File modes
The modes used for files depend on what functionality you want and the
level of security you require.
setuid status
sendmail(1M)
is normally installed
setuid to root. At the point where it is
about to
exec(2)
a mailer, it checks to see if the user ID is zero (root); if so, it
resets the user ID and group ID to a default (set
by the
U= equate in the mailer line;
if that is not set, the
DefaultUser
option is used).
This can be overridden
by setting the S flag to the mailer for mailers that are trusted
and must be called as root. However, this will cause mail
processing to be accounted to root rather than to the user
sending the mail.
If you don't make sendmail setuid to root, it will
still run but you lose a lot of functionality and a lot of privacy,
since you'll have to make the queue directory world readable. You could
also make sendmail setuid to some pseudo-user (for example,
create a user called sendmail and make sendmail
setuid to that) which will fix the privacy problems but not the
functionality issues. Also, this isn't a guarantee of security: for
example, root occasionally sends mail, and the daemon often runs as
root.
NOTE:
Sendmail must run as root or the trusted user
to create the SMTP listener socket.
A middle ground is to make
sendmail
setuid to root,
but set the
RunAsUser
option.
This causes
sendmail
to become the indicated user as soon as it has done the startup
that requires root privileges
(primarily, opening the
SMTP
socket).
If you use
RunAsUser,
the queue directory
(normally
/var/spool/mqueue)
should be owned by that user,
and all files and databases
(including user
.forward
files,
alias files,
:include: files,
and external databases)
must be readable by that user.
Also, since sendmail cannot change the uid,
delivery to programs or files will be marked as unsafe,
(such as undeliverable), in .forward, aliases,
and :include: files.
Administrators can override this by setting the
DontBlameSendmail option to the setting NonRootSafeAddr.
RunAsUser
is probably best suited for firewall configurations
that do not have regular user logins.
Turning off security checks
Sendmail
is very particular about the modes of files that it reads or writes.
For example, by default it refuses to read most files
that are group writable
on the grounds that they might have been tampered with
by someone other than the owner;
it will even refuse to read files in group writable directories.
If you are
sure that your configuration is safe and you want
sendmail
to avoid these security checks,
you can turn off certain checks using the
DontBlameSendmail
option.
This option takes one or more names that disable checks.
In the descriptions that follow,
``unsafe directory''
means a directory that is writable by anyone other than the owner.
The values are:
Safe-
No special handling.
AssumeSafeChown-
Assume that the
chown(2)
system call is restricted to root.
Since some versions of UNIX permit regular users
to give away their files to other users on some filesystems,
sendmail
often cannot assume that a given file was created by the owner,
particularly when it is in a writable directory.
You can set this flag if you know that file giveaway is restricted
on your system.
ClassFileInUnsafeDirPath-
When reading class files (using the
F line in the configuration file),
allow files that are in unsafe directories.
DontWarnForwardFileInUnsafeDirPath-
Prevent logging of
unsafe directory path warnings
for non-existent forward files.
ErrorHeaderInUnsafeDirPath-
Allow the file named in the
ErrorHeader
option to be in an unsafe directory.
GroupWritableDirPathSafe-
Change the definition of
``unsafe directory''
to consider group-writable directories to be safe.
World-writable directories are always unsafe.
GroupWritableForwardFileSafe-
Accept group-writable
.forward
files.
GroupWritableIncludeFileSafe-
Accept group-writable
:include:
files.
GroupWritableAliasFile-
Allow group-writable alias files.
HelpFileInUnsafeDirPath-
Allow the file named in the
HelpFile
option to be in an unsafe directory.
WorldWritableAliasFile-
Accept world-writable alias files.
ForwardFileInGroupWritableDirPath-
Allow
.forward
files in group writable directories.
IncludeFileInGroupWritableDirPath-
Allow
:include:
files in group writable directories.
ForwardFileInUnsafeDirPath-
Allow
.forward
files in unsafe directories.
IncludeFileInUnsafeDirPath-
Allow
:include:
files in unsafe directories.
ForwardFileInUnsafeDirPathSafe-
Allow a
.forward
file that is in an unsafe directory to include references
to program and files.
IncludeFileInUnsafeDirPathSafe-
Allow a
:include:
file that is in an unsafe directory to include references
to program and files.
MapInUnsafeDirPath-
Allow maps (e.g.,
hash,
btree,
and
dbm
files)
in unsafe directories.
LinkedAliasFileInWritableDir-
Allow an alias file that is a link in a writable directory.
LinkedClassFileInWritableDir-
Allow class files that are links in writable directories.
LinkedForwardFileInWritableDir-
Allow
.forward
files that are links in writable directories.
LinkedIncludeFileInWritableDir-
Allow
:include:
files that are links in writable directories.
LinkedMapInWritableDir-
Allow map files that are links in writable directories.
LinkedServiceSwitchFileInWritableDir-
Allow the service switch file to be a link
even if the directory is writable.
FileDeliveryToHardLink-
Allow delivery to files that are hard links.
FileDeliveryToSymLink-
Allow delivery to files that are symbolic links.
RunProgramInUnsafeDirPath-
Go ahead and run programs that are in writable directories.
RunWritableProgram-
Go ahead and run programs that are group- or world-writable.
WriteMapToHardLink-
Allow writes to maps that are hard links.
WriteMapToSymLink-
Allow writes to maps that are symbolic links.
WriteStatsToHardLink-
Allow the status file to be a hard link.
WriteStatsToSymLink-
Allow the status file to be a symbolic link.
TrustStickyBit-
Allow group or world writable directories
if the sticky bit is set on the directory.
Do not set this on systems which do not honor
the sticky bit on directories.
NonRootSafeAddr-
Do not mark file and program deliveries as unsafe
if sendmail is not running with root privileges.
© 2000 The Santa Cruz Operation, Inc. All rights reserved.