From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Notmuch Mail <notmuch@notmuchmail.org>
Subject: Re: [PATCH v2] cli/insert: new message file can be world-readable (rely on umask)
Date: Thu, 08 Feb 2018 21:00:46 -0500 [thread overview]
Message-ID: <87h8qqvs4x.fsf@fifthhorseman.net> (raw)
In-Reply-To: <87k1vnuehz.fsf@fifthhorseman.net>
[-- Attachment #1: Type: text/plain, Size: 1367 bytes --]
On Thu 2018-02-08 20:40:40 -0500, Daniel Kahn Gillmor wrote:
> postfix's local delivery agent has apparently been delivering with mode
> 0600 for nearly 20 years:
>
> https://github.com/vdukhovni/postfix/blame/master/postfix/src/local/maildir.c#L188
and even postfix's master process (the one capable of spawning the local
delivery agent, which is ultimately responsible for dropping privileges
to the local user to execute commands in ~/.forward) starts off with a
umask(077):
https://github.com/vdukhovni/postfix/blame/master/postfix/src/master/master.c#L278
this makes it pretty difficult to attempt safe simple world-readable
mail delivery through the MUA :(
Anyway, this is not on the critical path for me. For the purposes of
mail delivery to the mailing list archive, i'm now considering just
writing a wrapper script around "notmuch insert" that (as the local
user) chmod on the files that are delivered with overly-restrictive
permissions.
This makes me nervous, because chmods are tricky to do safely,
especially in an automated fashion, but given the tight permissions
we're seeing during message delivery at the moment, this is the simplest
option.
Another option would be to write a mailman3 plugin that delivers to
notmuch, but that's a bigger task than i'm willing to take on right now.
I welcome other suggestions though!
--dkg
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
next prev parent reply other threads:[~2018-02-09 2:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-05 4:37 [PATCH] cli/insert: new message file can be world-readable (rely on umask) Daniel Kahn Gillmor
2018-02-05 11:59 ` Peter Wang
2018-02-06 19:43 ` [PATCH v2] " Daniel Kahn Gillmor
2018-02-09 1:40 ` Daniel Kahn Gillmor
2018-02-09 1:52 ` Brian Sniffen
2018-02-09 2:33 ` Daniel Kahn Gillmor
2018-02-09 2:00 ` Daniel Kahn Gillmor [this message]
2018-02-09 4:10 ` [PATCH v3] cli/insert: add --world-readable flag Daniel Kahn Gillmor
2018-02-15 6:08 ` Tomi Ollila
2018-03-24 23:17 ` David Bremner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h8qqvs4x.fsf@fifthhorseman.net \
--to=dkg@fifthhorseman.net \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).