diff options
| author | bapt <bapt@FreeBSD.org> | 2016-08-22 07:24:02 +0000 |
|---|---|---|
| committer | bapt <bapt@FreeBSD.org> | 2016-08-22 07:24:02 +0000 |
| commit | 1d8e5c9e86e339fa6efd19bd25b88ff6624c710d (patch) | |
| tree | af277bcb84f4941bb300db8c9c4ad6bb48f003e5 /libexec | |
| parent | 57e9741f29bdc1c3b4354a48fc8c40f4454c2616 (diff) | |
| download | FreeBSD-src-1d8e5c9e86e339fa6efd19bd25b88ff6624c710d.zip FreeBSD-src-1d8e5c9e86e339fa6efd19bd25b88ff6624c710d.tar.gz | |
Import Dragonfly Mail Agent snapshort from 20160806 aka v0.11+
Most important change being:
dma - Fix security hole
Affecting DragonFly 4.6 and earlier, Matt Dillon fixed this in base after
finding out from BSDNow Episode 152. Comments following were from his commit
which explains better than I. Just taking his change and putting it here as well.
* dma makes an age-old mistake of not properly checking whether a file
owned by a user is a symlink or not, a bug which the original mail.local
also had.
* Add O_NOFOLLOW to disallow symlinks.
Thanks-to: BSDNow Episode 152, made me dive dma to check when they talked
about the mail.local bug.
Approved by: re (kib)
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/dma/Makefile.inc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libexec/dma/Makefile.inc b/libexec/dma/Makefile.inc index ec5eba8..b24f85d 100644 --- a/libexec/dma/Makefile.inc +++ b/libexec/dma/Makefile.inc @@ -7,7 +7,7 @@ DMA_SOURCES= ${.CURDIR}/../../../contrib/dma CFLAGS+= -I${DMA_SOURCES} \ -DHAVE_REALLOCF -DHAVE_STRLCPY -DHAVE_GETPROGNAME \ -DCONF_PATH='"/etc/dma"' \ - -DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.10"' \ + -DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.11+"' \ -DDMA_ROOT_USER='"mailnull"' \ -DDMA_GROUP='"mail"' BINGRP= mail |
