postfix-2.3.17

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 3e35a69a38e463d8d46dc8f0995df0d6539d7cf4..e536d9ee6b177b89a78f85981e8386ffb7569b80 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -13185,3 +13185,14 @@ Apologies for any names omitted.
        Cleanup: adjust the VSTREAM buffer strategy when reusing
        an SMTP connection with a large TCP MSS value. File:
        smtp/smtp_reuse.c.
+
+20090419
+
+       Bugfix: don't re-enable SIGHUP if it is ignored in the
+       parent. This may cause random "Postfix integrity check
+       failed" errors at boot time (POSIX SIGHUP death), causing
+       Postfix not to start. We duplicate code from postdrop and
+       thus avoid past mistakes.  File: postsuper/postsuper.c.
+
+       Robustness: don't re-enable SIGTERM if it is ignored in the
+       parent. Files: postsuper/postsuper.c, postdrop/postdrop.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 24d01bc3d5638485cf470b77ed584fefe763e888..1145ce410850b3e7ca48ac0833aff9ed70852482 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20090103"
-#define MAIL_VERSION_NUMBER    "2.3.16"
+#define MAIL_RELEASE_DATE      "20090511"
+#define MAIL_VERSION_NUMBER    "2.3.17"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE     "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/postdrop/postdrop.c b/postfix/src/postdrop/postdrop.c
index 93708776e972273ba926a96c47693365f1353821..11d9429381212374f6c4da1f0a46c17295354095 100644 (file)
--- a/postfix/src/postdrop/postdrop.c
+++ b/postfix/src/postdrop/postdrop.c
@@ -330,7 +330,8 @@ int     main(int argc, char **argv)
 
     signal(SIGINT, postdrop_sig);
     signal(SIGQUIT, postdrop_sig);
-    signal(SIGTERM, postdrop_sig);
+    if (signal(SIGTERM, SIG_IGN) == SIG_DFL)
+       signal(SIGTERM, postdrop_sig);
     if (signal(SIGHUP, SIG_IGN) == SIG_DFL)
        signal(SIGHUP, postdrop_sig);
     msg_cleanup(postdrop_cleanup);

diff --git a/postfix/src/postsuper/postsuper.c b/postfix/src/postsuper/postsuper.c
index e3636cdf766f2983a59300333b6fb3ef3ef368cf..e4d87cee93854b44c9024c90ced909d9b88c8e41 100644 (file)
--- a/postfix/src/postsuper/postsuper.c
+++ b/postfix/src/postsuper/postsuper.c
@@ -969,11 +969,17 @@ static void interrupted(int sig)
     /*
      * This commands requires root privileges. We therefore do not worry
      * about hostile signals, and report problems via msg_warn().
+     * 
+     * We use the in-kernel SIGINT handler address as an atomic variable to
+     * prevent nested interrupted() calls. For this reason, main() must
+     * configure interrupted() as SIGINT handler before other signal handlers
+     * are allowed to invoke interrupted(). See also similar code in
+     * postdrop.
      */
-    if (signal(SIGHUP, SIG_IGN) != SIG_IGN) {
-       (void) signal(SIGINT, SIG_IGN);
+    if (signal(SIGINT, SIG_IGN) != SIG_IGN) {
        (void) signal(SIGQUIT, SIG_IGN);
        (void) signal(SIGTERM, SIG_IGN);
+       (void) signal(SIGHUP, SIG_IGN);
        if (inode_mismatch > 0 || inode_fixed > 0 || position_mismatch > 0)
            msg_warn("OPERATION INCOMPLETE -- RERUN COMMAND TO FIX THE QUEUE FIRST");
        if (sig)
@@ -1161,11 +1167,20 @@ int     main(int argc, char **argv)
      * 
      * Set up signal handlers after permanently dropping super-user privileges,
      * so that signal handlers will always run with the correct privileges.
+     * 
+     * XXX Don't enable SIGHUP or SIGTERM if it was ignored by the parent.
+     * 
+     * interrupted() uses the in-kernel SIGINT handler address as an atomic
+     * variable to prevent nested interrupted() calls. For this reason, the
+     * SIGINT handler must be configured before other signal handlers are
+     * allowed to invoke interrupted(). See also similar code in postdrop.
      */
-    signal(SIGHUP, interrupted);
     signal(SIGINT, interrupted);
     signal(SIGQUIT, interrupted);
-    signal(SIGTERM, interrupted);
+    if (signal(SIGTERM, SIG_IGN) == SIG_DFL)
+       signal(SIGTERM, interrupted);
+    if (signal(SIGHUP, SIG_IGN) == SIG_DFL)
+       signal(SIGHUP, interrupted);
     msg_cleanup(fatal_warning);
 
     /*