Milter-greylist

On Thu, Feb 03, 2005 at 10:17:45AM +0100, Enrico Scholz wrote:
> I have attached two patches against 1.6 fixing the following issues:

Interesting! These are just what the SPEC I use does also. I'm in favor
of this being applied.

-- 
Brent J. Nordquist <b-nordquist@...> N0BJN
Other contact information: http://kepler.its.bethel.edu/~bjn/contact.html

Enrico Scholz <greylist-milter@...> wrote:

> +             if (initgroups(conf.c_user, pw->pw_gid) != 0) {
> +                     syslog(LOG_ERR, "%s: can not change supplementary groups: %s\n",
> +                            argv[0], strerror(errno));
> +                     exit(EX_OSERR);
> +             }
> +
> +             if (setgid(pw->pw_gid) != 0 ||
> +                 setegid(pw->pw_gid) != 0) {
> +                     syslog(LOG_ERR, "%s: cannot change GID: %s\n",
> +                         argv[0], strerror(errno));
> +                     exit(EX_OSERR);
> +             }
> +

I'm ready to commit that, but I'm concerned about initgroups() not being
portable. Any input on that? How should it work on systems without
initgroups? 

-- 
Emmanuel Dreyfus
Un bouquin en français sur BSD:
http://www.eyrolles.com/Informatique/Livre/9782212114638/livre-bsd.php
manu@netbsd.org

--- manu@... wrote:

> Enrico Scholz <greylist-milter@...> wrote:
> 
> > +             if (initgroups(conf.c_user,
> pw->pw_gid) != 0) {
> > +                     syslog(LOG_ERR, "%s: can not
> change supplementary groups: %s\n",
> > +                            argv[0],
> strerror(errno));
> > +                     exit(EX_OSERR);
> > +             }
> > +
> > +             if (setgid(pw->pw_gid) != 0 ||
> > +                 setegid(pw->pw_gid) != 0) {
> > +                     syslog(LOG_ERR, "%s: cannot
> change GID: %s\n",
> > +                         argv[0],
> strerror(errno));
> > +                     exit(EX_OSERR);
> > +             }
> > +
> 
> I'm ready to commit that, but I'm concerned about
> initgroups() not being
> portable. Any input on that? How should it work on
> systems without
> initgroups? 

Remember my patch for seteuid?  Here again, I think
that setregid is more portable than setegid.  And only
setgid exists on absolutely any system.  I think that
configure check should be added for setregid, setegid
and initgroups existence.

Eugene


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Easier than ever with enhanced search. Learn more.
http://info.mail.yahoo.com/mail_250

Eugene Crosser <egcrosser@...> wrote:

> Remember my patch for seteuid?  Here again, I think
> that setregid is more portable than setegid.  And only
> setgid exists on absolutely any system.  I think that
> configure check should be added for setregid, setegid
> and initgroups existence.

Sure, but what do we do if it does not exist?

-- 
Emmanuel Dreyfus
Le cahier de l'admin BSD 2eme ed. est dans toutes les bonnes librairies
http://www.eyrolles.com/Informatique/Livre/9782212114638/livre-bsd.php
manu@...

--- manu@... wrote:

> Eugene Crosser <egcrosser@...> wrote:
> 
> > Remember my patch for seteuid?  Here again, I
> think
> > that setregid is more portable than setegid.  And
> only
> > setgid exists on absolutely any system.  I think
> that
> > configure check should be added for setregid,
> setegid
> > and initgroups existence.
> 
> Sure, but what do we do if it does not exist?

On systems where neither setregid nor setegid exist,
setgid sets *both* gid and egid.  Hopefully :-)  As
far as I know, anyway.

Even if not, well, then nothing can be done, we just
continue running with elevated priviledges...

Eugene


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Helps protect you from nasty viruses. 
http://promotions.yahoo.com/new_mail

Enrico Scholz <greylist-milter@...> wrote:

> I see that you applied both my 'daemon --user=...' patch for the
> initscripts and the initgroups patch in 2.0beta1. Sorry, that I was
> unclear about this, but they will not work together so please revert
> the milter-greylist-1.6-user.patch.

Send me a diff, to avoid another unclear thing :)

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@...

Enrico Scholz <greylist-milter@...> wrote:

> As Eugen noticed, setregid() shall be used instead of the setgid() +
> setegid() sequence. Accordingly SUSv3, 'setregid(2)' was "first released
> in Issue 4, Version 2.", but setegid(2) is younger because it was "first
> released in Issue 6.".

In setregid(2) on my favourite OS, I have:
HISTORY
     The setregid() function call appeared in 4.2BSD.  An incompatible
     version was implemented in 4.4BSD.  It was reimplemented in NetBSD
     1.2 in a way compatible with 4.3BSD, SunOS and Linux, but should
     not be used in new code.

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@...