70.1.45. pepsi-helper-dot-forward

run a single user’s ~/.forward as that user

Manual section:

1

70.1.45.1.1. Name

pepsi-helper-dot-forward - privileged helper that processes one local user’s ~/.forward after dropping to that user.

70.1.45.1.2. Synopsis

pepsi-helper-dot-forward TARGET-UID [–pipe] [–file] < message

70.1.45.1.3. Description

pepsi-helper-dot-forward is a minimal, security-hardened helper that runs exactly one local user’s ~/.forward file. It exists so that a trusted but unprivileged caller (a member of the pepsi-forward group, in practice pepsi-stage-dot-forward(1)) can have any local user’s ~/.forward processed as that user — and do nothing else.

The helper is installed setuid-root, owned root:pepsi-forward with mode 4750. Only members of the pepsi-forward group may execute it; when they do, the kernel runs it with an effective uid of root. Given the numeric uid of the target user as its sole positional argument, and the raw message on standard input, the helper:

  1. resolves the target user’s passwd entry, refusing uid 0 / the login root and any uid below /etc/login.defs UID_MIN (default 1000);

  2. fully and irreversibly drops to the target user — installing the user’s supplementary groups, then the gid, then the uid (real, effective and saved) — and verifies that root cannot be regained, exactly as pepsi-helper-maildir-writer(1) and pepsi-helper-auto-pay(1) do;

  3. if the user has no ~/.forward file, exits 1 (the stage then proceeds to its next stage);

  4. otherwise reads ~/.forward and acts on each non-empty, non-# line as the user: a bare address (optional leading \) is collected as a forwarding address; |command pipes the message to /bin/sh -c command (only with –pipe); /absolute/path appends the message to that file (only with –file). A directive whose kind was not enabled, or whose execution fails, is a failure. A |command is run with a sanitised environment — HOME and USER/LOGNAME set to the target user, a fixed PATH, and the shell-hijacking variables IFS/BASH_ENV/ENV/CDPATH removed — so the inherited delivery-agent environment cannot influence the command.

The message is read from standard input only when a |pipe//file directive that consumes it may run (i.e. when –pipe or –file is given).

70.1.45.1.4. Arguments

TARGET-UID

The numeric user id whose ~/.forward is processed. It must have a passwd entry; uid 0 / the root account and any uid below /etc/login.defs UID_MIN are refused.

–pipe

Permit |command directives (the stage passes this when its ALLOW_PIPE is on).

–file

Permit /path file-append directives (the stage passes this when its ALLOW_FILE is on).

70.1.45.1.5. Exit Status

0

The ~/.forward was processed successfully. The forwarding addresses it named (possibly none) are written one per line to standard output.

1

The user has no ~/.forward. The caller proceeds to its next stage.

2

Processing failed — a pipe command exited non-zero (or was killed), a file could not be written, a disabled directive was requested, or an operational error occurred (bad uid, not setuid-root, the root account). A human-readable diagnostic is written to standard output for inclusion in the bounce.

When invoked by a user who is not a member of the pepsi-forward group, the kernel refuses to execute the binary at all; the helper itself never runs.

70.1.45.1.6. Security

Membership of the pepsi-forward group is the access-control gate. The helper runs arbitrary commands and writes arbitrary files only as the unprivileged target user, never as root: it drops privilege completely before reading the ~/.forward or touching any of the user’s files, and refuses to act for the root account.

70.1.45.1.7. See Also

pepsi-stage-dot-forward(1), pepsi-helper-maildir-writer(1), pepsi-dispatch(1), pepsi.conf(5)

70.1.45.1.8. Bugs

Report bugs to the Pepsi issue tracker.