Bug#883349: Acknowledgement (/etc/msmtprc should not be world readable)

[Simon Deziel]

On Sat, 2 Dec 2017 14:39:00 -0500 Simon Deziel  wrote:
> Please find attached a patch that:
> 
> * Removes world read access to /etc/msmtprc and chgrp to "mail".
> * Installs the msmtp binary as setgid and owned by "root:mail".

Seth Arnold from the Ubuntu security team quickly reviewed my patch and
found a blatant problem. Here's the IRC log

 sarnold: sdeziel: hrm, not sure I love that patch :/ ... normally most
 tools aren't written robustly enough to be setgid
 sarnold: sdeziel: if a user config file asks to log to something
 writable by group mail, what happens?
 ...
 sarnold: a dedicated group would definitely be safer

So when I'll have more time, I'll propose an updated patch that creates
a dedicated group to use with setgid.

Regards,
Simon

Bug#883349: Acknowledgement (/etc/msmtprc should not be world readable)

[Simon Deziel]

Please find attached a patch that:

* Removes world read access to /etc/msmtprc and chgrp to "mail".
* Installs the msmtp binary as setgid and owned by "root:mail".
* Adds a note in README.Debian

Regards,
Simon

commit 211125a232c529e17192878e30c23742f2377ca2 (HEAD -> msmtp-setgit)
Author: Simon Deziel 
Date:   Sat Dec 2 14:25:44 2017 -0500

Remove world read access to /etc/msmtprc and chgrp to "mail".

Install the msmtp binary as setgid and owned by "root:mail".
Closes: #883349

Signed-off-by: Simon Deziel 

diff --git a/debian/README.Debian b/debian/README.Debian
index 7f601d5..e3fec4c 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -42,3 +42,12 @@ the package msmtp-mta. It will provide the basic features required to be a MTA
 Even if msmtp-mta can be used as a very basic MTA, it's not (and will never be)
 a full featured one.
 
+The system-wide configuration file (/etc/msmtprc) can contain SMTP credentials
+that are best kept secret. To let regular users use msmtp-mta while preventing
+them from reading the file, the permissions are adjusted that way:
+
+ # chmod 0640 /etc/msmtprc
+ # chgrp mail /etc/msmtprc
+
+And msmtp's binary executes as the "mail" group because of the setgid bit.
+
diff --git a/debian/msmtp.postinst b/debian/msmtp.postinst
index b75e468..64e7fad 100644
--- a/debian/msmtp.postinst
+++ b/debian/msmtp.postinst
@@ -47,6 +47,10 @@ case $1 in
 mv /etc/msmtprc.new /etc/msmtprc
 			fi
 		fi
+		if [ -f /etc/msmtprc ]; then
+			chmod 0640 /etc/msmtprc
+			chgrp mail /etc/msmtprc
+		fi
 		;;
 	*)
 		exit 0
diff --git a/debian/rules b/debian/rules
index bda3dcd..63002e9 100755
--- a/debian/rules
+++ b/debian/rules
@@ -43,6 +43,11 @@ override_dh_link:
 	rm -rf $(CURDIR)/debian/msmtp-gnome/usr/share/doc/msmtp-gnome
 	dh_link
 
+override_dh_fixperms:
+	dh_fixperms
+	chmod 2755 debian/msmtp/usr/bin/msmtp
+	chgrp mail debian/msmtp/usr/bin/msmtp
+
 override_dh_auto_clean:
 	rm -rf build build-gnome
 	rm -f debian/newaliases.1


signature.asc
Description: OpenPGP digital signature