Compare commits

..

2 commits

Author SHA1 Message Date
Jaroslav Škarvada
1e3971d1c4 New version
Resolves: rhbz#2255641
Fixed SMTP smuggling vulnerability
  Resolves: CVE-2023-51764
2024-01-02 23:39:23 +01:00
Jaroslav Škarvada
cf35dda8b1 Rebuilt for new openssl 2023-11-09 14:12:14 +01:00
11 changed files with 121 additions and 274 deletions

View file

@ -0,0 +1,15 @@
diff --git pflogsumm-1.1.5/pflogsumm.pl pflogsumm-1.1.5/pflogsumm.pl
index 31de5bd..36384dd 100755
--- pflogsumm-1.1.5/pflogsumm.pl
+++ pflogsumm-1.1.5/pflogsumm.pl
@@ -398,8 +398,8 @@ Copyright (C) 1998-2010 by James S. Seymour, Release 1.1.5
use strict;
use locale;
use Getopt::Long;
-eval { require Date::Calc };
-my $hasDateCalc = $@ ? 0 : 1;
+require Date::Calc;
+my $hasDateCalc = 1;
my $mailqCmd = "mailq";
my $release = "1.1.5";

View file

@ -0,0 +1,13 @@
diff --git pflogsumm-1.1.5/pflogsumm.pl pflogsumm-1.1.5/pflogsumm.pl
index 36384dd..eb527d0 100755
--- pflogsumm-1.1.5/pflogsumm.pl
+++ pflogsumm-1.1.5/pflogsumm.pl
@@ -1536,7 +1536,7 @@ sub gimme_domain {
# split domain/ipaddr into separates
# newer versions of Postfix have them "dom.ain[i.p.add.ress]"
# older versions of Postfix have them "dom.ain/i.p.add.ress"
- unless((($domain, $ipAddr) = /^([^\[]+)\[((?:\d{1,3}\.){3}\d{1,3})\]/) == 2 ||
+ unless((($domain, $ipAddr) = /^([^\[]+)\[((?:\d{1,3}\.){3}\d{1,3}|[0-9a-f:]+)\]/) == 2 ||
(($domain, $ipAddr) = /^([^\/]+)\/([0-9a-f.:]+)/i) == 2) {
# more exhaustive method
($domain, $ipAddr) = /^([^\[\(\/]+)[\[\(\/]([^\]\)]+)[\]\)]?:?\s*$/;

View file

@ -1,7 +1,7 @@
diff --git a/pflogsumm b/pflogsumm
index cb3b8a9..35309f0 100755
--- a/pflogsumm
+++ b/pflogsumm
diff --git a/pflogsumm-1.1.5/pflogsumm.pl b/pflogsumm-1.1.5/pflogsumm.pl
index eb527d0..7e26206 100755
--- a/pflogsumm-1.1.5/pflogsumm.pl
+++ b/pflogsumm-1.1.5/pflogsumm.pl
@@ -503,7 +503,12 @@ $usageMsg =
# Accept either "_"s or "-"s in --switches
foreach (@ARGV) {

View file

@ -1,8 +1,8 @@
diff --git a/conf/post-install b/conf/post-install
index ed7c79a..c647f81 100644
index 25ef7e6..4fd6434 100644
--- a/conf/post-install
+++ b/conf/post-install
@@ -541,6 +541,18 @@ test -n "$create" && {
@@ -537,6 +537,17 @@ test -n "$create" && {
case $path in
no|no/*) continue;;
esac
@ -15,7 +15,6 @@ index ed7c79a..c647f81 100644
+ /usr/share/man/man1/mailq.1.gz) path=/usr/share/man/man1/mailq.postfix.1.gz ;;
+ /usr/share/man/man1/newaliases.1.gz) path=/usr/share/man/man1/newaliases.postfix.1.gz ;;
+ /usr/share/man/man5/aliases.5.gz) path=/usr/share/man/man5/aliases.postfix.5.gz ;;
+ /usr/share/man/man8/smtp.8.gz) path=/usr/share/man/man8/smtp.postfix.8.gz ;;
+ /usr/share/man/man8/smtpd.8.gz) path=/usr/share/man/man8/smtpd.postfix.8.gz ;;
+ esac
# Pick up the flags.

View file

@ -1,8 +1,8 @@
diff --git a/conf/postfix-files b/conf/postfix-files
index 5a93982..b843fec 100644
index 4ed9d1f..19711d2 100644
--- a/conf/postfix-files
+++ b/conf/postfix-files
@@ -84,7 +84,6 @@ $shlib_directory/${LIB_PREFIX}sqlite${LIB_SUFFIX}:f:root:-:755
@@ -83,7 +83,6 @@ $shlib_directory/${LIB_PREFIX}sqlite${LIB_SUFFIX}:f:root:-:755
$meta_directory/dynamicmaps.cf.d:d:root:-:755
$meta_directory/dynamicmaps.cf:f:root:-:644
$meta_directory/main.cf.proto:f:root:-:644
@ -10,7 +10,7 @@ index 5a93982..b843fec 100644
$meta_directory/master.cf.proto:f:root:-:644
$meta_directory/postfix-files.d:d:root:-:755
$meta_directory/postfix-files:f:root:-:644
@@ -142,18 +141,13 @@ $command_directory/postqueue:f:root:$setgid_group:2755:u
@@ -141,18 +140,13 @@ $command_directory/postqueue:f:root:$setgid_group:2755:u
$sendmail_path:f:root:-:755
$newaliases_path:l:$sendmail_path
$mailq_path:l:$sendmail_path
@ -29,7 +29,7 @@ index 5a93982..b843fec 100644
$config_directory/main.cf:f:root:-:644:p
$config_directory/master.cf:f:root:-:644:p
$config_directory/pcre_table:f:root:-:644:o
@@ -166,8 +160,8 @@ $config_directory/postfix-script:f:root:-:755:o
@@ -165,8 +159,8 @@ $config_directory/postfix-script:f:root:-:755:o
$config_directory/postfix-script-sgid:f:root:-:755:o
$config_directory/postfix-script-nosgid:f:root:-:755:o
$config_directory/post-install:f:root:-:755:o
@ -40,7 +40,7 @@ index 5a93982..b843fec 100644
$manpage_directory/man1/postalias.1:f:root:-:644
$manpage_directory/man1/postcat.1:f:root:-:644
$manpage_directory/man1/postconf.1:f:root:-:644
@@ -181,9 +175,9 @@ $manpage_directory/man1/postmap.1:f:root:-:644
@@ -180,9 +174,9 @@ $manpage_directory/man1/postmap.1:f:root:-:644
$manpage_directory/man1/postmulti.1:f:root:-:644
$manpage_directory/man1/postqueue.1:f:root:-:644
$manpage_directory/man1/postsuper.1:f:root:-:644
@ -52,13 +52,11 @@ index 5a93982..b843fec 100644
$manpage_directory/man5/body_checks.5:f:root:-:644
$manpage_directory/man5/bounce.5:f:root:-:644
$manpage_directory/man5/canonical.5:f:root:-:644
@@ -231,8 +225,8 @@ $manpage_directory/man8/qmgr.8:f:root:-:644
$manpage_directory/man8/qmqpd.8:f:root:-:644
@@ -230,7 +224,7 @@ $manpage_directory/man8/qmqpd.8:f:root:-:644
$manpage_directory/man8/scache.8:f:root:-:644
$manpage_directory/man8/showq.8:f:root:-:644
-$manpage_directory/man8/smtp.8:f:root:-:644
$manpage_directory/man8/smtp.8:f:root:-:644
-$manpage_directory/man8/smtpd.8:f:root:-:644
+$manpage_directory/man8/smtp.postfix.8:f:root:-:644
+$manpage_directory/man8/smtpd.postfix.8:f:root:-:644
$manpage_directory/man8/spawn.8:f:root:-:644
$manpage_directory/man8/tlsproxy.8:f:root:-:644

View file

@ -1,5 +1,5 @@
diff --git a/conf/main.cf b/conf/main.cf
index 3687c85..ae3af9e 100644
index 2ee7996..336bd7b 100644
--- a/conf/main.cf
+++ b/conf/main.cf
@@ -136,6 +136,10 @@ mail_owner = postfix
@ -40,13 +40,11 @@ index 3687c85..ae3af9e 100644
#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
# ADDRESS EXTENSIONS (e.g., user+foo)
@@ -487,8 +491,28 @@ unknown_local_recipient_reject_code = 550
# non-UNIX accounts with "User unknown in local recipient table".
@@ -488,7 +492,27 @@ unknown_local_recipient_reject_code = 550
#
# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
-# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
+# listen="/var/lib/imap/socket/lmtp" prefork=0'' in cyrus.conf.
+#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
+
+# If using the cyrus-imapd IMAP server deliver local mail to the IMAP
@ -81,13 +79,11 @@ index 3687c85..ae3af9e 100644
#fallback_transport =
# The luser_relay parameter specifies an optional destination address
@@ -682,6 +705,43 @@ sample_directory =
@@ -682,4 +705,41 @@ sample_directory =
# readme_directory: The location of the Postfix README files.
#
readme_directory =
-inet_protocols = ipv4
shlib_directory = /usr/lib/postfix/${mail_version}
meta_directory = /etc/postfix
+
+# TLS CONFIGURATION
+#
@ -127,10 +123,10 @@ index 3687c85..ae3af9e 100644
+#
+smtp_tls_security_level = may
diff --git a/conf/master.cf b/conf/master.cf
index 5abe06c..81ae929 100644
index fd282dd..8d969c6 100644
--- a/conf/master.cf
+++ b/conf/master.cf
@@ -116,14 +116,14 @@ postlog unix-dgram n - n - 1 postlogd
@@ -112,14 +112,14 @@ postlog unix-dgram n - n - 1 postlogd
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe

View file

@ -51,20 +51,15 @@ conf_check() {
}
make_aliasesdb() {
local MAP=""
local ALIASESDB="$(/usr/sbin/postconf -h alias_database)"
[ "$ALIASESDB" = "hash:/etc/aliases" ] && MAP="db"
[ "$ALIASESDB" = "lmdb:/etc/aliases" ] && MAP="lmdb"
if [ "$MAP" = "db" -o "$MAP" = "lmdb" ]
if [ "$(/usr/sbin/postconf -h alias_database)" == "hash:/etc/aliases" ]
then
# /etc/aliases.db|lmdb may be used by other MTA, make sure nothing
# /etc/aliases.db may be used by other MTA, make sure nothing
# has touched it since our last newaliases call
[ /etc/aliases -nt /etc/aliases.$MAP ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.$MAP ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.$MAP ] || return
[ /etc/aliases -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.db ] || return
/usr/bin/newaliases
touch -r /etc/aliases.$MAP "$ALIASESDB_STAMP"
touch -r /etc/aliases.db "$ALIASESDB_STAMP"
else
/usr/bin/newaliases
fi

View file

@ -3,20 +3,15 @@
ALIASESDB_STAMP=/var/lib/misc/postfix.aliasesdb-stamp
make_aliasesdb() {
local MAP=""
local ALIASESDB="$(/usr/sbin/postconf -h alias_database)"
[ "$ALIASESDB" = "hash:/etc/aliases" ] && MAP="db"
[ "$ALIASESDB" = "lmdb:/etc/aliases" ] && MAP="lmdb"
if [ "$MAP" = "db" -o "$MAP" = "lmdb" ]
if [ "$(/usr/sbin/postconf -h alias_database)" == "hash:/etc/aliases" ]
then
# /etc/aliases.db|lmdb may be used by other MTA, make sure nothing
# /etc/aliases.db may be used by other MTA, make sure nothing
# has touched it since our last newaliases call
[ /etc/aliases -nt /etc/aliases.$MAP ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.$MAP ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.$MAP ] || return 0
[ /etc/aliases -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -nt /etc/aliases.db ] ||
[ "$ALIASESDB_STAMP" -ot /etc/aliases.db ] || return 0
/usr/bin/newaliases
touch -r /etc/aliases.$MAP "$ALIASESDB_STAMP"
touch -r /etc/aliases.db "$ALIASESDB_STAMP"
else
/usr/bin/newaliases
fi

View file

@ -1,11 +1,6 @@
# plugins have unresolvable symbols in compile time
%undefine _strict_symbol_defs_build
%if 0%{?rhel} < 10
%bcond_without db
%else
%bcond_with db
%endif
%bcond_without mysql
%bcond_without pgsql
%bcond_without sqlite
@ -18,12 +13,6 @@
%bcond_without ipv6
%bcond_without pflogsumm
%if %{without db} && %{with lmdb}
%global defmap_lmdb 1
%else
%global defmap_lmdb 0
%endif
%global sysv2systemdnvr 2.8.12-2
# hardened build if not overrided
@ -32,9 +21,12 @@
# Postfix requires one exlusive uid/gid and a 2nd exclusive gid for its own
# use. Let me know if the second gid collides with another package.
# Be careful: Redhat's 'mail' user & group isn't unique!
# It's now handled by systemd-sysusers.
%define postfix_uid 89
%define postfix_user postfix
%define postfix_gid 89
%define postfix_group postfix
%define maildrop_group postdrop
%define maildrop_gid 90
%define postfix_config_dir %{_sysconfdir}/postfix
%define postfix_daemon_dir %{_libexecdir}/postfix
@ -56,14 +48,16 @@
Name: postfix
Summary: Postfix Mail Transport Agent
Version: 3.10.7
Version: 3.8.4
Release: 1%{?dist}
Epoch: 2
URL: http://www.postfix.org
License: (IPL-1.0 OR EPL-2.0) AND GPL-2.0-or-later AND BSD-4-Clause-UC
License: (IBM and GPLv2+) or (EPL-2.0 and GPLv2+)
Requires(post): systemd systemd-sysv hostname
Requires(post): %{_sbindir}/alternatives
Requires(post): %{_bindir}/openssl
Requires(pre): %{_sbindir}/groupadd
Requires(pre): %{_sbindir}/useradd
Requires(preun): %{_sbindir}/alternatives
Requires(preun): systemd
Requires(postun): systemd
@ -74,17 +68,16 @@ Requires: findutils
Requires: policycoreutils
Provides: MTA smtpd smtpdaemon server(smtp)
Source0: http://ftp.porcupine.org/mirrors/postfix-release/official/%{name}-%{version}.tar.gz
Source0: ftp://ftp.porcupine.org/mirrors/postfix-release/official/%{name}-%{version}.tar.gz
Source1: postfix-etc-init.d-postfix
Source2: postfix.service
Source3: README-Postfix-SASL-RedHat.txt
Source4: postfix.aliasesdb
Source5: postfix-chroot-update
Source6: postfix.sysusers
# Sources 50-99 are upstream [patch] contributions
%define pflogsumm_ver 1.1.6
%define pflogsumm_ver 1.1.5
# Postfix Log Entry Summarizer: http://jimsun.linxnet.com/postfix_contrib.html
Source53: http://jimsun.linxnet.com/downloads/pflogsumm-%{pflogsumm_ver}.tar.gz
@ -96,14 +89,17 @@ Source101: postfix-pam.conf
# Patches
Patch1: postfix-3.10.5-config.patch
Patch2: postfix-3.9.0-files.patch
Patch3: postfix-3.9.0-alternatives.patch
Patch1: postfix-3.8.0-config.patch
Patch2: postfix-3.4.0-files.patch
Patch3: postfix-3.3.3-alternatives.patch
# probably rhbz#428996
Patch4: postfix-3.8.0-large-fs.patch
# rhbz#1931403, sent upstream
Patch9: pflogsumm-1.1.6-syslog-name-underscore-fix.patch
Patch9: pflogsumm-1.1.5-datecalc.patch
# rhbz#1384871, sent upstream
Patch10: pflogsumm-1.1.5-ipv6-warnings-fix.patch
Patch11: postfix-3.4.4-chroot-example-fix.patch
# rhbz#1931403, sent upstream
Patch13: pflogsumm-1.1.5-syslog-name-underscore-fix.patch
# Optional patches - set the appropriate environment variables to include
# them when building the package/spec file
@ -111,21 +107,13 @@ Patch11: postfix-3.4.4-chroot-example-fix.patch
# Determine the different packages required for building postfix
BuildRequires: make
BuildRequires: perl-generators
BuildRequires: pkgconfig
BuildRequires: zlib-devel
BuildRequires: systemd-units
BuildRequires: libicu-devel
BuildRequires: gcc
BuildRequires: m4
BuildRequires: findutils
BuildRequires: systemd-rpm-macros
BuildRequires: sed
BuildRequires: libdb-devel, perl-generators, pkgconfig, zlib-devel
BuildRequires: systemd-units, libicu-devel
BuildRequires: gcc, m4, findutils
%if 0%{?rhel} < 9
BuildRequires: libnsl2-devel
%endif
%{?with_db:BuildRequires: libdb-devel}
%{?with_ldap:BuildRequires: openldap-devel}
%{?with_lmdb:BuildRequires: lmdb-devel}
%{?with_sasl:BuildRequires: cyrus-sasl-devel}
@ -136,18 +124,6 @@ BuildRequires: libnsl2-devel
%{?with_cdb:BuildRequires: tinycdb-devel}
%{?with_tls:BuildRequires: openssl-devel}
%if 0%{?defmap_lmdb}
Requires: %{name}-lmdb%{?_isa} = %{epoch}:%{version}-%{release}
%endif
%if "%{_sbindir}" == "%{_bindir}"
# Compat symlinks for Requires in other packages.
# We rely on filesystem to create the symlinks for us.
Requires: filesystem(unmerged-sbin-symlinks)
Provides: /usr/sbin/sendmail
Provides: /usr/sbin/smtp-sink
%endif
%description
Postfix is a Mail Transport Agent (MTA).
@ -256,10 +232,10 @@ maps with Postfix, you need this.
%prep
%setup -q
# Apply obligatory patches
%patch -P1 -p1 -b .config
%patch -P2 -p1 -b .files
%patch -P3 -p1 -b .alternatives
%patch -P4 -p1 -b .large-fs
%patch1 -p1 -b .config
%patch2 -p1 -b .files
%patch3 -p1 -b .alternatives
%patch4 -p1 -b .large-fs
# Change DEF_SHLIB_DIR according to build host
sed -i \
@ -269,10 +245,12 @@ src/global/mail_params.h
%if %{with pflogsumm}
gzip -dc %{SOURCE53} | tar xf -
pushd pflogsumm-%{pflogsumm_ver}
%patch -P9 -p1 -b .pflogsumm-1.1.6-syslog-name-underscore-fix
%patch9 -p1 -b .datecalc
%patch10 -p1 -b .ipv6-warnings-fix
popd
%endif
%patch -P11 -p1 -b .chroot-example-fix
%patch11 -p1 -b .chroot-example-fix
%patch13 -p1 -b .pflogsumm-1.1.5-syslog-name-underscore-fix
# Backport 3.8-20221006 fix for uname -r detection
sed -i makedefs -e '\@Linux\.@s|345|3456|'
@ -283,28 +261,16 @@ for f in README_FILES/TLS_{LEGACY_,}README TLS_ACKNOWLEDGEMENTS; do
touch -r ${f}{,_} && mv -f ${f}{_,}
done
# fix default maps
%if 0%{?defmap_lmdb}
sed -i '/^\s*alias_maps\s*=\s*hash:\/etc\/aliases/ s|hash:|lmdb:|g' conf/main.cf
sed -i '/^\s*alias_database\s*=\s*hash:\/etc\/aliases/ s|hash:|lmdb:|g' conf/main.cf
echo >> conf/main.cf
echo "default_database_type = lmdb" >> conf/main.cf
%endif
%build
%set_build_flags
unset AUXLIBS AUXLIBS_LDAP AUXLIBS_LMDB AUXLIBS_PCRE AUXLIBS_MYSQL AUXLIBS_PGSQL AUXLIBS_SQLITE AUXLIBS_CDB
CCARGS="-fPIC -fcommon -std=gnu17"
CCARGS="-fPIC -fcommon"
%if 0%{?rhel} >= 9
AUXLIBS=""
%else
AUXLIBS="-lnsl"
%endif
%if %{without db}
CCARGS="${CCARGS} -DNO_DB"
%endif
%ifarch s390 s390x ppc
CCARGS="${CCARGS} -fsigned-char"
%endif
@ -382,7 +348,7 @@ make -f Makefile.init makefiles shared=yes dynamicmaps=yes \
# install postfix into $RPM_BUILD_ROOT
# Move stuff around so we don't conflict with sendmail
for i in man1/mailq.1 man1/newaliases.1 man1/sendmail.1 man5/aliases.5 man8/smtp{,d}.8; do
for i in man1/mailq.1 man1/newaliases.1 man1/sendmail.1 man5/aliases.5 man8/smtpd.8; do
dest=$(echo $i | sed 's|\.[1-9]$|.postfix\0|')
mv man/$i man/$dest
sed -i "s|^\.so $i|\.so $dest|" man/man?/*.[1-9]
@ -418,9 +384,6 @@ install -m 644 %{SOURCE2} %{buildroot}%{_unitdir}
install -m 755 %{SOURCE4} %{buildroot}%{postfix_daemon_dir}/aliasesdb
install -m 755 %{SOURCE5} %{buildroot}%{postfix_daemon_dir}/chroot-update
# systemd-sysusers
install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/postfix.conf
install -c auxiliary/rmail/rmail $RPM_BUILD_ROOT%{_bindir}/rmail.postfix
for i in active bounce corrupt defer deferred flush incoming private saved maildrop public pid saved trace; do
@ -466,7 +429,7 @@ find $RPM_BUILD_ROOT%{postfix_doc_dir} -type d | xargs chmod 755
%if %{with pflogsumm}
install -c -m 644 pflogsumm-%{pflogsumm_ver}/pflogsumm-faq.txt $RPM_BUILD_ROOT%{postfix_doc_dir}/pflogsumm-faq.txt
install -c -m 644 pflogsumm-%{pflogsumm_ver}/pflogsumm.1 $RPM_BUILD_ROOT%{_mandir}/man1/pflogsumm.1
install -c pflogsumm-%{pflogsumm_ver}/pflogsumm $RPM_BUILD_ROOT%{postfix_command_dir}/pflogsumm
install -c pflogsumm-%{pflogsumm_ver}/pflogsumm.pl $RPM_BUILD_ROOT%{postfix_command_dir}/pflogsumm
%endif
# install qshape
@ -479,7 +442,9 @@ rm -f $RPM_BUILD_ROOT%{postfix_config_dir}/aliases
# create /usr/lib/sendmail
mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib
ln -sf --relative $RPM_BUILD_ROOT%{_sbindir}/sendmail.postfix $RPM_BUILD_ROOT%{_prefix}/lib/
pushd $RPM_BUILD_ROOT%{_prefix}/lib
ln -sf ../sbin/sendmail.postfix .
popd
mkdir -p $RPM_BUILD_ROOT%{_var}/lib/misc
touch $RPM_BUILD_ROOT%{_var}/lib/misc/postfix.aliasesdb-stamp
@ -487,7 +452,7 @@ touch $RPM_BUILD_ROOT%{_var}/lib/misc/postfix.aliasesdb-stamp
# prepare alternatives ghosts
for i in %{postfix_command_dir}/sendmail %{_bindir}/{mailq,newaliases,rmail} \
%{_sysconfdir}/pam.d/smtp %{_prefix}/lib/sendmail \
%{_mandir}/{man1/{mailq.1,newaliases.1},man5/aliases.5,man8/{sendmail.8,smtp{,d}.8}}
%{_mandir}/{man1/{mailq.1,newaliases.1},man5/aliases.5,man8/{sendmail.8,smtpd.8}}
do
touch $RPM_BUILD_ROOT$i
done
@ -528,27 +493,21 @@ popd
readme_directory=%{postfix_readme_dir} &> /dev/null
ALTERNATIVES_DOCS=""
[ "%%{_excludedocs}" = 1 ] || ALTERNATIVES_DOCS='--follower %{_mandir}/man1/mailq.1.gz mta-mailqman %{_mandir}/man1/mailq.postfix.1.gz
--follower %{_mandir}/man1/newaliases.1.gz mta-newaliasesman %{_mandir}/man1/newaliases.postfix.1.gz
--follower %{_mandir}/man8/sendmail.8.gz mta-sendmailman %{_mandir}/man1/sendmail.postfix.1.gz
--follower %{_mandir}/man5/aliases.5.gz mta-aliasesman %{_mandir}/man5/aliases.postfix.5.gz
--follower %{_mandir}/man8/smtp.8.gz mta-smtpman %{_mandir}/man8/smtp.postfix.8.gz
--follower %{_mandir}/man8/smtpd.8.gz mta-smtpdman %{_mandir}/man8/smtpd.postfix.8.gz'
[ "%%{_excludedocs}" = 1 ] || ALTERNATIVES_DOCS='--slave %{_mandir}/man1/mailq.1.gz mta-mailqman %{_mandir}/man1/mailq.postfix.1.gz
--slave %{_mandir}/man1/newaliases.1.gz mta-newaliasesman %{_mandir}/man1/newaliases.postfix.1.gz
--slave %{_mandir}/man8/sendmail.8.gz mta-sendmailman %{_mandir}/man1/sendmail.postfix.1.gz
--slave %{_mandir}/man5/aliases.5.gz mta-aliasesman %{_mandir}/man5/aliases.postfix.5.gz
--slave %{_mandir}/man8/smtpd.8.gz mta-smtpdman %{_mandir}/man8/smtpd.postfix.8.gz'
alternatives --install %{postfix_command_dir}/sendmail mta %{postfix_command_dir}/sendmail.postfix 60 \
--follower %{_bindir}/mailq mta-mailq %{_bindir}/mailq.postfix \
--follower %{_bindir}/newaliases mta-newaliases %{_bindir}/newaliases.postfix \
--follower %{_sysconfdir}/pam.d/smtp mta-pam %{_sysconfdir}/pam.d/smtp.postfix \
--follower %{_bindir}/rmail mta-rmail %{_bindir}/rmail.postfix \
--follower %{_prefix}/lib/sendmail mta-sendmail %{_prefix}/lib/sendmail.postfix \
%{_sbindir}/alternatives --install %{postfix_command_dir}/sendmail mta %{postfix_command_dir}/sendmail.postfix 60 \
--slave %{_bindir}/mailq mta-mailq %{_bindir}/mailq.postfix \
--slave %{_bindir}/newaliases mta-newaliases %{_bindir}/newaliases.postfix \
--slave %{_sysconfdir}/pam.d/smtp mta-pam %{_sysconfdir}/pam.d/smtp.postfix \
--slave %{_bindir}/rmail mta-rmail %{_bindir}/rmail.postfix \
--slave %{_prefix}/lib/sendmail mta-sendmail %{_prefix}/lib/sendmail.postfix \
$ALTERNATIVES_DOCS \
--initscript postfix
# Make sure that /usr/sbin/sendmail is not missing, if /usr/sbin is a
# directory. The symlink will only be created if there is no symlink
# or file already.
test -h /usr/sbin || ln -s ../bin/sendmail /usr/sbin/sendmail 2>/dev/null || :
%if %{with sasl}
# Move sasl config to new location
if [ -f %{_libdir}/sasl2/smtpd.conf ]; then
@ -580,12 +539,15 @@ exit 0
%pre
# Add user and groups if necessary
%sysusers_create_compat %{SOURCE6}
%{_sbindir}/groupadd -g %{maildrop_gid} -r %{maildrop_group} 2>/dev/null
%{_sbindir}/groupadd -g %{postfix_gid} -r %{postfix_group} 2>/dev/null
%{_sbindir}/groupadd -g 12 -r mail 2>/dev/null
%{_sbindir}/useradd -d %{postfix_queue_dir} -s /sbin/nologin -g %{postfix_group} -G mail -M -r -u %{postfix_uid} %{postfix_user} 2>/dev/null
# hack, to turn man8/smtp.8.gz into alternatives symlink (part of the rhbz#2274402 fix)
# this could be probably dropped in f44+
if [ -e %{_mandir}/man8/smtp.8.gz ]; then
[ -h %{_mandir}/man8/smtp.8.gz ] || rm -f %{_mandir}/man8/smtp.8.gz
# hack, to turn man8/smtpd.8.gz into alternatives symlink (part of the rhbz#1051180 fix)
# this could be probably dropped in f23+
if [ -e %{_mandir}/man8/smtpd.8.gz ]; then
[ -h %{_mandir}/man8/smtpd.8.gz ] || rm -f %{_mandir}/man8/smtpd.8.gz
fi
exit 0
@ -594,7 +556,7 @@ exit 0
%systemd_preun %{name}.service
if [ "$1" = 0 ]; then
alternatives --remove mta %{postfix_command_dir}/sendmail.postfix
%{_sbindir}/alternatives --remove mta %{postfix_command_dir}/sendmail.postfix
fi
exit 0
@ -697,7 +659,7 @@ fi
%attr(0644, root, root) %{_mandir}/man5/*.postfix.5*
%attr(0644, root, root) %{_mandir}/man8/[a-qt-v]*.8*
%attr(0644, root, root) %{_mandir}/man8/s[ch-lnp]*.8*
%attr(0644, root, root) %{_mandir}/man8/smtp.postfix.8*
%attr(0644, root, root) %{_mandir}/man8/smtp.8*
%attr(0644, root, root) %{_mandir}/man8/smtpd.postfix.8*
%attr(0755, root, root) %{postfix_command_dir}/smtp-sink
@ -711,7 +673,7 @@ fi
%attr(0755, root, root) %{postfix_command_dir}/postfix
%attr(0755, root, root) %{postfix_command_dir}/postkick
%attr(0755, root, root) %{postfix_command_dir}/postlock
%attr(2755, root, %{maildrop_group}) %{postfix_command_dir}/postlog
%attr(0755, root, root) %{postfix_command_dir}/postlog
%attr(0755, root, root) %{postfix_command_dir}/postmap
%attr(0755, root, root) %{postfix_command_dir}/postmulti
%attr(2755, root, %{maildrop_group}) %{postfix_command_dir}/postqueue
@ -754,7 +716,6 @@ fi
%ghost %{_mandir}/man1/newaliases.1.gz
%ghost %{_mandir}/man5/aliases.5.gz
%ghost %{_mandir}/man8/sendmail.8.gz
%ghost %{_mandir}/man8/smtp.8.gz
%ghost %{_mandir}/man8/smtpd.8.gz
%ghost %attr(0755, root, root) %{_bindir}/mailq
@ -765,9 +726,6 @@ fi
%ghost %attr(0644, root, root) %{_var}/lib/misc/postfix.aliasesdb-stamp
# systemd-sysusers
%{_sysusersdir}/postfix.conf
%if 0%{?fedora} < 23 && 0%{?rhel} < 9
%files sysvinit
%{_initrddir}/postfix
@ -846,133 +804,14 @@ fi
%endif
%changelog
* Fri Jan 02 2026 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.7-1
- New version
Resolves: rhbz#2417154
* Thu Oct 30 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.5-1
- New version
Resolves: rhbz#2406450
- Changed protocol for downloading sources from FTP to HTTP (HTTPS isn't supported)
* Mon Aug 25 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.4-1
- New version
Resolves: rhbz#2389310
* Wed Aug 06 2025 František Zatloukal <fzatlouk@redhat.com> - 2:3.10.3-3
- Rebuilt for icu 77.1
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.10.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Thu Jul 10 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.3-1
- New version
Resolves: rhbz#2379297
- Updated cyrus-imapd comment in config to point to the correct location
Related: RHEL-63089
* Thu Jun 5 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.2-3
- Updated pflogsumm to 1.1.6
Resolves: rhbz#2368396
* Thu May 08 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:3.10.2-2
- Make sure the /usr/sbin/sendmail symlink is created on unmerged systems
Resolves: rhbz#2360491
* Thu Apr 24 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.2-1
- New version
Resolves: rhbz#2361704
* Thu Mar 6 2025 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.10.1-1
- New version
Resolves: rhbz#2346039
* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.9.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:3.9.1-3
- Rebuilt for the bin-sbin merge (2nd attempt)
* Sun Dec 08 2024 Pete Walter <pwalter@fedoraproject.org> - 2:3.9.1-2
- Rebuild for ICU 76
* Thu Dec 5 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.1-1
- New version
Resolves: rhbz#2330454
* Thu Jul 25 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-8
- Fixed postlog RPM verification
* Thu Jul 25 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-7
- Explicitly set default_database_type if lmdb map is used
* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.9.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:3.9.0-5
- Rebuilt for the bin-sbin merge
* Fri Apr 12 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-4
- Fixed closing quote in alternatives
Related: rhbz#2274402
* Thu Apr 11 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-3
- Fixed typo in alternatives
Related: rhbz#2274402
* Thu Apr 11 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-2
- Added man8/smtp.8.gz to alternatives
Resolves: rhbz#2274402
* Thu Mar 7 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.9.0-1
- New version
Resolves: rhbz#2268245
* Tue Mar 5 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.6-1
- New version
Resolves: rhbz#2267836
* Tue Feb 27 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.5-4
- Dropped mail group configuration / creation, it is provided by setup
Resolves: rhbz#2244744
* Thu Feb 01 2024 Pete Walter <pwalter@fedoraproject.org> - 2:3.8.5-3
- Rebuild for ICU 74
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.8.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Jan 22 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.5-1
- New version
Resolves: rhbz#2259469
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.8.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Jan 2 2024 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.4-1
- New version
Resolves: rhbz#2255641
- Fixed SMTP smuggling vulnerability
Resolves: CVE-2023-51764
* Tue Dec 12 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.3-2
- Converted license tag to SPDX
* Thu Nov 2 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.3-1
- New version
Resolves: rhbz#2247553
* Mon Oct 9 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.2-2
- Drop libdb for RHEL>9
Related: rhbz#1788480
* Tue Sep 5 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.2-1
- New version
Resolves: rhbz#2236828
* Mon Aug 14 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.1-5
- Use systemd-sysusers, original patch by
Jonathan Wright <jonathan@almalinux.org>
* Thu Nov 9 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.8.1-5
- Rebuilt for new openssl
* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:3.8.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

View file

@ -1,3 +0,0 @@
u postfix 89 - /var/spool/postfix /sbin/nologin
g postdrop 90
m postfix mail

View file

@ -1,2 +1,2 @@
SHA512 (pflogsumm-1.1.6.tar.gz) = 4581d2120bc17cfb322fda8d293989a2754eb9fa2696e3a1cea9032e85ed6a566e75aea1f628a6c7bbc7b9d6bf47ffeb873f95d71d7cb7f0ee46e27e492cf630
SHA512 (postfix-3.10.7.tar.gz) = 28d7c05bfd6fb15f906c67cca989c4b47640ec631b640943deb66d91e44a6684deb79af95f0d4ba4dd362d9ba59179e5ed268942384e5e35ba472c91cf366e4c
SHA512 (postfix-3.8.4.tar.gz) = 5bae3d62e104714aead1fff28a595bab4315227382f53c8dae2a231f4240e31abda19c1e3befc1db4c89bc5d66c9a43830390365aadabdac5cf36b493c5c48c7
SHA512 (pflogsumm-1.1.5.tar.gz) = 994d660692dfea38a1dd9866d15f15035657e85131c1f5a2cd82baa5bd4ad987a00939cb5233f316d2090014c52ae68ef20db0c893f8634969484e0e74678f4d