On 2007-02-01 17:04:12 +0100, Hans Salvisberg wrote:
> qpsmtpd 0.3x is running under xinetd and the basic functionality is 
> working fine, especially the check_verybadrcptto plugin.
> 
> Now I'd like to enable greylisting and I inserted
> 
>       greylisting mode testonly db_dir /home/smtpd/data
> 
> and set the data directory as follows
> 
>       drwx------  2 smtpd smtpd  1024 Feb  1 00:05 data
> 
> The log shows
> 
>    using /home/smtpd/data/denysoft_greylist.dbm as greylisting database
>    FATAL PLUGIN ERROR:  Insecure dependency in open while running with 
> -T switch at /usr/share/qpsmtpd/plugins/greylisting line 222.

Sounds familiar.


> and nothing is created in the data directory, apparently because Perl 
> deems the $db parameter with the db_dir value tainted.
> 
> After reading http://www.perl.com/doc/manual/html/pod/perlsec.html it 
> seems that either qpsmtpd should not run with the -T switch

It should.

> or referencing tainted data in the greylisting plugin is a bug.

It's a bug, I'm just not sure where. 

I think the arguments for the plugins should always be untainted
(because if a bad guy can write to the plugins file he already has
complete control over which code is running, so worrying about arguments
is futile). This is less clear for other config files, so it would
probably be cleanest to untaint everything read from plugins
automatically and let individual plugins worry about the rest.

Since the greylisting module can get the dbdir from a variety of sources
it probably should check and untaint it itself. My variant does this:

  # why are config items tainted?
  if ($self->{_greylist_db} =~ m{^([-a-zA-Z0-9./_]+)$}) {
    $self->{_greylist_db} = $1; 
  }

I'll check in a similar fix unless somebody objects.

        hp

-- 
   _  | Peter J. Holzer    | I know I'd be respectful of a pirate 
|_|_) | Sysadmin WSR       | with an emu on his shoulder.
| |   | [EMAIL PROTECTED]         |
__/   | http://www.hjp.at/ |    -- Sam in "Freefall"

Attachment: signature.asc
Description: Digital signature

Reply via email to