Re: [Exim] Bug? pipe transport without associated user=... r…

Top Page
Delete this message
Reply to this message
Author: John Dalbec
Date:  
To: exim-users
Subject: Re: [Exim] Bug? pipe transport without associated user=... runs as EXIM_USER

Andreas Metzler wrote:

> On Fri, Jan 16, 2004 at 03:17:55PM +0200, Sheldon Hearn wrote:
>
>>On (2004/01/16 13:54), Andreas Metzler wrote:
>>
>>>Using this router/transport
>>>
>>>system_aliases:
>>> driver = redirect
>>> allow_fail
>>> allow_defer
>>> data = ${lookup{$local_part}lsearch{/etc/aliases}}
>>> file_transport = address_file
>>> pipe_transport = address_pipe
>>>
>>>address_pipe:
>>> debug_print = "T: address_pipe for $local_part@$domain"
>>> driver = pipe
>>> return_fail_output
>>>
>>>will run run any pipe in /etc/aliases as the EXIM_USER instead of
>>>dumping an error (as iirc eximv3 did)[1]. This contradicts the
>>>documentation, which says:
>>>
>>>| In the case when "pipe" is run as a consequence of an entry in a
>>>| local user's `.forward' file, the command runs under the uid and gid
>>>| of that user. In other cases, the uid and gid have to be specified
>>>| explicitly, either on the transport or on the router that handles the
>>>| address.
>>
>>No, you're reading about documentation that relates to .forward files,
>>but showing us a router that relates to /etc/aliases. Read the
>>documentation for the redirect driver. :-)
>
>
> Maybe I am blind, but this is a direct quote from the documentation
> for the redirect router (There is no "redirect driver".) Please show
> quote/link.


http://www.exim.org/exim-html-4.30/doc/html/spec_24.html#CHAP24

24. Generic options for transports

...

group
Type: string, expanded
--> Default: Exim group <--

This option specifies a gid for running the transport process, overriding any
value that the router supplies, and also overriding any value associated with
user (see below).

...

user
Type: string, expanded
--> Default: Exim user <--

This option specifies the user under whose uid the delivery process is to be
run, overriding any uid that may have been set by the router. If the user is
given as a name, the uid is looked up from the password data, and the associated
group is taken as the value of the gid to be used if the group option is not set.

For remote transports, you should leave this option unset unless you really are
sure you know what you are doing. When a remote transport is running, it needs
to be able to access Exim's hints databases, because each host may have its own
retry data.

HTH,
John
>
> With references:
> | 22.1 Redirection data
> |
> | The router operates by interpreting a text string which it obtains
> | either by expanding the contents of the "data" option, or by reading
> | the entire contents of a file whose name is given in the "file"
> | option.
> [...]
> | 22.3. Interpreting redirection data
> |
> | The contents of the data string, whether obtained from data or file,
> | can be interpreted in two different ways:
> |
> | If the allow_filter option is set true, and the data begins with the
> | text #Exim filter or #Sieve filter, it is interpreted as a list
> | of filtering instructions in the form of an Exim or Sieve filter
> | file, respectively. Details of the syntax and semantics of filter
> | files are described in a separate document entitled Exim's interfaces
> | to mail filtering; this document is intended for use by end users. *
> |
> |       Otherwise, the data must be a comma-separated list of
> | redirection items, as described in the next section.
> [...]
> | 22.6. Special items in redirection lists
> |
> | In addition to addresses, the following types of item may appear in
> | redirection lists (that is, in non-filter redirection data):
> |
> |       An item is treated as a pipe command if it begins with |
> | and does not parse as a valid RFC 2822 address that includes a
> | domain. A transport for running the command must be specified by
> | the pipe_transport option. Either the router or the transport must
> | specify a user and group under which to run the delivery.

>
> The only differences between using redirect to implement aliases and
> .forward are:
>
> * "data" versus "file". The documentation does not suggest that using
> one or another causes different behavior.
>
> * The userforward router has check_local_user set. This initializes
>   user= and group= to the uid/gid of the respective user.
>                  cu andreas

>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>
>
>