[Bug 1203340] New: AUDIT-0: sendmail: Need to crate /run/sendmail
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 Bug ID: 1203340 Summary: AUDIT-0: sendmail: Need to crate /run/sendmail Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs@suse.de Reporter: werner@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Current SR#990515 had been declined due to sendmail.x86_64: E: systemd-tmpfile-entry-unauthorized (Badness: 10) /usr/lib/tmpfiles.d/sendmail.conf "a+ /run - - - - u:mail:rwx,g:mail:rwx" sendmail.x86_64: E: systemd-tmpfile-entry-unauthorized (Badness: 10) /usr/lib/tmpfiles.d/sendmail.conf "a+ /run/sendmail - - - - u:mail:rwx,g:mail:rwx" This package installs a systemd-tmpfiles drop-in configuration file that contains sensitive configuration entries. If the package is intended for inclusion in any SUSE product please open a bug report to request review of the package by the security team. Please refer to https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for more information. but current package throws warnings during starting its services therefore this changes seems to be required -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 Dr. Werner Fink <werner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-0: sendmail: Need to |AUDIT-0: sendmail: Need to |crate /run/sendmail |create /run/sendmail -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c3 Dr. Werner Fink <werner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.gerstner@suse.com Flags| |needinfo?(matthias.gerstner | |@suse.com) --- Comment #3 from Dr. Werner Fink <werner@suse.com> --- (In reply to Matthias Gerstner from comment #2)
So this entry here:
a+ /run - - - - u:mail:rwx,g:mail:rwx
is a bit over the top. This would allow the mail user and group to do what they want below /run. That probably even allows a local root exploit vector the one way or the other from mail to root.
If /run/sendmail is already created via systemd-tmpfiles, then why does mail:mail need write access in /run?
This file is not coming from upstream but from our packaging it looks like, right?
Normally sendmail would use /var/run but this is /run with systemd and this leads to error messages as well as sometimes not running service. Sep 15 09:54:37 boole sendmail[1483]: daemon could not open control socket /var/run/sendmail/control: Group writable directory If I change permissions I see Sep 15 16:28:42 boole sendmail[31011]: daemon could not open control socket /var/run/sendmail/control: Permission denied I simply want to have a fix which enables sendmail to do its job after reboot -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c4 --- Comment #4 from Dr. Werner Fink <werner@suse.com> --- On TW I see Sep 15 14:54:27 noether systemd[1]: sendmail.service: Can't open PID file /run/sendmail.pid (yet?) after start: Operation not permitted -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c5 --- Comment #5 from Dr. Werner Fink <werner@suse.com> --- But a socket for daemon control noether:~ # ll -rt /run/sendmail -d drwxr-x--T+ 2 root mail 60 Sep 15 16:39 /run/sendmail noether:~ # ll -rt /run/sendmail -d drwxr-x--T+ 2 root mail 60 Sep 15 16:39 /run/sendmail -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c6 --- Comment #6 from Dr. Werner Fink <werner@suse.com> --- (In reply to Dr. Werner Fink from comment #5)
But a socket for daemon control
noether:~ # ll -rt /run/sendmail -d drwxr-x--T+ 2 root mail 60 Sep 15 16:39 /run/sendmail noether:~ # ll -rt /run/sendmail -d drwxr-x--T+ 2 root mail 60 Sep 15 16:39 /run/sendmail
noether:~ # ll -rt /run/sendmail total 0 srw-rw---- 1 root mail 0 Sep 15 16:39 control -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c7 --- Comment #7 from Dr. Werner Fink <werner@suse.com> --- Created attachment 861509 --> http://bugzilla.opensuse.org/attachment.cgi?id=861509&action=edit /usr/lib/systemd/system/sendmail.service from my TW After some debugging I've identified same races for sendmail.pid file and problems due not writable /etc/aliases.db ... What I still want is to use systemd-tmpfiles-setup.service to replace the part of creating the directory /run/sendmail as a place for the control socket ... which is done in /etc/mail/system/sm.pre -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c9 --- Comment #9 from Dr. Werner Fink <werner@suse.com> --- I've added a directory to the sendmail permissions files and now I face [ 107s] sendmail.x86_64: E: permissions-file-digest-mismatch (Badness: 10) /etc/permissions.d/sendmail.paranoid expected sha256:afa2a74dfef4ac98dd048a7c962a3528e4b5c932e538f7c3666f167924de2d4e, has:2d5c56cdfb00ec169c182de791cf2934331159842f1849c5f2d7059f0086bd2c [ 107s] sendmail.x86_64: E: permissions-file-digest-mismatch (Badness: 10) /etc/permissions.d/sendmail expected sha256:423780cfd9d5935a26981b1cfede12816c1ce4c0982c22dd28d4ceadeed5cce5, has:1212f3c38078b22eca57c92554ee15f43f6dfb3fcebb21e420ba9f3397319c06 ... das Problem ist /etc/mail/system/ root:root 0755 ... ist unter server:mails/sendmail zu sehen. Zur Zeit l�uft der Scan nach der Belegung von Port 25 aka smtp f�r sendmail-client.service ins timeout ... und das obwohl sendmail.service l�uft -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c10 --- Comment #10 from Dr. Werner Fink <werner@suse.com> --- (In reply to Dr. Werner Fink from comment #9)
... das Problem ist
/etc/mail/system/ root:root 0755
... ist unter server:mails/sendmail zu sehen.
Zur Zeit l�uft der Scan nach der Belegung von Port 25 aka smtp f�r sendmail-client.service ins timeout ... und das obwohl sendmail.service l�uft
OK ... Problem gefunden und behoben -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c11 --- Comment #11 from Dr. Werner Fink <werner@suse.com> --- What now? I'm still waiting e.g on comment #9 to get fixed checksums for the permissions file sendmail and senmail.paranoid -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c12 --- Comment #12 from Dr. Werner Fink <werner@suse.com> --- [ 243s] sendmail.x86_64: W: permissions-dir-without-slash /etc/mail/auth [ 243s] sendmail.x86_64: W: permissions-dir-without-slash /etc/mail/certs [ 243s] sendmail.x86_64: W: permissions-dir-without-slash /etc/mail/system [ 243s] sendmail.x86_64: W: permissions-dir-without-slash /usr/libexec/sendmail.d/bin [ 243s] sendmail.x86_64: W: permissions-dir-without-slash /var/spool/mqueue [ 243s] the entry in the permissions file refers to a directory. Please contact [ 243s] security@suse.de to append a slash to the entry in order to avoid security [ 243s] problems. Please refer to [ 243s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 243s] more information. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c13 --- Comment #13 from Dr. Werner Fink <werner@suse.com> --- Please change the checksums done for sendmail and sendmail.paranoid with sha256sum noether:/ # cd /etc/permissions.d/ noether:permissions.d # sha256sum sendmail* e09ca5efebd0b3c123afc2364f9745f4d85c4327fa83f709bccbaa64da764486 sendmail 2d5c56cdfb00ec169c182de791cf2934331159842f1849c5f2d7059f0086bd2c sendmail.paranoid noether:permissions.d # cat sendmail* /usr/sbin/sendmail root:mail 2555 /etc/sendmail.cf root:root 0644 /etc/mail/auth/ root:root 0750 /etc/mail/certs/ root:root 0750 /etc/mail/system/ root:root 0755 /var/spool/clientmqueue/ mail:mail 0770 /var/spool/mqueue/ root:root 0700 /usr/libexec/sendmail.d/bin/ root:root 0755 /usr/libexec/sendmail.d/bin/smrsh root:root 0511 /usr/libexec/sendmail.d/bin/mail.local root:root 0511 /usr/sbin/sendmail root:mail 0555 /etc/sendmail.cf root:root 0644 /etc/mail/auth/ root:root 0750 /etc/mail/certs/ root:root 0750 /etc/mail/system/ root:root 0755 /var/spool/clientmqueue/ mail:mail 0750 /var/spool/mqueue/ root:root 0700 /usr/libexec/sendmail.d/bin/ root:root 0755 /usr/libexec/sendmail.d/bin/smrsh root:root 0511 /usr/libexec/sendmail.d/bin/mail.local root:root 0511 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c14 Dr. Werner Fink <werner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |filippo.bonazzi@suse.com, | |jsegitz@suse.com, | |paolo.perego@suse.com --- Comment #14 from Dr. Werner Fink <werner@suse.com> --- Can anyone of the added guys in the Carbin Copy list ask one of my questions and e.g. change the sha256 for sendmails permsissions files (or better add a second check to allow both new and old sendmail packages to build) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 Dr. Werner Fink <werner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(werner@suse.com) | -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c18 --- Comment #18 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1203340) was mentioned in https://build.opensuse.org/request/show/1007830 Factory / rpmlint -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c20 Dr. Werner Fink <werner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(paolo.perego@suse | |.com) --- Comment #20 from Dr. Werner Fink <werner@suse.com> --- Question: Are the sha256 check sums also changed to the new values? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c21 Paolo Perego <paolo.perego@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(paolo.perego@suse | |.com) | --- Comment #21 from Paolo Perego <paolo.perego@suse.com> --- Yes they are -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1203340 http://bugzilla.opensuse.org/show_bug.cgi?id=1203340#c22 --- Comment #22 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1203340) was mentioned in https://build.opensuse.org/request/show/1008922 Factory / rpmlint -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com