X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/9c2b45c9eafbcceb99cbcdcc2075088d7a2a74de..2eec84caa477a4b3b1f9fff999000768f65bd936:/doc/doc-src/FAQ.src

diff --git a/doc/doc-src/FAQ.src b/doc/doc-src/FAQ.src
index b53070e07..9280e0314 100644
--- a/doc/doc-src/FAQ.src
+++ b/doc/doc-src/FAQ.src
@@ -1,4 +1,3 @@
-## $Cambridge: exim/doc/doc-src/FAQ.src,v 1.8 2009/11/05 19:37:00 nm4 Exp $
 ##
 ## This file is processed by Perl scripts to produce an ASCII and an HTML
 ## version. Lines starting with ## are omitted. The markup used with paragraphs
@@ -851,7 +850,9 @@ A0044: Exim has been unable to create a file in its spool area in which to
 
        If you are running Exim with an alternate configuration file using a
        command such as \"exim -C altconfig..."\, remember that the use of -C
-       takes away Exim's root privilege.
+       takes away Exim's root privilege, unless \\TRUSTED_CONFIG_LIST\\
+       is set in \(Local/Makefile)\ and the corresponding file contains a
+       prefix which matches the alternative configuration file being used.
 
        Check that you have defined the spool directory correctly by running
 
@@ -1147,25 +1148,17 @@ Q0065: When (as \/root/\) I use -C to run Exim with an alternate configuration
        trying to run an \%autoreply%\ transport. Why is this?
 
 A0065: When Exim is called with -C, it passes on -C to any instances of itself
-       that it calls (so that the whole sequence uses the same config file). If
-       it's running as \/exim/\ when it does this, all is well. However, if it
-       happens as a consequence of a non-privileged user running \%autoreply%\,
-       the called Exim gives up its root privilege. Then it can't write to the
-       spool.
-
-       This means that you can't use -C (even as \/root/\) to run an instance of
-       Exim that is going to try to run \%autoreply%\ from a process that is
-       neither \/root/\ nor \/exim/\. Because of the architecture of Exim (using
-       re-execs to regain privilege), there isn't any way round this
-       restriction. Therefore, the only way you can make this scenario work is
-       to run the \%autoreply%\ transport as \/exim/\ (that is, the user that
-       owns the Exim spool files). This may be satisfactory for autoreplies
-       that are essentially system-generated, but of course is no good for
-       autoreplies from unprivileged users, where you want the \%autoreply%\
-       transport to be run as the user. To get that to work with an alternate
-       configuration, you'll have to use two Exim binaries, with different
-       configuration file names in each. See S001 for a script that patches
-       the configuration name in an Exim binary.
+       that it calls (so that the whole sequence uses the same config file).
+       However, Exim gives up its root privilege if any user except \/root\/
+       passes a -C option to use a non-default configuration file, and that
+       includes the case where Exim re-execs itself to regain root privilege.
+       Thus it can't write to the spool.
+
+       The fix for this is to use the \\TRUSTED_CONFIG_LIST\\ build-time
+       option. This defines a file containing a list of 'trusted' prefixes for
+       configuration files. Any configuration file specified with -C, if it
+       matches a prefix listed in that file, will be used without dropping root
+       privileges (as long as it is not writeable by a non-root user).
 
 
 Q0066: What does the message \*unable to set gid=xxx or uid=xxx*\ mean?
@@ -2323,7 +2316,7 @@ A0310: If a DNS lookup returns no MXs, Exim looks for an address record, in
 
 
 Q0311: When a DNS lookup for MX records fails to complete, why doesn't Exim
-       send the messsage to the host defined by the A record?
+       send the message to the host defined by the A record?
 
 A0311: The RFCs are quite clear on this. Only if it is known that there are no
        MX records is an MTA allowed to make use of the A record. When an MX