Public bug reported:
Affects: cron 3.0pl1-184ubuntu2, Ubuntu 24.04 (noble)
The MAILFROM feature added via
debian/patches/features/Add-MAILFROM-environment-variable.patch
(Debian #898177 / Ubuntu LP #1750051) only sets the "From:" header inside the
mail body:
fprintf(mail, "From: %s\n", mailfrom);
It does NOT pass mailfrom as the SMTP envelope sender (sendmail's -f flag) to
MAILCMD. The
actual sendmail invocation is still built purely from MAILARGS:
#define MAILARGS "%s -FCronDaemon -i -B8BITMIME -oem %s"
"-FCronDaemon" only sets the display/full name, not the envelope address. As a
result, the
envelope sender used by the MTA (and checked by SPF, and shown as "from=" in
mail logs) remains
"<username> (Cron Daemon)"-derived / the invoking user, regardless of MAILFROM.
This causes SPF
validation to fail for any cron mail on servers where the recipient's mail
provider enforces
strict SPF/DKIM (e.g. Microsoft 365 for mail sent over IPv6), even though
MAILFROM is correctly
set in the crontab and correctly shows up in the message's "From:" header.
Steps to reproduce:
1. crontab -e, add:
MAILFROM="[email protected]"
MAILTO="[email protected]"
* * * * * echo test
2. Wait for the mail, inspect the queue / mail log (e.g. `postcat -q
<queue-id>` and
`grep from= /var/log/mail.log`).
3. Observe that the envelope sender ("from=" in the log, and what SPF/DMARC
checks are run
against) is NOT [email protected], even though the From: header in the
message body is.
Expected: MAILFROM should also set the SMTP envelope sender, matching cronie's
behaviour and
the documented "same semantics as cronie" claim in crontab(5).
I've attached a patch (against 3.0pl1-184ubuntu2) that adds -f<mailfrom> to the
sendmail
invocation when MAILFROM is set and passes the existing safe_p() validation
(which already
restricts it to a safe character set, so no new injection risk is introduced).
I built and
tested this locally; cron mail is now correctly relayed with a valid,
SPF/DKIM-verifiable
envelope sender.
Note: I suspect the original MAILFROM patch deliberately avoided -f due to the
historical
1999-2001 sendmail argument-injection root exploits (bugtraq #11593 etc.) that
led to MAILARGS
being locked down in the first place. My patch does not reopen that issue since
mailfrom is
already passed through safe_p() before use, exactly as mailto already is.
** Affects: cron (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "PATCH"
https://bugs.launchpad.net/bugs/2164731/+attachment/5994028/+files/Add-MAILFROM-envelope-sender.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164731
Title:
cron's MAILFROM only sets the From: header, not the SMTP envelope
sender — SPF checks fail
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cron/+bug/2164731/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
