Hi,
Andreas M. Kirchwitz <amk@???> (Mo 07 Mär 2016 02:03:52 CET):
> Heiko Schlittermann <hs@???> wrote:
> Thanks for the security updates! Highly appreciated.
>
> Unfortunately, it looks like this warning message also has the
> potential to break existing installations because
>
> "<eximbin> -C /dev/null -bP <configvar>"
>
> is sometimes used to get preconfigured configuration settings.
>
> For example, "exicyclog" (shipped with Exim) does that and now the
> cron daemon issues a warning when running it. Of course, stderr
> could be redirected to /dev/null but in fact there's nothing wrong
> here, and on real problems admins should still see error messages.
Yes, that's an issue with the new warnings about tls_advertise_hosts
being unset too. I'm working on it, to suppress these warnings
in these testing modes.
I'm not sure if the changes will be backported to the security releases
of the older Exims, but probably to the +fixes branches on top of the
security releases.
> Admins who do not read the release notes may also not read the
> mainlog. They will never notice that warning anyway.
But.. if you're looking for problems, you'll read the mainlog.
And I'd suppose every admin should. Daily operation isn't influenced,
but debugging is aided :)
> Clearing the complete environment also raises some questions like
> do I have to make exceptions for LANG and TZ? And will Exim work
> without any PATH? When it comes to delivery, MTAs usually call
> external programms and those call others and so on. I've never put
> much thought into that before but now I'm wondering how it ever
> worked. :-) Recommendations welcome!
Tha't not totally clear. Exim itself doesn't use any environment. BUT it
may use the environment indirect, by using libraries (LDAP being some
example). I suppose that libldap check LDAP* variables. I'm not sure
about other lookups (Berkeley DB?)
And for calling external programs Exim always forced you to put the
complete path there: ${run{/usr/bin/foo}…}. BUT, indeed, if the external
program relies on some PATH or other environment, it's time to think
about it.
keep_environment = TZ : LANG : ^LC_ : ^LDAP
add_environment = <; PATH=/bin:/usr/bin:/usr/local/bin
could be a good starting point.
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
gnupg encrypted messages are welcome --------------- key ID: F69376CE -
! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -
