Tests compat. setgid failure / dropped_privilege

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 66dfab7cd6b1a31acde0b090e16f5363b188ae16..fa73e50811e0b92b4f77b614890c878e72f58d4c 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -48,7 +48,7 @@
 . /////////////////////////////////////////////////////////////////////////////
 
 .set previousversion "4.72"
-.set version "4.73"
+.set version "4.74"
 
 .set ACL "access control lists (ACLs)"
 .set I   "    "
@@ -1946,6 +1946,36 @@ support has not been tested for some time.
 
 
 
+.section "Dynamically loaded lookup module support" "SECTdynamicmodules"
+.cindex "lookup modules"
+.cindex "dynamic modules"
+.cindex ".so building"
+On some platforms, Exim supports not compiling all lookup types directly into
+the main binary, instead putting some into external modules which can be loaded
+on demand.
+This permits packagers to build Exim with support for lookups with extensive
+library dependencies without requiring all users to install all of those
+dependencies.
+Most, but not all, lookup types can be built this way.
+
+Set &`LOOKUP_MODULE_DIR`& to the directory into which the modules will be
+installed; Exim will only load modules from that directory, as a security
+measure.  You will need to set &`CFLAGS_DYNAMIC`& if not already defined
+for your OS; see &_OS/Makefile-Linux_& for an example.
+Some other requirements for adjusting &`EXTRALIBS`& may also be necessary,
+see &_src/EDITME_& for details.
+
+Then, for each module to be loaded dynamically, define the relevant
+&`LOOKUP_`&<&'lookup_type'&> flags to have the value "2" instead of "yes".
+For example, this will build in lsearch but load sqlite and mysql support
+on demand:
+.code
+LOOKUP_LSEARCH=yes
+LOOKUP_SQLITE=2
+LOOKUP_MYSQL=2
+.endd
+
+
 .section "The building process" "SECID29"
 .cindex "build directory"
 Once &_Local/Makefile_& (and &_Local/eximon.conf_&, if required) have been
@@ -15401,6 +15431,13 @@ are using OpenSSL, you can set &%tls_verify_certificates%& to the name of a
 directory containing certificate files. This does not work with GnuTLS; the
 option must be set to the name of a single file if you are using GnuTLS.
 
+These certificates should be for the certificate authorities trusted, rather
+than the public cert of individual clients.  With both OpenSSL and GnuTLS, if
+the value is a file then the certificates are sent by Exim as a server to
+connecting clients, defining the list of accepted certificate authorities.
+Thus the values defined should be considered public data.  To avoid this,
+use OpenSSL with a directory.
+
 
 .option tls_verify_hosts main "host list&!!" unset
 .cindex "TLS" "client certificate verification"
@@ -34208,6 +34245,13 @@ arbitrary program's being run as exim, not as root.
 
 
 
+.section "Dynamic module directory" "SECTdynmoddir"
+Any dynamically loadable modules must be installed into the directory
+defined in &`LOOKUP_MODULE_DIR`& in &_Local/Makefile_& for Exim to permit
+loading it.
+
+
+
 .section "Use of sprintf()" "SECID279"
 .cindex "&[sprintf()]&"
 A large number of occurrences of &"sprintf"& in the code are actually calls to