mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-08-30 05:38:06 +00:00
Code Issues Releases Wiki Activity

postfix-2.6-20080814

Browse Source
This commit is contained in:
Wietse Venema 2008-08-14 00:00:00 -05:00 committed by Viktor Dukhovni
parent 7e3ab00293
commit acb84351c9
4 changed files with 41 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
postfix/HISTORY
View File

@ -14549,3 +14549,23 @@ Apologies for any names omitted.
Paranoia: defer delivery when a mailbox file is not owned
by the recipient. Sebastian Krahmer, SuSE. Files:
local/mailbox.c, virtual/mailbox.c.
20080804
Bugfix: dangling pointer in vstring_sprintf_prepend().
File: util/vstring.c.
20080814
Security: some systems have changed their link() semantics,
and will hardlink a symlink, contrary to POSIX and XPG4.
Sebastian Krahmer, SuSE. File: util/safe_open.c.
The solution introduces the following incompatible change:
when the target of mail delivery is a symlink, the parent
directory of that symlink must now be writable by root only
(in addition to the already existing requirement that the
symlink itself is owned by root). This change will break
legitimate configurations that deliver mail to a symbolic
link in a directory with less restrictive permissions.

2
postfix/src/global/mail_version.h
View File

@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
#define MAIL_RELEASE_DATE "20080726"
#define MAIL_RELEASE_DATE "20080814"
#define MAIL_VERSION_NUMBER "2.6"
#ifdef SNAPSHOT

21
postfix/src/util/safe_open.c
View File

@ -83,6 +83,7 @@
#include <msg.h>
#include <vstream.h>
#include <vstring.h>
#include <stringops.h>
#include <safe_open.h>
/* safe_open_exist - open existing file */
@ -138,13 +139,29 @@ static VSTREAM *safe_open_exist(const char *path, int flags,
* for symlinks owned by root. NEVER, NEVER, make exceptions for symlinks
* owned by a non-root user. This would open a security hole when
* delivering mail to a world-writable mailbox directory.
*
* Sebastian Krahmer of SuSE brought to my attention that some systems have
* changed their semantics of link(symlink, newpath), such that the
* result is a hardlink to the symlink. For this reason, we now also
* require that the symlink's parent directory is writable only by root.
*/
else if (lstat(path, &lstat_st) < 0) {
vstring_sprintf(why, "file status changed unexpectedly: %m");
errno = EPERM;
} else if (S_ISLNK(lstat_st.st_mode)) {
if (lstat_st.st_uid == 0)
return (fp);
if (lstat_st.st_uid == 0) {
VSTRING *parent_buf = vstring_alloc(100);
const char *parent_path = sane_dirname(parent_buf, path);
struct stat parent_st;
int parent_ok;
parent_ok = (stat(parent_path, &parent_st) == 0 /* not lstat */
&& parent_st.st_uid == 0
&& (parent_st.st_mode & (S_IWGRP | S_IWOTH)) == 0);
vstring_free(parent_buf);
if (parent_ok)
return (fp);
}
vstring_sprintf(why, "file is a symbolic link");
errno = EPERM;
} else if (fstat_st->st_dev != lstat_st.st_dev

1
postfix/src/util/vstring.c
View File

@ -624,6 +624,7 @@ VSTRING *vstring_sprintf_prepend(VSTRING *vp, const char *format,...)
result_len = VSTRING_LEN(vp);
/* Construct: old|new|old|free */
VSTRING_SPACE(vp, old_len);
vstring_memcat(vp, vstring_str(vp), old_len);
/* Construct: new|old|free */