Don't allow a configure file which is writeable by the Exim user or group

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 837813cecbf40a849b86316e62bd5bd6d5cd9b53..049b2b6b082e291cb33dceac969d26ed41dcd66a 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -1,4 +1,4 @@
-. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.85 2010/06/07 08:42:15 pdp Exp $
+. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.88 2010/06/14 18:51:09 pdp Exp $

 .
 . /////////////////////////////////////////////////////////////////////////////
 . This is the primary source of the Exim Manual. It is an xfpt document that is
 .
 . /////////////////////////////////////////////////////////////////////////////
 . This is the primary source of the Exim Manual. It is an xfpt document that is


@@ -1896,6 +1896,8 @@ given in chapter &<<CHAPTLS>>&.
 .section "Use of tcpwrappers" "SECID27"
 .cindex "tcpwrappers, building Exim to support"
 .cindex "USE_TCP_WRAPPERS"
 .section "Use of tcpwrappers" "SECID27"
 .cindex "tcpwrappers, building Exim to support"
 .cindex "USE_TCP_WRAPPERS"

+.cindex "TCP_WRAPPERS_DAEMON_NAME"
+.cindex "tcp_wrappers_daemon_name"

 Exim can be linked with the &'tcpwrappers'& library in order to check incoming
 SMTP calls using the &'tcpwrappers'& control files. This may be a convenient
 alternative to Exim's own checking facilities for installations that are
 Exim can be linked with the &'tcpwrappers'& library in order to check incoming
 SMTP calls using the &'tcpwrappers'& control files. This may be a convenient
 alternative to Exim's own checking facilities for installations that are


@@ -1910,14 +1912,17 @@ USE_TCP_WRAPPERS=yes
 CFLAGS=-O -I/usr/local/include
 EXTRALIBS_EXIM=-L/usr/local/lib -lwrap
 .endd
 CFLAGS=-O -I/usr/local/include
 EXTRALIBS_EXIM=-L/usr/local/lib -lwrap
 .endd

-in &_Local/Makefile_&. The name to use in the &'tcpwrappers'& control files is
-&"exim"&. For example, the line
+in &_Local/Makefile_&. The daemon name to use in the &'tcpwrappers'& control
+files is &"exim"&. For example, the line

 .code
 exim : LOCAL  192.168.1.  .friendly.domain.example
 .endd
 in your &_/etc/hosts.allow_& file allows connections from the local host, from
 the subnet 192.168.1.0/24, and from all hosts in &'friendly.domain.example'&.
 .code
 exim : LOCAL  192.168.1.  .friendly.domain.example
 .endd
 in your &_/etc/hosts.allow_& file allows connections from the local host, from
 the subnet 192.168.1.0/24, and from all hosts in &'friendly.domain.example'&.

-All other connections are denied. Consult the &'tcpwrappers'& documentation for
+All other connections are denied. The daemon name used by &'tcpwrappers'&
+can be changed at build time by setting TCP_WRAPPERS_DAEMON_NAME in
+in &_Local/Makefile_&, or by setting tcp_wrappers_daemon_name in the
+configure file. Consult the &'tcpwrappers'& documentation for

 further details.
 
 
 further details.
 
 


@@ -3179,11 +3184,20 @@ the listening daemon.
 .cindex "testing", "malware"
 .cindex "malware scan test"
 This debugging option causes Exim to scan the given file,
 .cindex "testing", "malware"
 .cindex "malware scan test"
 This debugging option causes Exim to scan the given file,

-using the malware scanning framework.  The option of av_scanner influences
-this option, so if av_scanner's value is dependent upon an expansion then
-the expansion should have defaults which apply to this invocation.  Exim will
-have changed working directory before resolving the filename, so using fully
-qualified pathnames is advisable.  This option requires admin privileges.
+using the malware scanning framework.  The option of &%av_scanner%& influences
+this option, so if &%av_scanner%&'s value is dependent upon an expansion then
+the expansion should have defaults which apply to this invocation.  ACLs are
+not invoked, so if &%av_scanner%& references an ACL variable then that variable
+will never be populated and &%-bmalware%& will fail.
+
+Exim will have changed working directory before resolving the filename, so
+using fully qualified pathnames is advisable.  Exim will be running as the Exim
+user when it tries to open the file, rather than as the invoking user.
+This option requires admin privileges.
+
+The &%-bmalware%& option will not be extended to be more generally useful,
+there are better tools for file-scanning.  This option exists to help
+administrators verify their Exim and AV scanner configuration.

 
 .vitem &%-bt%&
 .oindex "&%-bt%&"
 
 .vitem &%-bt%&
 .oindex "&%-bt%&"


@@ -4487,17 +4501,21 @@ existing file in the list.
 .cindex "configuration file" "ownership"
 .cindex "ownership" "configuration file"
 The run time configuration file must be owned by root or by the user that is
 .cindex "configuration file" "ownership"
 .cindex "ownership" "configuration file"
 The run time configuration file must be owned by root or by the user that is

-specified at compile time by the EXIM_USER option, or by the user that is

 specified at compile time by the CONFIGURE_OWNER option (if set). The
 specified at compile time by the CONFIGURE_OWNER option (if set). The

-configuration file must not be world-writeable or group-writeable, unless its
-group is the one specified at compile time by the EXIM_GROUP option or by the
+configuration file must not be world-writeable, or group-writeable unless its
+group is the root group or the one specified at compile time by the

 CONFIGURE_GROUP option.
 
 &*Warning*&: In a conventional configuration, where the Exim binary is setuid
 to root, anybody who is able to edit the run time configuration file has an
 CONFIGURE_GROUP option.
 
 &*Warning*&: In a conventional configuration, where the Exim binary is setuid
 to root, anybody who is able to edit the run time configuration file has an

-easy way to run commands as root. If you make your mail administrators members
-of the Exim group, but do not trust them with root, make sure that the run time
-configuration is not group writeable.
+easy way to run commands as root. If you specify a user or group in the
+CONFIGURE_OWNER or CONFIGURE_GROUP options, then that user and/or any users
+who are members of that group will trivially be able to obtain root privileges.
+
+Up to Exim version 4.72, the run time configuration file was also permitted to
+be writeable by the Exim user and/or group. That has been changed in Exim 4.73
+since it offered a simple privilege escalation for any attacker who managed to
+compromise the Exim user account.

 
 A default configuration file, which will work correctly in simple situations,
 is provided in the file &_src/configure.default_&. If CONFIGURE_FILE
 
 A default configuration file, which will work correctly in simple situations,
 is provided in the file &_src/configure.default_&. If CONFIGURE_FILE