Viktor Dukhovni via Postfix-users:
> On Mon, Sep 28, 2026 at 11:34:53AM -0400, Wietse Venema via Postfix-users
> wrote:
>
> > > Do MAIL_CONFIG values need to be restricted to registered instances
> > > for most users? Any exceptions for "root" and "postfix"?
> >
> > I don't recall that "postfix" is presently exempted.
>
> You're right, only "root" is unrestricted. This is done in
> mail_conf_suck():
>
> if (strcmp(var_config_dir, DEF_CONFIG_DIR) != 0 /* non-default */
> && unsafe()) /* untrusted env and cli */
> mail_conf_checkdir(var_config_dir);
>
> With unsafe() exempting root and otherwise checking that the process is
> not running setuid or setgid. This will I guess require a bit of
> emulation on the far end of the new mux, to make sure that the
> "MAIL_CONFIG" value passes mail_conf_checkdir().
It's not difficult: 'root' runs postdrop etc. without 'mux' assistance.
All other users must go through the 'mux' which requires an authorized
configuration directory. It also ignores unexpected environment settings.
Wietse
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
