Subject: getzenv() to use (unix) environment ZCONFIG

From: Eugene Crosser <[email-masked]>
Date: 11 Jul 2002 16:42:49 +0400

Matti,
do you think the following change makes any sense?
(will also need to "export ZCONFIG" in "zmailer" script)

Index: libc/getzenv.c
===================================================================
RCS file: /cvsroot/zmailer/libc/getzenv.c,v
retrieving revision 1.5
diff -u -r1.5 getzenv.c
--- libc/getzenv.c      2001/01/15 15:12:04     1.5
+++ libc/getzenv.c      2002/07/11 12:29:01
@@ -28,12 +28,13 @@
 static int zenvlen = 0;
 
 int
-readzenv(file)
-       const char *file;
+readzenv(void)
 {
+       char *file;
        int fd;
        struct stat stbuf;
 
+       if (!(file=getenv("ZCONFIG"))) file=ZMAILER_ENV_FILE;
        fd = open(file, 0);
        if (fd < 0) {
          fprintf(stderr, "%s: open: %s: %s\n",
@@ -86,7 +87,7 @@
 
        len = zenvlen;
        if (len <= 0) {
-         if (!readzenv(ZMAILER_ENV_FILE))
+         if (!readzenv())
            return NULL;
          len = zenvlen;
          if (len <= 0)
Index: include/libc.h
===================================================================
RCS file: /cvsroot/zmailer/include/libc.h,v
retrieving revision 1.11
diff -u -r1.11 libc.h
--- include/libc.h      2002/02/11 15:12:10     1.11
+++ include/libc.h      2002/07/11 12:29:01
@@ -24,7 +24,7 @@
 extern int getdtablesize __((void));
 
 /* getzenv.c */
-extern int         readzenv __((const char *file));
+extern int         readzenv __((void));
 extern const char *getzenv  __((const char *variable));
 
 /* mail.c */
Index: include/mail.h.in
===================================================================
RCS file: /cvsroot/zmailer/include/mail.h.in,v
retrieving revision 1.11
diff -u -r1.11 mail.h.in
--- include/mail.h.in   2001/07/29 18:21:39     1.11
+++ include/mail.h.in   2002/07/11 12:29:01
@@ -87,7 +87,7 @@
 /* These following are declared in order they are in prespective files */
 
 /* getzenv.c */
-extern int         readzenv __((const char *file));
+extern int         readzenv __((void));
 extern const char *getzenv  __((const char *variable));
 
 /* mail.c */

-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Matti Aarnio <[email-masked]>
Date: Thu, 11 Jul 2002 15:59:16 +0300

> (will also need to "export ZCONFIG" in "zmailer" script)

  It makes a lot of sense.  Without suid-programs this form of the routine
  should be sufficient, but I would still like to pass some sort of program
  global flag telling to be suspicuous, and possibly to verify things. 
  Mark it as a TODO item, if you don't implement it right now.

  Separate thing is, that the   readzenv()  is not called from anywhere
  else than within the  getzenv.c  file, thus it could be made into
  static, or very least prototyped only in the  getzenv.c  file.

  I am interested to see how you develop it, and what all changes you will
  eventually make.  I prefer to defer merging until the set of changes is
  complete, including documentation updates!  (Or very near complete,
  small refinements may creep up latter.)

-- 
/Matti Aarnio	<[email-masked]>
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Eugene Crosser <[email-masked]>
Date: 11 Jul 2002 18:50:28 +0400

On Thu, 2002-07-11 at 18:16, Matti Aarnio wrote:

> > Do you already have a global flag saying "suid program, stay alert"?
> > Or is it OK to just check "if (getuid() != geteuid()) { be extra
> > causios; }" in the text?  What exactly check sould be performed?
> > Is simple "if (access(file,W_OK) == 0) { complain loudly and abort; }"
> > sufficient?
> 
>   In this regard I would be extremely paranoid, alike:
> 
>     if (getuid() != geteuid()) {
>       fprintf(stderr,"THIS SOFTWARE IS NOT VERIFIED TO BE SAFE FOR"
>                      " SUID-SOMETHING MODE!\n");
>       abort();
>     }

Look at my checks; and and if you don't feel confident you might replace
them with abort() :-)

[yes, I realized that at least W_OK check is insufficient: the attacker
may chmod his own file u-w and the check will succeed but the file is
still under the attacker's control.]

> > right, and anotehr thing, is it necessary to have redundant definition
> > of getzenv() in both libc.h and mail.h?
> 
>    include/mail.h.in  you mean ?
>    I think the  include/libc.h  should be sufficient.
> 
>    Remove the definition from  mail.h(.in), and then do:
> 	make clean; make
>    That will be most educative.

Looks OK (but I could have missed some compile warnings).

>    Recall also what I told you about  MAILSHARE  z-environment, and its
>    uses.  All MTA instances might share the MAILSHARE, but should not
>    share MAILVAR.  (e.g.  MAILSHARE/router.cf  isn't very good thing..)

I'll have different MAILSHARE to have different scheduler.conf and
smtpserver.conf (at least).

Maybe I'll also implement another feature: BINDADDRESS zenv variable
that would affect both smtpserver and smtp transport if no explicit
PARAM/command line option is specified...  Then there will be no need in
separate smtpserver.conf and scheduler.conf!

Eugene

-