Bug 78223

Summary: Milters should not run with root privilegies
Product: [Retired] Red Hat Linux Reporter: Petr Krištof <petr>
Component: sendmailAssignee: Florian La Roche <laroche>
Status: CLOSED RAWHIDE QA Contact: David Lawrence <dkl>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2003-01-12 11:31:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Petr Krištof 2002-11-20 11:03:29 UTC 
It is better to compile sendmail to do not allow run milters
with root privilegies.

Im suggest to add -D_FFR_MILTER_ROOT_UNSAFE.

Cut from libmilter/README:
Note: we strongly recommend not to run any milter as root.  Libmilter
does not need root access to communicate with sendmail.  It is a
good security practice to run a program only with root privileges
if really necessary.  A milter should probably check first whether
it runs as root and refuse to start in that case.  There is a
compile time option _FFR_MILTER_ROOT_UNSAFE which keeps libmilter
from unlinking a socket when running as root.  It is recommended
to turn on this option:

APPENDDEF(`conf_libmilter_ENVDEF', `-D_FFR_MILTER_ROOT_UNSAFE ')
Comment 1 Florian La Roche 2003-01-12 11:31:13 UTC 
added to sendmail-8.12.7-3 or newer

thanks,

Florian La Roche