Skip to content

Commit 2656ab0

Browse files
thestingerthestinger
committed
postfix: use chroot for all services
1 parent 7345e3a commit 2656ab0

2 files changed

Lines changed: 42 additions & 37 deletions

File tree

‎postfix/master.cf‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@
99
# service type private unpriv chroot wakeup maxproc command + args
1010
# (yes) (yes) (no) (never) (100)
1111
# ==========================================================================
12-
smtp inet n - n - - smtpd
13-
#smtp inet n - n - 1 postscreen
14-
#smtpd pass - - n - - smtpd
15-
#dnsblog unix - - n - 0 dnsblog
16-
#tlsproxy unix - - n - 0 tlsproxy
12+
smtp inet n - y - - smtpd
13+
#smtp inet n - y - 1 postscreen
14+
#smtpd pass - - y - - smtpd
15+
#dnsblog unix - - y - 0 dnsblog
16+
#tlsproxy unix - - y - 0 tlsproxy
1717
# Choose one: enable submission for loopback clients only, or for any client.
18-
#127.0.0.1:submission inet n - n - - smtpd
19-
#submission inet n - n - - smtpd
18+
#127.0.0.1:submission inet n - y - - smtpd
19+
#submission inet n - y - - smtpd
2020
# -o syslog_name=postfix/submission
2121
# -o smtpd_forbid_unauth_pipelining=no
2222
# -o smtpd_tls_security_level=encrypt
@@ -38,7 +38,7 @@ smtp inet n - n - - smtpd
3838
# -o cleanup_service_name=subcleanup
3939
# Choose one: enable submissions for loopback clients only, or for any client.
4040
#127.0.0.1:submissions inet n - n - - smtpd
41-
submissions inet n - n - - smtpd
41+
submissions inet n - y - - smtpd
4242
-o syslog_name=postfix/submissions
4343
-o smtpd_forbid_unauth_pipelining=no
4444
-o smtpd_tls_wrappermode=yes
@@ -57,36 +57,36 @@ submissions inet n - n - - smtpd
5757
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
5858
-o milter_macro_daemon_name=ORIGINATING
5959
-o cleanup_service_name=subcleanup
60-
#628 inet n - n - - qmqpd
61-
pickup unix n - n 60 1 pickup
62-
cleanup unix n - n - 0 cleanup
63-
subcleanup unix n - - - 0 cleanup
60+
#628 inet n - y - - qmqpd
61+
pickup unix n - y 60 1 pickup
62+
cleanup unix n - y - 0 cleanup
63+
subcleanup unix n - y - 0 cleanup
6464
-o header_checks=pcre:/etc/postfix/submission_header_checks
65-
qmgr unix n - n 300 1 qmgr
66-
#qmgr unix n - n 300 1 oqmgr
67-
tlsmgr unix - - n 1000? 1 tlsmgr
68-
rewrite unix - - n - - trivial-rewrite
69-
bounce unix - - n - 0 bounce
70-
defer unix - - n - 0 bounce
71-
trace unix - - n - 0 bounce
72-
verify unix - - n - 1 verify
73-
flush unix n - n 1000? 0 flush
74-
#proxymap unix - - n - - proxymap
75-
#proxywrite unix - - n - 1 proxymap
76-
smtp unix - - n - - smtp
77-
relay unix - - n - - smtp
65+
qmgr unix n - y 300 1 qmgr
66+
#qmgr unix n - y 300 1 oqmgr
67+
tlsmgr unix - - y 1000? 1 tlsmgr
68+
rewrite unix - - y - - trivial-rewrite
69+
bounce unix - - y - 0 bounce
70+
defer unix - - y - 0 bounce
71+
trace unix - - y - 0 bounce
72+
verify unix - - y - 1 verify
73+
flush unix n - y 1000? 0 flush
74+
#proxymap unix - - y - - proxymap
75+
#proxywrite unix - - y - 1 proxymap
76+
smtp unix - - y - - smtp
77+
relay unix - - y - - smtp
7878
-o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
7979
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
80-
showq unix n - n - - showq
81-
error unix - - n - - error
82-
retry unix - - n - - error
83-
discard unix - - n - - discard
84-
#local unix - n n - - local
85-
#virtual unix - n n - - virtual
86-
lmtp unix - - n - - lmtp
87-
anvil unix - - n - 1 anvil
88-
scache unix - - n - 1 scache
89-
#postlog unix-dgram n - n - 1 postlogd
80+
showq unix n - y - - showq
81+
error unix - - y - - error
82+
retry unix - - y - - error
83+
discard unix - - y - - discard
84+
#local unix - n y - - local
85+
#virtual unix - n y - - virtual
86+
lmtp unix - - y - - lmtp
87+
anvil unix - - y - 1 anvil
88+
scache unix - - y - 1 scache
89+
#postlog unix-dgram n - y - 1 postlogd
9090
#
9191
# ====================================================================
9292
# Interfaces to non-Postfix software. Be sure to examine the manual

‎systemd/system/postfix.service.d/override.conf‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[Service]
22
CapabilityBoundingSet=
3-
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
3+
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_SYS_CHROOT
44
LockPersonality=yes
55
MemoryDenyWriteExecute=yes
66
NoNewPrivileges=yes
@@ -25,5 +25,10 @@ RestrictNamespaces=yes
2525
RestrictRealtime=yes
2626
RestrictSUIDSGID=yes
2727
SystemCallArchitectures=native
28-
SystemCallFilter=@system-service
28+
SystemCallFilter=@system-service chroot
2929
SystemCallFilter=~@obsolete
30+
31+
# set up chroot in /var/spool/postfix
32+
TemporaryFileSystem=/var/spool/postfix/etc:ro
33+
BindReadOnlyPaths=/etc/resolv.conf:/var/spool/postfix/etc/resolv.conf
34+
BindReadOnlyPaths=/etc/services:/var/spool/postfix/etc/services

0 commit comments

Comments
 (0)