cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Have check_mailscanner pick up the "Run As User" setting from

Browse Source 
MailScanner.conf and explicitly start as that user. This avoids setuid
in perl (triggering taint mode) and so it sidesteps taint mode fallout
which has appeared recently, most likely due to the CVE-2011-1487 fix
in Perl.

Maintainer believed to be away this week, so committing now and we
can change it later if he disagrees when he returns.   ok todd@
This commit is contained in:
sthen 2011-04-21 20:25:35 +00:00
parent f2a8537a69
commit e3cbc9ab0b
2 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
mail/mailscanner/Makefile
View File

@ -1,10 +1,11 @@
# $OpenBSD: Makefile,v 1.39 2011/03/24 09:55:30 sthen Exp $
# $OpenBSD: Makefile,v 1.40 2011/04/21 20:25:35 sthen Exp $
COMMENT= virus/spam scanning framework
V= 4.83
Vs= 4
Vss= ${Vs}-1
REVISION= 0
CATEGORIES= mail
MASTER_SITES= http://mailscanner.info/files/4/tar/
DISTNAME= mailscanner-${V}.${Vss}

17
mail/mailscanner/patches/patch-bin_check_mailscanner
View File

@ -1,6 +1,6 @@
$OpenBSD: patch-bin_check_mailscanner,v 1.1.1.1 2008/02/20 03:47:18 todd Exp $
--- bin/check_mailscanner.orig Sat Mar 11 11:25:43 2006
+++ bin/check_mailscanner Wed Mar 22 20:44:27 2006
$OpenBSD: patch-bin_check_mailscanner,v 1.2 2011/04/21 20:25:35 sthen Exp $
--- bin/check_mailscanner.orig Wed Mar 16 19:41:34 2011
+++ bin/check_mailscanner Thu Apr 21 18:41:07 2011
@@ -42,8 +42,8 @@
# unless MailScanner actually had to be started.
@ -12,3 +12,14 @@ $OpenBSD: patch-bin_check_mailscanner,v 1.1.1.1 2008/02/20 03:47:18 todd Exp $
# These seem to get put all over the shop...
PATH=/usr/bin:/bin
@@ -121,7 +121,9 @@ if [ "x$pid" = "x" ]; then
PATH=${msbindir}:$PATH
echo -n 'Starting MailScanner...'
cd $msbindir
- $process $config 2>/dev/null || RETVALUE=" Failed."
+ username=$(awk '/^Run As User/ {print $5;}' /etc/MailScanner/MailScanner.conf)
+ [ -n "$username" -a "$(whoami)" != "$username" ] && preamble="su -l -s /bin/sh $username -c "
+ $preamble $process $config 2>/dev/null || RETVALUE=" Failed."
echo "$RETVALUE"
else
if [ "x$1" != "x-q" ]; then