Add perl_taintmode option

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 904f831e8abe9893fedc89025bb95e25895a3de1..8a0c96753d6aaeb957c759e46012a069e1aad516 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -12967,6 +12967,14 @@ overriding the setting of &%perl_at_start%&.
 There is also a command line option &%-pd%& (for delay) which suppresses the
 initial startup, even if &%perl_at_start%& is set.
 
 There is also a command line option &%-pd%& (for delay) which suppresses the
 initial startup, even if &%perl_at_start%& is set.
 

+.ilist
+.oindex "&%perl_taintmode%&"
+To provide more security executing Perl code via the embedded Perl
+interpeter, the &%perl_taintmode%& option can be set. This enables the
+taint mode of the Perl interpreter. You are encouraged to set this
+option to a true value. To avoid breaking existing installations, it
+defaults to false.
+

 
 .section "Calling Perl subroutines" "SECID86"
 When the configuration file includes a &%perl_startup%& option you can make use
 
 .section "Calling Perl subroutines" "SECID86"
 When the configuration file includes a &%perl_startup%& option you can make use


@@ -13495,6 +13503,7 @@ listed in more than one group.
 .table2
 .row &%perl_at_start%&               "always start the interpreter"
 .row &%perl_startup%&                "code to obey when starting Perl"
 .table2
 .row &%perl_at_start%&               "always start the interpreter"
 .row &%perl_startup%&                "code to obey when starting Perl"

+.row &%perl_taintmode%&                     "enable taint mode in Perl"

 .endtable
 
 
 .endtable
 
 


@@ -15582,14 +15591,20 @@ local parts. Exim's default configuration does this.
 
 
 .option perl_at_start main boolean false
 
 
 .option perl_at_start main boolean false

+.cindex "Perl"

 This option is available only when Exim is built with an embedded Perl
 interpreter. See chapter &<<CHAPperl>>& for details of its use.
 
 
 .option perl_startup main string unset
 This option is available only when Exim is built with an embedded Perl
 interpreter. See chapter &<<CHAPperl>>& for details of its use.
 
 
 .option perl_startup main string unset

+.cindex "Perl"

 This option is available only when Exim is built with an embedded Perl
 interpreter. See chapter &<<CHAPperl>>& for details of its use.
 
 This option is available only when Exim is built with an embedded Perl
 interpreter. See chapter &<<CHAPperl>>& for details of its use.
 

+.option perl_startup main boolean false
+.cindex "Perl"
+This Option enables the taint mode of the embedded Perl interpreter.
+

 
 .option pgsql_servers main "string list" unset
 .cindex "PostgreSQL lookup type" "server list"
 
 .option pgsql_servers main "string list" unset
 .cindex "PostgreSQL lookup type" "server list"


@@ -23418,6 +23433,15 @@ the message. As a result, the overall timeout for a message depends on the size
 of the message. Its value must not be zero. See also &%final_timeout%&.
 
 
 of the message. Its value must not be zero. See also &%final_timeout%&.
 
 

+.option dkim_domain smtp string&!! unset
+.option dkim_selector smtp string&!! unset
+.option dkim_private_key smtp string&!! unset
+.option dkim_canon smtp string&!! unset
+.option dkim_strict smtp string&!! unset
+.option dkim_sign_headers smtp string&!! unset
+DKIM signing options.  For details see &<<SECDKIMSIGN>>&.
+
+

 .option delay_after_cutoff smtp boolean true
 This option controls what happens when all remote IP addresses for a given
 domain have been inaccessible for so long that they have passed their retry
 .option delay_after_cutoff smtp boolean true
 This option controls what happens when all remote IP addresses for a given
 domain have been inaccessible for so long that they have passed their retry


@@ -38006,7 +38030,7 @@ where you accept mail from relay sources (internal hosts or authenticated
 senders).
 
 
 senders).
 
 

-.section "Signing outgoing messages" "SECID513"
+.section "Signing outgoing messages" "SECDKIMSIGN"

 .cindex "DKIM" "signing"
 
 Signing is implemented by setting private options on the SMTP transport.
 .cindex "DKIM" "signing"
 
 Signing is implemented by setting private options on the SMTP transport.