When this option is used by a caller other than root, and the list is different
from the compiled-in list, Exim gives up its root privilege immediately, and
runs with the real and effective uid and gid set to those of the caller.
-However, if a TRUSTED_CONFIG_PREFIX_LIST file is defined in &_Local/Makefile_&,
-root privilege is retained for any configuration file which matches a prefix
-listed in that file.
+However, if a TRUSTED_CONFIG_LIST file is defined in &_Local/Makefile_&, root
+privilege is retained for any configuration file which is listed in that file
+as long as the caller is the Exim user (or the user specified in the
+CONFIGURE_OWNER option, if any).
-Leaving TRUSTED_CONFIG_PREFIX_LIST unset precludes the possibility of testing
-a configuration using &%-C%& right through message reception and delivery,
+Leaving TRUSTED_CONFIG_LIST unset precludes the possibility of testing a
+configuration using &%-C%& right through message reception and delivery,
even if the caller is root. The reception works, but by that time, Exim is
running as the Exim user, so when it re-executes to regain privilege for the
delivery, the use of &%-C%& causes privilege to be lost. However, root can
If DISABLE_D_OPTION is defined in &_Local/Makefile_&, the use of &%-D%& is
completely disabled, and its use causes an immediate error exit.
+If WHITELIST_D_MACROS is defined in &_Local/Makefile_& then it should be a
+colon-separated list of macros which are considered safe and, if &%-D%& only
+supplies macros from this list, and the values are acceptable, then Exim will
+not give up root privilege if the caller is root, the Exim run-time user, or
+the CONFIGURE_OWNER, if set. This is a transition mechanism and is expected
+to be removed in the future. Acceptable values for the macros satisfy the
+regexp: &`^[A-Za-z0-9_/.-]*$`&
+
The entire option (including equals sign if present) must all be within one
command line item. &%-D%& can be used to set the value of a macro to the empty
string, in which case the equals sign is optional. These two commands are
option, which may specify a single file or a list of files. However, when
&%-C%& is used, Exim gives up its root privilege, unless called by root (or
unless the argument for &%-C%& is identical to the built-in value from
-CONFIGURE_FILE) or matches a prefix listed in the TRUSTED_CONFIG_PREFIX_LIST
-file. &%-C%& is useful mainly for checking the syntax of configuration files
-before installing them. No owner or group checks are done on a configuration
-file specified by &%-C%&, if root privilege has been dropped.
+CONFIGURE_FILE), or is listed in the TRUSTED_CONFIG_LIST file and the caller
+is the Exim user or the user specified in the CONFIGURE_OWNER setting. &%-C%&
+is useful mainly for checking the syntax of configuration files before
+installing them. No owner or group checks are done on a configuration file
+specified by &%-C%&, if root privilege has been dropped.
Even the Exim user is not trusted to specify an arbitrary configuration file
with the &%-C%& option to be used with root privileges, unless that file is
-listed in the TRUSTED_CONFIG_PREFIX_LIST file. This locks out the possibility
-of testing a configuration using &%-C%& right through message reception and
+listed in the TRUSTED_CONFIG_LIST file. This locks out the possibility of
+testing a configuration using &%-C%& right through message reception and
delivery, even if the caller is root. The reception works, but by that time,
Exim is running as the Exim user, so when it re-execs to regain privilege for
the delivery, the use of &%-C%& causes privilege to be lost. However, root
If DISABLE_D_OPTION is defined in &_Local/Makefile_&, the use of &%-D%& is
completely disabled, and its use causes an immediate error exit.
+The WHITELIST_D_MACROS option in &_Local/Makefile_& permits the binary builder
+to declare certain macro names trusted, such that root privilege will not
+necessarily be discarded.
+WHITELIST_D_MACROS defines a colon-separated list of macros which are
+considered safe and, if &%-D%& only supplies macros from this list, and the
+values are acceptable, then Exim will not give up root privilege if the caller
+is root, the Exim run-time user, or the CONFIGURE_OWNER, if set. This is a
+transition mechanism and is expected to be removed in the future. Acceptable
+values for the macros satisfy the regexp: &`^[A-Za-z0-9_/.-]*$`&
+
Some sites may wish to use the same Exim binary on different machines that
share a file system, but to use different configuration files on each machine.
If CONFIGURE_FILE_USE_NODE is defined in &_Local/Makefile_&, Exim first
into the Exim account from running a privileged Exim with an arbitrary
configuration file, and using it to break into other accounts.
.next
-If a non-trusted configuration file (i.e. the default configuration file or
-one which is trusted by virtue of matching a prefix listed in the
-TRUSTED_CONFIG_PREFIX_LIST file) is specified with &%-C%&, or if macros are
-given with &%-D%&, then root privilege is retained only if the caller of Exim
-is root. This locks out the possibility of testing a configuration using &%-C%&
+If a non-trusted configuration file (i.e. not the default configuration file
+or one which is trusted by virtue of being listed in the TRUSTED_CONFIG_LIST
+file) is specified with &%-C%&, or if macros are given with &%-D%& (but see
+the next item), then root privilege is retained only if the caller of Exim is
+root. This locks out the possibility of testing a configuration using &%-C%&
right through message reception and delivery, even if the caller is root. The
reception works, but by that time, Exim is running as the Exim user, so when
it re-execs to regain privilege for the delivery, the use of &%-C%& causes
privilege to be lost. However, root can test reception and delivery using two
separate commands.
.next
+The WHITELIST_D_MACROS build option declares some macros to be safe to override
+with &%-D%& if the real uid is one of root, the Exim run-time user or the
+CONFIGURE_OWNER, if defined. The potential impact of this option is limited by
+requiring the run-time value supplied to &%-D%& to match a regex that errs on
+the restrictive side. Requiring build-time selection of safe macros is onerous
+but this option is intended solely as a transition mechanism to permit
+previously-working configurations to continue to work after release 4.73.
+.next
If DISABLE_D_OPTION is defined, the use of the &%-D%& command line option
is disabled.
.next
If the &%-C%& option is used to specify an alternate configuration file, or if
the &%-D%& option is used to define macro values for the configuration, and the
calling process is not running as root, the uid and gid are changed to those of
- the calling process.
+the calling process.
However, if DISABLE_D_OPTION is defined in &_Local/Makefile_&, the &%-D%&
option may not be used at all.
+If WHITELIST_D_MACROS is defined in &_Local/Makefile_&, then some macro values
+can be supplied if the calling process is running as root, the Exim run-time
+user or CONFIGURE_OWNER, if defined.
.next
.oindex "&%-be%&"
.oindex "&%-bf%&"
git://git.exim.org / exim.git / blobdiff