From reho@rx.cz  Sun Jul 24 08:00:45 2005
Return-Path: <reho@rx.cz>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E650A16A424;
	Sun, 24 Jul 2005 08:00:44 +0000 (GMT)
	(envelope-from reho@rx.cz)
Received: from ns.decros.cz (ns.decros.cz [193.85.26.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C5DF743D45;
	Sun, 24 Jul 2005 08:00:42 +0000 (GMT)
	(envelope-from reho@rx.cz)
Received: from charon.rx.cz ([81.90.165.83])
	by ns.decros.cz (8.11.7/8.11.7) with ESMTP id j6O80dO09802;
	Sun, 24 Jul 2005 10:00:39 +0200 (CEST)
Received: from charon.rx.cz (localhost [127.0.0.1])
	by charon.rx.cz (8.13.1/8.13.1) with ESMTP id j6O80XbK060054;
	Sun, 24 Jul 2005 10:00:33 +0200 (CEST)
	(envelope-from reho@charon.rx.cz)
Received: (from root@localhost)
	by charon.rx.cz (8.13.1/8.13.1/Submit) id j6O80Wvs060053;
	Sun, 24 Jul 2005 10:00:32 +0200 (CEST)
	(envelope-from reho)
Message-Id: <200507240800.j6O80Wvs060053@charon.rx.cz>
Date: Sun, 24 Jul 2005 10:00:32 +0200 (CEST)
From: Petr Rehor <prehor@gmail.com>
Reply-To: Petr Rehor <prehor@gmail.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc: blaz@si.FreeBSD.org, flz@freebsd.org
Subject: [PATCH] security/amavisd-new: properly set default values
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         83988
>Category:       ports
>Synopsis:       [PATCH] security/amavisd-new: properly set default values
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jul 24 08:10:16 GMT 2005
>Closed-Date:    Wed Aug 24 18:54:10 GMT 2005
>Last-Modified:  Wed Aug 24 18:54:10 GMT 2005
>Originator:     Petr Rehor
>Release:        FreeBSD 5.3-RELEASE-p2 i386
>Organization:
>Environment:
System: FreeBSD charon.rx.cz 5.3-RELEASE-p2 FreeBSD 5.3-RELEASE-p2 #0: Sun Dec 5 01:31:43 UTC 2004 root@marvin.rx.cz:/usr/obj/usr/src/sys/GENERIC i386
>Description:
When amavisd_flags is in rc.conf is set to empty value, then rc script
set it to default value (wanted on czech FreeBSD mailing list).
>How-To-Repeat:
Add amavisd_flags="" to /etc/rc.conf and restart amavisd - it run with
default amavisd_flags="-u vscan"
>Fix:
--- amavisd-new.diff begins here ---
Index: Makefile
===================================================================
RCS file: /home/ncvs/ports/security/amavisd-new/Makefile,v
retrieving revision 1.29
diff -u -r1.29 Makefile
--- Makefile	17 Jul 2005 21:42:11 -0000	1.29
+++ Makefile	24 Jul 2005 07:45:22 -0000
@@ -8,7 +8,7 @@
 
 PORTNAME=	amavisd-new
 PORTVERSION=	2.3.2
-PORTREVISION=	1
+PORTREVISION=	2
 PORTEPOCH=	1
 CATEGORIES=	security
 MASTER_SITES=	http://www.ijs.si/software/amavisd/ \
Index: files/amavisd.sh.in
===================================================================
RCS file: /home/ncvs/ports/security/amavisd-new/files/amavisd.sh.in,v
retrieving revision 1.1
diff -u -r1.1 amavisd.sh.in
--- files/amavisd.sh.in	6 Jul 2005 08:47:09 -0000	1.1
+++ files/amavisd.sh.in	24 Jul 2005 07:40:58 -0000
@@ -33,7 +33,7 @@
 # set defaults
 
 amavisd_enable=${amavisd_enable:-"NO"}
-amavisd_flags=${amavisd_flags:-"-u %%AMAVISUSER%%"}
+amavisd_flags=${amavisd_flags-"-u %%AMAVISUSER%%"}
 
 load_rc_config $name
 run_rc_command "$1"
--- amavisd-new.diff ends here ---


>Release-Note:
>Audit-Trail:

From: Blaz Zupan <blaz@amis.net>
To: bug-followup@FreeBSD.org,  prehor@gmail.com
Cc:  
Subject: Re: ports/83988: [PATCH] security/amavisd-new: properly set default
 values
Date: Sun, 24 Jul 2005 17:31:49 +0200

 The line should instead be completely removed, because I think it is not 
 needed anymore. amavisd can be safely run as root, because it 
 immediately drops privileges and switches to the "vscan" user. I'm just 
 waiting for a confirmation from the amavisd-new author that this is 
 indeed safe.
State-Changed-From-To: open->feedback 
State-Changed-By: leeym 
State-Changed-When: Mon Jul 25 15:22:04 GMT 2005 
State-Changed-Why:  
The maintainer is waiting a confirmation from the author. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=83988 

From: Blaz Zupan <blaz@si.FreeBSD.org>
To: freebsd-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: ports/83988: [PATCH] security/amavisd-new: properly set default
 values
Date: Sun, 31 Jul 2005 16:23:24 +0200 (CEST)

 I have confirmation from the amavisd-new author that starting amavisd as root 
 is safe, because it drops privileges as soon as possible. The only caveat is 
 that p5-Net-Server 0.88 is needed, which is included in the ports collection. 
 If somebody upgrades amavisd-new but does not upgrade p5-Net-Server, 
 amavisd-new will not start until p5-Net-Server is upgraded. Below is the patch 
 that should be commited. This makes amavisd-new work automatically both with 
 and without chroot (but only if p5-Net-Server 0.88 is also installed).
 
 diff -urN amavisd-new.orig/Makefile amavisd-new/Makefile
 --- amavisd-new.orig/Makefile	Sun Jul 17 23:42:11 2005
 +++ amavisd-new/Makefile	Sun Jul 31 16:05:58 2005
 @@ -8,7 +8,7 @@
 
   PORTNAME=	amavisd-new
   PORTVERSION=	2.3.2
 -PORTREVISION=	1
 +PORTREVISION=	2
   PORTEPOCH=	1
   CATEGORIES=	security
   MASTER_SITES=	http://www.ijs.si/software/amavisd/ \
 diff -urN amavisd-new.orig/files/amavisd.sh.in amavisd-new/files/amavisd.sh.in
 --- amavisd-new.orig/files/amavisd.sh.in	Wed Jul  6 10:47:09 2005
 +++ amavisd-new/files/amavisd.sh.in	Sun Jul 31 16:15:45 2005
 @@ -33,7 +33,6 @@
   # set defaults
 
   amavisd_enable=${amavisd_enable:-"NO"}
 -amavisd_flags=${amavisd_flags:-"-u %%AMAVISUSER%%"}
 
   load_rc_config $name
   run_rc_command "$1"
State-Changed-From-To: feedback->closed 
State-Changed-By: lesi 
State-Changed-When: Wed Aug 24 18:53:01 GMT 2005 
State-Changed-Why:  
Fix from maintainer merged with upgrade in PR ports/85241. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=83988 
>Unformatted:
