1 /* $NetBSD: local.c,v 1.1.1.1 2009/06/23 10:08:48 tron Exp $ */ 2 3 /*++ 4 /* NAME 5 /* local 8 6 /* SUMMARY 7 /* Postfix local mail delivery 8 /* SYNOPSIS 9 /* \fBlocal\fR [generic Postfix daemon options] 10 /* DESCRIPTION 11 /* The \fBlocal\fR(8) daemon processes delivery requests from the 12 /* Postfix queue manager to deliver mail to local recipients. 13 /* Each delivery request specifies a queue file, a sender address, 14 /* a domain or host to deliver to, and one or more recipients. 15 /* This program expects to be run from the \fBmaster\fR(8) process 16 /* manager. 17 /* 18 /* The \fBlocal\fR(8) daemon updates queue files and marks recipients 19 /* as finished, or it informs the queue manager that delivery should 20 /* be tried again at a later time. Delivery status reports are sent 21 /* to the \fBbounce\fR(8), \fBdefer\fR(8) or \fBtrace\fR(8) daemon as 22 /* appropriate. 23 /* CASE FOLDING 24 /* .ad 25 /* .fi 26 /* All delivery decisions are made using the bare recipient 27 /* name (i.e. the address localpart), folded to lower case. 28 /* See also under ADDRESS EXTENSION below for a few exceptions. 29 /* SYSTEM-WIDE AND USER-LEVEL ALIASING 30 /* .ad 31 /* .fi 32 /* The system administrator can set up one or more system-wide 33 /* \fBsendmail\fR-style alias databases. 34 /* Users can have \fBsendmail\fR-style ~/.\fBforward\fR files. 35 /* Mail for \fIname\fR is delivered to the alias \fIname\fR, to 36 /* destinations in ~\fIname\fR/.\fBforward\fR, to the mailbox owned 37 /* by the user \fIname\fR, or it is sent back as undeliverable. 38 /* 39 /* The system administrator can specify a comma/space separated list 40 /* of ~\fR/.\fBforward\fR like files through the \fBforward_path\fR 41 /* configuration parameter. Upon delivery, the local delivery agent 42 /* tries each pathname in the list until a file is found. 43 /* 44 /* Delivery via ~/.\fBforward\fR files is done with the privileges 45 /* of the recipient. 46 /* Thus, ~/.\fBforward\fR like files must be readable by the 47 /* recipient, and their parent directory needs to have "execute" 48 /* permission for the recipient. 49 /* 50 /* The \fBforward_path\fR parameter is subject to interpolation of 51 /* \fB$user\fR (recipient username), \fB$home\fR (recipient home 52 /* directory), \fB$shell\fR (recipient shell), \fB$recipient\fR 53 /* (complete recipient address), \fB$extension\fR (recipient address 54 /* extension), \fB$domain\fR (recipient domain), \fB$local\fR 55 /* (entire recipient address localpart) and 56 /* \fB$recipient_delimiter.\fR The forms \fI${name?value}\fR and 57 /* \fI${name:value}\fR expand conditionally to \fIvalue\fR when 58 /* \fI$name\fR is (is not) defined. 59 /* Characters that may have special meaning to the shell or file system 60 /* are replaced by underscores. The list of acceptable characters 61 /* is specified with the \fBforward_expansion_filter\fR configuration 62 /* parameter. 63 /* 64 /* An alias or ~/.\fBforward\fR file may list any combination of external 65 /* commands, destination file names, \fB:include:\fR directives, or 66 /* mail addresses. 67 /* See \fBaliases\fR(5) for a precise description. Each line in a 68 /* user's .\fBforward\fR file has the same syntax as the right-hand part 69 /* of an alias. 70 /* 71 /* When an address is found in its own alias expansion, delivery is 72 /* made to the user instead. When a user is listed in the user's own 73 /* ~/.\fBforward\fR file, delivery is made to the user's mailbox instead. 74 /* An empty ~/.\fBforward\fR file means do not forward mail. 75 /* 76 /* In order to prevent the mail system from using up unreasonable 77 /* amounts of memory, input records read from \fB:include:\fR or from 78 /* ~/.\fBforward\fR files are broken up into chunks of length 79 /* \fBline_length_limit\fR. 80 /* 81 /* While expanding aliases, ~/.\fBforward\fR files, and so on, the 82 /* program attempts to avoid duplicate deliveries. The 83 /* \fBduplicate_filter_limit\fR configuration parameter limits the 84 /* number of remembered recipients. 85 /* MAIL FORWARDING 86 /* .ad 87 /* .fi 88 /* For the sake of reliability, forwarded mail is re-submitted as 89 /* a new message, so that each recipient has a separate on-file 90 /* delivery status record. 91 /* 92 /* In order to stop mail forwarding loops early, the software adds an 93 /* optional 94 /* \fBDelivered-To:\fR header with the final envelope recipient address. If 95 /* mail arrives for a recipient that is already listed in a 96 /* \fBDelivered-To:\fR header, the message is bounced. 97 /* MAILBOX DELIVERY 98 /* .ad 99 /* .fi 100 /* The default per-user mailbox is a file in the UNIX mail spool 101 /* directory (\fB/var/mail/\fIuser\fR or \fB/var/spool/mail/\fIuser\fR); 102 /* the location can be specified with the \fBmail_spool_directory\fR 103 /* configuration parameter. Specify a name ending in \fB/\fR for 104 /* \fBqmail\fR-compatible \fBmaildir\fR delivery. 105 /* 106 /* Alternatively, the per-user mailbox can be a file in the user's home 107 /* directory with a name specified via the \fBhome_mailbox\fR 108 /* configuration parameter. Specify a relative path name. Specify a name 109 /* ending in \fB/\fR for \fBqmail\fR-compatible \fBmaildir\fR delivery. 110 /* 111 /* Mailbox delivery can be delegated to an external command specified 112 /* with the \fBmailbox_command_maps\fR and \fBmailbox_command\fR 113 /* configuration parameters. The command 114 /* executes with the privileges of the recipient user (exceptions: 115 /* secondary groups are not enabled; in case of delivery as root, 116 /* the command executes with the privileges of \fBdefault_privs\fR). 117 /* 118 /* Mailbox delivery can be delegated to alternative message transports 119 /* specified in the \fBmaster.cf\fR file. 120 /* The \fBmailbox_transport_maps\fR and \fBmailbox_transport\fR 121 /* configuration parameters specify an optional 122 /* message transport that is to be used for all local recipients, 123 /* regardless of whether they are found in the UNIX passwd database. 124 /* The \fBfallback_transport_maps\fR and 125 /* \fBfallback_transport\fR parameters specify an optional 126 /* message transport 127 /* for recipients that are not found in the aliases(5) or UNIX 128 /* passwd database. 129 /* 130 /* In the case of UNIX-style mailbox delivery, 131 /* the \fBlocal\fR(8) daemon prepends a "\fBFrom \fIsender time_stamp\fR" 132 /* envelope header to each message, prepends an 133 /* \fBX-Original-To:\fR header with the recipient address as given to 134 /* Postfix, prepends an 135 /* optional \fBDelivered-To:\fR header 136 /* with the final envelope recipient address, prepends a \fBReturn-Path:\fR 137 /* header with the envelope sender address, prepends a \fB>\fR character 138 /* to lines beginning with "\fBFrom \fR", and appends an empty line. 139 /* The mailbox is locked for exclusive access while delivery is in 140 /* progress. In case of problems, an attempt is made to truncate the 141 /* mailbox to its original length. 142 /* 143 /* In the case of \fBmaildir\fR delivery, the local daemon prepends 144 /* an optional 145 /* \fBDelivered-To:\fR header with the final envelope recipient address, 146 /* prepends an 147 /* \fBX-Original-To:\fR header with the recipient address as given to 148 /* Postfix, 149 /* and prepends a \fBReturn-Path:\fR header with the envelope sender 150 /* address. 151 /* EXTERNAL COMMAND DELIVERY 152 /* .ad 153 /* .fi 154 /* The \fBallow_mail_to_commands\fR configuration parameter restricts 155 /* delivery to external commands. The default setting (\fBalias, 156 /* forward\fR) forbids command destinations in \fB:include:\fR files. 157 /* 158 /* Optionally, the process working directory is changed to the path 159 /* specified with \fBcommand_execution_directory\fR (Postfix 2.2 and 160 /* later). Failure to change directory causes mail to be deferred. 161 /* 162 /* The \fBcommand_execution_directory\fR parameter value is subject 163 /* to interpolation of \fB$user\fR (recipient username), 164 /* \fB$home\fR (recipient home directory), \fB$shell\fR 165 /* (recipient shell), \fB$recipient\fR (complete recipient 166 /* address), \fB$extension\fR (recipient address extension), 167 /* \fB$domain\fR (recipient domain), \fB$local\fR (entire 168 /* recipient address localpart) and \fB$recipient_delimiter.\fR 169 /* The forms \fI${name?value}\fR and \fI${name:value}\fR expand 170 /* conditionally to \fIvalue\fR when \fI$name\fR is (is not) 171 /* defined. Characters that may have special meaning to the 172 /* shell or file system are replaced by underscores. The list 173 /* of acceptable characters is specified with the 174 /* \fBexecution_directory_expansion_filter\fR configuration 175 /* parameter. 176 /* 177 /* The command is executed directly where possible. Assistance by the 178 /* shell (\fB/bin/sh\fR on UNIX systems) is used only when the command 179 /* contains shell magic characters, or when the command invokes a shell 180 /* built-in command. 181 /* 182 /* A limited amount of command output (standard output and standard 183 /* error) is captured for inclusion with non-delivery status reports. 184 /* A command is forcibly terminated if it does not complete within 185 /* \fBcommand_time_limit\fR seconds. Command exit status codes are 186 /* expected to follow the conventions defined in <\fBsysexits.h\fR>. 187 /* Exit status 0 means normal successful completion. 188 /* 189 /* Postfix version 2.3 and later support RFC 3463-style enhanced 190 /* status codes. If a command terminates with a non-zero exit 191 /* status, and the command output begins with an enhanced 192 /* status code, this status code takes precedence over the 193 /* non-zero exit status. 194 /* 195 /* A limited amount of message context is exported via environment 196 /* variables. Characters that may have special meaning to the shell 197 /* are replaced by underscores. The list of acceptable characters 198 /* is specified with the \fBcommand_expansion_filter\fR configuration 199 /* parameter. 200 /* .IP \fBSHELL\fR 201 /* The recipient user's login shell. 202 /* .IP \fBHOME\fR 203 /* The recipient user's home directory. 204 /* .IP \fBUSER\fR 205 /* The bare recipient name. 206 /* .IP \fBEXTENSION\fR 207 /* The optional recipient address extension. 208 /* .IP \fBDOMAIN\fR 209 /* The recipient address domain part. 210 /* .IP \fBLOGNAME\fR 211 /* The bare recipient name. 212 /* .IP \fBLOCAL\fR 213 /* The entire recipient address localpart (text to the left of the 214 /* rightmost @ character). 215 /* .IP \fBORIGINAL_RECIPIENT\fR 216 /* The entire recipient address, before any address rewriting 217 /* or aliasing (Postfix 2.5 and later). 218 /* .IP \fBRECIPIENT\fR 219 /* The entire recipient address. 220 /* .IP \fBSENDER\fR 221 /* The entire sender address. 222 /* .PP 223 /* Additional remote client information is made available via 224 /* the following environment variables: 225 /* .IP \fBCLIENT_ADDRESS\fR 226 /* Remote client network address. Available as of Postfix 2.2. 227 /* .IP \fBCLIENT_HELO\fR 228 /* Remote client EHLO command parameter. Available as of Postfix 2.2. 229 /* .IP \fBCLIENT_HOSTNAME\fR 230 /* Remote client hostname. Available as of Postfix 2.2. 231 /* .IP \fBCLIENT_PROTOCOL\fR 232 /* Remote client protocol. Available as of Postfix 2.2. 233 /* .IP \fBSASL_METHOD\fR 234 /* SASL authentication method specified in the 235 /* remote client AUTH command. Available as of Postfix 2.2. 236 /* .IP \fBSASL_SENDER\fR 237 /* SASL sender address specified in the remote client MAIL 238 /* FROM command. Available as of Postfix 2.2. 239 /* .IP \fBSASL_USERNAME\fR 240 /* SASL username specified in the remote client AUTH command. 241 /* Available as of Postfix 2.2. 242 /* .PP 243 /* The \fBPATH\fR environment variable is always reset to a 244 /* system-dependent default path, and environment variables 245 /* whose names are blessed by the \fBexport_environment\fR 246 /* configuration parameter are exported unchanged. 247 /* 248 /* The current working directory is the mail queue directory. 249 /* 250 /* The \fBlocal\fR(8) daemon prepends a "\fBFrom \fIsender time_stamp\fR" 251 /* envelope header to each message, prepends an 252 /* \fBX-Original-To:\fR header with the recipient address as given to 253 /* Postfix, prepends an 254 /* optional \fBDelivered-To:\fR 255 /* header with the final recipient envelope address, prepends a 256 /* \fBReturn-Path:\fR header with the sender envelope address, 257 /* and appends no empty line. 258 /* EXTERNAL FILE DELIVERY 259 /* .ad 260 /* .fi 261 /* The delivery format depends on the destination filename syntax. 262 /* The default is to use UNIX-style mailbox format. Specify a name 263 /* ending in \fB/\fR for \fBqmail\fR-compatible \fBmaildir\fR delivery. 264 /* 265 /* The \fBallow_mail_to_files\fR configuration parameter restricts 266 /* delivery to external files. The default setting (\fBalias, 267 /* forward\fR) forbids file destinations in \fB:include:\fR files. 268 /* 269 /* In the case of UNIX-style mailbox delivery, 270 /* the \fBlocal\fR(8) daemon prepends a "\fBFrom \fIsender time_stamp\fR" 271 /* envelope header to each message, prepends an 272 /* \fBX-Original-To:\fR header with the recipient address as given to 273 /* Postfix, prepends an 274 /* optional \fBDelivered-To:\fR 275 /* header with the final recipient envelope address, prepends a \fB>\fR 276 /* character to lines beginning with "\fBFrom \fR", and appends an 277 /* empty line. 278 /* The envelope sender address is available in the \fBReturn-Path:\fR 279 /* header. 280 /* When the destination is a regular file, it is locked for exclusive 281 /* access while delivery is in progress. In case of problems, an attempt 282 /* is made to truncate a regular file to its original length. 283 /* 284 /* In the case of \fBmaildir\fR delivery, the local daemon prepends 285 /* an optional 286 /* \fBDelivered-To:\fR header with the final envelope recipient address, 287 /* and prepends an 288 /* \fBX-Original-To:\fR header with the recipient address as given to 289 /* Postfix. 290 /* The envelope sender address is available in the \fBReturn-Path:\fR 291 /* header. 292 /* ADDRESS EXTENSION 293 /* .ad 294 /* .fi 295 /* The optional \fBrecipient_delimiter\fR configuration parameter 296 /* specifies how to separate address extensions from local recipient 297 /* names. 298 /* 299 /* For example, with "\fBrecipient_delimiter = +\fR", mail for 300 /* \fIname\fR+\fIfoo\fR is delivered to the alias \fIname\fR+\fIfoo\fR 301 /* or to the alias \fIname\fR, to the destinations listed in 302 /* ~\fIname\fR/.\fBforward\fR+\fIfoo\fR or in ~\fIname\fR/.\fBforward\fR, 303 /* to the mailbox owned by the user \fIname\fR, or it is sent back as 304 /* undeliverable. 305 /* DELIVERY RIGHTS 306 /* .ad 307 /* .fi 308 /* Deliveries to external files and external commands are made with 309 /* the rights of the receiving user on whose behalf the delivery is made. 310 /* In the absence of a user context, the \fBlocal\fR(8) daemon uses the 311 /* owner rights of the \fB:include:\fR file or alias database. 312 /* When those files are owned by the superuser, delivery is made with 313 /* the rights specified with the \fBdefault_privs\fR configuration 314 /* parameter. 315 /* STANDARDS 316 /* RFC 822 (ARPA Internet Text Messages) 317 /* RFC 3463 (Enhanced status codes) 318 /* DIAGNOSTICS 319 /* Problems and transactions are logged to \fBsyslogd\fR(8). 320 /* Corrupted message files are marked so that the queue 321 /* manager can move them to the \fBcorrupt\fR queue afterwards. 322 /* 323 /* Depending on the setting of the \fBnotify_classes\fR parameter, 324 /* the postmaster is notified of bounces and of other trouble. 325 /* SECURITY 326 /* .ad 327 /* .fi 328 /* The \fBlocal\fR(8) delivery agent needs a dual personality 329 /* 1) to access the private Postfix queue and IPC mechanisms, 330 /* 2) to impersonate the recipient and deliver to recipient-specified 331 /* files or commands. It is therefore security sensitive. 332 /* 333 /* The \fBlocal\fR(8) delivery agent disallows regular expression 334 /* substitution of $1 etc. in \fBalias_maps\fR, because that 335 /* would open a security hole. 336 /* 337 /* The \fBlocal\fR(8) delivery agent will silently ignore 338 /* requests to use the \fBproxymap\fR(8) server within 339 /* \fBalias_maps\fR. Instead it will open the table directly. 340 /* Before Postfix version 2.2, the \fBlocal\fR(8) delivery 341 /* agent will terminate with a fatal error. 342 /* BUGS 343 /* For security reasons, the message delivery status of external commands 344 /* or of external files is never checkpointed to file. As a result, 345 /* the program may occasionally deliver more than once to a command or 346 /* external file. Better safe than sorry. 347 /* 348 /* Mutually-recursive aliases or ~/.\fBforward\fR files are not detected 349 /* early. The resulting mail forwarding loop is broken by the use of the 350 /* \fBDelivered-To:\fR message header. 351 /* CONFIGURATION PARAMETERS 352 /* .ad 353 /* .fi 354 /* Changes to \fBmain.cf\fR are picked up automatically, as \fBlocal\fR(8) 355 /* processes run for only a limited amount of time. Use the command 356 /* "\fBpostfix reload\fR" to speed up a change. 357 /* 358 /* The text below provides only a parameter summary. See 359 /* \fBpostconf\fR(5) for more details including examples. 360 /* COMPATIBILITY CONTROLS 361 /* .ad 362 /* .fi 363 /* .IP "\fBbiff (yes)\fR" 364 /* Whether or not to use the local biff service. 365 /* .IP "\fBexpand_owner_alias (no)\fR" 366 /* When delivering to an alias "aliasname" that has an "owner-aliasname" 367 /* companion alias, set the envelope sender address to the expansion 368 /* of the "owner-aliasname" alias. 369 /* .IP "\fBowner_request_special (yes)\fR" 370 /* Give special treatment to owner-listname and listname-request 371 /* address localparts: don't split such addresses when the 372 /* recipient_delimiter is set to "-". 373 /* .IP "\fBsun_mailtool_compatibility (no)\fR" 374 /* Obsolete SUN mailtool compatibility feature. 375 /* .PP 376 /* Available in Postfix version 2.3 and later: 377 /* .IP "\fBfrozen_delivered_to (yes)\fR" 378 /* Update the \fBlocal\fR(8) delivery agent's idea of the Delivered-To: 379 /* address (see prepend_delivered_header) only once, at the start of 380 /* a delivery attempt; do not update the Delivered-To: address while 381 /* expanding aliases or .forward files. 382 /* .PP 383 /* Available in Postfix version 2.5.3 and later: 384 /* .IP "\fBstrict_mailbox_ownership (yes)\fR" 385 /* Defer delivery when a mailbox file is not owned by its recipient. 386 /* DELIVERY METHOD CONTROLS 387 /* .ad 388 /* .fi 389 /* The precedence of \fBlocal\fR(8) delivery methods from high to low is: 390 /* aliases, .forward files, mailbox_transport_maps, 391 /* mailbox_transport, mailbox_command_maps, mailbox_command, 392 /* home_mailbox, mail_spool_directory, fallback_transport_maps, 393 /* fallback_transport, and luser_relay. 394 /* .IP "\fBalias_maps (see 'postconf -d' output)\fR" 395 /* The alias databases that are used for \fBlocal\fR(8) delivery. 396 /* .IP "\fBforward_path (see 'postconf -d' output)\fR" 397 /* The \fBlocal\fR(8) delivery agent search list for finding a .forward 398 /* file with user-specified delivery methods. 399 /* .IP "\fBmailbox_transport_maps (empty)\fR" 400 /* Optional lookup tables with per-recipient message delivery 401 /* transports to use for \fBlocal\fR(8) mailbox delivery, whether or not the 402 /* recipients are found in the UNIX passwd database. 403 /* .IP "\fBmailbox_transport (empty)\fR" 404 /* Optional message delivery transport that the \fBlocal\fR(8) delivery 405 /* agent should use for mailbox delivery to all local recipients, 406 /* whether or not they are found in the UNIX passwd database. 407 /* .IP "\fBmailbox_command_maps (empty)\fR" 408 /* Optional lookup tables with per-recipient external commands to use 409 /* for \fBlocal\fR(8) mailbox delivery. 410 /* .IP "\fBmailbox_command (empty)\fR" 411 /* Optional external command that the \fBlocal\fR(8) delivery agent should 412 /* use for mailbox delivery. 413 /* .IP "\fBhome_mailbox (empty)\fR" 414 /* Optional pathname of a mailbox file relative to a \fBlocal\fR(8) user's 415 /* home directory. 416 /* .IP "\fBmail_spool_directory (see 'postconf -d' output)\fR" 417 /* The directory where \fBlocal\fR(8) UNIX-style mailboxes are kept. 418 /* .IP "\fBfallback_transport_maps (empty)\fR" 419 /* Optional lookup tables with per-recipient message delivery 420 /* transports for recipients that the \fBlocal\fR(8) delivery agent could 421 /* not find in the \fBaliases\fR(5) or UNIX password database. 422 /* .IP "\fBfallback_transport (empty)\fR" 423 /* Optional message delivery transport that the \fBlocal\fR(8) delivery 424 /* agent should use for names that are not found in the \fBaliases\fR(5) 425 /* or UNIX password database. 426 /* .IP "\fBluser_relay (empty)\fR" 427 /* Optional catch-all destination for unknown \fBlocal\fR(8) recipients. 428 /* .PP 429 /* Available in Postfix version 2.2 and later: 430 /* .IP "\fBcommand_execution_directory (empty)\fR" 431 /* The \fBlocal\fR(8) delivery agent working directory for delivery to 432 /* external command. 433 /* MAILBOX LOCKING CONTROLS 434 /* .ad 435 /* .fi 436 /* .IP "\fBdeliver_lock_attempts (20)\fR" 437 /* The maximal number of attempts to acquire an exclusive lock on a 438 /* mailbox file or \fBbounce\fR(8) logfile. 439 /* .IP "\fBdeliver_lock_delay (1s)\fR" 440 /* The time between attempts to acquire an exclusive lock on a mailbox 441 /* file or \fBbounce\fR(8) logfile. 442 /* .IP "\fBstale_lock_time (500s)\fR" 443 /* The time after which a stale exclusive mailbox lockfile is removed. 444 /* .IP "\fBmailbox_delivery_lock (see 'postconf -d' output)\fR" 445 /* How to lock a UNIX-style \fBlocal\fR(8) mailbox before attempting delivery. 446 /* RESOURCE AND RATE CONTROLS 447 /* .ad 448 /* .fi 449 /* .IP "\fBcommand_time_limit (1000s)\fR" 450 /* Time limit for delivery to external commands. 451 /* .IP "\fBduplicate_filter_limit (1000)\fR" 452 /* The maximal number of addresses remembered by the address 453 /* duplicate filter for \fBaliases\fR(5) or \fBvirtual\fR(5) alias expansion, or 454 /* for \fBshowq\fR(8) queue displays. 455 /* .IP "\fBlocal_destination_concurrency_limit (2)\fR" 456 /* The maximal number of parallel deliveries via the local mail 457 /* delivery transport to the same recipient (when 458 /* "local_destination_recipient_limit = 1") or the maximal number of 459 /* parallel deliveries to the same local domain (when 460 /* "local_destination_recipient_limit > 1"). 461 /* .IP "\fBlocal_destination_recipient_limit (1)\fR" 462 /* The maximal number of recipients per message delivery via the 463 /* local mail delivery transport. 464 /* .IP "\fBmailbox_size_limit (51200000)\fR" 465 /* The maximal size of any \fBlocal\fR(8) individual mailbox or maildir 466 /* file, or zero (no limit). 467 /* SECURITY CONTROLS 468 /* .ad 469 /* .fi 470 /* .IP "\fBallow_mail_to_commands (alias, forward)\fR" 471 /* Restrict \fBlocal\fR(8) mail delivery to external commands. 472 /* .IP "\fBallow_mail_to_files (alias, forward)\fR" 473 /* Restrict \fBlocal\fR(8) mail delivery to external files. 474 /* .IP "\fBcommand_expansion_filter (see 'postconf -d' output)\fR" 475 /* Restrict the characters that the \fBlocal\fR(8) delivery agent allows in 476 /* $name expansions of $mailbox_command and $command_execution_directory. 477 /* .IP "\fBdefault_privs (nobody)\fR" 478 /* The default rights used by the \fBlocal\fR(8) delivery agent for delivery 479 /* to external file or command. 480 /* .IP "\fBforward_expansion_filter (see 'postconf -d' output)\fR" 481 /* Restrict the characters that the \fBlocal\fR(8) delivery agent allows in 482 /* $name expansions of $forward_path. 483 /* .PP 484 /* Available in Postfix version 2.2 and later: 485 /* .IP "\fBexecution_directory_expansion_filter (see 'postconf -d' output)\fR" 486 /* Restrict the characters that the \fBlocal\fR(8) delivery agent allows 487 /* in $name expansions of $command_execution_directory. 488 /* .PP 489 /* Available in Postfix version 2.5.3 and later: 490 /* .IP "\fBstrict_mailbox_ownership (yes)\fR" 491 /* Defer delivery when a mailbox file is not owned by its recipient. 492 /* MISCELLANEOUS CONTROLS 493 /* .ad 494 /* .fi 495 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR" 496 /* The default location of the Postfix main.cf and master.cf 497 /* configuration files. 498 /* .IP "\fBdaemon_timeout (18000s)\fR" 499 /* How much time a Postfix daemon process may take to handle a 500 /* request before it is terminated by a built-in watchdog timer. 501 /* .IP "\fBdelay_logging_resolution_limit (2)\fR" 502 /* The maximal number of digits after the decimal point when logging 503 /* sub-second delay values. 504 /* .IP "\fBexport_environment (see 'postconf -d' output)\fR" 505 /* The list of environment variables that a Postfix process will export 506 /* to non-Postfix processes. 507 /* .IP "\fBipc_timeout (3600s)\fR" 508 /* The time limit for sending or receiving information over an internal 509 /* communication channel. 510 /* .IP "\fBlocal_command_shell (empty)\fR" 511 /* Optional shell program for \fBlocal\fR(8) delivery to non-Postfix command. 512 /* .IP "\fBmax_idle (100s)\fR" 513 /* The maximum amount of time that an idle Postfix daemon process waits 514 /* for an incoming connection before terminating voluntarily. 515 /* .IP "\fBmax_use (100)\fR" 516 /* The maximal number of incoming connections that a Postfix daemon 517 /* process will service before terminating voluntarily. 518 /* .IP "\fBprepend_delivered_header (command, file, forward)\fR" 519 /* The message delivery contexts where the Postfix \fBlocal\fR(8) delivery 520 /* agent prepends a Delivered-To: message header with the address 521 /* that the mail was delivered to. 522 /* .IP "\fBprocess_id (read-only)\fR" 523 /* The process ID of a Postfix command or daemon process. 524 /* .IP "\fBprocess_name (read-only)\fR" 525 /* The process name of a Postfix command or daemon process. 526 /* .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR" 527 /* What address lookup tables copy an address extension from the lookup 528 /* key to the lookup result. 529 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR" 530 /* The location of the Postfix top-level queue directory. 531 /* .IP "\fBrecipient_delimiter (empty)\fR" 532 /* The separator between user names and address extensions (user+foo). 533 /* .IP "\fBrequire_home_directory (no)\fR" 534 /* Whether or not a \fBlocal\fR(8) recipient's home directory must exist 535 /* before mail delivery is attempted. 536 /* .IP "\fBsyslog_facility (mail)\fR" 537 /* The syslog facility of Postfix logging. 538 /* .IP "\fBsyslog_name (see 'postconf -d' output)\fR" 539 /* The mail system name that is prepended to the process name in syslog 540 /* records, so that "smtpd" becomes, for example, "postfix/smtpd". 541 /* FILES 542 /* The following are examples; details differ between systems. 543 /* $HOME/.forward, per-user aliasing 544 /* /etc/aliases, system-wide alias database 545 /* /var/spool/mail, system mailboxes 546 /* SEE ALSO 547 /* qmgr(8), queue manager 548 /* bounce(8), delivery status reports 549 /* newaliases(1), create/update alias database 550 /* postalias(1), create/update alias database 551 /* aliases(5), format of alias database 552 /* postconf(5), configuration parameters 553 /* master(5), generic daemon options 554 /* syslogd(8), system logging 555 /* LICENSE 556 /* .ad 557 /* .fi 558 /* The Secure Mailer license must be distributed with this software. 559 /* HISTORY 560 /* .ad 561 /* .fi 562 /* The \fBDelivered-To:\fR message header appears in the \fBqmail\fR 563 /* system by Daniel Bernstein. 564 /* 565 /* The \fImaildir\fR structure appears in the \fBqmail\fR system 566 /* by Daniel Bernstein. 567 /* AUTHOR(S) 568 /* Wietse Venema 569 /* IBM T.J. Watson Research 570 /* P.O. Box 704 571 /* Yorktown Heights, NY 10598, USA 572 /*--*/ 573 574 /* System library. */ 575 576 #include <sys_defs.h> 577 #include <unistd.h> 578 #include <stdlib.h> 579 #include <string.h> 580 #include <fcntl.h> 581 #ifdef USE_PATHS_H 582 #include <paths.h> 583 #endif 584 585 /* Utility library. */ 586 587 #include <msg.h> 588 #include <mymalloc.h> 589 #include <htable.h> 590 #include <vstring.h> 591 #include <vstream.h> 592 #include <iostuff.h> 593 #include <name_mask.h> 594 #include <set_eugid.h> 595 #include <dict.h> 596 597 /* Global library. */ 598 599 #include <recipient_list.h> 600 #include <deliver_request.h> 601 #include <deliver_completed.h> 602 #include <mail_params.h> 603 #include <mail_addr.h> 604 #include <mail_conf.h> 605 #include <been_here.h> 606 #include <mail_params.h> 607 #include <mail_version.h> 608 #include <ext_prop.h> 609 #include <maps.h> 610 #include <flush_clnt.h> 611 612 /* Single server skeleton. */ 613 614 #include <mail_server.h> 615 616 /* Application-specific. */ 617 618 #include "local.h" 619 620 /* 621 * Tunable parameters. 622 */ 623 char *var_allow_commands; 624 char *var_allow_files; 625 char *var_alias_maps; 626 int var_dup_filter_limit; 627 int var_command_maxtime; 628 char *var_home_mailbox; 629 char *var_mailbox_command; 630 char *var_mailbox_cmd_maps; 631 char *var_rcpt_fdelim; 632 char *var_local_cmd_shell; 633 char *var_luser_relay; 634 int var_biff; 635 char *var_mail_spool_dir; 636 char *var_mailbox_transport; 637 char *var_mbox_transp_maps; 638 char *var_fallback_transport; 639 char *var_fbck_transp_maps; 640 char *var_exec_directory; 641 char *var_exec_exp_filter; 642 char *var_forward_path; 643 char *var_cmd_exp_filter; 644 char *var_fwd_exp_filter; 645 char *var_prop_extension; 646 int var_exp_own_alias; 647 char *var_deliver_hdr; 648 int var_stat_home_dir; 649 int var_mailtool_compat; 650 char *var_mailbox_lock; 651 int var_mailbox_limit; 652 bool var_frozen_delivered; 653 bool var_strict_mbox_owner; 654 655 int local_cmd_deliver_mask; 656 int local_file_deliver_mask; 657 int local_ext_prop_mask; 658 int local_deliver_hdr_mask; 659 int local_mbox_lock_mask; 660 MAPS *alias_maps; 661 662 /* local_deliver - deliver message with extreme prejudice */ 663 664 static int local_deliver(DELIVER_REQUEST *rqst, char *service) 665 { 666 const char *myname = "local_deliver"; 667 RECIPIENT *rcpt_end = rqst->rcpt_list.info + rqst->rcpt_list.len; 668 RECIPIENT *rcpt; 669 int rcpt_stat; 670 int msg_stat; 671 LOCAL_STATE state; 672 USER_ATTR usr_attr; 673 674 if (msg_verbose) 675 msg_info("local_deliver: %s from %s", rqst->queue_id, rqst->sender); 676 677 /* 678 * Initialize the delivery attributes that are not recipient specific. 679 * While messages are being delivered and while aliases or forward files 680 * are being expanded, this attribute list is being changed constantly. 681 * For this reason, the list is passed on by value (except when it is 682 * being initialized :-), so that there is no need to undo attribute 683 * changes made by lower-level routines. The alias/include/forward 684 * expansion attribute list is part of a tree with self and parent 685 * references (see the EXPAND_ATTR definitions). The user-specific 686 * attributes are security sensitive, and are therefore kept separate. 687 * All this results in a noticeable level of clumsiness, but passing 688 * things around by value gives good protection against accidental change 689 * by subroutines. 690 */ 691 state.level = 0; 692 deliver_attr_init(&state.msg_attr); 693 state.msg_attr.queue_name = rqst->queue_name; 694 state.msg_attr.queue_id = rqst->queue_id; 695 state.msg_attr.fp = rqst->fp; 696 state.msg_attr.offset = rqst->data_offset; 697 state.msg_attr.encoding = rqst->encoding; 698 state.msg_attr.sender = rqst->sender; 699 state.msg_attr.dsn_envid = rqst->dsn_envid; 700 state.msg_attr.dsn_ret = rqst->dsn_ret; 701 state.msg_attr.relay = service; 702 state.msg_attr.msg_stats = rqst->msg_stats; 703 state.msg_attr.request = rqst; 704 RESET_OWNER_ATTR(state.msg_attr, state.level); 705 RESET_USER_ATTR(usr_attr, state.level); 706 state.loop_info = delivered_hdr_init(rqst->fp, rqst->data_offset, 707 FOLD_ADDR_ALL); 708 state.request = rqst; 709 710 /* 711 * Iterate over each recipient named in the delivery request. When the 712 * mail delivery status for a given recipient is definite (i.e. bounced 713 * or delivered), update the message queue file and cross off the 714 * recipient. Update the per-message delivery status. 715 */ 716 for (msg_stat = 0, rcpt = rqst->rcpt_list.info; rcpt < rcpt_end; rcpt++) { 717 state.dup_filter = been_here_init(var_dup_filter_limit, BH_FLAG_FOLD); 718 forward_init(); 719 state.msg_attr.rcpt = *rcpt; 720 rcpt_stat = deliver_recipient(state, usr_attr); 721 rcpt_stat |= forward_finish(rqst, state.msg_attr, rcpt_stat); 722 if (rcpt_stat == 0 && (rqst->flags & DEL_REQ_FLAG_SUCCESS)) 723 deliver_completed(state.msg_attr.fp, rcpt->offset); 724 been_here_free(state.dup_filter); 725 msg_stat |= rcpt_stat; 726 } 727 728 /* 729 * Clean up. 730 */ 731 delivered_hdr_free(state.loop_info); 732 deliver_attr_free(&state.msg_attr); 733 734 return (msg_stat); 735 } 736 737 /* local_service - perform service for client */ 738 739 static void local_service(VSTREAM *stream, char *service, char **argv) 740 { 741 DELIVER_REQUEST *request; 742 int status; 743 744 /* 745 * Sanity check. This service takes no command-line arguments. 746 */ 747 if (argv[0]) 748 msg_fatal("unexpected command-line argument: %s", argv[0]); 749 750 /* 751 * This routine runs whenever a client connects to the UNIX-domain socket 752 * that is dedicated to local mail delivery service. What we see below is 753 * a little protocol to (1) tell the client that we are ready, (2) read a 754 * delivery request from the client, and (3) report the completion status 755 * of that request. 756 */ 757 if ((request = deliver_request_read(stream)) != 0) { 758 status = local_deliver(request, service); 759 deliver_request_done(stream, request, status); 760 } 761 } 762 763 /* local_mask_init - initialize delivery restrictions */ 764 765 static void local_mask_init(void) 766 { 767 static const NAME_MASK file_mask[] = { 768 "alias", EXPAND_TYPE_ALIAS, 769 "forward", EXPAND_TYPE_FWD, 770 "include", EXPAND_TYPE_INCL, 771 0, 772 }; 773 static const NAME_MASK command_mask[] = { 774 "alias", EXPAND_TYPE_ALIAS, 775 "forward", EXPAND_TYPE_FWD, 776 "include", EXPAND_TYPE_INCL, 777 0, 778 }; 779 static const NAME_MASK deliver_mask[] = { 780 "command", DELIVER_HDR_CMD, 781 "file", DELIVER_HDR_FILE, 782 "forward", DELIVER_HDR_FWD, 783 0, 784 }; 785 786 local_file_deliver_mask = name_mask(VAR_ALLOW_FILES, file_mask, 787 var_allow_files); 788 local_cmd_deliver_mask = name_mask(VAR_ALLOW_COMMANDS, command_mask, 789 var_allow_commands); 790 local_ext_prop_mask = 791 ext_prop_mask(VAR_PROP_EXTENSION, var_prop_extension); 792 local_deliver_hdr_mask = name_mask(VAR_DELIVER_HDR, deliver_mask, 793 var_deliver_hdr); 794 local_mbox_lock_mask = mbox_lock_mask(var_mailbox_lock); 795 if (var_mailtool_compat) { 796 msg_warn("%s: deprecated parameter, use \"%s = dotlock\" instead", 797 VAR_MAILTOOL_COMPAT, VAR_MAILBOX_LOCK); 798 local_mbox_lock_mask &= MBOX_DOT_LOCK; 799 } 800 if (local_mbox_lock_mask == 0) 801 msg_fatal("parameter %s specifies no applicable mailbox locking method", 802 VAR_MAILBOX_LOCK); 803 } 804 805 /* pre_accept - see if tables have changed */ 806 807 static void pre_accept(char *unused_name, char **unused_argv) 808 { 809 const char *table; 810 811 if ((table = dict_changed_name()) != 0) { 812 msg_info("table %s has changed -- restarting", table); 813 exit(0); 814 } 815 } 816 817 /* post_init - post-jail initialization */ 818 819 static void post_init(char *unused_name, char **unused_argv) 820 { 821 822 /* 823 * Drop privileges most of the time, and set up delivery restrictions. 824 */ 825 set_eugid(var_owner_uid, var_owner_gid); 826 local_mask_init(); 827 } 828 829 /* pre_init - pre-jail initialization */ 830 831 static void pre_init(char *unused_name, char **unused_argv) 832 { 833 834 /* 835 * Reset the file size limit from the message size limit to the mailbox 836 * size limit. XXX This still isn't accurate because the file size limit 837 * also affects delivery to command. 838 * 839 * A file size limit protects the machine against runaway software errors. 840 * It is not suitable to enforce mail quota, because users can get around 841 * mail quota by delivering to /file/name or to |command. 842 * 843 * We can't have mailbox size limit smaller than the message size limit, 844 * because that prohibits the delivery agent from updating the queue 845 * file. 846 */ 847 if (var_mailbox_limit) { 848 if (var_mailbox_limit < var_message_limit || var_message_limit == 0) 849 msg_fatal("main.cf configuration error: %s is smaller than %s", 850 VAR_MAILBOX_LIMIT, VAR_MESSAGE_LIMIT); 851 set_file_limit(var_mailbox_limit); 852 } 853 alias_maps = maps_create("aliases", var_alias_maps, 854 DICT_FLAG_LOCK | DICT_FLAG_PARANOID 855 | DICT_FLAG_FOLD_FIX); 856 857 flush_init(); 858 } 859 860 MAIL_VERSION_STAMP_DECLARE; 861 862 /* main - pass control to the single-threaded skeleton */ 863 864 int main(int argc, char **argv) 865 { 866 static const CONFIG_TIME_TABLE time_table[] = { 867 VAR_COMMAND_MAXTIME, DEF_COMMAND_MAXTIME, &var_command_maxtime, 1, 0, 868 0, 869 }; 870 static const CONFIG_INT_TABLE int_table[] = { 871 VAR_DUP_FILTER_LIMIT, DEF_DUP_FILTER_LIMIT, &var_dup_filter_limit, 0, 0, 872 VAR_MAILBOX_LIMIT, DEF_MAILBOX_LIMIT, &var_mailbox_limit, 0, 0, 873 0, 874 }; 875 static const CONFIG_STR_TABLE str_table[] = { 876 VAR_ALIAS_MAPS, DEF_ALIAS_MAPS, &var_alias_maps, 0, 0, 877 VAR_HOME_MAILBOX, DEF_HOME_MAILBOX, &var_home_mailbox, 0, 0, 878 VAR_ALLOW_COMMANDS, DEF_ALLOW_COMMANDS, &var_allow_commands, 0, 0, 879 VAR_ALLOW_FILES, DEF_ALLOW_FILES, &var_allow_files, 0, 0, 880 VAR_LOCAL_CMD_SHELL, DEF_LOCAL_CMD_SHELL, &var_local_cmd_shell, 0, 0, 881 VAR_MAIL_SPOOL_DIR, DEF_MAIL_SPOOL_DIR, &var_mail_spool_dir, 0, 0, 882 VAR_MAILBOX_TRANSP, DEF_MAILBOX_TRANSP, &var_mailbox_transport, 0, 0, 883 VAR_MBOX_TRANSP_MAPS, DEF_MBOX_TRANSP_MAPS, &var_mbox_transp_maps, 0, 0, 884 VAR_FALLBACK_TRANSP, DEF_FALLBACK_TRANSP, &var_fallback_transport, 0, 0, 885 VAR_FBCK_TRANSP_MAPS, DEF_FBCK_TRANSP_MAPS, &var_fbck_transp_maps, 0, 0, 886 VAR_CMD_EXP_FILTER, DEF_CMD_EXP_FILTER, &var_cmd_exp_filter, 1, 0, 887 VAR_FWD_EXP_FILTER, DEF_FWD_EXP_FILTER, &var_fwd_exp_filter, 1, 0, 888 VAR_EXEC_EXP_FILTER, DEF_EXEC_EXP_FILTER, &var_exec_exp_filter, 1, 0, 889 VAR_PROP_EXTENSION, DEF_PROP_EXTENSION, &var_prop_extension, 0, 0, 890 VAR_DELIVER_HDR, DEF_DELIVER_HDR, &var_deliver_hdr, 0, 0, 891 VAR_MAILBOX_LOCK, DEF_MAILBOX_LOCK, &var_mailbox_lock, 1, 0, 892 VAR_MAILBOX_CMD_MAPS, DEF_MAILBOX_CMD_MAPS, &var_mailbox_cmd_maps, 0, 0, 893 0, 894 }; 895 static const CONFIG_BOOL_TABLE bool_table[] = { 896 VAR_BIFF, DEF_BIFF, &var_biff, 897 VAR_EXP_OWN_ALIAS, DEF_EXP_OWN_ALIAS, &var_exp_own_alias, 898 VAR_STAT_HOME_DIR, DEF_STAT_HOME_DIR, &var_stat_home_dir, 899 VAR_MAILTOOL_COMPAT, DEF_MAILTOOL_COMPAT, &var_mailtool_compat, 900 VAR_FROZEN_DELIVERED, DEF_FROZEN_DELIVERED, &var_frozen_delivered, 901 VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner, 902 0, 903 }; 904 905 /* Suppress $name expansion upon loading. */ 906 static const CONFIG_RAW_TABLE raw_table[] = { 907 VAR_EXEC_DIRECTORY, DEF_EXEC_DIRECTORY, &var_exec_directory, 0, 0, 908 VAR_FORWARD_PATH, DEF_FORWARD_PATH, &var_forward_path, 0, 0, 909 VAR_MAILBOX_COMMAND, DEF_MAILBOX_COMMAND, &var_mailbox_command, 0, 0, 910 VAR_LUSER_RELAY, DEF_LUSER_RELAY, &var_luser_relay, 0, 0, 911 0, 912 }; 913 914 /* 915 * Fingerprint executables and core dumps. 916 */ 917 MAIL_VERSION_STAMP_ALLOCATE; 918 919 single_server_main(argc, argv, local_service, 920 MAIL_SERVER_INT_TABLE, int_table, 921 MAIL_SERVER_STR_TABLE, str_table, 922 MAIL_SERVER_RAW_TABLE, raw_table, 923 MAIL_SERVER_BOOL_TABLE, bool_table, 924 MAIL_SERVER_TIME_TABLE, time_table, 925 MAIL_SERVER_PRE_INIT, pre_init, 926 MAIL_SERVER_POST_INIT, post_init, 927 MAIL_SERVER_PRE_ACCEPT, pre_accept, 928 MAIL_SERVER_PRIVILEGED, 929 0); 930 } 931