public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/opensmtpd: add a setgid wrapper for smtpctl (#89962) 

The setgid is currently required for offline enqueuing, and
unfortunately smtpctl is currently not split from sendmail so there's
little running around it.
This commit is contained in:
José Romildo Malaquias 2020-06-10 10:08:36 -03:00 committed by GitHub
parent fd8892961f
commit a421af29e4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
nixos/modules/services/mail/opensmtpd.nix
View File

@ -17,6 +17,10 @@ in {
###### interface ###### interface
imports = [
(mkRenamedOptionModule [ "services" "opensmtpd" "addSendmailToSystemPath" ] [ "services" "opensmtpd" "setSendmail" ])
];
options = { options = {
services.opensmtpd = { services.opensmtpd = {
@ -34,13 +38,10 @@ in {
description = "The OpenSMTPD package to use."; description = "The OpenSMTPD package to use.";
}; };
addSendmailToSystemPath = mkOption { setSendmail = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;
description = '' description = "Whether to set the system sendmail to OpenSMTPD's.";
Whether to add OpenSMTPD's sendmail binary to the
system path or not.
'';
}; };
extraServerArgs = mkOption { extraServerArgs = mkOption {
@ -82,7 +83,7 @@ in {
###### implementation ###### implementation
config = mkIf cfg.enable { config = mkIf cfg.enable rec {
users.groups = { users.groups = {
smtpd.gid = config.ids.gids.smtpd; smtpd.gid = config.ids.gids.smtpd;
smtpq.gid = config.ids.gids.smtpq; smtpq.gid = config.ids.gids.smtpq;
@ -101,6 +102,14 @@ in {
}; };
}; };
security.wrappers.smtpctl = {
group = "smtpq";
setgid = true;
source = "${cfg.package}/bin/smtpctl";
};
services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail security.wrappers.smtpctl;
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /var/spool/smtpd 711 root - - -" "d /var/spool/smtpd 711 root - - -"
"d /var/spool/smtpd/offline 770 root smtpq - -" "d /var/spool/smtpd/offline 770 root smtpq - -"
@ -119,7 +128,5 @@ in {
serviceConfig.ExecStart = "${cfg.package}/sbin/smtpd -d -f ${conf} ${args}"; serviceConfig.ExecStart = "${cfg.package}/sbin/smtpd -d -f ${conf} ${args}";
environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd"; environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd";
}; };
environment.systemPackages = mkIf cfg.addSendmailToSystemPath [ sendmail ];
}; };
} }