Skip to content

Restrict the Rspamd controller socket to root and the mail user #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
byjpr wants to merge 1 commit into
base: claude/admiring-planck-25cvzf
Choose a base branch
from
Open

Restrict the Rspamd controller socket to root and the mail user #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions modules/mail.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,23 @@ in
);

# --- Rspamd -----------------------------------------------------------------
# The controller socket accepts unauthenticated commands (retrain Bayes,
# change maps). The mail module makes it world-writable (0666); restrict it
# to root (the admin `rspamc` wrapper) and the mail user, whose Dovecot
# processes call rspamc to learn spam/ham when mail is moved to/from Junk.
services.rspamd.workers.controller.bindSockets = lib.mkForce [
{
socket = "/run/rspamd/worker-controller.sock";
mode = "0660";
owner = config.services.rspamd.user;
group = config.mailserver.storage.group;
}
];
# Rspamd runs unprivileged and may only hand the socket to a group it is
# in. The group grants nothing else: mail homes are 0700 and mail files are
# written with umask 0077.
systemd.services.rspamd.serviceConfig.SupplementaryGroups = [ config.mailserver.storage.group ];

services.rspamd.locals = {
# Enforce the sender's published DMARC policy instead of only scoring it.
# This is what stops spoofed mail claiming to be from paypal.com & co.
Expand Down
Loading