Sendmail Operation Guide

File modes

The modes used for files depend on what functionality you want and the level of security you require.

setuid status

sendmail(1M) is normally installed setuid to root. At the point where it is about to exec(2) a mailer, it checks to see if the user ID is zero (root); if so, it resets the user ID and group ID to a default (set by the U= equate in the mailer line; if that is not set, the DefaultUser option is used). This can be overridden by setting the S flag to the mailer for mailers that are trusted and must be called as root. However, this will cause mail processing to be accounted to root rather than to the user sending the mail.

If you don't make sendmail setuid to root, it will still run but you lose a lot of functionality and a lot of privacy, since you'll have to make the queue directory world readable. You could also make sendmail setuid to some pseudo-user (for example, create a user called sendmail and make sendmail setuid to that) which will fix the privacy problems but not the functionality issues. Also, this isn't a guarantee of security: for example, root occasionally sends mail, and the daemon often runs as root.


NOTE: Sendmail must run as root or the trusted user to create the SMTP listener socket.

A middle ground is to make sendmail setuid to root, but set the RunAsUser option. This causes sendmail to become the indicated user as soon as it has done the startup that requires root privileges (primarily, opening the SMTP socket). If you use RunAsUser, the queue directory (normally /var/spool/mqueue) should be owned by that user, and all files and databases (including user .forward files, alias files, :include: files, and external databases) must be readable by that user. Also, since sendmail cannot change the uid, delivery to programs or files will be marked as unsafe, (such as undeliverable), in .forward, aliases, and :include: files. Administrators can override this by setting the DontBlameSendmail option to the setting NonRootSafeAddr. RunAsUser is probably best suited for firewall configurations that do not have regular user logins.

Turning off security checks

Sendmail is very particular about the modes of files that it reads or writes. For example, by default it refuses to read most files that are group writable on the grounds that they might have been tampered with by someone other than the owner; it will even refuse to read files in group writable directories.

If you are sure that your configuration is safe and you want sendmail to avoid these security checks, you can turn off certain checks using the DontBlameSendmail option. This option takes one or more names that disable checks. In the descriptions that follow, ``unsafe directory'' means a directory that is writable by anyone other than the owner. The values are:


Safe
No special handling.

AssumeSafeChown
Assume that the chown(2) system call is restricted to root. Since some versions of UNIX permit regular users to give away their files to other users on some filesystems, sendmail often cannot assume that a given file was created by the owner, particularly when it is in a writable directory. You can set this flag if you know that file giveaway is restricted on your system.

ClassFileInUnsafeDirPath
When reading class files (using the F line in the configuration file), allow files that are in unsafe directories.

DontWarnForwardFileInUnsafeDirPath
Prevent logging of unsafe directory path warnings for non-existent forward files.

ErrorHeaderInUnsafeDirPath
Allow the file named in the ErrorHeader option to be in an unsafe directory.

GroupWritableDirPathSafe
Change the definition of ``unsafe directory'' to consider group-writable directories to be safe. World-writable directories are always unsafe.

GroupWritableForwardFileSafe
Accept group-writable .forward files.

GroupWritableIncludeFileSafe
Accept group-writable :include: files.

GroupWritableAliasFile
Allow group-writable alias files.

HelpFileInUnsafeDirPath
Allow the file named in the HelpFile option to be in an unsafe directory.

WorldWritableAliasFile
Accept world-writable alias files.

ForwardFileInGroupWritableDirPath
Allow .forward files in group writable directories.

IncludeFileInGroupWritableDirPath
Allow :include: files in group writable directories.

ForwardFileInUnsafeDirPath
Allow .forward files in unsafe directories.

IncludeFileInUnsafeDirPath
Allow :include: files in unsafe directories.

ForwardFileInUnsafeDirPathSafe
Allow a .forward file that is in an unsafe directory to include references to program and files.

IncludeFileInUnsafeDirPathSafe
Allow a :include: file that is in an unsafe directory to include references to program and files.

MapInUnsafeDirPath
Allow maps (e.g., hash, btree, and dbm files) in unsafe directories.

LinkedAliasFileInWritableDir
Allow an alias file that is a link in a writable directory.

LinkedClassFileInWritableDir
Allow class files that are links in writable directories.

LinkedForwardFileInWritableDir
Allow .forward files that are links in writable directories.

LinkedIncludeFileInWritableDir
Allow :include: files that are links in writable directories.

LinkedMapInWritableDir
Allow map files that are links in writable directories.

LinkedServiceSwitchFileInWritableDir
Allow the service switch file to be a link even if the directory is writable.

FileDeliveryToHardLink
Allow delivery to files that are hard links.

FileDeliveryToSymLink
Allow delivery to files that are symbolic links.

RunProgramInUnsafeDirPath
Go ahead and run programs that are in writable directories.

RunWritableProgram
Go ahead and run programs that are group- or world-writable.

WriteMapToHardLink
Allow writes to maps that are hard links.

WriteMapToSymLink
Allow writes to maps that are symbolic links.

WriteStatsToHardLink
Allow the status file to be a hard link.

WriteStatsToSymLink
Allow the status file to be a symbolic link.

TrustStickyBit
Allow group or world writable directories if the sticky bit is set on the directory. Do not set this on systems which do not honor the sticky bit on directories.

NonRootSafeAddr
Do not mark file and program deliveries as unsafe if sendmail is not running with root privileges.

© 2000 The Santa Cruz Operation, Inc. All rights reserved.