From: Wietse Venema Date: Tue, 1 Oct 2013 05:00:00 +0000 (-0500) Subject: postfix-2.11-20131001 X-Git-Tag: v2.11.0-RC1~21 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8b9901ce03ef16d4b483d465c2865a62590d8bf9;p=thirdparty%2Fpostfix.git postfix-2.11-20131001 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 27f13d49d..a8c8893a4 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -18969,3 +18969,11 @@ Apologies for any names omitted. LMDB files can still be created by unprivileged Postfix daemon processes under the postfix-owned data_directory. Files: proto/LMDB_README.html, global/mkmap.c. + +20131001 + + Cleanup: LMDB support is forbidden due to problems with + LMDB lock management. These problems hinder error recovery + in multi-programmed systems, and prohibit database sharing + between privileged writer processes and unprivileged reader + processes. diff --git a/postfix/Makefile.in b/postfix/Makefile.in index 7145bc437..9fb328a3a 100644 --- a/postfix/Makefile.in +++ b/postfix/Makefile.in @@ -59,7 +59,7 @@ libexec/postmulti-script: conf/postmulti-script manpages: set -e; for i in $(MANDIRS); do \ (set -e; echo "[$$i]"; cd $$i; $(MAKE) -f Makefile.in $(OPTS) MAKELEVEL=) || exit 1; \ - done + done +
+ + +

Postfix LMDB support is forbidden due to problems with LMDB lock +management. These problems hinder error recovery in multi-programmed +systems, and prohibit database sharing between privileged writer +processes and unprivileged reader processes.

+ + +- -> -

Non-obvious recovery with +

Non-obvious recovery with postmap(1), postalias(1), - -> postscreen(8), tlsmgr(8), or verify(8) from a corrupted database.

Problem:

You cannot rebuild a corrupted LMDB -database simply by waiting until a daemon restarts. This problem does not exist +database simply by postmap(1) or postalias(1), or +by - -> waiting until a daemon restarts. This problem does not exist with other Postfix databases.

Background:

The Postfix LMDB database client @@ -313,10 +323,10 @@ That is obviously not possible with a corrupted database file.

someone fixes the problem.

Recovery:

First delete the ".lmdb" file by hand. -Then, restart -postfix.

+Then, postmap(1) or postalias(1) +command if the file was created with those commands, or - -> restart +postfix.

Prevention:
@@ -330,3 +340,7 @@ in-memory file system data and metadata.

corruption of on-disk file system data and metadata.

+ +--> + + diff --git a/postfix/proto/LMDB_README.html b/postfix/proto/LMDB_README.html index 9c148b092..b69f81085 100644 --- a/postfix/proto/LMDB_README.html +++ b/postfix/proto/LMDB_README.html @@ -17,6 +17,16 @@
+
+ + +

Postfix LMDB support is forbidden due to problems with LMDB lock +management. These problems hinder error recovery in multi-programmed +systems, and prohibit database sharing between privileged writer +processes and unprivileged reader processes.

+ + +- -> -

Non-obvious recovery with +

Non-obvious recovery with postscreen(8), tlsmgr(8), or verify(8) from a corrupted database.

Problem:

You cannot rebuild a corrupted LMDB -database simply by waiting until a daemon restarts. This problem does not exist +database simply by waiting until a daemon restarts. This problem does not exist with other Postfix databases.

Background:

The Postfix LMDB database client @@ -313,10 +323,10 @@ That is obviously not possible with a corrupted database file.

someone fixes the problem.

Recovery:

First delete the ".lmdb" file by hand. -Then, restart -postfix.

+Then, restart +postfix.

Prevention:
@@ -330,3 +340,5 @@ in-memory file system data and metadata.

corruption of on-disk file system data and metadata.

+ +--> diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index 41a11f1f0..c306fbbaf 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20130929" +#define MAIL_RELEASE_DATE "20131001" #define MAIL_VERSION_NUMBER "2.11" #ifdef SNAPSHOT diff --git a/postfix/src/global/mkmap_open.c b/postfix/src/global/mkmap_open.c index c4b1c45fd..f84ef692d 100644 --- a/postfix/src/global/mkmap_open.c +++ b/postfix/src/global/mkmap_open.c @@ -102,29 +102,8 @@ static const MKMAP_OPEN_INFO mkmap_types[] = { DICT_TYPE_HASH, mkmap_hash_open, DICT_TYPE_BTREE, mkmap_btree_open, #endif - - /* - * LMDB readers open the LMDB lock file O_RDWR. This complicates - * database sharing between processes that run with different effective - * UIDs. - * - * For example, this violates the Postfix security model as it passes a - * read-write file handle for a root-owned file under /etc/postfix into a - * non-root daemon process. - * - * This also totally breaks non-root access for root-owned databases by - * non-daemon processes. - * - * Even if LMDB lock files were kept under /tmp or /var/run, those files - * would still have to be world-writable, and that would still violate - * the principle of least privilege. - * - * For all these reasons, LMDB is supported only for caches that are - * maintained by non-root daemon processes such as postscreen(8), - * tlsmgr(8) or verify(8). All the effort to recover from bogus LMDB - * errors was good for something. - */ -#ifdef notdef +#ifdef HAS_LMDB +#error "LMDB support is forbidden" DICT_TYPE_LMDB, mkmap_lmdb_open, #endif DICT_TYPE_FAIL, mkmap_fail_open, diff --git a/postfix/src/util/dict_open.c b/postfix/src/util/dict_open.c index aee1f8ddd..d3b33aa0f 100644 --- a/postfix/src/util/dict_open.c +++ b/postfix/src/util/dict_open.c @@ -299,6 +299,7 @@ static const DICT_OPEN_INFO dict_open_info[] = { DICT_TYPE_BTREE, dict_btree_open, #endif #ifdef HAS_LMDB +#error "LMDB support is forbidden" DICT_TYPE_LMDB, dict_lmdb_open, #endif #ifdef HAS_NIS