Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 494540 Details for
Bug 629450
mail-filter/mimedefang: privilege escalation via PID file manipulation
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch to address this issue in config file and init script
mimedefang_split_pid_lockfile.patch (text/plain), 4.99 KB, created by
Eddie Chapman
on 2017-09-14 18:28:36 UTC
(
hide
)
Description:
Patch to address this issue in config file and init script
Filename:
MIME Type:
Creator:
Eddie Chapman
Created:
2017-09-14 18:28:36 UTC
Size:
4.99 KB
patch
obsolete
>--- a/files/mimedefang.conf 2015-08-09 01:38:18.000000000 +0100 >+++ b/files/mimedefang.conf 2017-09-13 18:12:14.628334596 +0100 >@@ -43,26 +43,26 @@ > # want to use it with MIMEDefang > # MX_MAP_SOCKET=$SPOOLDIR/map.sock > >-# The multiplexor does not start all slaves at the same time. Instead, >-# it starts one slave every MX_SLAVE_DELAY seconds when the system is idle. >-# (If the system is busy, the multiplexor starts slaves as incoming mail >+# The multiplexor does not start all workers at the same time. Instead, >+# it starts one worker every MX_WORKER_DELAY seconds when the system is idle. >+# (If the system is busy, the multiplexor starts workers as incoming mail > # requires attention.) >-# MX_SLAVE_DELAY=3 >+# MX_WORKER_DELAY=3 > >-# The next setting is an absolute limit on slave activation. The multiplexor >-# will NEVER activate a slave within MX_MIN_SLAVE_DELAY seconds of another. >-# The default of zero means that the multiplexor will activate slaves as >+# The next setting is an absolute limit on worker activation. The multiplexor >+# will NEVER activate a worker within MX_MIN_WORKER_DELAY seconds of another. >+# The default of zero means that the multiplexor will activate workers as > # quickly as necessary to keep up with incoming mail. >-# MX_MIN_SLAVE_DELAY=0 >+# MX_MIN_WORKER_DELAY=0 > > # Set to yes if you want the multiplexor to log stats in > # /var/log/mimedefang/stats The /var/log/mimedefang directory must > # exist and be writable by the user you're running MIMEDefang as. > # MX_STATS=no > >-# Number of slaves reserved for connections from loopback. Use -1 >+# Number of workers reserved for connections from loopback. Use -1 > # for default behaviour, 0 to allow loopback connections to queue, >-# or >0 to reserve slaves for loopback connections >+# or >0 to reserve workers for loopback connections > LOOPBACK_RESERVED_CONNECTIONS=-1 > > # Set to yes if you want the stats file flushed after each entry >@@ -88,20 +88,20 @@ > # too low; we suggest 10 instead > MX_MAXIMUM=10 > >-# Uncomment to log slave status; it will be logged every >-# MX_LOG_SLAVE_STATUS_INTERVAL seconds >-# MX_LOG_SLAVE_STATUS_INTERVAL=30 >+# Uncomment to log worker status; it will be logged every >+# MX_LOG_WORKER_STATUS_INTERVAL seconds >+# MX_LOG_WORKER_STATUS_INTERVAL=30 > >-# Uncomment next line to have busy slaves send status updates to the >-# multiplexor. NOTE: Consumes one extra file descriptor per slave, plus >+# Uncomment next line to have busy workers send status updates to the >+# multiplexor. NOTE: Consumes one extra file descriptor per worker, plus > # a bit of CPU time. > # MX_STATUS_UPDATES=yes > >-# Limit slave processes' resident-set size to this many kilobytes. Default >+# Limit worker processes' resident-set size to this many kilobytes. Default > # is unlimited. > # MX_MAX_RSS=10000 > >-# Limit total size of slave processes' memory space to this many kilobytes. >+# Limit total size of worker processes' memory space to this many kilobytes. > # Default is unlimited. > # MX_MAX_AS=30000 > >--- a/files/mimedefang.init 2016-05-18 07:38:34.000000000 +0100 >+++ b/files/mimedefang.init 2017-09-13 18:08:30.248042941 +0100 >@@ -7,8 +7,10 @@ > prog='mimedefang' > PROGDIR=/usr/bin > SPOOLDIR='/var/spool/MIMEDefang' >-PID="$SPOOLDIR/$prog.pid" >-MXPID="$SPOOLDIR/$prog-multiplexor.pid" >+PID="/run/$prog.pid" >+MXPID="/run/$prog-multiplexor.pid" >+LOCK="$SPOOLDIR/$prog.lock" >+MXLOCK="$SPOOLDIR/$prog-multiplexor.lock" > > # Make sure required vars are set > SOCKET=${SOCKET:=$SPOOLDIR/$prog.sock} >@@ -41,7 +43,7 @@ > > ebegin "Starting mimedefang-multiplexor" > start-stop-daemon --start --quiet \ >- --exec $PROGDIR/$prog-multiplexor -- -p $MXPID \ >+ --exec $PROGDIR/$prog-multiplexor -- -p $MXPID -o $MXLOCK \ > $EMBEDFLAG \ > `[ -n "$SPOOLDIR" ] && echo "-z $SPOOLDIR"` \ > `[ -n "$FILTER" ] && echo "-f $FILTER"` \ >@@ -50,13 +52,13 @@ > `[ -n "$MX_MINIMUM" ] && echo "-m $MX_MINIMUM"` \ > `[ -n "$MX_MAXIMUM" ] && echo "-x $MX_MAXIMUM"` \ > `[ -n "$MX_MAP_SOCKET" ] && echo "-N $MX_MAP_SOCKET"` \ >- `[ -n "$MX_LOG_SLAVE_STATUS_INTERVAL" ] && echo "-L $MX_LOG_SLAVE_STATUS_INTERVAL"` \ >+ `[ -n "$MX_LOG_WORKER_STATUS_INTERVAL" ] && echo "-L $MX_LOG_WORKER_STATUS_INTERVAL"` \ > `[ -n "$MX_USER" ] && echo "-U $MX_USER"` \ > `[ -n "$MX_IDLE" ] && echo "-i $MX_IDLE"` \ > `[ -n "$MX_BUSY" ] && echo "-b $MX_BUSY"` \ > `[ -n "$MX_REQUESTS" ] && echo "-r $MX_REQUESTS"` \ >- `[ -n "$MX_SLAVE_DELAY" ] && echo "-w $MX_SLAVE_DELAY"` \ >- `[ -n "$MX_MIN_SLAVE_DELAY" ] && echo "-W $MX_MIN_SLAVE_DELAY"` \ >+ `[ -n "$MX_WORKER_DELAY" ] && echo "-w $MX_WORKER_DELAY"` \ >+ `[ -n "$MX_MIN_WORKER_DELAY" ] && echo "-W $MX_MIN_WORKER_DELAY"` \ > `[ -n "$MX_MAX_RSS" ] && echo "-R $MX_MAX_RSS"` \ > `[ -n "$MX_MAX_AS" ] && echo "-M $MX_MAX_AS"` \ > `[ "$MX_LOG" = "yes" ] && echo "-l"` \ >@@ -74,7 +76,7 @@ > rm -f $SOCKET > /dev/null 2>&1 > ebegin "Starting mimedefang" > start-stop-daemon --start --quiet \ >- --exec $PROGDIR/$prog -- -P $PID \ >+ --exec $PROGDIR/$prog -- -P $PID -o $LOCK \ > -R $LOOPBACK_RESERVED_CONNECTIONS \ > -m $MX_SOCKET \ > `[ -n "$SPOOLDIR" ] && echo "-z $SPOOLDIR"` \
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 629450
: 494540