From nobody@FreeBSD.org  Thu May 22 09:06:48 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 887491065677
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 22 May 2008 09:06:48 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 74F128FC25
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 22 May 2008 09:06:48 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m4M95MDI080621
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 22 May 2008 09:05:22 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.2/8.14.1/Submit) id m4M95M2p080620;
	Thu, 22 May 2008 09:05:22 GMT
	(envelope-from nobody)
Message-Id: <200805220905.m4M95M2p080620@www.freebsd.org>
Date: Thu, 22 May 2008 09:05:22 GMT
From: Helmut Schneider <jumper99@gmx.de>
To: freebsd-gnats-submit@FreeBSD.org
Subject: security/amavisd-new broken when running chroot'ed
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         123888
>Category:       ports
>Synopsis:       security/amavisd-new broken when running chroot'ed
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    gabor
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu May 22 09:10:06 UTC 2008
>Closed-Date:    Mon May 26 17:40:37 UTC 2008
>Last-Modified:  Mon May 26 17:40:37 UTC 2008
>Originator:     Helmut Schneider
>Release:        7.0-RELEASE
>Organization:
>Environment:
>Description:
[root@FBSD70VM ~]# amavisd debug
May 22 10:47:51.064 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: starting.  /usr/local/sbin/amavisd at FBSD70VM.v-pe.de amavisd-new-2.6.0 (20080423), Unicode aware
May 22 10:47:51.065 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: user=, EUID: 110 (110);  group=, EGID: 110 110 (110 110)
May 22 10:47:51.065 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Perl version               5.008008
May 22 10:47:51.853 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: INFO: SA version: 3.2.4, 3.002004, no optional modules: Mail::SpamAssassin::SQLBasedAddrList Net::CIDR::Lite Sys::Hostname::Long DBD::mysql Mail::SpamAssassin::BayesStore::PgSQL IP::Country::Fast Image::Info Image::Info::GIF Image::Info::JPEG Image::Info::PNG Image::Info::TIFF Mail::SPF::Query
May 22 10:47:51.853 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: SpamControl: init_pre_chroot on SpamAssassin done
May 22 10:47:51.854 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: 2008/05/22-10:47:51 Amavis (type Net::Server::PreForkSimple) starting! pid(81036)
May 22 10:47:51.862 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: Binding to UNIX socket file /var/amavis/amavisd.sock using SOCK_STREAM
May 22 10:47:51.863 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1
May 22 10:47:51.864 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: Group Not Defined.  Defaulting to EGID '110 110'
May 22 10:47:51.865 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: User Not Defined.  Defaulting to EUID '110'
May 22 10:47:51.865 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: Chrooting to /var/amavis
May 22 10:47:51.865 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: (!)Net::Server: 2008/05/22-10:47:51 Couldn't chroot to "/var/amavis": Operation not permitted\n  at line 523 in file /usr/local/lib/perl5/site_perl/5.8.8/Net/Server.pm
May 22 10:47:51.865 FBSD70VM.v-pe.de /usr/local/sbin/amavisd[81036]: Net::Server: 2008/05/22-10:47:51 Server closing!
[root@FBSD70VM ~]#

I guess Net::Server tries to chroot as non-root (GID/UID vscan) which according to "man 2 chroot" is not allowed.
>How-To-Repeat:
Install amavisd-new 2.6 and set

$daemon_chroot_dir = $MYHOME;
>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-ports-bugs->gabor 
Responsible-Changed-By: edwin 
Responsible-Changed-When: Thu May 22 09:10:13 UTC 2008 
Responsible-Changed-Why:  
Over to maintainer (via the GNATS Auto Assign Tool) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=123888 
State-Changed-From-To: open->closed 
State-Changed-By: gabor 
State-Changed-When: Mon May 26 17:39:40 UTC 2008 
State-Changed-Why:  
This does not seem FreeBSD-specific, please ask about this issue on the 
official amavisd-new mailing list. Thanks for your submission, though! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=123888 
>Unformatted:
