BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/opensmtpd: add a setgid wrapper for smtpctl (#89962)

Browse source 
The setgid is currently required for offline enqueuing, and
unfortunately smtpctl is currently not split from sendmail so there's
little running around it.
This commit is contained in:
José Romildo Malaquias 2020-06-10 10:08:36 -03:00 committed by GitHub
parent fd8892961f
commit a421af29e4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
nixos/modules/services/mail/opensmtpd.nix
View file

@ -17,6 +17,10 @@ in {
###### interface
imports = [
(mkRenamedOptionModule [ "services" "opensmtpd" "addSendmailToSystemPath" ] [ "services" "opensmtpd" "setSendmail" ])
];
options = {
services.opensmtpd = {
@ -34,13 +38,10 @@ in {
description = "The OpenSMTPD package to use.";
};
addSendmailToSystemPath = mkOption {
setSendmail = mkOption {
type = types.bool;
default = true;
description = ''
Whether to add OpenSMTPD's sendmail binary to the
system path or not.
'';
description = "Whether to set the system sendmail to OpenSMTPD's.";
};
extraServerArgs = mkOption {
@ -82,7 +83,7 @@ in {
###### implementation
config = mkIf cfg.enable {
config = mkIf cfg.enable rec {
users.groups = {
smtpd.gid = config.ids.gids.smtpd;
smtpq.gid = config.ids.gids.smtpq;
@ -101,6 +102,14 @@ in {
};
};
security.wrappers.smtpctl = {
group = "smtpq";
setgid = true;
source = "${cfg.package}/bin/smtpctl";
};
services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail security.wrappers.smtpctl;
systemd.tmpfiles.rules = [
"d /var/spool/smtpd 711 root - - -"
"d /var/spool/smtpd/offline 770 root smtpq - -"
@ -119,7 +128,5 @@ in {
serviceConfig.ExecStart = "${cfg.package}/sbin/smtpd -d -f ${conf} ${args}";
environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd";
};
environment.systemPackages = mkIf cfg.addSendmailToSystemPath [ sendmail ];
};
}