[__opendkim[_genkey]]: potential for wrong permissions with --userid #17

New Issue

evilham · 2022-03-09T20:05:19Z

evilham commented

2022-03-09 20:05:19 +00:00

Porting these types to work on FreeBSD I noticed that __opendkim has support for a --userid parameter.

OTOH, __opendkim_genkey just uses chown opendkim:opendkim KEY.private; therefore assuming that the service runs with those credentials.

Without knowing the internals of Alpine, I can imagine this being an issue as per opendkim(8):

   Thus, keys referenced by the KeyTable must always be accessible for
   read by the unprivileged user.  Also, run-time reloads are not possible
   if any of the other files will not be readable by the unprivileged
   user.

Instead of making things complex, I suggest deprecating __opendkim's --userid argument; does that sound ok? Which use-case am I missing?

Porting these types to work on FreeBSD I noticed that `__opendkim` has support for a `--userid` parameter. OTOH, `__opendkim_genkey` just uses `chown opendkim:opendkim KEY.private`; therefore assuming that the service runs with those credentials. Without knowing the internals of Alpine, I can imagine this being an issue as per `opendkim(8)`: Thus, keys referenced by the KeyTable must always be accessible for read by the unprivileged user. Also, run-time reloads are not possible if any of the other files will not be readable by the unprivileged user. Instead of making things complex, I suggest deprecating `__opendkim`'s `--userid` argument; does that sound ok? Which use-case am I missing?

evilham changed title from ~~__opendkim[_genkey]: potential for wrong permissions with --userid~~ to [__opendkim[_genkey]]: potential for wrong permissions with --userid

2022-03-09 20:35:18 +00:00

evilham commented

2022-03-09 20:35:45 +00:00

cc: @sparrowhawk

evilham referenced this issue from a commit

2022-03-10 19:04:16 +00:00

[__opendkim*] FreeBSD support and minor fixes

evilham referenced this issue

2022-03-10 19:04:46 +00:00

[__opendkim*] FreeBSD support and minor fixes #18

evilham referenced this issue from a commit

2022-03-10 19:09:59 +00:00

[__opendkim*] FreeBSD support and minor fixes

sparrowhawk commented

2022-03-15 14:29:23 +00:00

Uuugh, pretty sure that's a loosely concentrated me trying to ease further generalization of the type without actually thinking it through. We don't use that parameter anywhere, and I don't see why anyone would want to use another user than the one that is preconfigured in the package for their distribution.

Go for deprecation.

Uuugh, pretty sure that's a loosely concentrated me trying to ease further generalization of the type without actually thinking it through. We don't use that parameter anywhere, and I don't see why anyone would want to use another user than the one that is preconfigured in the package for their distribution. Go for deprecation.

evilham referenced this issue from a commit

2022-03-25 10:02:26 +00:00

[__opendkim] Deprecate --userid

Sign in to join this conversation.