Fix taint-checking on OpenBSD

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dd0439644dbb7b5484ebfae00c6ec3cfb2f2ac6c..32d57d027ec1a7c2d2d42a6c5a0e807b69508bab 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -2528,6 +2528,8 @@ use of Exim's filtering capabilities, you should make the document entitled
 If you are already running Exim on your host, building and installing a new
 version automatically makes it available to MUAs, or any other programs that
 call the MTA directly. However, if you are running an Exim daemon, you do need
 If you are already running Exim on your host, building and installing a new
 version automatically makes it available to MUAs, or any other programs that
 call the MTA directly. However, if you are running an Exim daemon, you do need

+.cindex restart "on HUP signal"
+.cindex signal "HUP, to restart"

 to send it a HUP signal, to make it re-execute itself, and thereby pick up the
 new binary. You do not need to stop processing mail in order to install a new
 version of Exim. The install script does not modify an existing runtime
 to send it a HUP signal, to make it re-execute itself, and thereby pick up the
 new binary. You do not need to stop processing mail in order to install a new
 version of Exim. The install script does not modify an existing runtime


@@ -2766,9 +2768,12 @@ used to specify a path on the command line if a pid file is required.
 
 The SIGHUP signal
 .cindex "SIGHUP"
 
 The SIGHUP signal
 .cindex "SIGHUP"

+.cindex restart "on HUP signal"
+.cindex signal "HUP, to restart"

 .cindex "daemon" "restarting"
 .cindex signal "to reload configuration"
 .cindex daemon "reload configuration"
 .cindex "daemon" "restarting"
 .cindex signal "to reload configuration"
 .cindex daemon "reload configuration"

+.cindex reload configuration

 can be used to cause the daemon to re-execute itself. This should be done
 whenever Exim's configuration file, or any file that is incorporated into it by
 means of the &%.include%& facility, is changed, and also whenever a new version
 can be used to cause the daemon to re-execute itself. This should be done
 whenever Exim's configuration file, or any file that is incorporated into it by
 means of the &%.include%& facility, is changed, and also whenever a new version


@@ -9214,7 +9219,13 @@ dependent upon the option for which a value is sought; in this documentation,
 options for which string expansion is performed are marked with † after
 the data type.  ACL rules always expand strings.  A couple of expansion
 conditions do not expand some of the brace-delimited branches, for security
 options for which string expansion is performed are marked with † after
 the data type.  ACL rules always expand strings.  A couple of expansion
 conditions do not expand some of the brace-delimited branches, for security

-reasons.
+reasons,
+.new
+.cindex "tainted data" expansion
+.cindex expansion "tainted data"
+and expansion of data deriving from the sender (&"tainted data"&)
+is not permitted.
+.wen

 
 
 
 
 
 


@@ -39538,6 +39549,11 @@ was received from the client, this records the Distinguished Name from that
 certificate.
 .endlist
 
 certificate.
 .endlist
 

+.new
+Any of the above may have an extra hyphen prepended, to indicate the the
+corresponding data is untrusted.
+.wen
+

 Following the options there is a list of those addresses to which the message
 is not to be delivered. This set of addresses is initialized from the command
 line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&
 Following the options there is a list of those addresses to which the message
 is not to be delivered. This set of addresses is initialized from the command
 line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&