Attachment #169822 for bug #115957




You should get into the habit of checking this file for changes each time
you update your ports collection, before attempting any port upgrades.

20160427:
  AFFECTS: Users of mail/dspam
  AUTHOR: junovitch@FreeBSD.org

  dspam has been modified to no longer run as root:mail by default.
  Existing configuration must be adjusted to reflect using a non-privileged
  port and the /var/run/dspam directory for PID and socket files.  If you
  need dspam to run as root for your mail setup, you can use the SETUID
  config option to enable the old insecure behavior.
  
20160414:
  AFFECTS: Users of net-mgmt/icinga2
  AUTHOR: lme@FreeBSD.org

Lines 7-13 Link Here

(-)b/mail/dspam/Makefile (-13 / +44 lines)
7		7
8	PORTNAME= dspam	8	PORTNAME= dspam
9	PORTVERSION= 3.10.2	9	PORTVERSION= 3.10.2
10	PORTREVISION= 1	10	PORTREVISION= 2
11	CATEGORIES= mail	11	CATEGORIES= mail
12	MASTER_SITES= SF/${PORTNAME}/${PORTNAME}/${PORTNAME}-${PORTVERSION}	12	MASTER_SITES= SF/${PORTNAME}/${PORTNAME}/${PORTNAME}-${PORTVERSION}
13		13
Lines 16-28 COMMENT= Bayesian spam filter Link Here
16		16
17	LICENSE= AGPLv3	17	LICENSE= AGPLv3
18		18
		19	USERS= dspam
		20	GROUPS= dspam
		21
19	OPTIONS_SUB= yes	22	OPTIONS_SUB= yes
20		23
21	OPTIONS_DEFINE= SYSLOG DEBUG VERBOSE_DEBUG BNR_DEBUG PREF_EXT DAEMON \	24	OPTIONS_DEFINE= SYSLOG DEBUG VERBOSE_DEBUG BNR_DEBUG PREF_EXT DAEMON \
22	CLAMAV CLAMAV_LOCAL EXTERNAL_LOOKUP \	25	CLAMAV CLAMAV_LOCAL EXTERNAL_LOOKUP \
23	USER_HOMEDIR TRUSTED_USERS VIRT_USERS LONG_USERNAMES \	26	USER_HOMEDIR TRUSTED_USERS VIRT_USERS LONG_USERNAMES \
24	LARGE_SCALE DOMAIN_SCALE NICESENDMAIL POSTFIX_MBC \	27	LARGE_SCALE DOMAIN_SCALE NICESENDMAIL POSTFIX_MBC \
25	QMAIL WEBUI LIGHTTPD DOCS EXAMPLES	28	QMAIL WEBUI LIGHTTPD DOCS EXAMPLES SETUID
26		29
27	OPTIONS_MULTI= DB	30	OPTIONS_MULTI= DB
28	OPTIONS_MULTI_DB= HASH MYSQL MYSQL_COMPRESS MYSQL_LOCAL \	31	OPTIONS_MULTI_DB= HASH MYSQL MYSQL_COMPRESS MYSQL_LOCAL \
Lines 70-75 POSTFIX_MBC_DESC= Dspam as mailbox_command in Postfix Link Here
70	QMAIL_DESC= Play nice with Qmail mail server	73	QMAIL_DESC= Play nice with Qmail mail server
71	WEBUI_DESC= Install WebUI (RUN_DEPEND on Apache/Lighttpd)	74	WEBUI_DESC= Install WebUI (RUN_DEPEND on Apache/Lighttpd)
72	LIGHTTPD_DESC= RUN_DEPEND on Lighttpd instead of Apache	75	LIGHTTPD_DESC= RUN_DEPEND on Lighttpd instead of Apache
		76	SETUID_DESC= Run as root:mail with setuid (insecure)
73		77
74	MAKE_JOBS_UNSAFE= yes	78	MAKE_JOBS_UNSAFE= yes
75	USES= perl5 libtool shebangfix	79	USES= perl5 libtool shebangfix
Lines 97-109 CONFLICTS= dspam-devel-[0-9]* Link Here
97		101
98	SIGNATURE_LIFE?= 15	102	SIGNATURE_LIFE?= 15
99		103
		104	.include <bsd.port.options.mk>
		105
100	_VAR_DIR= /var	106	_VAR_DIR= /var
		107
		108	RUN_DIR?= ${_VAR_DIR}/run/dspam
		109
101	LOG_DIR?= ${_VAR_DIR}/log/dspam	110	LOG_DIR?= ${_VAR_DIR}/log/dspam
102	LOGFILE?= ${LOG_DIR}/dspam.log	111	LOGFILE?= ${LOG_DIR}/dspam.log
103		112
104	DSPAM_MODE?= 4510	113	.if ${PORT_OPTIONS:MSETUID}
105	DSPAM_OWNER?= root	114	DSPAM_OWNER?= root
106	DSPAM_GROUP?= mail	115	DSPAM_GROUP?= mail
		116	DSPAM_MODE?= 4510
		117	.else
		118	DSPAM_OWNER?= ${USERS}
		119	DSPAM_GROUP?= ${GROUPS}
		120	DSPAM_MODE?= 0555
		121	.endif
107		122
108	DSPAM_ETC?= ${LOCALBASE}/etc	123	DSPAM_ETC?= ${LOCALBASE}/etc
109	DSPAM_HOME?= ${_VAR_DIR}/db/dspam	124	DSPAM_HOME?= ${_VAR_DIR}/db/dspam
Lines 124-129 PLIST_SUB+= DSPAM_HOME=${DSPAM_HOME} \ Link Here
124	CONFIGURE_ARGS+= --sysconfdir=${DSPAM_ETC}	139	CONFIGURE_ARGS+= --sysconfdir=${DSPAM_ETC}
125	CONFIGURE_ARGS+= --with-logdir=${LOG_DIR}	140	CONFIGURE_ARGS+= --with-logdir=${LOG_DIR}
126	PLIST_SUB+= LOG_DIR=${LOG_DIR}	141	PLIST_SUB+= LOG_DIR=${LOG_DIR}
		142	PLIST_SUB+= RUN_DIR=${RUN_DIR}
127		143
128	CONFIGURE_ARGS+= --with-dspam-home=${DSPAM_HOME}	144	CONFIGURE_ARGS+= --with-dspam-home=${DSPAM_HOME}
129	CONFIGURE_ARGS+= --with-dspam-home-owner=${DSPAM_HOME_OWNER}	145	CONFIGURE_ARGS+= --with-dspam-home-owner=${DSPAM_HOME_OWNER}
Lines 148-154 _SED_SCRIPT= -e 's,%%DOCSDIR%%,${DOCSDIR},g' \ Link Here
148	-e 's,%%_VAR_DIR%%,${_VAR_DIR},g' \	164	-e 's,%%_VAR_DIR%%,${_VAR_DIR},g' \
149	-e '/^%%FreeBSD/D'	165	-e '/^%%FreeBSD/D'
150		166
151	.include <bsd.port.options.mk>
152		167
153	.if ${PORT_OPTIONS:MSYSLOG}	168	.if ${PORT_OPTIONS:MSYSLOG}
154	CONFIGURE_ARGS+= --enable-syslog	169	CONFIGURE_ARGS+= --enable-syslog
Lines 178-183 CONFIGURE_ARGS+= --enable-daemon Link Here
178	USE_RC_SUBR= ${PORTNAME}	193	USE_RC_SUBR= ${PORTNAME}
179	_SED_SCRIPT+= -e 's,%%DAEMON%%,,g'	194	_SED_SCRIPT+= -e 's,%%DAEMON%%,,g'
180	SUB_LIST+= DSPAM_HOME=${DSPAM_HOME}	195	SUB_LIST+= DSPAM_HOME=${DSPAM_HOME}
		196	SUB_LIST+= DSPAM_OWNER=${DSPAM_OWNER}
		197	SUB_LIST+= DSPAM_GROUP=${DSPAM_GROUP}
181	.else	198	.else
182	_SED_SCRIPT+= -e '/%%DAEMON%%/D'	199	_SED_SCRIPT+= -e '/%%DAEMON%%/D'
183	.endif	200	.endif
Lines 217-231 _DBDRV:= ${_DBDRV:S/pgsql_drv,//} Link Here
217	.if ${PORT_OPTIONS:MSQLITE3}	234	.if ${PORT_OPTIONS:MSQLITE3}
218	USES+= sqlite:3	235	USES+= sqlite:3
219	_DBDRV_COUNT:= ${_DBDRV_COUNT}o	236	_DBDRV_COUNT:= ${_DBDRV_COUNT}o
		237	PLIST_SUB+= SQLITE3=""
220	.else	238	.else
221	_DBDRV:= ${_DBDRV:S/sqlite3_drv,//}	239	_DBDRV:= ${_DBDRV:S/sqlite3_drv,//}
		240	PLIST_SUB+= SQLITE3="@comment "
222	.endif	241	.endif
223		242
224	.if ${PORT_OPTIONS:MSQLITE2}	243	.if ${PORT_OPTIONS:MSQLITE2}
225	USES+= sqlite:2	244	USES+= sqlite:2
226	_DBDRV_COUNT:= ${_DBDRV_COUNT}o	245	_DBDRV_COUNT:= ${_DBDRV_COUNT}o
		246	PLIST_SUB+= SQLITE2=""
227	.else	247	.else
228	_DBDRV:= ${_DBDRV:S/sqlite_drv,//}	248	_DBDRV:= ${_DBDRV:S/sqlite_drv,//}
		249	PLIST_SUB+= SQLITE2="@comment "
229	.endif	250	.endif
230		251
231	.if ${USES:Msqlite*}	252	.if ${USES:Msqlite*}
Lines 246-252 PLIST_SUB+= HASH="@comment " Link Here
246	.endif	267	.endif
247		268
248	.if ${PORT_OPTIONS:MMYSQL}	269	.if ${PORT_OPTIONS:MMYSQL}
249	USE_MYSQL= yes	270	USES+= mysql
250	CONFIGURE_ARGS+= --with-mysql-includes=${LOCALBASE}/include/mysql \	271	CONFIGURE_ARGS+= --with-mysql-includes=${LOCALBASE}/include/mysql \
251	--with-mysql-libraries=${LOCALBASE}/lib/mysql	272	--with-mysql-libraries=${LOCALBASE}/lib/mysql
252	PLIST_SUB+= MYSQL=""	273	PLIST_SUB+= MYSQL=""
Lines 255-261 _DBDRV_COUNT:= ${_DBDRV_COUNT}o Link Here
255	CONFIGURE_ARGS+= --enable-client-compression	276	CONFIGURE_ARGS+= --enable-client-compression
256	. endif	277	. endif
257	. if ${PORT_OPTIONS:MMYSQL_LOCAL}	278	. if ${PORT_OPTIONS:MMYSQL_LOCAL}
258	USE_MYSQL= server	279	WANT_MYSQL= server
259	SUB_LIST+= MYSQL=mysql	280	SUB_LIST+= MYSQL=mysql
260	. else	281	. else
261	SUB_LIST+= MYSQL=	282	SUB_LIST+= MYSQL=
Lines 274-279 PLIST_SUB+= DYNAMIC="" Link Here
274	PLIST_SUB+= DYNAMIC="@comment "	295	PLIST_SUB+= DYNAMIC="@comment "
275	.endif	296	.endif
276		297
		298	.if %{PORT_OPTIONS:MSETUID}
		299	PLIST_SUB+= SETUID=""
		300	PLIST_SUB+= NOSETUID="@comment "
		301	.else
		302	PLIST_SUB+= SETUID="@comment "
		303	PLIST_SUB+= NOSETUID=""
		304	.endif
		305
277	.if ${PORT_OPTIONS:MEXTERNAL_LOOKUP}	306	.if ${PORT_OPTIONS:MEXTERNAL_LOOKUP}
278	CONFIGURE_ARGS+= --enable-external-lookup	307	CONFIGURE_ARGS+= --enable-external-lookup
279	USE_OPENLDAP= YES	308	USE_OPENLDAP= YES
Lines 421-426 pre-extract: Link Here
421	@${ECHO_CMD} "DSPAM_HOME_GROUP=${DSPAM_HOME_GROUP}"	450	@${ECHO_CMD} "DSPAM_HOME_GROUP=${DSPAM_HOME_GROUP}"
422	@${ECHO_CMD} "DSPAM_HOME_MODE=${DSPAM_HOME_MODE} (default: 0770)"	451	@${ECHO_CMD} "DSPAM_HOME_MODE=${DSPAM_HOME_MODE} (default: 0770)"
423	@${ECHO_CMD} "LOG_DIR=${LOG_DIR} (default: ${_VAR_DIR}/log/dspam)"	452	@${ECHO_CMD} "LOG_DIR=${LOG_DIR} (default: ${_VAR_DIR}/log/dspam)"
		453	@${ECHO_CMD} "RUN_DIR=${RUN_DIR} (default: ${_VAR_DIR}/run/dspam)"
424	. ifdef(WITHOUT_SYSLOG)	454	. ifdef(WITHOUT_SYSLOG)
425	@${ECHO_CMD} "LOGFILE=${LOGFILE} (default: ${_VAR_DIR}/log/dspam/dspam.log)"	455	@${ECHO_CMD} "LOGFILE=${LOGFILE} (default: ${_VAR_DIR}/log/dspam/dspam.log)"
426	. endif	456	. endif
Lines 448-471 post-patch: Link Here
448	${WRKSRC}/src/tools/dspam_notify.in	478	${WRKSRC}/src/tools/dspam_notify.in
449		479
450	pre-configure:	480	pre-configure:
451	.if ${PORT_OPTIONS:MVIRT_USERS} && !( defined(USE_MYSQL) \|\| \	481	.if ${PORT_OPTIONS:MVIRT_USERS} && !( ${PORT_OPTIONS:MMYSQL} \|\| \
452	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MHASH} )	482	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MHASH} )
453	@${ECHO_CMD} "You need MySQL, POSTGRESQL or HASH for virtual users."	483	@${ECHO_CMD} "You need MySQL, POSTGRESQL or HASH for virtual users."
454	@${FALSE}	484	@${FALSE}
455	.endif	485	.endif
456	.if ${PORT_OPTIONS:MPREF_EXT} && !( defined(USE_MYSQL) \|\| \	486	.if ${PORT_OPTIONS:MPREF_EXT} && !( ${PORT_OPTIONS:MMYSQL} \|\| \
457	${PORT_OPTIONS:MPGSQL} )	487	${PORT_OPTIONS:MPGSQL} )
458	@${ECHO_CMD} "You need MySQL or Postgres for preferences extension"	488	@${ECHO_CMD} "You need MySQL or Postgres for preferences extension"
459	@${FALSE}	489	@${FALSE}
460	.endif	490	.endif
461	.if ${PORT_OPTIONS:MDAEMON} && !( defined(USE_MYSQL) \|\| \	491	.if ${PORT_OPTIONS:MDAEMON} && !( ${PORT_OPTIONS:MMYSQL} \|\| \
462	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MHASH} )	492	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MHASH} )
463	@${ECHO_CMD} "You need MySQL, PostgreSQL or Hash for Daemon mode, because multithreading support is needed"	493	@${ECHO_CMD} "You need MySQL, PostgreSQL or Hash for Daemon mode, because multithreading support is needed"
464	@${FALSE}	494	@${FALSE}
465	.endif	495	.endif
466	.if ${PORT_OPTIONS:MEXTERNAL_LOOKUP} && !( defined(USE_MYSQL) \|\| \	496	.if ${PORT_OPTIONS:MEXTERNAL_LOOKUP} && !( ${PORT_OPTIONS:MMYSQL} \|\| \
467	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MSQLITE*} )	497	${PORT_OPTIONS:MPGSQL} \|\| ${PORT_OPTIONS:MSQLITE*} )
468	@${ECHO_CMD} "You need MySQL, Postgres or SQLITE for EXTERNAL_LOOKUP."	498	@${ECHO_CMD} "You need MySQL, Postgres or SQLite for EXTERNAL_LOOKUP."
469	@${FALSE}	499	@${FALSE}
470	.endif	500	.endif
471	.if ${PORT_OPTIONS:MUSER_HOMEDIR} && ${PORT_OPTIONS:MWEBUI}	501	.if ${PORT_OPTIONS:MUSER_HOMEDIR} && ${PORT_OPTIONS:MWEBUI}
Lines 490-496 post-install: Link Here
490	${RM} -R ${STAGEDIR}${PREFIX}/lib/pkgconfig \|\| true	520	${RM} -R ${STAGEDIR}${PREFIX}/lib/pkgconfig \|\| true
491		521
492	.if ${PORT_OPTIONS:MEXAMPLES}	522	.if ${PORT_OPTIONS:MEXAMPLES}
493	.ifdef(USE_MYSQL)	523	.if ${PORT_OPTIONS:MMYSQL}
494	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/mysql	524	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/mysql
495	cd ${WRKSRC}/src/tools.mysql_drv && \	525	cd ${WRKSRC}/src/tools.mysql_drv && \
496	${INSTALL_DATA} mysql_objects-4.1.sql \	526	${INSTALL_DATA} mysql_objects-4.1.sql \
Lines 558-564 post-install: Link Here
558	${INSTALL_DATA} ${_file}.sample ${STAGEDIR}${DSPAM_HOME}	588	${INSTALL_DATA} ${_file}.sample ${STAGEDIR}${DSPAM_HOME}
559	.endfor	589	.endfor
560		590
561	@${MKDIR} -m ${DSPAM_HOME_MODE} ${STAGEDIR}${LOG_DIR}	591	@${MKDIR} ${STAGEDIR}${RUN_DIR}
		592	@${MKDIR} ${STAGEDIR}${LOG_DIR}
562		593
563	@${CAT} ${WRKSRC}/README.FreeBSD	594	@${CAT} ${WRKSRC}/README.FreeBSD
564		595




make extract;  more `find . -type f -maxdepth 2 -name UPGRADING`

###########################################################################
# dspam-3.10.2_2
#

Port Changes:
- Runs as dspam:dspam instead of root:mail [1]
- Default run directory is now /var/run/dspam [1]
- Default daemon/client communication port is now 2424 [1]
- New SETUID option to enable old insecure behavior [1]

[1] Questionable ownership and security on mail/dspam (PR #115957)


###########################################################################
# dspam-3.10.2
#


Lines 25-31 load_rc_config $name Link Here

(-)b/mail/dspam/files/dspam.in (-1 / +3 lines)
25	#defaults	25	#defaults
26	: ${dspam_enable="NO"}	26	: ${dspam_enable="NO"}
27	: ${dspam_debug="NO"}	27	: ${dspam_debug="NO"}
28	: ${dspam_pidfile:-/var/run/dspam.pid}	28	: ${dspam_pidfile:-/var/run/dspam/dspam.pid}
		29	: ${dspam_user="%%DSPAM_OWNER%%"}
		30	: ${dspam_group="%%DSPAM_GROUP%%"}
29		31
30	command=%%PREFIX%%/bin/${name}	32	command=%%PREFIX%%/bin/${name}
31		33

Lines 1-6 Link Here

(-)b/mail/dspam/files/patch-src__Makefile.in (-3 / +3 lines)
1	--- src/Makefile.in.orig 2014-05-14 17:35:13.000000000 -0300	1	--- src/Makefile.in.orig 2012-04-23 17:53:45 UTC
2	+++ src/Makefile.in 2014-05-14 17:35:48.000000000 -0300	2	+++ src/Makefile.in
3	@@ -1117,11 +1117,11 @@	3	@@ -1249,11 +1249,11 @@ install-exec-hook:
4	mkdir -p $(DESTDIR)$(sysconfdir); \	4	mkdir -p $(DESTDIR)$(sysconfdir); \
5	chmod 755 $(DESTDIR)$(sysconfdir); \	5	chmod 755 $(DESTDIR)$(sysconfdir); \
6	fi	6	fi

Added Link Here

(-)b/mail/dspam/files/patch-src__client.c (+11 lines)
1	--- src/client.c.orig 2012-04-11 18:48:33 UTC
2	+++ src/client.c
3	@@ -304,7 +304,7 @@ int client_connect(AGENT_CTX *ATX, int f
4	struct sockaddr_un saun;
5	int sockfd;
6	int yes = 1;
7	- int port = 24;
8	+ int port = 2424;
9	int domain = 0;
10	int addr_len;
11	char *host;

Added Link Here

(-)b/mail/dspam/files/patch-src__daemon.c (+11 lines)
1	--- src/daemon.c.orig 2012-04-11 18:48:33 UTC
2	+++ src/daemon.c
3	@@ -97,7 +97,7 @@ int daemon_listen(DRIVER_CTX *DTX) {
4	int domain = 0; /* listening on domain socket? */
5	int listener; /* listener fd */
6	int i;
7	- int port = 24, queue = 32; /* default port and queue size */
8	+ int port = 2424, queue = 32; /* default port and queue size */
9
10	signal(SIGPIPE, SIG_IGN);
11	signal(SIGINT, process_signal);

Removed Link Here

(-)a/mail/dspam/files/patch-src__dspam.c (-11 lines)
1	--- src/dspam.c.orig 2012-04-11 11:48:33.000000000 -0700
2	+++ src/dspam.c 2014-09-23 19:43:09.688194417 -0700
3	@@ -4194,7 +4194,7 @@
4
5	pidfile = _ds_read_attribute(agent_config, "ServerPID");
6	if ( pidfile == NULL )
7	- pidfile = "/var/run/dspam/dspam.pid";
8	+ pidfile = "/var/run/dspam.pid";
9
10	if (pidfile) {
11	FILE *file;




--- src/dspam.conf.in.orig	2012-04-11 18:48:33 UTC
+++ src/dspam.conf.in
@@ -56,6 +56,7 @@ TrustedDeliveryAgent "@delivery_agent@"
 # necessary if you plan on allowing untrusted processing.
 #
 #UntrustedDeliveryAgent "/usr/bin/procmail -d %u"

 
 #
 # SMTP or LMTP Delivery: Alternatively, you may wish to use SMTP or LMTP
@@ -350,7 +351,7 @@ AllowOverride notifications
 # Storage driver settings: Specific to a particular storage driver. Uncomment
 # the configuration specific to your installation, if applicable.
 #

 #MySQLPort		
 #MySQLUser		dspam
 #MySQLPass		changeme
@@ -361,7 +362,7 @@ AllowOverride notifications
 # If you are using replication for clustering, you can also specify a separate
 # server to perform all writes to.
 #

 #MySQLWritePort		
 #MySQLWriteUser		dspam
 #MySQLWritePass		changeme
@@ -406,7 +407,7 @@ AllowOverride notifications
 # in /var/run/postgresql/.s.PGSQL.5432 specify just the path where the socket
 # resits (without .s.PGSQL.5432).
 

 #PgSQLPort		
 #PgSQLUser		dspam
 #PgSQLPass		changeme
@@ -807,9 +808,9 @@ Opt out
 # interfaces.
 #
 #ServerHost		127.0.0.1
-#ServerPort		24
+#ServerPort		2424
 #ServerQueueSize	32
-#ServerPID		/var/run/dspam.pid
+#ServerPID		/var/run/dspam/dspam.pid
 
 #
 # ServerMode specifies the type of LMTP server to start. This can be one of:
@@ -845,18 +846,18 @@ Opt out
 # you are running the client and server on the same machine, as it eliminates
 # much of the bandwidth overhead.
 #
-#ServerDomainSocketPath	"/tmp/dspam.sock"
+#ServerDomainSocketPath	"/var/run/dspam/dspam.sock"
 
 #
 # Client Mode: If you are running DSPAM in client/server mode, uncomment and

 # a domain socket.
 #
-#ClientHost	/tmp/dspam.sock
+#ClientHost	/var/run/dspam/dspam.sock
 #ClientIdent	"secret@Relay1"
 #
 #ClientHost	127.0.0.1
-#ClientPort	24
+#ClientPort	2424
 #ClientIdent	"secret@Relay1"
 
 # --- RABL ---

Lines 2-8 Link Here

(-)b/mail/dspam/pkg-plist (-9 / +15 lines)
2	%%HASH%%bin/csscompress	2	%%HASH%%bin/csscompress
3	%%HASH%%bin/cssconvert	3	%%HASH%%bin/cssconvert
4	%%HASH%%bin/cssstat	4	%%HASH%%bin/cssstat
5	@(%%DSPAM_OWNER%%,%%DSPAM_GROUP%%,%%DSPAM_MODE%%) bin/dspam	5	%%SETUID%%@(%%DSPAM_OWNER%%,%%DSPAM_GROUP%%,%%DSPAM_MODE%%) bin/dspam
		6	%%NOSETUID%%bin/dspam
6	bin/dspamc	7	bin/dspamc
7	bin/dspam_2sql	8	bin/dspam_2sql
8	bin/dspam_admin	9	bin/dspam_admin
Lines 65-74 man/man3/libdspam.3.gz Link Here
65	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so	66	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so
66	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so.7	67	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so.7
67	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so.7.0.0	68	%%DYNAMIC%%%%PGSQL%%lib/dspam/libpgsql_drv.so.7.0.0
68	%%DYNAMIC%%%%SQLITE%%lib/dspam/libsqlite3_drv.a	69	%%DYNAMIC%%%%SQLITE2%%lib/dspam/libsqlite_drv.so.7.0.0
69	%%DYNAMIC%%%%SQLITE%%lib/dspam/libsqlite3_drv.so	70	%%DYNAMIC%%%%SQLITE2%%lib/dspam/libsqlite_drv.a
70	%%DYNAMIC%%%%SQLITE%%lib/dspam/libsqlite3_drv.so.7	71	%%DYNAMIC%%%%SQLITE2%%lib/dspam/libsqlite_drv.so
71	%%DYNAMIC%%%%SQLITE%%lib/dspam/libsqlite3_drv.so.7.0.0	72	%%DYNAMIC%%%%SQLITE2%%lib/dspam/libsqlite_drv.so.7
		73	%%DYNAMIC%%%%SQLITE3%%lib/dspam/libsqlite3_drv.a
		74	%%DYNAMIC%%%%SQLITE3%%lib/dspam/libsqlite3_drv.so
		75	%%DYNAMIC%%%%SQLITE3%%lib/dspam/libsqlite3_drv.so.7
		76	%%DYNAMIC%%%%SQLITE3%%lib/dspam/libsqlite3_drv.so.7.0.0
72	libdata/pkgconfig/dspam.pc	77	libdata/pkgconfig/dspam.pc
73	%%PORTDOCS%%%%DOCSDIR%%/CHANGELOG	78	%%PORTDOCS%%%%DOCSDIR%%/CHANGELOG
74	%%PORTDOCS%%%%DOCSDIR%%/LICENSE	79	%%PORTDOCS%%%%DOCSDIR%%/LICENSE
Lines 206-213 libdata/pkgconfig/dspam.pc Link Here
206	%%WebUI%%%%WWWDIR%%/templates/ro/nav_preferences.html	211	%%WebUI%%%%WWWDIR%%/templates/ro/nav_preferences.html
207	%%WebUI%%%%WWWDIR%%/templates/ro/nav_quarantine.html	212	%%WebUI%%%%WWWDIR%%/templates/ro/nav_quarantine.html
208	%%WebUI%%%%WWWDIR%%/templates/ro/nav_viewmessage.html	213	%%WebUI%%%%WWWDIR%%/templates/ro/nav_viewmessage.html
209	%%DSPAM_HOME%%/firstrun.txt.sample	214	@(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%) %%DSPAM_HOME%%/firstrun.txt.sample
210	%%DSPAM_HOME%%/firstspam.txt.sample	215	@(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%) %%DSPAM_HOME%%/firstspam.txt.sample
211	%%DSPAM_HOME%%/quarantinefull.txt.sample	216	@(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%) %%DSPAM_HOME%%/quarantinefull.txt.sample
212	@dir(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%,%%DSPAM_HOME_MODE%%) %%DSPAM_HOME%%	217	@dir(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%,%%DSPAM_HOME_MODE%%) %%DSPAM_HOME%%
213	@dir(%%DSPAM_HOME_OWNER%%,%%DSPAM_HOME_GROUP%%) %%LOG_DIR%%	218	@dir(%%DSPAM_OWNER%%,%%DSPAM_GROUP%%) %%LOG_DIR%%
		219	@dir(%%DSPAM_OWNER%%,%%DSPAM_GROUP%%) %%RUN_DIR%%

Return to bug 115957

Lines 5-10 they are unavoidable. Link Here

(-)b/UPDATING (+10 lines)
5	You should get into the habit of checking this file for changes each time	5	You should get into the habit of checking this file for changes each time
6	you update your ports collection, before attempting any port upgrades.	6	you update your ports collection, before attempting any port upgrades.
7		7
		8	20160427:
		9	AFFECTS: Users of mail/dspam
		10	AUTHOR: junovitch@FreeBSD.org
		11
		12	dspam has been modified to no longer run as root:mail by default.
		13	Existing configuration must be adjusted to reflect using a non-privileged
		14	port and the /var/run/dspam directory for PID and socket files. If you
		15	need dspam to run as root for your mail setup, you can use the SETUID
		16	config option to enable the old insecure behavior.
		17
8	20160414:	18	20160414:
9	AFFECTS: Users of net-mgmt/icinga2	19	AFFECTS: Users of net-mgmt/icinga2
10	AUTHOR: lme@FreeBSD.org	20	AUTHOR: lme@FreeBSD.org

Lines 17-22 in the port directory: Link Here

(-)b/mail/dspam/files/UPDATING (+13 lines)
17	make extract; more `find . -type f -maxdepth 2 -name UPGRADING`	17	make extract; more `find . -type f -maxdepth 2 -name UPGRADING`
18		18
19	###########################################################################	19	###########################################################################
		20	# dspam-3.10.2_2
		21	#
		22
		23	Port Changes:
		24	- Runs as dspam:dspam instead of root:mail [1]
		25	- Default run directory is now /var/run/dspam [1]
		26	- Default daemon/client communication port is now 2424 [1]
		27	- New SETUID option to enable old insecure behavior [1]
		28
		29	[1] Questionable ownership and security on mail/dspam (PR #115957)
		30
		31
		32	###########################################################################
20	# dspam-3.10.2	33	# dspam-3.10.2
21	#	34	#
22		35

Lines 1-6 Link Here

(-)b/mail/dspam/files/patch-src__dspam.conf.in (-9 / +26 lines)
1	--- src/dspam.conf.in.orig 2014-09-18 00:33:02.874722063 -0700	1	--- src/dspam.conf.in.orig 2012-04-11 18:48:33 UTC
2	+++ src/dspam.conf.in 2014-09-18 00:41:49.434685786 -0700	2	+++ src/dspam.conf.in
3	@@ -56,6 +56,7 @@	3	@@ -56,6 +56,7 @@ TrustedDeliveryAgent "@delivery_agent@"
4	# necessary if you plan on allowing untrusted processing.	4	# necessary if you plan on allowing untrusted processing.
5	#	5	#
6	#UntrustedDeliveryAgent "/usr/bin/procmail -d %u"	6	#UntrustedDeliveryAgent "/usr/bin/procmail -d %u"
Lines 8-14 Link Here
8		8
9	#	9	#
10	# SMTP or LMTP Delivery: Alternatively, you may wish to use SMTP or LMTP	10	# SMTP or LMTP Delivery: Alternatively, you may wish to use SMTP or LMTP
11	@@ -350,7 +351,7 @@	11	@@ -350,7 +351,7 @@ AllowOverride notifications
12	# Storage driver settings: Specific to a particular storage driver. Uncomment	12	# Storage driver settings: Specific to a particular storage driver. Uncomment
13	# the configuration specific to your installation, if applicable.	13	# the configuration specific to your installation, if applicable.
14	#	14	#
Lines 17-23 Link Here
17	#MySQLPort	17	#MySQLPort
18	#MySQLUser dspam	18	#MySQLUser dspam
19	#MySQLPass changeme	19	#MySQLPass changeme
20	@@ -361,7 +362,7 @@	20	@@ -361,7 +362,7 @@ AllowOverride notifications
21	# If you are using replication for clustering, you can also specify a separate	21	# If you are using replication for clustering, you can also specify a separate
22	# server to perform all writes to.	22	# server to perform all writes to.
23	#	23	#
Lines 26-32 Link Here
26	#MySQLWritePort	26	#MySQLWritePort
27	#MySQLWriteUser dspam	27	#MySQLWriteUser dspam
28	#MySQLWritePass changeme	28	#MySQLWritePass changeme
29	@@ -406,7 +407,7 @@	29	@@ -406,7 +407,7 @@ AllowOverride notifications
30	# in /var/run/postgresql/.s.PGSQL.5432 specify just the path where the socket	30	# in /var/run/postgresql/.s.PGSQL.5432 specify just the path where the socket
31	# resits (without .s.PGSQL.5432).	31	# resits (without .s.PGSQL.5432).
32		32
Lines 35-46 Link Here
35	#PgSQLPort	35	#PgSQLPort
36	#PgSQLUser dspam	36	#PgSQLUser dspam
37	#PgSQLPass changeme	37	#PgSQLPass changeme
38	@@ -845,14 +846,14 @@	38	@@ -807,9 +808,9 @@ Opt out
		39	# interfaces.
		40	#
		41	#ServerHost 127.0.0.1
		42	-#ServerPort 24
		43	+#ServerPort 2424
		44	#ServerQueueSize 32
		45	-#ServerPID /var/run/dspam.pid
		46	+#ServerPID /var/run/dspam/dspam.pid
		47
		48	#
		49	# ServerMode specifies the type of LMTP server to start. This can be one of:
		50	@@ -845,18 +846,18 @@ Opt out
39	# you are running the client and server on the same machine, as it eliminates	51	# you are running the client and server on the same machine, as it eliminates
40	# much of the bandwidth overhead.	52	# much of the bandwidth overhead.
41	#	53	#
42	-#ServerDomainSocketPath "/tmp/dspam.sock"	54	-#ServerDomainSocketPath "/tmp/dspam.sock"
43	+#ServerDomainSocketPath "/var/run/dspam.sock"	55	+#ServerDomainSocketPath "/var/run/dspam/dspam.sock"
44		56
45	#	57	#
46	# Client Mode: If you are running DSPAM in client/server mode, uncomment and	58	# Client Mode: If you are running DSPAM in client/server mode, uncomment and
Lines 48-54 Link Here
48	# a domain socket.	60	# a domain socket.
49	#	61	#
50	-#ClientHost /tmp/dspam.sock	62	-#ClientHost /tmp/dspam.sock
51	+#ClientHost /var/run/dspam.sock	63	+#ClientHost /var/run/dspam/dspam.sock
52	#ClientIdent "secret@Relay1"	64	#ClientIdent "secret@Relay1"
53	#	65	#
54	#ClientHost 127.0.0.1	66	#ClientHost 127.0.0.1
		67	-#ClientPort 24
		68	+#ClientPort 2424
		69	#ClientIdent "secret@Relay1"
		70
		71	# --- RABL ---