diff --git a/postfix/HISTORY b/postfix/HISTORY index d08f791d6..5bdc156d7 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -14397,3 +14397,17 @@ Apologies for any names omitted. Cleanup: using "Before-queue content filter", RFC3848 information was not added to the headers. Carlos Velasco. File smtpd/smtpd.c. + +20080717 + + Cleanup: a poorly-implemented integer overflow check for + TCP MSS calculation had the unexpected effect that people + broke Postfix on LP64 systems while attempting to silence + a compiler warning. File: util/vstream_tweak.c. + +20080725 + + Paranoia: defer delivery when a mailbox file is not owned + by the recipient. Requested by Sebastian Krahmer, SuSE. + Specify "strict_mailbox_ownership=no" to ignore ownership + discrepancies. Files: local/mailbox.c, virtual/mailbox.c. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index f560d3b5d..14fd19aa1 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -11,8 +11,16 @@ instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. -Incompatibility with Postfix 2.3 and earlier --------------------------------------------- +Incompatibility with Postfix 2.5.3 +================================== + +When a mailbox file is not owned by its recipient, the local and +virtual delivery agents now log a warning and defer delivery. +Specify "strict_mailbox_ownership = no" to ignore such ownership +discrepancies. + +Postfix 2.5.0 Release Notes +=========================== If you upgrade from Postfix 2.3 or earlier, read RELEASE_NOTES-2.4 before proceeding. diff --git a/postfix/html/local.8.html b/postfix/html/local.8.html index 6a5ff6c17..e43fdb985 100644 --- a/postfix/html/local.8.html +++ b/postfix/html/local.8.html @@ -398,60 +398,66 @@ LOCAL(8) LOCAL(8) attempt; do not update the Delivered-To: address while expanding aliases or .forward files. + Available in Postfix version 2.5.3 and later: + + strict_mailbox_ownership (yes) + Defer delivery when a mailbox file is not owned by + its recipient. + DELIVERY METHOD CONTROLS - The precedence of local(8) delivery methods from high to - low is: aliases, .forward files, mailbox_transport_maps, - mailbox_transport, mailbox_command_maps, mailbox_command, - home_mailbox, mail_spool_directory, fallback_trans- + The precedence of local(8) delivery methods from high to + low is: aliases, .forward files, mailbox_transport_maps, + mailbox_transport, mailbox_command_maps, mailbox_command, + home_mailbox, mail_spool_directory, fallback_trans- port_maps, fallback_transport, and luser_relay. alias_maps (see 'postconf -d' output) - The alias databases that are used for local(8) + The alias databases that are used for local(8) delivery. forward_path (see 'postconf -d' output) The local(8) delivery agent search list for finding - a .forward file with user-specified delivery meth- + a .forward file with user-specified delivery meth- ods. mailbox_transport_maps (empty) - Optional lookup tables with per-recipient message - delivery transports to use for local(8) mailbox - delivery, whether or not the recipients are found + Optional lookup tables with per-recipient message + delivery transports to use for local(8) mailbox + delivery, whether or not the recipients are found in the UNIX passwd database. mailbox_transport (empty) - Optional message delivery transport that the - local(8) delivery agent should use for mailbox - delivery to all local recipients, whether or not + Optional message delivery transport that the + local(8) delivery agent should use for mailbox + delivery to all local recipients, whether or not they are found in the UNIX passwd database. mailbox_command_maps (empty) - Optional lookup tables with per-recipient external + Optional lookup tables with per-recipient external commands to use for local(8) mailbox delivery. mailbox_command (empty) - Optional external command that the local(8) deliv- + Optional external command that the local(8) deliv- ery agent should use for mailbox delivery. home_mailbox (empty) - Optional pathname of a mailbox file relative to a + Optional pathname of a mailbox file relative to a local(8) user's home directory. mail_spool_directory (see 'postconf -d' output) - The directory where local(8) UNIX-style mailboxes + The directory where local(8) UNIX-style mailboxes are kept. fallback_transport_maps (empty) - Optional lookup tables with per-recipient message - delivery transports for recipients that the - local(8) delivery agent could not find in the + Optional lookup tables with per-recipient message + delivery transports for recipients that the + local(8) delivery agent could not find in the aliases(5) or UNIX password database. fallback_transport (empty) - Optional message delivery transport that the - local(8) delivery agent should use for names that - are not found in the aliases(5) or UNIX password + Optional message delivery transport that the + local(8) delivery agent should use for names that + are not found in the aliases(5) or UNIX password database. luser_relay (empty) @@ -461,7 +467,7 @@ LOCAL(8) LOCAL(8) Available in Postfix version 2.2 and later: command_execution_directory (empty) - The local(8) delivery agent working directory for + The local(8) delivery agent working directory for delivery to external command. MAILBOX LOCKING CONTROLS @@ -470,15 +476,15 @@ LOCAL(8) LOCAL(8) sive lock on a mailbox file or bounce(8) logfile. deliver_lock_delay (1s) - The time between attempts to acquire an exclusive + The time between attempts to acquire an exclusive lock on a mailbox file or bounce(8) logfile. stale_lock_time (500s) - The time after which a stale exclusive mailbox + The time after which a stale exclusive mailbox lockfile is removed. mailbox_delivery_lock (see 'postconf -d' output) - How to lock a UNIX-style local(8) mailbox before + How to lock a UNIX-style local(8) mailbox before attempting delivery. RESOURCE AND RATE CONTROLS @@ -486,17 +492,17 @@ LOCAL(8) LOCAL(8) Time limit for delivery to external commands. duplicate_filter_limit (1000) - The maximal number of addresses remembered by the - address duplicate filter for aliases(5) or vir- + The maximal number of addresses remembered by the + address duplicate filter for aliases(5) or vir- tual(5) alias expansion, or for showq(8) queue dis- plays. local_destination_concurrency_limit (2) - The maximal number of parallel deliveries via the + The maximal number of parallel deliveries via the local mail delivery transport to the same recipient - (when "local_destination_recipient_limit = 1") or - the maximal number of parallel deliveries to the - same local domain (when "local_destination_recipi- + (when "local_destination_recipient_limit = 1") or + the maximal number of parallel deliveries to the + same local domain (when "local_destination_recipi- ent_limit > 1"). local_destination_recipient_limit (1) @@ -509,33 +515,39 @@ LOCAL(8) LOCAL(8) SECURITY CONTROLS allow_mail_to_commands (alias, forward) - Restrict local(8) mail delivery to external com- + Restrict local(8) mail delivery to external com- mands. allow_mail_to_files (alias, forward) - Restrict local(8) mail delivery to external files. + Restrict local(8) mail delivery to external files. command_expansion_filter (see 'postconf -d' output) - Restrict the characters that the local(8) delivery - agent allows in $name expansions of $mailbox_com- - mand. + Restrict the characters that the local(8) delivery + agent allows in $name expansions of $mailbox_com- + mand and $command_execution_directory. default_privs (nobody) - The default rights used by the local(8) delivery + The default rights used by the local(8) delivery agent for delivery to external file or command. forward_expansion_filter (see 'postconf -d' output) - Restrict the characters that the local(8) delivery - agent allows in $name expansions of $forward_path. + Restrict the characters that the local(8) delivery + agent allows in $name expansions of $forward_path. Available in Postfix version 2.2 and later: execution_directory_expansion_filter (see 'postconf -d' output) - Restrict the characters that the local(8) delivery + Restrict the characters that the local(8) delivery agent allows in $name expansions of $command_execu- tion_directory. + Available in Postfix version 2.5.3 and later: + + strict_mailbox_ownership (yes) + Defer delivery when a mailbox file is not owned by + its recipient. + MISCELLANEOUS CONTROLS config_directory (see 'postconf -d' output) The default location of the Postfix main.cf and diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index f442ec2c5..9166671ce 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -12495,6 +12495,17 @@ This feature is available in Postfix 2.0 and later.
+ + +Defer delivery when a mailbox file is not owned by its recipient. +The default setting is not backwards compatible.
+ +This feature is available in Postfix 2.5.3 and later.
+ +This feature is available in Postfix 2.5 and later.
+%PARAM strict_mailbox_ownership yes + +Defer delivery when a mailbox file is not owned by its recipient. +The default setting is not backwards compatible.
+ +This feature is available in Postfix 2.5.3 and later.
diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index fe7dd5db8..ca9d1cf48 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -2932,6 +2932,13 @@ extern int var_dest_rate_delay; #define DEF_STRESS "" extern char *var_stress; + /* + * Mailbox ownership. + */ +#define VAR_STRICT_MBOX_OWNER "strict_mailbox_ownership" +#define DEF_STRICT_MBOX_OWNER 1 +extern bool var_strict_mbox_owner; + /* LICENSE /* .ad /* .fi diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index a91ed72cb..7e7bcf5d8 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,8 +20,8 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20080711" -#define MAIL_VERSION_NUMBER "2.5.3-RC1" +#define MAIL_RELEASE_DATE "20080726" +#define MAIL_VERSION_NUMBER "2.5.3" #ifdef SNAPSHOT # define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE diff --git a/postfix/src/local/local.c b/postfix/src/local/local.c index 6300111af..33af0ad76 100644 --- a/postfix/src/local/local.c +++ b/postfix/src/local/local.c @@ -381,6 +381,10 @@ /* address (see prepend_delivered_header) only once, at the start of /* a delivery attempt; do not update the Delivered-To: address while /* expanding aliases or .forward files. +/* .PP +/* Available in Postfix version 2.5.3 and later: +/* .IP "\fBstrict_mailbox_ownership (yes)\fR" +/* Defer delivery when a mailbox file is not owned by its recipient. /* DELIVERY METHOD CONTROLS /* .ad /* .fi @@ -471,7 +475,7 @@ /* Restrict \fBlocal\fR(8) mail delivery to external files. /* .IP "\fBcommand_expansion_filter (see 'postconf -d' output)\fR" /* Restrict the characters that the \fBlocal\fR(8) delivery agent allows in -/* $name expansions of $mailbox_command. +/* $name expansions of $mailbox_command and $command_execution_directory. /* .IP "\fBdefault_privs (nobody)\fR" /* The default rights used by the \fBlocal\fR(8) delivery agent for delivery /* to external file or command. @@ -483,6 +487,10 @@ /* .IP "\fBexecution_directory_expansion_filter (see 'postconf -d' output)\fR" /* Restrict the characters that the \fBlocal\fR(8) delivery agent allows /* in $name expansions of $command_execution_directory. +/* .PP +/* Available in Postfix version 2.5.3 and later: +/* .IP "\fBstrict_mailbox_ownership (yes)\fR" +/* Defer delivery when a mailbox file is not owned by its recipient. /* MISCELLANEOUS CONTROLS /* .ad /* .fi @@ -644,6 +652,7 @@ int var_mailtool_compat; char *var_mailbox_lock; int var_mailbox_limit; bool var_frozen_delivered; +bool var_strict_mbox_owner; int local_cmd_deliver_mask; int local_file_deliver_mask; @@ -891,6 +900,7 @@ int main(int argc, char **argv) VAR_STAT_HOME_DIR, DEF_STAT_HOME_DIR, &var_stat_home_dir, VAR_MAILTOOL_COMPAT, DEF_MAILTOOL_COMPAT, &var_mailtool_compat, VAR_FROZEN_DELIVERED, DEF_FROZEN_DELIVERED, &var_frozen_delivered, + VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner, 0, }; diff --git a/postfix/src/local/mailbox.c b/postfix/src/local/mailbox.c index 92bd79d67..d35ef66b4 100644 --- a/postfix/src/local/mailbox.c +++ b/postfix/src/local/mailbox.c @@ -194,6 +194,12 @@ static int deliver_mailbox_file(LOCAL_STATE state, USER_ATTR usr_attr) vstream_fclose(mp->fp); dsb_simple(why, "5.2.0", "destination %s is not a regular file", mailbox); + } else if (var_strict_mbox_owner && st.st_uid != usr_attr.uid) { + vstream_fclose(mp->fp); + dsb_simple(why, "4.2.0", + "destination %s is not owned by recipient", mailbox); + msg_warn("specify \"%s = no\" to ignore mailbox ownership mismatch", + VAR_STRICT_MBOX_OWNER); } else { end = vstream_fseek(mp->fp, (off_t) 0, SEEK_END); mail_copy_status = mail_copy(COPY_ATTR(state.msg_attr), mp->fp, diff --git a/postfix/src/util/vstream_tweak.c b/postfix/src/util/vstream_tweak.c index d1afac8fd..a9dc8bd1b 100644 --- a/postfix/src/util/vstream_tweak.c +++ b/postfix/src/util/vstream_tweak.c @@ -115,7 +115,7 @@ int vstream_tweak_tcp(VSTREAM *fp) */ #ifdef VSTREAM_CTL_BUFSIZE if (mss > 0) { - if (mss < __MAXINT__(ssize_t) /2) + if (mss < INT_MAX / 2) mss *= 2; vstream_control(fp, VSTREAM_CTL_BUFSIZE, (ssize_t) mss, diff --git a/postfix/src/virtual/mailbox.c b/postfix/src/virtual/mailbox.c index 09fc54bb0..f0ad6eb4a 100644 --- a/postfix/src/virtual/mailbox.c +++ b/postfix/src/virtual/mailbox.c @@ -125,6 +125,12 @@ static int deliver_mailbox_file(LOCAL_STATE state, USER_ATTR usr_attr) msg_warn("recipient %s: destination %s is not a regular file", state.msg_attr.rcpt.address, usr_attr.mailbox); dsb_simple(why, "5.3.5", "mail system configuration error"); + } else if (var_strict_mbox_owner && st.st_uid != usr_attr.uid) { + vstream_fclose(mp->fp); + dsb_simple(why, "4.2.0", + "destination %s is not owned by recipient", usr_attr.mailbox); + msg_warn("specify \"%s = no\" to ignore mailbox ownership mismatch", + VAR_STRICT_MBOX_OWNER); } else { end = vstream_fseek(mp->fp, (off_t) 0, SEEK_END); mail_copy_status = mail_copy(COPY_ATTR(state.msg_attr), mp->fp, diff --git a/postfix/src/virtual/virtual.c b/postfix/src/virtual/virtual.c index 88d969ca5..835f53bf7 100644 --- a/postfix/src/virtual/virtual.c +++ b/postfix/src/virtual/virtual.c @@ -183,6 +183,10 @@ /* .IP "\fBvirtual_transport (virtual)\fR" /* The default mail delivery transport and next-hop destination for /* final delivery to domains listed with $virtual_mailbox_domains. +/* .PP +/* Available in Postfix version 2.5.3 and later: +/* .IP "\fBstrict_mailbox_ownership (yes)\fR" +/* Defer delivery when a mailbox file is not owned by its recipient. /* LOCKING CONTROLS /* .ad /* .fi @@ -329,6 +333,7 @@ char *var_virt_mailbox_base; char *var_virt_mailbox_lock; int var_virt_mailbox_limit; char *var_mail_spool_dir; /* XXX dependency fix */ +bool var_strict_mbox_owner; /* * Mappings. @@ -504,6 +509,10 @@ int main(int argc, char **argv) VAR_VIRT_MAILBOX_LOCK, DEF_VIRT_MAILBOX_LOCK, &var_virt_mailbox_lock, 1, 0, 0, }; + static const CONFIG_BOOL_TABLE bool_table[] = { + VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner, + 0, + }; /* * Fingerprint executables and core dumps. @@ -513,6 +522,7 @@ int main(int argc, char **argv) single_server_main(argc, argv, local_service, MAIL_SERVER_INT_TABLE, int_table, MAIL_SERVER_STR_TABLE, str_table, + MAIL_SERVER_BOOL_TABLE, bool_table, MAIL_SERVER_PRE_INIT, pre_init, MAIL_SERVER_POST_INIT, post_init, MAIL_SERVER_PRE_ACCEPT, pre_accept,