CVS log for src/libexec/mail.local/mail.local.c

Up to [cvs.NetBSD.org] / src / libexec / mail.local

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

use the correct constant

fix merge botch

KNF, clarify/provide warning messages, set rval to fail initially and only
set to success once everything works.

- remove lock file on error
- clarify diagnostic messages
- initialize struct stat if lstat(2) failed (from mhal at rbox dot co)
- ensure appending to a regular file

Pull up following revision(s) (requested by kre in ticket #1743):
	libexec/mail.local/mail.local.c: revision 1.29
fix local privilege escalation due to a race condition
NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).
mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).
An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.
Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).
Thanks to Jan Schaumann for bringing this to our attention.

Pull up following revision(s) (requested by kre in ticket #1455):
	libexec/mail.local/mail.local.c: revision 1.29
fix local privilege escalation due to a race condition
NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).
mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).
An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.
Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).
Thanks to Jan Schaumann for bringing this to our attention.

fix local privilege escalation due to a race condition

NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).

mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).

An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.

Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).

Thanks to Jan Schaumann for bringing this to our attention.

Sync with HEAD

Pull up following revision(s) (requested by shm in ticket #1392):
	libexec/mail.local/mail.local.c: revision 1.28
Fix error checks in open(2) calls.

Pull up following revision(s) (requested by shm in ticket #1392):
	libexec/mail.local/mail.local.c: revision 1.28
Fix error checks in open(2) calls.

Pull up following revision(s) (requested by shm in ticket #1392):
	libexec/mail.local/mail.local.c: revision 1.28
Fix error checks in open(2) calls.

Pull up following revision(s) (requested by shm in ticket #1207):
	libexec/mail.local/mail.local.c: revision 1.28
Fix error checks in open(2) calls.

Pull up following revision(s) (requested by shm in ticket #1207):
	libexec/mail.local/mail.local.c: revision 1.28
Fix error checks in open(2) calls.

Fix error checks in open(2) calls.

Pull up following revision(s) (requested by shm in ticket #1391):
	libexec/mail.local/mail.local.c: revision 1.27
Fix race condition in deliver(), fix resource leak.

Pull up following revision(s) (requested by shm in ticket #1391):
	libexec/mail.local/mail.local.c: revision 1.27
Fix race condition in deliver(), fix resource leak.

Pull up following revision(s) (requested by shm in ticket #1391):
	libexec/mail.local/mail.local.c: revision 1.27
Fix race condition in deliver(), fix resource leak.

Pull up following revision(s) (requested by shm in ticket #1206):
	libexec/mail.local/mail.local.c: revision 1.27
Fix race condition in deliver(), fix resource leak.

Pull up following revision(s) (requested by shm in ticket #1206):
	libexec/mail.local/mail.local.c: revision 1.27
Fix race condition in deliver(), fix resource leak.

Fix race condition in deliver(), fix resource leak.

De-__P. staticfy. Use __dead, __printflike.

Sync with wrstuden-revivesa-base-2.

Remove the \n and tabs from the __COPYRIGHT() strings.

Sync with netbsd-4.

sync with head.

Pull up following revision(s) (requested by manu in ticket #1148):
	libexec/mail.local/mail.local.c: revision 1.24
Make sure temporary errors are reported as such, using status code
EX_TEMPFAIL (cannot lookup user through NSS, may be because of an
unreachable NIS or LDAP server), or EX_OSERR (other file or memory
related problems).
Sendmail and Postfix should honour EX_TEMPFAIL and EX_OSERR by
queueing the message.
This avoids problems with transcient NSS errors, where the MTA may
successfully lookup a user at a time while mail.local can fail a
few secoonds later.

Make sure temporary errors are reported as such, using status code
EX_TEMPFAIL (cannot lookup user through NSS, may be because of an
unreachable NIS or LDAP server), or EX_OSERR (other file or memory
related problems).

Sendmail and Postfix should honour EX_TEMPFAIL and EX_OSERR by
queueing the message.

This avoids problems with transcient NSS errors, where the MTA may
successfully lookup a user at a time while mail.local can fail a
few secoonds later.

Coverity CID 3931: Fix memory leak.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22284, verified by myself.

die if strdup fails

__STDC__ is always defined on NetBSD.

Sync getopt() / man page with actual getopt options.

use more standard %ll_ in favour of %q_

Pullup libexec string format fixes [is].
See "cvs log" for explicit revision numbers per file, from sommerfeld.

Pull up revision 1.17 (requested by is):
  Format string cleanup.

Format string cleanups by sommerfeld.

bzero->memset, bcopy->memcpy, bcmp->memcmp

const poisoning.

Put a whitespace after the keyword `switch'.

Compare a return value of getopt() against -1 instead of EOF.

fix warnings on alpha.

WARNS?=1.  RCS ids.  did not merge very much of lite-2.

lite-2.

KNF.  RCSids.  be safe with buffers.

Fill in sin_len.

update from trunk

Change format specification from %ld to %qd, as off_t's are now quads.

fix from <arndt@uniko.uni-koblenz.de>

Another off_t glitch.

Initialize return value from deliver() to zero.  I guess the 386 crowd
has been fortunate.  It's odd to see mail delivered and get a bounce
back, though, which is what was happening--spent a while thinking it
was sendmail.

Add RCS identifiers.

Fix bogus handling of short writes.

mail.local can now use username.lock files as well as flock(). Use the
-l flag in your favorite sendmail.cf file.

initial import of 386bsd-0.1 sources

Initial revision