NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kern/55675: ZFS mounts do not work with setuid programs writes:

>>Number:         55675
>>Category:       kern
>>Synopsis:       ZFS mounts do not work with setuid programs
>>Confidential:   no
>>Severity:       serious
>>Priority:       high
>>Responsible:    kern-bug-people
>>State:          open
>>Class:          sw-bug
>>Submitter-Id:   net
>>Arrival-Date:   Mon Sep 21 12:10:00 +0000 2020
>>Originator:     Roy Marples
>>Release:        9.99.73
> NetBSD 9.99.73 NetBSD 9.99.73 (GENERIC) #2: Thu Sep 17 11:52:51 BST 2020 amd64
> Setup /var/spool on ZFS.
> Send an email from a local user.
> Look at console or maillog for errors like so:
> postdrop: warning: mail_queue_enter: create file maildrop/899911.8834: Permission denied
> mailx -s test < /tmp/email.message
> mounting /var/spool/postfix/postdrop as tmpfs solves the issue

I don't have a fix and won't be able to look for one in the near future,
but I did test for this problem.

The problem is actually with setgid, not setuid.  For postfix, postdrop
is setgid maildrop and relies upon being able to write to
/var/spool/postfix/maildrop in the usual manor when only the group wx
bits are set on that directory.  This is what does not work as expected
with a ZFS fileset.

I also tested setuid in a simular situation and it actually works as

A workaround for Postfix would be to set the read bit on
/var/spool/postfix/maildrop along with write and excute.  I don't know
the security implications of doing that, but that should work.

Brad Spencer - - KC8VKS -

Home | Main Index | Thread Index | Old Index