diff options
| author | Maya <maya.omase@protonmail.com> | 2022-07-25 09:02:18 +0000 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2022-08-01 14:08:08 +0200 |
| commit | dd3cf144028ccd4e12b32133846525e97101d9cd (patch) | |
| tree | f0163db2b61e33e9cb94df4f325173690f5924a6 | |
| parent | 432ea6446dd52a5ce04ef9a1c6874656c4c3dc84 (diff) | |
services: opensmtpd: Make commands setgid to "smtpq" by default.
This is a patch that fixes "<executable name>: this program must be setgid smtpq".
* gnu/services/mail.scm (<opensmtpd-configuration>)[setgid-commands?]: New field.
(opensmtpd-set-gids): New procedure.
(opensmtpd-service-type)[extensions]: Add SETUID-PROGRAM-SERVICE-TYPE extension.
* doc/guix.texi (Mail Services): Document it.
Co-authored-by: Ludovic Courtès <ludo@gnu.org>
| -rw-r--r-- | doc/guix.texi | 5 | ||||
| -rw-r--r-- | gnu/services/mail.scm | 45 |
2 files changed, 48 insertions, 2 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index 271aad32f0..fc6f477c9a 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -25149,6 +25149,11 @@ it listens on the loopback network interface, and allows for mail from users and daemons on the local machine, as well as permitting email to remote servers. Run @command{man smtpd.conf} for more information. +@item @code{setgid-commands?} (default: @code{#t}) +Make the following commands setgid to @code{smtpq} so they can be +executed: @command{smtpctl}, @command{sendmail}, @command{send-mail}, +@command{makemap}, @command{mailq}, and @command{newaliases}. +@xref{Setuid Programs}, for more information on setgid programs. @end table @end deftp diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index 10e6523861..43f144a42d 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -30,6 +30,7 @@ #:use-module (gnu services shepherd) #:use-module (gnu system pam) #:use-module (gnu system shadow) + #:use-module (gnu system setuid) #:use-module (gnu packages mail) #:use-module (gnu packages admin) #:use-module (gnu packages dav) @@ -1653,7 +1654,8 @@ by @code{dovecot-configuration}. @var{config} may also be created by (package opensmtpd-configuration-package (default opensmtpd)) (config-file opensmtpd-configuration-config-file - (default %default-opensmtpd-config-file))) + (default %default-opensmtpd-config-file)) + (setgid-commands? opensmtpd-setgid-commands? (default #t))) (define %default-opensmtpd-config-file (plain-file "smtpd.conf" " @@ -1714,6 +1716,43 @@ match from local for any action outbound (define %opensmtpd-pam-services (list (unix-pam-service "smtpd"))) +(define opensmtpd-set-gids + (match-lambda + (($ <opensmtpd-configuration> package config-file set-gids?) + (if set-gids? + (list + (setuid-program + (program (file-append package "/sbin/smtpctl")) + (setuid? #false) + (setgid? #true) + (group "smtpq")) + (setuid-program + (program (file-append package "/sbin/sendmail")) + (setuid? #false) + (setgid? #true) + (group "smtpq")) + (setuid-program + (program (file-append package "/sbin/send-mail")) + (setuid? #false) + (setgid? #true) + (group "smtpq")) + (setuid-program + (program (file-append package "/sbin/makemap")) + (setuid? #false) + (setgid? #true) + (group "smtpq")) + (setuid-program + (program (file-append package "/sbin/mailq")) + (setuid? #false) + (setgid? #true) + (group "smtpq")) + (setuid-program + (program (file-append package "/sbin/newaliases")) + (setuid? #false) + (setgid? #true) + (group "smtpq"))) + '())))) + (define opensmtpd-service-type (service-type (name 'opensmtpd) @@ -1727,7 +1766,9 @@ match from local for any action outbound (service-extension profile-service-type (compose list opensmtpd-configuration-package)) (service-extension shepherd-root-service-type - opensmtpd-shepherd-service))) + opensmtpd-shepherd-service) + (service-extension setuid-program-service-type + opensmtpd-set-gids))) (description "Run the OpenSMTPD, a lightweight @acronym{SMTP, Simple Mail Transfer Protocol} server."))) |