[mailman-developers@python.org Cced in case they want to add my shell script to the tree, but followup set to mailman-users@python.org]

I wanted to have mailman run on my servers that have the secure-linux kernel patch. I ended up writing a small shell script that changed permissions so that scripts ran as UID mailman (by making sure that scripts that lock config.db do so with UID mailman). I later realized that python doesn't seem to have a suidpython wrapper like perl does, so I scrapped the shell script and attempted to put a few lines of python together to modify some scripts in mailman/bin so that they change their uid to mailman if root runs them or complain that they can't run unless their uid is mailman.

Please let me know if I forgot to chmod or modify other files that lock config.db: binfilestopatch= ( 'add_members', 'check_db', 'clone_member', 'config_list', 'move_list', 'newlist', 'remove_members', 'rmlist', 'sync_members', 'update', 'withlist' )

It'd be nice if that script were included as unsupported with the mailman tree so that people who really want to have the protections from secure-linux, can still run mailman. If someone needs to make minor modifications to the script before including it, I'm cool with that.

Thanks, Marc

~mailman/bin/fix_perms.securelinux

#! /usr/bin/env python # # Copyright (C) 1998,1999,2000 by the Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

"""If you use Solar Designer's secure-linux patch, it prevents a process from linking (hard link) to a file it doesn't own. As a result mailman has to be changed so that the whole tree is owned by mailman, and the CGIs and some of the programs in the bin tree (the ones that lock config.db files) are SUID mailman. The idea is that config.db files have to be owned by the mailman UID and only touched by programs that are UID mailman.

If you have to run check_perms -f, make sure to also run %(PROGRAM) -f, which applies the necessary permission fixes

As a result, to prevent anyone from running priviledged mailman commands (since the scripts are suid), binary commands that are changed to be SUID are also unreadable and unrunable by people who aren't in the mailman group. This shouldn't affect much since most of those commands would fail work if you weren't part of the mailman group anyway.

Marc <marcsoft@merlins.org>/<marc_bts@valinux.com> 2000/10/04 """

import sys import os import paths import re

# Those are the programs that we patch so that they insist being run under the # mailman uid or as root. binfilestopatch= ( 'add_members', 'check_db', 'clone_member', 'config_list', 'move_list', 'newlist', 'remove_members', 'rmlist', 'sync_members', 'update', 'withlist' )

def main(): binpath=paths.prefix+'/bin/' droplib=binpath+'CheckFixUid.py'

if len(argv)<2 or argv[1] != "-f":
print __doc__
sys.exit(1)

if not os.path.exists(droplib):
print "Creating "+droplib
fp=open(droplib, 'w', 0644)
fp.write("""import sys

import pwd import os

class CheckFixUid: mailmanuid=pwd.getpwnam("mailman")[2] if os.geteuid() == 0: os.setuid(mailmanuid) if os.geteuid() != mailmanuid: print "You need to run this script as root or mailman because it was configured to run\non a linux system with the secure-linux patch which restricts hard links" sys.exit() """) fp.close else: print "Skipping creation of "+droplib

print "Making cgis setuid mailman"
os.system('chmod 6755 '+paths.prefix+'/cgi-bin/*')

print "Making mail wrapper setuid mailman"
os.system('chmod 6755 '+paths.prefix+'/mail/wrapper')

print "Ensuring that all config.db fiels are owned by Mailman"
os.system('chown mailman.mailman '+paths.prefix+'/lists/*/config.db*')

print "Patching mailman scripts to change the uid to mailman"

for script in binfilestopatch:
filefd=open(script, "r")
file=filefd.readlines()
filefd.close()

patched=0
try:
    file.index("import CheckFixUid\n")
    print "Not patching "+script+", already patched"
except ValueError:
    file.insert(file.index("import paths\n")+1, "import CheckFixUid\n")
    for i in range(len(file)-1, 0, -1):
	object=re.compile("^([	 ]*)main\(").search(file[i])
	if object:
	    print "Patching "+script
	    file.insert(i, object.group(1)+"CheckFixUid.CheckFixUid()\n")
	    patched=1
	    break

    if patched==0:
	print "Warning, file "+script+" couldn't be patched.\nIf you use it, mailman may not function properly"
    else:
	filefd=open(script, "w")
	filefd.writelines(file)
    

main(sys.argv)

-- Microsoft is to software what McDonalds is to gourmet cooking

Home page: http://marc.merlins.org/ (friendly to non IE browsers) Finger marc_f@merlins.org for PGP key and other contact information