cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/postfix: postalias should not use source file permissions

Browse source 
Our postfix-setup service ensures that the directory is only writable by root.

postalias by default drops permissions to the user of the source file. In the
case of NixOS that file is in the nix store and thus always owned by root and
everything works.

The problem is that when using a nixos-container with user namespaces (`-U`)
then the nix store is owned by nobody/nogroup, and postfix-setup.service will be
unable to create or modify `aliases.db`.

Since the file would otherwise be owned by root, we should tell postfix to not
assume the user and permissions of the `aliases` file by setting -o and -p

From postalias(1)

> -o Do not release root privileges when processing a non-root input file. By
> default, postalias(1) drops root privileges and runs as the source file owner
> instead.

> -p Do not inherit the file access permissions from the input file when
> creating a new file. Instead, create a new file with default access
> permissions (mode 0644).
This commit is contained in:
George Shammas 2023-09-16 07:47:52 -04:00
parent 47fc70dde9
commit 142d83f90e
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/mail/postfix.nix
View file

@ -747,7 +747,7 @@ in
${concatStringsSep "\n" (mapAttrsToList (to: from: '' ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
ln -sf ${from} /var/lib/postfix/conf/${to} ln -sf ${from} /var/lib/postfix/conf/${to}
${pkgs.postfix}/bin/postalias /var/lib/postfix/conf/${to} ${pkgs.postfix}/bin/postalias -o -p /var/lib/postfix/conf/${to}
'') cfg.aliasFiles)} '') cfg.aliasFiles)}
${concatStringsSep "\n" (mapAttrsToList (to: from: '' ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
ln -sf ${from} /var/lib/postfix/conf/${to} ln -sf ${from} /var/lib/postfix/conf/${to}