OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: .forward file crashes and corresponding core dump files

From: Ronald F. Guilmette (rfgtristatelogic.com)
Date: Thu Jan 24 2008 - 15:41:19 CST


In message <20080124212526.C67F81F3E99spike.porcupine.org>,
Wietse wrote:

>It means: do not change directory.
>
>> If no value for this parameter is set explicitly within my main.cf,
>> then what directory will .forward commands actually execute out of?
>> (My .forward commands quite clearly _are_ executing _someplace_
>> already. I just don't know where.)
>
>Mail is delivered by Postfix daemon processes. These have
>the mail queue as working directory.

Hummm...

# cd /var/spool
# find . -name \*.core -print
#

OK. So let me see if I get this...

The .forward file commands are, by default, initially cd'd into
/var/spool/postfix, yes? But then if there is a signal 11 or other
fatal unhandled signal, the kernel tries to write a .core file in
the current directory, but since the command was executing under
the user-id of the account whose home directory contained the .forward
file, and since that user-id doesn't have write access to Postfix's
/var/spool/postfix directory, no .core file is written.

Correct so far?

And the solution to this problem is to explicitly set, for example:

   command_execution_directory = $home

in the main.cf file.

Am I on the right track?