use C-wrapper for setgid perl script

Because perl-suid does not exist on wheezy.

diff --git a/Makefile b/Makefile
index 6754736f3cc7045cc85e3173d6ce5e1fea97fe02..19425ecd95af16e8cbbb09560f1ea6be3b8923e3 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,9 @@ DESTDIR=
 #SUBDIRS = bin lib www aplinfo
 SUBDIRS = aplinfo PVE bin www po
 
-DEB=${PACKAGE}_${VERSION}-${PACKAGERELEASE}_all.deb
+ARCH:=$(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+DEB=${PACKAGE}_${VERSION}-${PACKAGERELEASE}_${ARCH}.deb
 
 all: ${SUBDIRS}
 
@@ -43,7 +45,8 @@ ${DEB} deb:
        dpkg-deb --build dest
        mv dest.deb ${DEB}
        rm -rf dest
-       lintian ${DEB}  
+       # supress lintian error: statically-linked-binary usr/bin/pvemailforward
+       lintian -X binaries ${DEB}      
 
 .PHONY: upload
 upload: ${DEB} check

diff --git a/bin/Makefile b/bin/Makefile
index 708914ec55b70a8fd9eb354f7fc4741098d18a51..42c87df7232896573b103dc96476121488128966 100644 (file)
--- a/bin/Makefile
+++ b/bin/Makefile
@@ -13,6 +13,7 @@ SCRIPTS =                     \
        pvedaemon               \
        pveversion              \
        pvesubscription         \
+       pvemailforward.pl       \
        pveperf
 
 MANS =                                 \
@@ -25,7 +26,7 @@ MANS =                                \
        pvesubscription.1       \
        pveperf.1
 
-all: ${MANS}
+all: ${MANS} pvemailforward
 
 %.1: %.1.pod
        rm -f $@
@@ -46,12 +47,15 @@ pvesubscription.1.pod: pvesubscription
 vzrestore.1.pod: vzrestore
        perl -I.. ./vzrestore printmanpod >$@
 
+pvemailforward: pvemailforward.c
+       gcc $< -o $@ -g -O2 -Wall -ldl -lc
+
 .PHONY: install 
 install: ${SCRIPTS} ${MANS} pvemailforward
        perl -I.. ./pvesh verifyapi
        install -d ${BINDIR}
        install -m 0755 ${SCRIPTS} ${BINDIR}
-       install -m 2755 -g www-data pvemailforward ${BINDIR}
+       install -s -m 2755 -g www-data pvemailforward ${BINDIR}
        install -d ${MAN1DIR}
        install -m 0644 ${MANS} ${MAN1DIR}
        install -d ${PODDIR}
@@ -67,5 +71,5 @@ distclean: clean
 
 .PHONY: clean
 clean:
-       rm -rf *~ ${MANS} *.1.pod
+       rm -rf *~ ${MANS} *.1.pod pvemailforward
        set -e && for i in ${SUBDIRS}; do ${MAKE} -C $$i $@; done

diff --git a/bin/pvemailforward b/bin/pvemailforward
deleted file mode 100755 (executable)
index 9dbd79e..0000000
--- a/bin/pvemailforward
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/perl -w -T
-
-use strict;
-use warnings;
-use PVE::Tools;
-use PVE::SafeSyslog;
-use PVE::AccessControl;
-use PVE::Cluster qw (cfs_read_file);
-
-# NOTE: we need to run this with setgid www-data
-# else we cant read /etc/pve/user.cfg
-
-$( = $); # $GID = $EGID
-
-$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
-
-initlog('pvemailforward');
-
-
-PVE::Cluster::cfs_update();
-
-eval {
-    my $usercfg = cfs_read_file("user.cfg");
-    my $rootcfg = $usercfg->{users}->{'root@pam'} || {};
-    my $mailto = $rootcfg->{email};
-
-    die "user 'root\@pam' does not have a email address\n" if !$mailto;
-
-    syslog("info", "forward mail to <$mailto>");
-
-    # we never send DSN (avoid mail loops)
-    open(CMD, "|sendmail -bm -N never $mailto") ||
-       die "can't exec sendmail - $!\n";
-    while (<>) { print CMD $_; }
-    close(CMD);
-};
-if (my $err = $@) {
-    syslog('err', "mail forward failed: $err");
-}
-
-exit(0);

diff --git a/bin/pvemailforward.c b/bin/pvemailforward.c
new file mode 100644 (file)
index 0000000..53c1a92
--- /dev/null
+++ b/bin/pvemailforward.c
@@ -0,0 +1,17 @@
+/* see 'man perlsec'
+ *
+ */ 
+#include <unistd.h>
+#include <stdio.h>
+
+#define REAL_PATH "/usr/bin/pvemailforward.pl"
+
+int main(ac, av)
+char **av;
+{
+    execv(REAL_PATH, av);
+ 
+    fprintf(stderr, "exec '%s' failed\n", REAL_PATH);
+
+    return -1;
+}

diff --git a/bin/pvemailforward.pl b/bin/pvemailforward.pl
new file mode 100755 (executable)
index 0000000..9dbd79e
--- /dev/null
+++ b/bin/pvemailforward.pl
@@ -0,0 +1,41 @@
+#!/usr/bin/perl -w -T
+
+use strict;
+use warnings;
+use PVE::Tools;
+use PVE::SafeSyslog;
+use PVE::AccessControl;
+use PVE::Cluster qw (cfs_read_file);
+
+# NOTE: we need to run this with setgid www-data
+# else we cant read /etc/pve/user.cfg
+
+$( = $); # $GID = $EGID
+
+$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
+
+initlog('pvemailforward');
+
+
+PVE::Cluster::cfs_update();
+
+eval {
+    my $usercfg = cfs_read_file("user.cfg");
+    my $rootcfg = $usercfg->{users}->{'root@pam'} || {};
+    my $mailto = $rootcfg->{email};
+
+    die "user 'root\@pam' does not have a email address\n" if !$mailto;
+
+    syslog("info", "forward mail to <$mailto>");
+
+    # we never send DSN (avoid mail loops)
+    open(CMD, "|sendmail -bm -N never $mailto") ||
+       die "can't exec sendmail - $!\n";
+    while (<>) { print CMD $_; }
+    close(CMD);
+};
+if (my $err = $@) {
+    syslog('err', "mail forward failed: $err");
+}
+
+exit(0);