From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 9325A1FF0B3 for ; Wed, 11 Nov 2026 15:20:49 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4CFAB21645; Wed, 11 Nov 2026 15:20:46 +0100 (CET) From: Shannon Sterz To: pve-devel@lists.proxmox.com Subject: [PATCH mail-forward] postinst: move from using a .forward file to an entry in /etc/aliases Date: Wed, 11 Nov 2026 15:20:34 +0100 Message-ID: <20261111142034.251131-1-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794406837988 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.626 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: ZOFWJIZKJSO5SB5HLJMDSW4T4RUI7OA4 X-Message-ID-Hash: ZOFWJIZKJSO5SB5HLJMDSW4T4RUI7OA4 X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: hardening guides such as the CIS Debian Benchmark [1] require that no `.forward` file exists for any interactive user in their home directory. since root is an interactive user on Proxmox VE and Proxmox Backup Server, auditing fails. to avoid this, move the pipe to `proxmox-mail-forward` to `/etc/aliases`. the postinst hook tries to be cautious here and only moves the forwarding pipe if no other alias for root exists in `/etc/aliases`. then it will only remove an existing `.forward` file if an appropriate alias entry exists and the file's content wasn't changed. a fix up for the binary location is also kept in case version updates were skipped. [1]: CIS Debian Linux 13 Benchmark v1.1.0, Section 7.2.10, "Ensure local interactive user dot files access is configured", requires an account with CIS: https://www.cisecurity.org/benchmark/debian_linux Signed-off-by: Shannon Sterz --- Notes: imo, the security impact of having a `/root/.forward` file that is only writable by root is negligible. however, the section in question is about all interactive users, so root's `.forward` file is a special case. the alternatives to this patch from my perspective are: - ignoring/removing the recommendation for Debian and adding our own guidance that adds an exemption, but that may be cumbersome to maintain. every upstream change would require a manual merge, due to how CIS guides are created. - documenting how to manually set up an alias and that the forward file can then be removed. however, every update of this package would re-add the `.forward` file. - getting the upstream Debian benchmark to adopt a general exemption, but that sounds unlikely to succeed. - long term changes to the notification framework that would obsolete proxmox-mail-forward. however, that would take too long. this seemed like a neat solution that requires no manual intervention by our users, while passing the benchmark. it should work for a default installation and customization will need manual intervention. debian/proxmox-mail-forward.postinst | 35 ++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/debian/proxmox-mail-forward.postinst b/debian/proxmox-mail-forward.postinst index f8a61ed..4ea17b9 100755 --- a/debian/proxmox-mail-forward.postinst +++ b/debian/proxmox-mail-forward.postinst @@ -4,13 +4,38 @@ set -e case "$1" in configure) - # The entry is rewritten unconditionally - if test -f /root/.forward; then - sed -i '\!|/usr/bin/proxmox-mail-forward!d' /root/.forward + # Always check if a root alias exists and if not set one + if ! grep -qsi '^root:' /etc/aliases ; then + # make sure the aliases file ends in a new line + if [ -s /etc/aliases ] && [ -n "$(tail -c1 /etc/aliases)" ]; then + echo >> /etc/aliases + fi + + echo '# Added by proxmox-mail-forward to forward root mails to the notification system' >>/etc/aliases + echo 'root: |/usr/libexec/proxmox-mail-forward' >>/etc/aliases + + if command -v newaliases >/dev/null && ! newaliases; then + echo "WARNING: newaliases run was not successful." >&2 + echo "WARNING: Please review and re-run it manually if needed." >&2 + fi + elif ! grep -qsiE '^root:.*\|/usr/libexec/proxmox-mail-forward' /etc/aliases; then + echo "WARNING: root alias in /etc/aliases does not pipe to proxmox-mail-forward;" \ + "system mail will bypass the notification system" >&2 fi - if ! test -f /root/.forward || ! grep -q '|/usr/libexec/proxmox-mail-forward' /root/.forward; then - echo '|/usr/libexec/proxmox-mail-forward' >>/root/.forward + # Check if an old '/root/.forward' file exists and clean it up if we are using aliases + if dpkg --compare-versions "$2" 'lt' '1.1.1~' && test -f /root/.forward \ + && grep -qsiE '^root:.*\|/usr/libexec/proxmox-mail-forward' /etc/aliases; then + if ! grep -qvxE -e '\|/usr/(bin|libexec)/proxmox-mail-forward' -e '' /root/.forward; then + rm /root/.forward + else + echo "WARNING: '/root/.forward' has unexpected content, leaving it as-is. It may" \ + "be ignored going forward, so move its content to '/etc/aliases' manually." >&2 + fi + elif test -f /root/.forward; then + # if the `.forward` file approach is kept, fix up the binary + # location in case versions were skipped + sed -i 's!^|/usr/bin/proxmox-mail-forward$!|/usr/libexec/proxmox-mail-forward!' /root/.forward fi ;; -- 2.47.3