Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.03] nixos/sympa: fix outgoing emails, update package version #84202

Merged
merged 3 commits into from Apr 4, 2020
Merged

[20.03] nixos/sympa: fix outgoing emails, update package version #84202

merged 3 commits into from Apr 4, 2020

Conversation

mmilata
Copy link
Member

@mmilata mmilata commented Apr 3, 2020

Backport of #83258. Should be low-risk backport because the service & package didn't exist in 19.09, nothing depends on them, and without this fix the module doesn't really work.

Motivation for this change
  • The service has not been able to actually send emails because systemd sandboxing didn't allow it to call sendmail setgid wrapper. I probably broke it during the later iterations of sympa: init at 6.2.52 + NixOS module #65397 and haven't caught it until now. Shame on me.
  • New version contains various bugfixes, including CVE-2020-9369. [not strictly needed to fix the problem]
  • The --enable-fhs configure flag makes the resulting package layout saner, e.g. by not installing perl modules into $out/bin. Upstream plans to make this the default eventually. [not strictly needed to fix the problem]
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@mmilata
sympa: 6.2.52 -> 6.2.54
769a5cc 
(cherry picked from commit adc7388)
@mmilata
sympa: build with --enable-fhs
b95cf62 
Update module accordingly.

(cherry picked from commit 8f632b4)
@mmilata
nixos/sympa: fix outgoing messaging
5edcadc 
Because ProtectKernelModules implies NoNewPrivileges, postfix's sendmail
executable, which is setgid, wasn't able to send mail.

(cherry picked from commit fdc36e2)
@ofborg ofborg bot requested a review from sorki April 3, 2020 18:30
sorki
sorki approved these changes Apr 3, 2020
View reviewed changes
Copy link
Member

@sorki sorki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

bhipple
bhipple approved these changes Apr 4, 2020
View reviewed changes
Copy link
Contributor

@bhipple bhipple left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Result of nixpkgs-review pr 84202 1

1 package built: - sympa

@bhipple bhipple merged commit 4dc8447 into NixOS:release-20.03 Apr 4, 2020
@mmilata mmilata deleted the sympa-outgoing-20.03 branch April 4, 2020 11:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sorki sorki sorki approved these changes

@bhipple bhipple bhipple approved these changes

Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 1-10 10.rebuild-darwin: 1 10.rebuild-linux: 1-10 10.rebuild-linux: 1 11.by: package-maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@mmilata @sorki @bhipple