SMTP protocol names (see the description of &$received_protocol$& in section
&<<SECTexpvar>>&). For &%-bs%&, the protocol is always &"local-"& followed by
one of those same names. For &%-bS%& (batched SMTP) however, the protocol can
-be set by &%-oMr%&.
+be set by &%-oMr%&. Repeated use of this option is not supported.
.vitem &%-oMs%&&~<&'host&~name'&>
.oindex "&%-oMs%&"
Note the Exim already has two private options, &%-pd%& and &%-ps%&, that refer
to embedded Perl. It is therefore impossible to set a protocol value of &`d`&
or &`s`& using this option (but that does not seem a real limitation).
+Repeated use of this option is not supported.
.vitem &%-q%&
.oindex "&%-q%&"
${if match_domain{a.b.c}{x.y.z:a.b.c:p.q.r}{yes}{no}}
.endd
In each case, the second argument may contain any of the allowable items for a
-list of the appropriate type. Also, because the second argument (after
-expansion) is a standard form of list, it is possible to refer to a named list.
+list of the appropriate type. Also, because the second argument
+is a standard form of list, it is possible to refer to a named list.
Thus, you can use conditions like this:
.code
${if match_domain{$domain}{+local_domains}{...
.section "Privilege controls" "SECID98"
.table2
.row &%admin_groups%& "groups that are Exim admin users"
+.row &%commandline_checks_require_admin%& "require admin for various checks"
.row &%deliver_drop_privilege%& "drop root for delivery processes"
.row &%local_from_check%& "insert &'Sender:'& if necessary"
.row &%local_from_prefix%& "for testing &'From:'& for local sender"
these hosts.
Hosts may use the BDAT command as an alternate to DATA.
+.new
+.option commandline_checks_require_admin main boolean &`false`&
+.cindex "restricting access to features"
+This option restricts various basic checking features to require an
+administrative user.
+This affects most of the &%-b*%& options, such as &%-be%&.
+.wen
+
.option debug_store main boolean &`false`&
.cindex debugging "memory corruption"
.cindex memory debugging
.option prod_requires_admin main boolean true
+.cindex "restricting access to features"
.oindex "&%-M%&"
.oindex "&%-R%&"
.oindex "&%-q%&"
The &%-M%&, &%-R%&, and &%-q%& command-line options require the caller to be an
admin user unless &%prod_requires_admin%& is set false. See also
-&%queue_list_requires_admin%&.
+&%queue_list_requires_admin%& and &%commandline_checks_require_admin%&.
.option qualify_domain main string "see below"
.option queue_list_requires_admin main boolean true
+.cindex "restricting access to features"
.oindex "&%-bp%&"
The &%-bp%& command-line option, which lists the messages that are on the
queue, requires the caller to be an admin user unless
-&%queue_list_requires_admin%& is set false. See also &%prod_requires_admin%&.
+&%queue_list_requires_admin%& is set false.
+See also &%prod_requires_admin%& and &%commandline_checks_require_admin%&.
.option queue_only main boolean false
lookup first. Only if that gives a definite &"no such host"& is the local
function called.
+&*Compatibility*&: From Exim 4.85 until fixed for 4.90, there was an
+inadvertent constraint that a transport name as an option had to be the last
+option specified.
+
If no IP address for a host can be found, what happens is controlled by the
.option forbid_blackhole redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, the &':blackhole:'& item may not appear in a
redirection list.
.option forbid_exim_filter redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is set true, only Sieve filters are permitted when
&%allow_filter%& is true.
.option forbid_file redirect boolean false
+.cindex "restricting access to features"
.cindex "delivery" "to file; forbidding"
+.cindex "filter" "locking out certain features"
.cindex "Sieve filter" "forbidding delivery to a file"
.cindex "Sieve filter" "&""keep""& facility; disabling"
If this option is true, this router may not generate a new address that
.option forbid_filter_dlfunc redirect boolean false
+.cindex "restricting access to features"
.cindex "filter" "locking out certain features"
If this option is true, string expansions in Exim filters are not allowed to
make use of the &%dlfunc%& expansion facility to run dynamically loaded
functions.
.option forbid_filter_existstest redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
.cindex "expansion" "statting a file"
If this option is true, string expansions in Exim filters are not allowed to
make use of the &%exists%& condition or the &%stat%& expansion item.
.option forbid_filter_logwrite redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, use of the logging facility in Exim filters is not
permitted. Logging is in any case available only if the filter is being run
under some unprivileged uid (which is normally the case for ordinary users'
.option forbid_filter_lookup redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, string expansions in Exim filter files are not allowed
to make use of &%lookup%& items.
.option forbid_filter_perl redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
This option has an effect only if Exim is built with embedded Perl support. If
it is true, string expansions in Exim filter files are not allowed to make use
of the embedded Perl support.
.option forbid_filter_readfile redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, string expansions in Exim filter files are not allowed
to make use of &%readfile%& items.
.option forbid_filter_readsocket redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, string expansions in Exim filter files are not allowed
to make use of &%readsocket%& items.
.option forbid_filter_reply redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, this router may not generate an automatic reply
message. Automatic replies can be generated only from Exim or Sieve filter
files, not from traditional forward files. This option is forced to be true if
.option forbid_filter_run redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, string expansions in Exim filter files are not allowed
to make use of &%run%& items.
.option forbid_include redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is true, items of the form
.code
:include:<path name>
.option forbid_pipe redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
.cindex "delivery" "to pipe; forbidding"
If this option is true, this router may not generate a new address which
specifies delivery to a pipe, either from an Exim filter or from a conventional
.option forbid_sieve_filter redirect boolean false
+.cindex "restricting access to features"
+.cindex "filter" "locking out certain features"
If this option is set true, only Exim filters are permitted when
&%allow_filter%& is true.
The value of the option is expanded, and must then be a numerical value
(decimal point allowed), optionally followed by one of the letters K, M, or G,
-for kilobytes, megabytes, or gigabytes. If Exim is running on a system with
+for kilobytes, megabytes, or gigabytes, optionally followed by a slash
+and further option modifiers. If Exim is running on a system with
large file support (Linux and FreeBSD have this), mailboxes larger than 2G can
be handled.
+The option modifier &%no_check%& can be used to force delivery even if the over
+quota condition is met. The quota gets updated as usual.
+
&*Note*&: A value of zero is interpreted as &"no quota"&.
The expansion happens while Exim is running as root, before it changes uid for
failure causes delivery to be deferred. A value of zero is interpreted as
&"no quota"&.
+The option modifier &%no_check%& can be used to force delivery even if the over
+quota condition is met. The quota gets updated as usual.
.option quota_is_inclusive appendfile boolean true
See &%quota%& above.
Note also that headers cannot be
modified by any of the post-data ACLs (DATA, MIME and DKIM).
Headers may be modified by routers (subject to the above) and transports.
+.new
+The Received-By: header is generated as soon as the body reception starts,
+rather than the traditional time after the full message is received;
+this will affect the timestamp.
+.wen
All the usual ACLs are called; if one results in the message being
rejected, all effort spent in delivery (including the costs on
a commandline to send (may include a single %s which will be replaced with
the path to the mail file to be scanned),
an RE to trigger on from the returned data,
-an RE to extract malware_name from the returned data.
+and an RE to extract malware_name from the returned data.
For example:
.code
-av_scanner = sock:127.0.0.1 6001:%s:(SPAM|VIRUS):(.*)\$
+av_scanner = sock:127.0.0.1 6001:%s:(SPAM|VIRUS):(.*)$
.endd
-Default for the socket specifier is &_/tmp/malware.sock_&.
-Default for the commandline is &_%s\n_&.
-Both regular-expressions are required.
+.new
+Note that surrounding whitespace is stripped from each option, meaning
+there is no way to specify a trailing newline.
+The socket specifier and both regular-expressions are required.
+Default for the commandline is &_%s\n_& (note this does have a trailing newline);
+specify an empty element to get this.
+.wen
.vitem &%sophie%&
.cindex "virus scanners" "Sophos and Sophie"
unprivileged), Exim must be built to allow group read access to its spool
files.
+.new
+By default, regular users are trusted to perform basic testing and
+introspection commands, as themselves. This setting can be tightened by
+setting the &%commandline_checks_require_admin%& option.
+This affects most of the checking options,
+such as &%-be%& and anything else &%-b*%&.
+.wen
.section "Spool files" "SECID275"
.vitem &%$dkim_canon_body%&
The body canonicalization method. One of 'relaxed' or 'simple'.
-.vitem &%dkim_canon_headers%&
+.vitem &%$dkim_canon_headers%&
The header canonicalization method. One of 'relaxed' or 'simple'.
.vitem &%$dkim_copiedheaders%&
git://git.exim.org / users / heiko / exim.git / blobdiff