Skip to content

sendmail whitelisting cleanups#1470

Merged
mgerstner merged 2 commits intorpm-software-management:opensusefrom
mgerstner:sendmail-cleanup
Mar 2, 2026
Merged

sendmail whitelisting cleanups#1470
mgerstner merged 2 commits intorpm-software-management:opensusefrom
mgerstner:sendmail-cleanup

Conversation

@mgerstner
Copy link
Contributor

The sendmail maintainer is uncooperative about cleaning up the permissions.d drop-in configuration files. Thus we simply anticipate the digests for the files we would like to see in the future, thereby forcing him to act and at the same time providing him a way to unblock himself.

The digests habe been calculated based on the following diffs:

--- /usr/share/permissions/permissions.d/sendmail       2026-02-11 10:31:31.000000000 +0100
+++ sendmail    2026-03-02 13:55:39.847103915 +0100
@@ -3,8 +3,6 @@
 /etc/mail/auth/                                root:root       0750
 /etc/mail/certs/                       root:root       0750
 /etc/mail/system/                      root:root       0755
-/var/spool/clientmqueue/               mail:mail       0770
-/var/spool/mqueue/                     root:root       0700
 /usr/libexec/sendmail.d/bin/           root:root       0755
 /usr/libexec/sendmail.d/bin/smrsh              root:root       0511
 /usr/libexec/sendmail.d/bin/mail.local root:root       0511
--- /usr/share/permissions/permissions.d/sendmail.paranoid      2026-02-11 10:31:31.000000000 +0100
+++ sendmail.paranoid   2026-03-02 13:55:41.227116174 +0100
@@ -3,8 +3,6 @@
 /etc/mail/auth/                                root:root       0750
 /etc/mail/certs/                       root:root       0750
 /etc/mail/system/                      root:root       0755
-/var/spool/clientmqueue/               mail:mail       0750
-/var/spool/mqueue/                     root:root       0700
 /usr/libexec/sendmail.d/bin/           root:root       0755
 /usr/libexec/sendmail.d/bin/smrsh              root:root       0511
 /usr/libexec/sendmail.d/bin/mail.local root:root       0511

Note that the files present in the sendmail-suse tarball in the package are different from the files installed in the RPM, because directory paths are replaced during build time. This diff is from a running current Tumbleweed installation.

…160)

This directory is now created by systemd-tmpfiles and covered by the
systemd-tmpfiles whitelisting.
The sendmail package now creates the directories /var/spool/mqueue and
/var/spool/clientmqueue via systemd-tmpfiles. We don't want two
different tools to claim responsibility for the permissions of these
directories. Thus adjust the digests accordingly.
@mgerstner mgerstner merged commit b6220eb into rpm-software-management:opensuse Mar 2, 2026
6 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants