Pc @ s d Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k l Z d d k
l Z l Z d d k
Td Z d Z d Z e e i d S( sd Fixes for running Mailman under the `secure-linux' patch or grsecurity.
Run check_perms -f and only then check_perms_grsecurity.py -f
Note that you will have to re-run this script after a mailman upgrade and
that check_perms will undo part of what this script does
If you use Solar Designer's secure-linux patch, it prevents a process from
linking (hard link) to a file it doesn't own.
Grsecurity (http://grsecurity.net/) can have the same restriction depending
on how it was built, including other restrictions like preventing you to run
a program if it is located in a directory writable by a non root user.
As a result Mailman has to be changed so that the whole tree is owned by
Mailman, and the CGIs and some of the programs in the bin tree (the ones
that lock config.pck files) are SUID Mailman. The idea is that config.pck
files have to be owned by the mailman UID and only touched by programs that
are UID mailman.
At the same time, We have to make sure that at least 3 directories under
~mailman aren't writable by mailman: mail, cgi-bin, and bin
Binary commands that are changed to be SUID mailman are also made unreadable
and unrunnable by people who aren't in the mailman group. This shouldn't
affect much since most of those commands would fail work if you weren't part
of the mailman group anyway.
Scripts in ~mailman/bin/ are not made suid or sgid, they need to be run by
user mailman or root to work.
Marc <marc_soft@merlins.org>/<marc_bts@vasoftware.com>
2000/10/27 - Initial version for secure_linux/openwall and mailman 2.0
2001/12/09 - Updated version for grsecurity and mailman 2.1
iN( t mm_cfg( t MAILMAN_USERt
MAILMAN_GROUP( t *t mails cgi-bint bint add_memberst change_pwt check_dbt clone_membert config_listt newlistt qrunnert remove_memberst rmlistt sync_memberst updatet withlistc C s t i d } | d } t | d j p | d d j o t GHt i d n d GHt i t d } xG t D]? } t i d | } t
i | d | t
i | d | GHqp WHt i d
} d | d GHt
i t d } t i t d } t
i | | | Ht
i i | p6 d
| GHt | d d } | i d | i n
d | GHd GHt i t i d } x6 | D]. } | GHt
i | | | t
i | d q|Wd GHt i d } t
i | | | t
i | d | GHd GHt i t i d }
t i t i d } x_ |
| D]S } t
i | } | t | j p | t | j o | GHt
i | | | q$q$Wd GHxt D]}
t |
d } | i } | i d } y | i d d |
d GHWqt j
o2| i | i d d d x t t | d d d D] } t i d! i! | | } t i d" i! | | } | o1 d# |
GH| i | | i" d d$ d } Pn | o1 d# |
GH| i | | i" d d$ d } Pq!q!W| d j o d% |
d& GHd' GHqt |
d } | i# | qXqWd S(( Ns /bin/s CheckFixUid.pyi i s -fs9 Making select directories owned and writable by root onlyt /i i s /data/last_mailman_versiont Makings owned by mailman (not root)s Creating t wi s import sys
import os
import grp, pwd
from Mailman.mm_cfg import MAILMAN_USER, MAILMAN_GROUP
class CheckFixUid:
uid = pwd.getpwnam(MAILMAN_USER)[2]
gid = grp.getgrnam(MAILMAN_GROUP)[2]
if os.geteuid() == 0:
os.setgid(gid)
os.setuid(uid)
if os.geteuid() != uid:
print "You need to run this script as root or mailman because it was configured to run"
print "on a linux system with a security patch which restricts hard links"
sys.exit()
s Skipping creation of s
Making cgis setuid mailmans
/cgi-bin/*i
s#
Making mail wrapper setuid mailmans
/mail/mailmans;
Ensuring that all config.db/pck files are owned by Mailmans /lists/*/config.db*s /lists/*/config.pck*s6
Patching mailman scripts to change the uid to mailmant rs import CheckFixUid
s
Not patching s , already patcheds
import paths
is ^([ ]*)main\(s ^([ ]*).*=[ ]*main\(s Patching s CheckFixUid.CheckFixUid()
s Warning, file s couldn't be patched.s0 If you use it, mailman may not function properly($ t pathst prefixt lent __doc__t syst exitt grpt getgrnamR t dirstochownroott ost chownt chmodt pwdt getpwnamR t patht existst opent writet closet globt statt ST_UIDt ST_GIDt binfilestopatcht readlinest indext
ValueErrort insertt ranget ret compilet searcht groupt
writelines( t argvt binpatht droplibt gidt dirt dirpatht filet uidt fpt cgist cdbst cpcksR* t scriptt filefdt patchedt it objectt object2( ( st /builddir/build/BUILDROOT/mailman-2.1.12-18.el6.i386//usr/share/doc/mailman-2.1.12/contrib/check_perms_grsecurity.pyt mainH s
$
"
( R s cgi-bins bin( R R R R R
R R R
R R s updateR ( R R R R R3 R) R" R t MailmanR t Mailman.mm_cfgR R R* R R- RJ R8 ( ( ( st /builddir/build/BUILDROOT/mailman-2.1.12-18.el6.i386//usr/share/doc/mailman-2.1.12/contrib/check_perms_grsecurity.pyt <module>2 s
n
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`
