NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kern/55675: ZFS mounts do not work with setuid programs

The following reply was made to PR kern/55675; it has been noted by GNATS.

From: Brad Spencer <>
Subject: Re: kern/55675: ZFS mounts do not work with setuid programs
Date: Mon, 21 Sep 2020 18:55:12 -0400 writes:
 >>Number:         55675
 >>Category:       kern
 >>Synopsis:       ZFS mounts do not work with setuid programs
 >>Confidential:   no
 >>Severity:       serious
 >>Priority:       high
 >>Responsible:    kern-bug-people
 >>State:          open
 >>Class:          sw-bug
 >>Submitter-Id:   net
 >>Arrival-Date:   Mon Sep 21 12:10:00 +0000 2020
 >>Originator:     Roy Marples
 >>Release:        9.99.73
 > NetBSD 9.99.73 NetBSD 9.99.73 (GENERIC) #2: Thu Sep 17 11:52:51 BST 2020 amd64
 > Setup /var/spool on ZFS.
 > Send an email from a local user.
 > Look at console or maillog for errors like so:
 > postdrop: warning: mail_queue_enter: create file maildrop/899911.8834: Permission denied
 > mailx -s test < /tmp/email.message
 > mounting /var/spool/postfix/postdrop as tmpfs solves the issue
 I don't have a fix and won't be able to look for one in the near future,
 but I did test for this problem.
 The problem is actually with setgid, not setuid.  For postfix, postdrop
 is setgid maildrop and relies upon being able to write to
 /var/spool/postfix/maildrop in the usual manor when only the group wx
 bits are set on that directory.  This is what does not work as expected
 with a ZFS fileset.
 I also tested setuid in a simular situation and it actually works as
 A workaround for Postfix would be to set the read bit on
 /var/spool/postfix/maildrop along with write and excute.  I don't know
 the security implications of doing that, but that should work.
 Brad Spencer - - KC8VKS -

Home | Main Index | Thread Index | Old Index