michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-11-02 08:30:40 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Existing SNI maps should be mode 0600 because they may contain keys
Some checks failed
Tests / prove (push) Has been cancelled
Details
Package and upload artifacts / build (push) Has been cancelled
Details
Close inactive / close-inactive (push) Has been cancelled
Details

Browse Source 
https://forum.virtualmin.com/t/postfix-sni-database-exposes-private-tls-keys-through-world-readable-permissions/138222
This commit is contained in:
Jamie Cameron
2026-10-25 14:49:29 -07:00
parent 1474fca04e
commit 1e01608d9e
1 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
postfix/postfix-lib.pl
View File

@@ -789,21 +789,27 @@ sub regenerate_dependent_table
#
sub regenerate_any_table
{
my ($name, $force, $after, $base64) = @_;
$base64 = 0 if (&compare_version_numbers($postfix_version, 3.4) < 0);
my @files;
if ($force) {
my ($name, $force, $after, $base64) = @_;
$base64 = 0 if (&compare_version_numbers($postfix_version, 3.4) < 0);
my @files;
if ($force) {
@files = map { [ "hash", $_ ] } @$force;
} elsif (&get_current_value($name) ne "") {
}
elsif (&get_current_value($name) ne "") {
my $value = &get_real_value($name);
if ($after) {
$value =~ s/^.*\Q$after\E\s+(\S+).*$/$1/ || return;
}
@files = &get_maps_types_files($value);
}
foreach my $map (@files)
{
next unless $map;
}
foreach my $map (@files) {
next unless $map;
# Make safe permissions for SNI maps
if ($name eq "tls_server_sni_maps" && &file_map_type($map->[0])) {
&set_ownership_permissions(undef, undef, 0600, $map->[1],
glob("$map->[1].*"));
}
# Text maps are read directly by Postfix and cannot be indexed.
if (&file_map_type($map->[0]) &&
$map->[0] ne 'regexp' && $map->[0] ne 'pcre' &&
@@ -814,12 +820,11 @@ sub regenerate_any_table
($base64 ? " -F" : "").
" $map->[0]:$map->[1] 2>&1");
if ($?) { &error(&text('regenerate_table_efailed', $map->[1], $out)); }
}
}
}
}
############################################################################
# maps [canonical, virtual, transport] support