Re: [exim-dev] Candidate patches for privilege escalation

Page principale
Supprimer ce message
Répondre à ce message
Auteur: Phil Pennock
Date:  
À: David Woodhouse, exim-dev
Sujet: Re: [exim-dev] Candidate patches for privilege escalation
On 2010-12-13 at 17:54 -0500, Phil Pennock wrote:
> On 2010-12-13 at 22:00 +0000, David Woodhouse wrote:
> > Perhaps a *build* time option with a colon-separated list of the macros
> > which are permitted to be defined (with no content)?
>
> Sounds good. I might permit numbers as a value. I guess one common
> override besides 0/1 is for port-numbers.


One of the installation modes for mailscanner is to make the spool
directory be a macro:
http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:exim:installation

I suspect that a changed spool directory is definitely a change which
needs to propagate. *sigh*

I'm tending back towards thinking a regexp which restricts the
characters allowed is the better migration approach.

Fortunately, Exim provides -oMr which things like DSpam and SpamAssassin
recommend using.

-Phil