← Back to branch summary

~ubuntu-dev/ubuntu/lucid/dovecot/lucid-201002110912

« back to all changes in this revision

Viewing changes to src/plugins/acl/acl-storage.c

  • Committer: Bazaar Package Importer
  • Author(s): CHuck Short, Chuck Short
  • Date: 2009-11-06 00:47:29 UTC
  • mfrom: (4.1.9 squeeze)
  • Revision ID: james.westby@ubuntu.com-20091106004729-i39n7v9e7d4h51f6
Tags: 1:1.2.6-1ubuntu1
https://launchpad.net/bugs/164837
https://launchpad.net/bugs/329878
https://launchpad.net/bugs/254721
* Merge from debian testing, remaining changes:
  Add new binary pkg dovecot-postfix that integrates postfix and dovecot
  automatically: (LP: #164837)
  + debian/control:
    - add new binary with short description
    - set Architecture all for dovecot-postfix (LP: #329878)
  + debian/dovecot-postfix.postinst:
    - create initial certificate symlinks to snakeoil.
    - set up postfix with postconf to:
      - use Maildir/ as the default mailbox.
      - use dovecot as the sasl authentication server.
      - use dovecot LDA (deliver).
      - use tls for smtp{d} services.
    - fix certificates paths in postfix' main.cf
    - add reject_unauth_destination to postfix' recipient restrictions
    - add reject_unknown_sender_domain to postfix' sender restrictions
    - rename configuration name on remove, delete on purge
    - restart dovecot after linking certificates
    - handle use case when postfix is unconfigurated
   + debian/dovecot-postfix.dirs: create backup directory for postfix's configuration
   + restart postfix and dovecot.
   + debian/dovecot-postfix.postrm:
     - remove all dovecot related configuration from postfix.
     - restart postfix and dovecot.
   + debian/dovecot-common.init:
     - check if /etc/dovecot/dovecot-postfix.conf exists and use it
       as the configuration file if so.
   + debian/patches/warning-ubuntu-postfix.dpatch
     - add warning about dovecot-postfix.conf in dovecot default 
       configuration file
   + debian/patches/dovecot-postfix.conf.diff:
     - Ubuntu server custom changes to the default dovecot configuration for
       better interfation with postfix
     - enable sieve plugin
   + debian/patches/dovecot-postfix.conf.diff:
     + Ubuntu server custom changes to the default dovecot configuration for
       better integration with postfix:
       - enable imap, pop3, imaps, pop3s and managesieve by default.
       - enable dovecot LDA (deliver).
       - enable SASL auth socket in postfix private directory.
   + debian/rules:
     - copy, patch and install dovecot-postfix.conf in /etc/dovecot/.
     - build architecure independent packages too
   + Use Snakeoil SSL certificates by default.
     - debian/control: Depend on ssl-cert.
     - debian/patches/ssl-cert-snakeoil.dpatch: Change default SSL cert
       paths to snakeoil.
     - debian/dovecot-common.postinst: Relax grep for SSL_* a bit.
   + Add autopkgtest to debian/tests/*.
   + Fast TearDown: Update the lsb init header to not stop in level 6.
   + Add ufw integration:
     - Created debian/dovecot-common.ufw.profile.
     - debian/rules:
       + install profile
     - debian/control:
       + Suggest ufw
   + debian/{control,rules}: enable PIE hardening.
   + dovecot-imapd, dovecot-pop3: Replaces dovecot-common (<< 1:1.1). LP: #254721
   + debian/control:
     - Update Vcs-* headers.
   + debian/rules:
     - Create emtpy stamp.h.in files in dovecot-sieve/ and dovecot-managesieve/
       if they're not there since empty files are not included in the diff.gz 
       file.
   + Add SMTP-AUTH support for Outlook (login auth mechanism)
   + Dropped:
     - debian/patches/security-CVE-2009-3235: Applied upstream.
     - debian/patches/fix-pop3-assertion.dpatch: Applied upstream.
     - dovecot-sieve and dovecot-managesieve: Use the debian patches instead.

  [Chuck Short]
  - Updated dovecot-sieve to 0.1.13.
  - Updated dovecot-managesieve to 0.11.9.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/plugins/acl/acl-storage.c
6
6
#include "mail-namespace.h"
7
7
#include "mailbox-list-private.h"
8
8
#include "acl-api-private.h"
 
9
#include "acl-lookup-dict.h"
9
10
#include "acl-plugin.h"
10
11
 
 
12
#include <stdlib.h>
 
13
 
11
14
struct acl_storage_module acl_storage_module =
12
15
        MODULE_CONTEXT_INIT(&mail_storage_module_register);
 
16
struct acl_user_module acl_user_module =
 
17
        MODULE_CONTEXT_INIT(&mail_user_module_register);
13
18
 
14
19
static const char *acl_storage_right_names[ACL_STORAGE_RIGHT_COUNT] = {
15
20
        MAIL_ACL_LOOKUP,
18
23
        MAIL_ACL_WRITE_SEEN,
19
24
        MAIL_ACL_WRITE_DELETED,
20
25
        MAIL_ACL_INSERT,
 
26
        MAIL_ACL_POST,
21
27
        MAIL_ACL_EXPUNGE,
22
28
        MAIL_ACL_CREATE,
23
29
        MAIL_ACL_DELETE,
95
101
{
96
102
        struct acl_mail_storage *astorage = ACL_CONTEXT(storage);
97
103
        struct mailbox *box;
 
104
        enum acl_storage_rights save_right;
98
105
        bool can_see;
99
106
        int ret;
100
107
 
101
108
        /* mailbox can be opened either for reading or appending new messages */
102
 
        if ((flags & MAILBOX_OPEN_SAVEONLY) != 0) {
103
 
                ret = acl_storage_have_right(storage, name,
104
 
                                             ACL_STORAGE_RIGHT_INSERT,
105
 
                                             &can_see);
106
 
        } else {
 
109
        if ((flags & MAILBOX_OPEN_IGNORE_ACLS) != 0) {
 
110
                ret = 1;
 
111
        } else if ((flags & MAILBOX_OPEN_SAVEONLY) == 0) {
107
112
                ret = acl_storage_have_right(storage, name,
108
113
                                             ACL_STORAGE_RIGHT_READ,
109
114
                                             &can_see);
 
115
        } else {
 
116
                save_right = (flags & MAILBOX_OPEN_POST_SESSION) != 0 ?
 
117
                        ACL_STORAGE_RIGHT_POST : ACL_STORAGE_RIGHT_INSERT;
 
118
                ret = acl_storage_have_right(storage, name, save_right,
 
119
                                             &can_see);
110
120
        }
111
121
        if (ret <= 0) {
112
122
                if (ret < 0)
129
139
        return acl_mailbox_open_box(box);
130
140
}
131
141
 
 
142
static void acl_mailbox_copy_acls_from_parent(struct mail_storage *storage,
 
143
                                             const char *name)
 
144
{
 
145
        struct acl_mail_storage *astorage = ACL_CONTEXT(storage);
 
146
        struct acl_object *parent_aclobj, *child_aclobj;
 
147
        struct acl_object_list_iter *iter;
 
148
        struct acl_rights_update update;
 
149
 
 
150
        memset(&update, 0, sizeof(update));
 
151
        update.modify_mode = ACL_MODIFY_MODE_REPLACE;
 
152
        update.neg_modify_mode = ACL_MODIFY_MODE_REPLACE;
 
153
 
 
154
        child_aclobj = acl_object_init_from_name(astorage->rights.backend,
 
155
                                                 storage, name);
 
156
        parent_aclobj = acl_object_init_from_parent(astorage->rights.backend,
 
157
                                                    storage, name);
 
158
        iter = acl_object_list_init(parent_aclobj);
 
159
        while (acl_object_list_next(iter, &update.rights) > 0) {
 
160
                /* don't copy global ACL rights. */
 
161
                if (!update.rights.global)
 
162
                        (void)acl_object_update(child_aclobj, &update);
 
163
        }
 
164
        acl_object_list_deinit(&iter);
 
165
        acl_object_deinit(&parent_aclobj);
 
166
        acl_object_deinit(&child_aclobj);
 
167
}
 
168
 
132
169
static int acl_mailbox_create(struct mail_storage *storage, const char *name,
133
170
                              bool directory)
134
171
{
153
190
                return -1;
154
191
        }
155
192
 
156
 
        return astorage->module_ctx.super.
157
 
                mailbox_create(storage, name, directory);
 
193
        if (astorage->module_ctx.super.
 
194
                        mailbox_create(storage, name, directory) < 0)
 
195
                return -1;
 
196
 
 
197
        if (!directory)
 
198
                acl_mailbox_copy_acls_from_parent(storage, name);
 
199
        return 0;
158
200
}
159
201
 
160
202
void acl_mail_storage_created(struct mail_storage *storage)
162
204
        struct acl_mail_storage *astorage;
163
205
        struct acl_backend *backend;
164
206
 
165
 
        astorage = p_new(storage->pool, struct acl_mail_storage, 1);
166
 
        astorage->module_ctx.super = storage->v;
167
 
        storage->v.destroy = acl_storage_destroy;
168
 
        storage->v.mailbox_open = acl_mailbox_open;
169
 
        storage->v.mailbox_create = acl_mailbox_create;
170
 
 
171
 
        backend = acl_mailbox_list_get_backend(mail_storage_get_list(storage));
172
 
        acl_storage_rights_ctx_init(&astorage->rights, backend);
173
 
 
174
 
        MODULE_CONTEXT_SET(storage, acl_storage_module, astorage);
 
207
        if ((storage->ns->flags & NAMESPACE_FLAG_NOACL) != 0) {
 
208
                /* no ACL checks for internal namespaces (deliver) */
 
209
        } else {
 
210
                astorage = p_new(storage->pool, struct acl_mail_storage, 1);
 
211
                astorage->module_ctx.super = storage->v;
 
212
                storage->v.destroy = acl_storage_destroy;
 
213
                storage->v.mailbox_open = acl_mailbox_open;
 
214
                storage->v.mailbox_create = acl_mailbox_create;
 
215
 
 
216
                backend = acl_mailbox_list_get_backend(mail_storage_get_list(storage));
 
217
                acl_storage_rights_ctx_init(&astorage->rights, backend);
 
218
 
 
219
                MODULE_CONTEXT_SET(storage, acl_storage_module, astorage);
 
220
        }
175
221
 
176
222
        if (acl_next_hook_mail_storage_created != NULL)
177
223
                acl_next_hook_mail_storage_created(storage);
178
224
}
179
225
 
 
226
static void acl_user_deinit(struct mail_user *user)
 
227
{
 
228
        struct acl_user *auser = ACL_USER_CONTEXT(user);
 
229
 
 
230
        acl_lookup_dict_deinit(&auser->acl_lookup_dict);
 
231
        auser->module_ctx.super.deinit(user);
 
232
}
 
233
 
 
234
void acl_mail_user_created(struct mail_user *user)
 
235
{
 
236
        struct acl_user *auser;
 
237
        const char *env;
 
238
 
 
239
        auser = p_new(user->pool, struct acl_user, 1);
 
240
        auser->module_ctx.super = user->v;
 
241
        user->v.deinit = acl_user_deinit;
 
242
        auser->acl_lookup_dict = acl_lookup_dict_init(user);
 
243
 
 
244
        auser->acl_env = getenv("ACL");
 
245
        i_assert(auser->acl_env != NULL);
 
246
        auser->master_user = getenv("MASTER_USER");
 
247
 
 
248
        env = getenv("ACL_GROUPS");
 
249
        if (env != NULL) {
 
250
                auser->groups =
 
251
                        (const char *const *)p_strsplit(user->pool, env, ",");
 
252
        }
 
253
 
 
254
        MODULE_CONTEXT_SET(user, acl_user_module, auser);
 
255
 
 
256
        if (acl_next_hook_mail_user_created != NULL)
 
257
                acl_next_hook_mail_user_created(user);
 
258
}
 
259