From patchwork Mon Jun 8 17:46:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Cournoyer X-Patchwork-Id: 22615 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 270D727BBE3; Mon, 8 Jun 2020 18:47:12 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,T_DKIM_INVALID,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTP id 8EB3227BBE1 for ; Mon, 8 Jun 2020 18:47:10 +0100 (BST) Received: from localhost ([::1]:46710 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jiLrZ-0000F2-N6 for patchwork@mira.cbaines.net; Mon, 08 Jun 2020 13:47:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:52886) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jiLrS-0000Ep-9O for guix-patches@gnu.org; Mon, 08 Jun 2020 13:47:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:46301) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jiLrS-0001yz-0F for guix-patches@gnu.org; Mon, 08 Jun 2020 13:47:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1jiLrR-0000Uj-U1 for guix-patches@gnu.org; Mon, 08 Jun 2020 13:47:01 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#41763] services: opensmtpd: Fix the setgid problem for the smtpctl utility. Resent-From: maxim.cournoyer@gmail.com Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Mon, 08 Jun 2020 17:47:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 41763 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: To: 41763@debbugs.gnu.org Cc: Christopher Baines X-Debbugs-Original-To: guix-patches Received: via spool by submit@debbugs.gnu.org id=B.15916384111883 (code B ref -1); Mon, 08 Jun 2020 17:47:01 +0000 Received: (at submit) by debbugs.gnu.org; 8 Jun 2020 17:46:51 +0000 Received: from localhost ([127.0.0.1]:57847 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jiLrG-0000UI-QL for submit@debbugs.gnu.org; Mon, 08 Jun 2020 13:46:51 -0400 Received: from lists.gnu.org ([209.51.188.17]:49030) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jiLrE-0000UA-Ok for submit@debbugs.gnu.org; Mon, 08 Jun 2020 13:46:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:52868) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jiLrD-0000EI-Sa for guix-patches@gnu.org; Mon, 08 Jun 2020 13:46:48 -0400 Received: from mail-qk1-x734.google.com ([2607:f8b0:4864:20::734]:34520) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jiLrB-0001uT-W3 for guix-patches@gnu.org; Mon, 08 Jun 2020 13:46:47 -0400 Received: by mail-qk1-x734.google.com with SMTP id f18so18144662qkh.1 for ; Mon, 08 Jun 2020 10:46:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version; bh=YXsJhIXSYJ+Rdp1JYxGf+ixFNFRfw1N4VxDDYTiXwCk=; b=Ojpye49MZXW2a6DcDHi+7z14Hvrhr7dlrTCafFVh1uOuaKHnXAuA40ulJaEEgAEouE isfnN5+r3TQKl5pp5TC06oc+EFHrkrjFvD/N5BI1i7GNyVLXjfHeE1NELy3auFOrdiTe DNE3aG/UILoNMlLKIEzC9iVCNXlEG8oyeDpXJ0NDk2VSDGx0keYFxEY9gyqWsj2/od4k /eZH7B40TK6IAqBKROn3hOEQ+r5p4rgG479bXWho7Ar/lCiE9cr1te3VWuXhDcz7Vymu zyarPo5gIO7KLWBtoimtT2lz5mryY4bm0nUD9IajqBvFkUh6C+Wp+Vb2AGCQEPS3T0fj abVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version; bh=YXsJhIXSYJ+Rdp1JYxGf+ixFNFRfw1N4VxDDYTiXwCk=; b=XoQGYpTZzxSsaMH1q7a0UYqVgFD4tkSbezUcke/Z8jOvVQPhNqo5UAgnH2etH/o8xU 9DC3qp3ljZ75ptGcTcofb9W9QuQNSWbA1EH7B4Gy83B6eXgRi1pIAVyS0Uz6XHHGeWw0 QkrHbIZWABkaA68RcGChbgszfvs1C8sKh+O1LW9AZd1GH5C3sKFGzSbEYn1ksiDk8TXH T+RT6FUWkdFRx/IXVvNmywRuZUFhhJ2zQKY7fitNX/KpefT+6saYqxHB0vO+THq7IS7Q Fl7ntcRZeudyU4L4+0RyTSXgHWdyVb2fiPZK/NQuHK4iGl18b8S7ephfmiZouwP+Egm6 9AcQ== X-Gm-Message-State: AOAM532P/vXh/ThwNovF9GJtkvRO9aX0iM/jwulHtB5iBit4suSK3mSM xhTa04z2fkBY7l4FpRr2jW3u6drLIT0= X-Google-Smtp-Source: ABdhPJydwxHQHRTPZaqAuEJirGCBhW7dglmExIeCuMlFmwNZiy4aL/ZKkw2qWf9kzC53hnRYv+JKZg== X-Received: by 2002:a05:620a:8cd:: with SMTP id z13mr22168575qkz.54.1591638404324; Mon, 08 Jun 2020 10:46:44 -0700 (PDT) Received: from hurd (dsl-152-235.b2b2c.ca. [66.158.152.235]) by smtp.gmail.com with ESMTPSA id x36sm8037092qtd.97.2020.06.08.10.46.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Jun 2020 10:46:43 -0700 (PDT) From: maxim.cournoyer@gmail.com Date: Mon, 08 Jun 2020 13:46:37 -0400 Message-ID: <87eeqpih6q.fsf@hurd.i-did-not-set--mail-host-address--so-tickle-me> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::734; envelope-from=maxim.cournoyer@gmail.com; helo=mail-qk1-x734.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches Hello! The following patches provide a mean to specify a user and group for a setuid program, and uses that to fix a setgid permission issue in the context of the opensmtpd service. Christopher, you should be able to leverage this new facility to configure the uid/gid of the sendmail program to that of the smtpq user, like this: --8<---------------cut here---------------start------------->8--- (operating-system) [...] (setuid-programs (cons (list (file-append sendmail "/usr/sbin/sendmail") "smtpq") %setuid-programs)) --8<---------------cut here---------------end--------------->8--- The smtpq user is created as part of the OpenSMTPD service definition. Thank you, Maxim From 52a1a031e6a7c0196cf17d0bd32061d02b453df8 Mon Sep 17 00:00:00 2001 From: Maxim Cournoyer Date: Sun, 7 Jun 2020 23:52:00 -0400 Subject: [PATCH 3/3] services: opensmtpd: Fix the setgid problem for the smtpctl utility. The utility was complaining that it wasn't setgid to the group ID of the "smtpq" group. * gnu/services/mail.scm (opensmtpd-service-type): Extend the setuid-program-service-type with the smtpctl program. --- gnu/services/mail.scm | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index 7c49d99e9f..96efbd951d 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -1662,6 +1662,11 @@ match from local for any action outbound (home-directory "/var/empty") (shell (file-append shadow "/sbin/nologin"))))) +(define (opensmtpd-setuid-programs opensmtpd-configuration) + (let ((smtpctl (file-append (opensmtpd-configuration-package + opensmtpd-configuration) "/sbin/smtpctl"))) + (list (list smtpctl "smtpq")))) + (define opensmtpd-activation (match-lambda (($ package config-file) @@ -1683,6 +1688,8 @@ match from local for any action outbound (extensions (list (service-extension account-service-type (const %opensmtpd-accounts)) + (service-extension setuid-program-service-type + opensmtpd-setuid-programs) (service-extension activation-service-type opensmtpd-activation) (service-extension pam-root-service-type -- 2.26.2