[PATCH mail-forward] postinst: move from using a .forward file to an entry in /etc/aliases

[PATCH mail-forward] postinst: move from using a .forward file to an entry in /etc/aliases

[Shannon Sterz]

hardening guides such as the CIS Debian Benchmark [1] require that no
`.forward` file exists for any interactive user in their home
directory. since root is an interactive user on Proxmox VE and Proxmox
Backup Server, auditing fails.

to avoid this, move the pipe to `proxmox-mail-forward` to
`/etc/aliases`. the postinst hook tries to be cautious here and only
moves the forwarding pipe if no other alias for root exists in
`/etc/aliases`. then it will only remove an existing `.forward` file
if an appropriate alias entry exists and the file's content wasn't
changed. a fix up for the binary location is also kept in case version
updates were skipped.

[1]: CIS Debian Linux 13 Benchmark v1.1.0, Section 7.2.10, "Ensure
local interactive user dot files access is configured", requires an
account with CIS: https://www.cisecurity.org/benchmark/debian_linux

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    imo, the security impact of having a `/root/.forward` file that is
    only writable by root is negligible. however, the section in question
    is about all interactive users, so root's `.forward` file is a special
    case. the alternatives to this patch from my perspective are:
    
    - ignoring/removing the recommendation for Debian and adding our own
      guidance that adds an exemption, but that may be cumbersome to
      maintain. every upstream change would require a manual merge, due to
      how CIS guides are created.
    - documenting how to manually set up an alias and that the forward file
      can then be removed. however, every update of this package would
      re-add the `.forward` file.
    - getting the upstream Debian benchmark to adopt a general exemption,
      but that sounds unlikely to succeed.
    - long term changes to the notification framework that would obsolete
      proxmox-mail-forward. however, that would take too long.
    
    this seemed like a neat solution that requires no manual intervention
    by our users, while passing the benchmark. it should work for a
    default installation and customization will need manual intervention.

 debian/proxmox-mail-forward.postinst | 35 ++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/debian/proxmox-mail-forward.postinst b/debian/proxmox-mail-forward.postinst
index f8a61ed..4ea17b9 100755
--- a/debian/proxmox-mail-forward.postinst
+++ b/debian/proxmox-mail-forward.postinst
@@ -4,13 +4,38 @@ set -e
 
 case "$1" in
     configure)
-        # The entry is rewritten unconditionally
-        if test -f /root/.forward; then
-           sed -i '\!|/usr/bin/proxmox-mail-forward!d' /root/.forward
+        # Always check if a root alias exists and if not set one
+        if ! grep -qsi '^root:' /etc/aliases ; then
+            # make sure the aliases file ends in a new line
+            if [ -s /etc/aliases ] && [ -n "$(tail -c1 /etc/aliases)" ]; then
+                echo >> /etc/aliases
+            fi
+
+            echo '# Added by proxmox-mail-forward to forward root mails to the notification system' >>/etc/aliases
+            echo 'root: |/usr/libexec/proxmox-mail-forward' >>/etc/aliases
+
+            if command -v newaliases >/dev/null && ! newaliases; then
+                echo "WARNING: newaliases run was not successful." >&2
+                echo "WARNING: Please review and re-run it manually if needed." >&2
+            fi
+        elif ! grep -qsiE '^root:.*\|/usr/libexec/proxmox-mail-forward' /etc/aliases; then
+            echo "WARNING: root alias in /etc/aliases does not pipe to proxmox-mail-forward;" \
+                 "system mail will bypass the notification system" >&2
         fi
 
-        if ! test -f /root/.forward || ! grep -q '|/usr/libexec/proxmox-mail-forward' /root/.forward; then
-            echo '|/usr/libexec/proxmox-mail-forward' >>/root/.forward
+        # Check if an old '/root/.forward' file exists and clean it up if we are using aliases
+        if dpkg --compare-versions "$2" 'lt' '1.1.1~' && test -f /root/.forward \
+            && grep -qsiE '^root:.*\|/usr/libexec/proxmox-mail-forward' /etc/aliases; then
+            if ! grep -qvxE -e '\|/usr/(bin|libexec)/proxmox-mail-forward' -e '' /root/.forward; then
+                rm /root/.forward
+            else
+                echo "WARNING: '/root/.forward' has unexpected content, leaving it as-is. It may" \
+                    "be ignored going forward, so move its content to '/etc/aliases' manually." >&2
+            fi
+        elif test -f /root/.forward; then
+            # if the `.forward` file approach is kept, fix up the binary
+            # location in case versions were skipped
+            sed -i 's!^|/usr/bin/proxmox-mail-forward$!|/usr/libexec/proxmox-mail-forward!' /root/.forward
         fi
     ;;
 
-- 
2.47.3