d/splashy.xml	2008-10-04 03:11:39 +0000
@@ -0,0 +1,282 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY COMMANDNAME "splashy">
+<!ENTITY TIMESTAMP "2008-10-04">
+<!ENTITY % common SYSTEM "../common.ent">
+%common;
+]>
+
+<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>Mandos Manual</title>
+    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
+    <productname>Mandos</productname>
+    <productnumber>&version;</productnumber>
+    <date>&TIMESTAMP;</date>
+    <authorgroup>
+      <author>
+	<firstname>Björn</firstname>
+	<surname>Påhlsson</surname>
+	<address>
+	  <email>belorn@fukt.bsnet.se</email>
+	</address>
+      </author>
+      <author>
+	<firstname>Teddy</firstname>
+	<surname>Hogeborn</surname>
+	<address>
+	  <email>teddy@fukt.bsnet.se</email>
+	</address>
+      </author>
+    </authorgroup>
+    <copyright>
+      <year>2008</year>
+      <holder>Teddy Hogeborn</holder>
+      <holder>Björn Påhlsson</holder>
+    </copyright>
+    <xi:include href="../legalnotice.xml"/>
+  </refentryinfo>
+  
+  <refmeta>
+    <refentrytitle>&COMMANDNAME;</refentrytitle>
+    <manvolnum>8mandos</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname><command>&COMMANDNAME;</command></refname>
+    <refpurpose>Mandos plugin to use splashy to get a
+    password.</refpurpose>
+  </refnamediv>
+  
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+  
+  <refsect1 id="description">
+    <title>DESCRIPTION</title>
+    <para>
+      This program prompts for a password using <citerefentry>
+      <refentrytitle>splashy_update</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> and outputs any given
+      password to standard output.  If no <citerefentry><refentrytitle
+      >splashy</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      process can be found, this program will immediately exit with an
+      exit code indicating failure.
+    </para>
+    <para>
+      This program is not very useful on its own.  This program is
+      really meant to run as a plugin in the <application
+      >Mandos</application> client-side system, where it is used as a
+      fallback and alternative to retrieving passwords from a
+      <application >Mandos</application> server.
+    </para>
+    <para>
+      If this program is killed (presumably by
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry> because some other
+      plugin provided the password), it cannot tell <citerefentry>
+      <refentrytitle>splashy</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry> to abort requesting a password, because
+      <citerefentry><refentrytitle>splashy</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> does not support this.
+      Therefore, this program will then <emphasis>kill</emphasis> the
+      running <citerefentry><refentrytitle>splashy</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> process and start a
+      <emphasis>new</emphasis> one, using <quote><literal
+      >boot</literal></quote> as the only argument.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="options">
+    <title>OPTIONS</title>
+    <para>
+      This program takes no options.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="exit_status">
+    <title>EXIT STATUS</title>
+    <para>
+      If exit status is 0, the output from the program is the password
+      as it was read.  Otherwise, if exit status is other than 0, the
+      program was interrupted or encountered an error, and any output
+      so far could be corrupt and/or truncated, and should therefore
+      be ignored.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="environment">
+    <title>ENVIRONMENT</title>
+    <variablelist>
+      <varlistentry>
+	<term><envar>cryptsource</envar></term>
+	<term><envar>crypttarget</envar></term>
+	<listitem>
+	  <para>
+	    If set, these environment variables will be assumed to
+	    contain the source device name and the target device
+	    mapper name, respectively, and will be shown as part of
+	    the prompt.
+	</para>
+	<para>
+	  These variables will normally be inherited from
+	  <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+	  <manvolnum>8mandos</manvolnum></citerefentry>, which will
+	  normally have inherited them from
+	  <filename>/scripts/local-top/cryptroot</filename> in the
+	  initial <acronym>RAM</acronym> disk environment, which will
+	  have set them from parsing kernel arguments and
+	  <filename>/conf/conf.d/cryptroot</filename> (also in the
+	  initial RAM disk environment), which in turn will have been
+	  created when the initial RAM disk image was created by
+	  <filename
+	  >/usr/share/initramfs-tools/hooks/cryptroot</filename>, by
+	  extracting the information of the root file system from
+	  <filename >/etc/crypttab</filename>.
+	</para>
+	<para>
+	  This behavior is meant to exactly mirror the behavior of
+	  <command>askpass</command>, the default password prompter.
+	</para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+  
+  <refsect1 id="files">
+    <title>FILES</title>
+    <variablelist>
+      <varlistentry>
+	<term><filename>/sbin/splashy_update</filename></term>
+	<listitem>
+	  <para>
+	    This is the command run to retrieve a password from
+	    <citerefentry><refentrytitle>splashy</refentrytitle>
+	    <manvolnum>8</manvolnum></citerefentry>.  See
+	    <citerefentry><refentrytitle
+	    >splashy_update</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/proc</filename></term>
+	<listitem>
+	  <para>
+	    To find the running <citerefentry><refentrytitle
+	    >splashy</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>, this directory will be searched for
+	    numeric entries which will be assumed to be directories.
+	    In all those directories, the <filename>exe</filename>
+	    entry will be used to determine the name of the running
+	    binary and the effective user and group
+	    <abbrev>ID</abbrev> of the process.  See <citerefentry>
+	    <refentrytitle>proc</refentrytitle><manvolnum
+	    >5</manvolnum></citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/sbin/splashy</filename></term>
+	<listitem>
+	  <para>
+	    This is the name of the binary which will be searched for
+	    in the process list.  See <citerefentry><refentrytitle
+	    >splashy</refentrytitle><manvolnum>8</manvolnum>
+	  </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+  
+  <refsect1 id="bugs">
+    <title>BUGS</title>
+    <para>
+      Killing <citerefentry><refentrytitle>splashy</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> and starting a new one
+      is ugly, but necessary as long as it does not support aborting a
+      password request.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="example">
+    <title>EXAMPLE</title>
+    <para>
+      Note that normally, this program will not be invoked directly,
+      but instead started by the Mandos <citerefentry><refentrytitle
+      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
+      </citerefentry>.
+    </para>
+    <informalexample>
+      <para>
+	This program takes no options.
+      </para>
+      <para>
+	<userinput>&COMMANDNAME;</userinput>
+      </para>
+    </informalexample>
+  </refsect1>
+  
+  <refsect1 id="security">
+    <title>SECURITY</title>
+    <para>
+      If this program is killed by a signal, it will kill the process
+      <abbrev>ID</abbrev> which at the start of this program was
+      determined to run <citerefentry><refentrytitle
+      >splashy</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      as root (see also <xref linkend="files"/>).  There is a very
+      slight risk that, in the time between those events, that process
+      <abbrev>ID</abbrev> was freed and then taken up by another
+      process; the wrong process would then be killed.  Now, this
+      program can only be killed by the user who started it; see
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>.  This program
+      should therefore be started by a completely separate
+      non-privileged user, and no other programs should be allowed to
+      run as that special user.  This means that it is not recommended
+      to use the user "nobody" to start this program, as other
+      possibly less trusted programs could be running as "nobody", and
+      they would then be able to kill this program, triggering the
+      killing of the process <abbrev>ID</abbrev> which may or may not
+      be <citerefentry><refentrytitle>splashy</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>.
+    </para>
+    <para>
+      The only other thing that could be considered worthy of note is
+      this:  This program is meant to be run by <citerefentry>
+      <refentrytitle>plugin-runner</refentrytitle><manvolnum
+      >8mandos</manvolnum></citerefentry>, and will, when run
+      standalone, outside, in a normal environment, immediately output
+      on its standard output any presumably secret password it just
+      received.  Therefore, when running this program standalone
+      (which should never normally be done), take care not to type in
+      any real secret password by force of habit, since it would then
+      immediately be shown as output.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="see_also">
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry><refentrytitle>crypttab</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>proc</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>splashy</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>splashy_update</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+</refentry>
+<!-- Local Variables: -->
+<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
+<!-- time-stamp-end: "[\"']>" -->
+<!-- time-stamp-format: "%:y-%02m-%02d" -->
+<!-- End: -->

=== modified file 'plugins.d/usplash.c'
--- plugins.d/usplash.c	2008-09-26 19:27:46 +0000
+++ plugins.d/usplash.c	2008-10-03 09:32:30 +0000
@@ -5,9 +5,10 @@
 				   SIG_IGN, kill(), SIGKILL */
 #include <stdbool.h>		/* bool, false, true */
 #include <fcntl.h>		/* open(), O_WRONLY, O_RDONLY */
+#include <iso646.h>		/* and, or, not*/
 #include <errno.h>		/* errno, EINTR */
-#include <sys/types.h>		/* size_t, ssize_t, pid_t, DIR,
-				   struct dirent */
+#include <sys/types.h>		/* size_t, ssize_t, pid_t, DIR, struct
+				   dirent */
 #include <stddef.h>		/* NULL */
 #include <string.h>		/* strlen(), memcmp() */
 #include <stdio.h>		/* asprintf(), perror() */
@@ -21,12 +22,7 @@
 				   _exit() */
 #include <stdlib.h>		/* getenv() */
 #include <dirent.h>		/* opendir(), readdir(), closedir() */
-
-
-
-#include <iso646.h>		/* and */
-#include <sys/wait.h>		/* waitpid(), WIFEXITED(),
-				   WEXITSTATUS() */
+#include <sys/stat.h>		/* struct stat, lstat(), S_ISLNK */
 
 sig_atomic_t interrupted_by_signal = 0;
 
@@ -36,8 +32,8 @@
 
 static bool usplash_write(const char *cmd, const char *arg){
   /* 
-   * usplash_write("TIMEOUT", "15"); -> "TIMEOUT 15\0"
-   * usplash_write("PULSATE", NULL); -> "PULSATE\0"
+   * usplash_write("TIMEOUT", "15") will write "TIMEOUT 15\0"
+   * usplash_write("PULSATE", NULL) will write "PULSATE\0"
    * SEE ALSO
    *         usplash_write(8)
    */
@@ -157,6 +153,7 @@
 	 /proc/<pid>/exe link */
       char exe_target[sizeof(usplash_name)];
       {
+	/* create file name string */
 	char *exe_link;
 	ret = asprintf(&exe_link, "/proc/%s/exe", proc_ent->d_name);
 	if(ret == -1){
@@ -165,6 +162,24 @@
 	  closedir(proc_dir);
 	  return EXIT_FAILURE;
 	}
+	
+	/* Check that it refers to a symlink owned by root:root */
+	struct stat exe_stat;
+	ret = lstat(exe_link, &exe_stat);
+	if(ret == -1){
+	  perror("lstat");
+	  free(exe_link);
+	  free(prompt);
+	  closedir(proc_dir);
+	  return EXIT_FAILURE;
+	}
+	if(not S_ISLNK(exe_stat.st_mode)
+	   or exe_stat.st_uid != 0
+	   or exe_stat.st_gid != 0){
+	  free(exe_link);
+	  continue;
+	}
+	
 	sret = readlink(exe_link, exe_target, sizeof(exe_target));
 	free(exe_link);
 	if(sret == -1){
@@ -253,7 +268,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGINT, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -267,7 +282,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGHUP, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -281,7 +296,7 @@
       free(prompt);
       return EXIT_FAILURE;
     }
-    if (old_action.sa_handler != SIG_IGN){
+    if(old_action.sa_handler != SIG_IGN){
       ret = sigaction(SIGTERM, &new_action, NULL);
       if(ret == -1){
 	perror("sigaction");
@@ -407,13 +422,13 @@
       return EXIT_SUCCESS;
     }
     break;			/* Big */
-  }
+  }				/* end of non-loop while() */
   
   /* If we got here, an error or interrupt must have happened */
   
+  /* Create argc and argv for new usplash*/
   int cmdline_argc = 0;
   char **cmdline_argv = malloc(sizeof(char *));
-  /* Create argv and argc for new usplash*/
   {
     size_t position = 0;
     while(position < cmdline_len){
@@ -433,8 +448,8 @@
     cmdline_argv[cmdline_argc] = NULL;
   }
   /* Kill old usplash */
-    kill(usplash_pid, SIGTERM);
-    sleep(2);
+  kill(usplash_pid, SIGTERM);
+  sleep(2);
   while(kill(usplash_pid, 0) == 0){
     kill(usplash_pid, SIGKILL);
     sleep(1);
@@ -446,7 +461,7 @@
     /* Make the effective user ID (root) the only user ID instead of
        the real user ID (mandos) */
     ret = setuid(geteuid());
-    if (ret == -1){
+    if(ret == -1){
       perror("setuid");
     }
     
@@ -462,7 +477,9 @@
     }
     
     execv(usplash_name, cmdline_argv);
-    perror("execv");
+    if(not interrupted_by_signal){
+      perror("execv");
+    }
     free(cmdline);
     free(cmdline_argv);
     _exit(EXIT_FAILURE);

=== added file 'plugins.d/usplash.xml'
--- plugins.d/usplash.xml	1970-01-01 00:00:00 +0000
+++ plugins.d/usplash.xml	2008-10-04 03:11:39 +0000
@@ -0,0 +1,296 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY COMMANDNAME "usplash">
+<!ENTITY TIMESTAMP "2008-10-04">
+<!ENTITY % common SYSTEM "../common.ent">
+%common;
+]>
+
+<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>Mandos Manual</title>
+    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
+    <productname>Mandos</productname>
+    <productnumber>&version;</productnumber>
+    <date>&TIMESTAMP;</date>
+    <authorgroup>
+      <author>
+	<firstname>Björn</firstname>
+	<surname>Påhlsson</surname>
+	<address>
+	  <email>belorn@fukt.bsnet.se</email>
+	</address>
+      </author>
+      <author>
+	<firstname>Teddy</firstname>
+	<surname>Hogeborn</surname>
+	<address>
+	  <email>teddy@fukt.bsnet.se</email>
+	</address>
+      </author>
+    </authorgroup>
+    <copyright>
+      <year>2008</year>
+      <holder>Teddy Hogeborn</holder>
+      <holder>Björn Påhlsson</holder>
+    </copyright>
+    <xi:include href="../legalnotice.xml"/>
+  </refentryinfo>
+  
+  <refmeta>
+    <refentrytitle>&COMMANDNAME;</refentrytitle>
+    <manvolnum>8mandos</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname><command>&COMMANDNAME;</command></refname>
+    <refpurpose>Mandos plugin to use usplash to get a
+    password.</refpurpose>
+  </refnamediv>
+  
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>&COMMANDNAME;</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+  
+  <refsect1 id="description">
+    <title>DESCRIPTION</title>
+    <para>
+      This program prompts for a password using <citerefentry>
+      <refentrytitle>usplash</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry> and outputs any given password to standard
+      output.  If no <citerefentry><refentrytitle
+      >usplash</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      process can be found, this program will immediately exit with an
+      exit code indicating failure.
+    </para>
+    <para>
+      This program is not very useful on its own.  This program is
+      really meant to run as a plugin in the <application
+      >Mandos</application> client-side system, where it is used as a
+      fallback and alternative to retrieving passwords from a
+      <application >Mandos</application> server.
+    </para>
+    <para>
+      If this program is killed (presumably by
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry> because some other
+      plugin provided the password), it cannot tell <citerefentry>
+      <refentrytitle>usplash</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry> to abort requesting a password, because
+      <citerefentry><refentrytitle>usplash</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> does not support this.
+      Therefore, this program will then <emphasis>kill</emphasis> the
+      running <citerefentry><refentrytitle>usplash</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> process and start a
+      <emphasis>new</emphasis> one using the same command line
+      arguments as the old one was using.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="options">
+    <title>OPTIONS</title>
+    <para>
+      This program takes no options.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="exit_status">
+    <title>EXIT STATUS</title>
+    <para>
+      If exit status is 0, the output from the program is the password
+      as it was read.  Otherwise, if exit status is other than 0, the
+      program was interrupted or encountered an error, and any output
+      so far could be corrupt and/or truncated, and should therefore
+      be ignored.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="environment">
+    <title>ENVIRONMENT</title>
+    <variablelist>
+      <varlistentry>
+	<term><envar>cryptsource</envar></term>
+	<term><envar>crypttarget</envar></term>
+	<listitem>
+	  <para>
+	    If set, these environment variables will be assumed to
+	    contain the source device name and the target device
+	    mapper name, respectively, and will be shown as part of
+	    the prompt.
+	</para>
+	<para>
+	  These variables will normally be inherited from
+	  <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+	  <manvolnum>8mandos</manvolnum></citerefentry>, which will
+	  normally have inherited them from
+	  <filename>/scripts/local-top/cryptroot</filename> in the
+	  initial <acronym>RAM</acronym> disk environment, which will
+	  have set them from parsing kernel arguments and
+	  <filename>/conf/conf.d/cryptroot</filename> (also in the
+	  initial RAM disk environment), which in turn will have been
+	  created when the initial RAM disk image was created by
+	  <filename
+	  >/usr/share/initramfs-tools/hooks/cryptroot</filename>, by
+	  extracting the information of the root file system from
+	  <filename >/etc/crypttab</filename>.
+	</para>
+	<para>
+	  This behavior is meant to exactly mirror the behavior of
+	  <command>askpass</command>, the default password prompter.
+	</para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+  
+  <refsect1 id="files">
+    <title>FILES</title>
+    <variablelist>
+      <varlistentry>
+	<term><filename>/dev/.initramfs/usplash_fifo</filename></term>
+	<listitem>
+	  <para>
+	    This is the <acronym>FIFO</acronym> to where this program
+	    will write the commands for <citerefentry><refentrytitle
+	    >usplash</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>.  See <citerefentry><refentrytitle
+	    >fifo</refentrytitle><manvolnum>7</manvolnum>
+	    </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/dev/.initramfs/usplash_outfifo</filename></term>
+	<listitem>
+	  <para>
+	    This is the <acronym>FIFO</acronym> where this program
+	    will read the password from <citerefentry><refentrytitle
+	    >usplash</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>.  See <citerefentry><refentrytitle
+	    >fifo</refentrytitle><manvolnum>7</manvolnum>
+	    </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/proc</filename></term>
+	<listitem>
+	  <para>
+	    To find the running <citerefentry><refentrytitle
+	    >usplash</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>, this directory will be searched for
+	    numeric entries which will be assumed to be directories.
+	    In all those directories, the <filename>exe</filename> and
+	    <filename>cmdline</filename> entries will be used to
+	    determine the name of the running binary, effective user
+	    and group <abbrev>ID</abbrev>, and the command line
+	    arguments.  See <citerefentry><refentrytitle
+	    >proc</refentrytitle><manvolnum>5</manvolnum>
+	    </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+      <varlistentry>
+	<term><filename>/sbin/usplash</filename></term>
+	<listitem>
+	  <para>
+	    This is the name of the binary which will be searched for
+	    in the process list.  See <citerefentry><refentrytitle
+	    >usplash</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>.
+	  </para>
+	</listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+  
+  <refsect1 id="bugs">
+    <title>BUGS</title>
+    <para>
+      Killing <citerefentry><refentrytitle>usplash</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry> and starting a new one
+      is ugly, but necessary as long as it does not support aborting a
+      password request.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="example">
+    <title>EXAMPLE</title>
+    <para>
+      Note that normally, this program will not be invoked directly,
+      but instead started by the Mandos <citerefentry><refentrytitle
+      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
+      </citerefentry>.
+    </para>
+    <informalexample>
+      <para>
+	This program takes no options.
+      </para>
+      <para>
+	<userinput>&COMMANDNAME;</userinput>
+      </para>
+    </informalexample>
+  </refsect1>
+  
+  <refsect1 id="security">
+    <title>SECURITY</title>
+    <para>
+      If this program is killed by a signal, it will kill the process
+      <abbrev>ID</abbrev> which at the start of this program was
+      determined to run <citerefentry><refentrytitle
+      >usplash</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      as root (see also <xref linkend="files"/>).  There is a very
+      slight risk that, in the time between those events, that process
+      <abbrev>ID</abbrev> was freed and then taken up by another
+      process; the wrong process would then be killed.  Now, this
+      program can only be killed by the user who started it; see
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>.  This program
+      should therefore be started by a completely separate
+      non-privileged user, and no other programs should be allowed to
+      run as that special user.  This means that it is not recommended
+      to use the user "nobody" to start this program, as other
+      possibly less trusted programs could be running as "nobody", and
+      they would then be able to kill this program, triggering the
+      killing of the process <abbrev>ID</abbrev> which may or may not
+      be <citerefentry><refentrytitle>usplash</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>.
+    </para>
+    <para>
+      The only other thing that could be considered worthy of note is
+      this:  This program is meant to be run by <citerefentry>
+      <refentrytitle>plugin-runner</refentrytitle><manvolnum
+      >8mandos</manvolnum></citerefentry>, and will, when run
+      standalone, outside, in a normal environment, immediately output
+      on its standard output any presumably secret password it just
+      received.  Therefore, when running this program standalone
+      (which should never normally be done), take care not to type in
+      any real secret password by force of habit, since it would then
+      immediately be shown as output.
+    </para>
+  </refsect1>
+  
+  <refsect1 id="see_also">
+    <title>SEE ALSO</title>
+    <para>
+      <citerefentry><refentrytitle>crypttab</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>fifo</refentrytitle>
+      <manvolnum>7</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
+      <manvolnum>8mandos</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>proc</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>usplash</refentrytitle>
+      <manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+</refentry>
+<!-- Local Variables: -->
+<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
+<!-- time-stamp-end: "[\"']>" -->
+<!-- time-stamp-format: "%:y-%02m-%02d" -->
+<!-- End: -->