exim/exim.spec

419 lines
12 KiB
RPMSpec
Raw Normal View History

#
# spec file for package exim
#
# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
# norootforbuild
Name: exim
BuildRequires: db-devel openldap2-devel pcre-devel
%if %{?suse_version:1}%{?!suse_version:0}
BuildRequires: tcpd-devel
%if %suse_version > 910
BuildRequires: xorg-x11-devel
%else
BuildRequires: XFree86-devel XFree86-libs
%endif
%else
BuildRequires: libXaw-devel libXext-devel libXt-devel openssl-devel tcp_wrappers xorg-x11-server-sdk
%endif
Url: http://www.exim.org/
Conflicts: sendmail sendmail-tls postfix
License: GPLv2+
Group: Productivity/Networking/Email/Servers
AutoReqProv: on
Provides: smtp_daemon
%if %{?suse_version:%suse_version}%{?!suse_version:0} > 800
Requires: logrotate
PreReq: %insserv_prereq %fillup_prereq /usr/sbin/useradd fileutils textutils
%endif
- update to 4.74 - Failure to get a lock on a hints database can have serious consequences so log it to the panic log. - Log LMTP confirmation messages in the same way as SMTP, controlled using the smtp_confirmation log selector. - Include the error message when we fail to unlink a spool file. - Bugzilla 139: Support dynamically loaded lookups as modules. - Bugzilla 139: Documentation and portability issues. Avoid GNU Makefile-isms, let Exim continue to build on BSD. Handle per-OS dynamic-module compilation flags. - Let /dev/null have normal permissions. The 4.73 fixes were a little too stringent and complained about the permissions on /dev/null. Exempt it from some checks. - Report version information for many libraries, including Exim version information for dynamically loaded libraries. Created version.h, now support a version extension string for distributors who patch heavily. Dynamic module ABI change. - CVE-2011-0017 - check return value of setuid/setgid. This is a privilege escalation vulnerability whereby the Exim run-time user can cause root to append content of the attacker's choosing to arbitrary files. - Bugzilla 1041: merged DCC maintainer's fixes for return code. - Bugzilla 1071: fix delivery logging with untrusted macros. If dropping privileges for untrusted macros, we disabled normal logging on the basis that it would fail; for the Exim run-time user, this is not the case, and it resulted in successful deliveries going unlogged. - update to 4.73 - Date: & Message-Id: revert to normally being appended to a message, only prepend for the Resent-* case. Fixes regression introduced in Exim 4.70 by NM/22 for Bugzilla 607. - Include check_rfc2047_length in configure.default because we're seeing increasing numbers of administrators be bitten by this. - Added DISABLE_DKIM and comment to src/EDITME - Bugzilla 994: added openssl_options main configuration option. - Bugzilla 995: provide better SSL diagnostics on failed reads. - Bugzilla 834: provide a permit_coredump option for pipe transports. - Adjust NTLM authentication to handle SASL Initial Response. - If TLS negotiated an anonymous cipher, we could end up with SSL but without a peer certificate, leading to a segfault because of an assumption that peers always have certificates. Be a little more paranoid. Problem reported by Martin Tscholak. - Bugzilla 926: switch ClamAV to use the new zINSTREAM API for content filtering; old API available if built with WITH_OLD_CLAMAV_STREAM=yes NB: ClamAV planning to remove STREAM in "middle of 2010". CL also introduces -bmalware, various -d+acl logging additions and more caution in buffer sizes. - Implemented reverse_ip expansion operator. - Bugzilla 937: provide a "debug" ACL control. - Bugzilla 922: Documentation dusting, patch provided by John Horne. - Bugzilla 973: Implement --version. - Bugzilla 752: Refuse to build/run if Exim user is root/0. - Build without WITH_CONTENT_SCAN. Path from Andreas Metzler. - Bugzilla 816: support multiple condition rules on Routers. - Add bool_lax{} expansion operator and use that for combining multiple condition rules, instead of bool{}. Make both bool{} and bool_lax{} ignore trailing whitespace. - prevent non-panic DKIM error from being sent to paniclog - added tcp_wrappers_daemon_name to allow host entries other than "exim" to be used - Fix malware regression for cmdline scanner introduced in PP/08. Notification from Dr Andrew Aitchison. - Change ClamAV response parsing to be more robust and to handle ClamAV's ExtendedDetectionInfo response format. Notification from John Horne. - OpenSSL 1.0.0a compatibility const-ness change, should be backwards compatible. - Added a CONTRIBUTING file. Fixed the documentation build to use http: XSL and documented dependency on system catalogs, with examples of how it normally works. - Added Valgrind hooks in store.c to help it capture out-of-bounds store access. - Bugzilla 1044: CVE-2010-4345 - partial fix: restrict default behaviour of CONFIGURE_OWNER and CONFIGURE_GROUP options to no longer allow a configuration file which is writeable by the Exim user or group. - Bugzilla 1044: CVE-2010-4345 - part two: extend checks for writeability of configuration files to cover files specified with the -C option if they are going to be used with root privileges, not just the default configuration file. - Bugzilla 1044: CVE-2010-4345 - part three: remove ALT_CONFIG_ROOT_ONLY option (effectively making it always true). - Add TRUSTED_CONFIG_PREFIX_FILE option to allow alternative configuration files to be used while preserving root privileges. - Set FD_CLOEXEC on SMTP sockets after forking in the daemon, to ensure that rogue child processes cannot use them. - Bugzilla 1047: change the default for system_filter_user to be the Exim run-time user, instead of root. - Add WHITELIST_D_MACROS option to let some macros be overriden by the Exim run-time user without dropping privileges. - Remove use of va_copy() which breaks pre-C99 systems. Duplicate the result string, instead of calling string_vformat() twice with the same arguments. - Allow TRUSTED_CONFIG_PREFIX_FILE only for Exim or CONFIGURE_OWNER, not for other users. Others should always drop root privileges if they use -C on the command line, even for a whitelisted configure file. - Turn TRUSTED_CONFIG_PREFIX_FILE into TRUSTED_CONFIG_FILE. No prefixes. - Fixed bug #1002 - Message loss when using multiple deliveries OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=98
2011-02-04 19:47:13 +00:00
Version: 4.74
Release: 8
%if %{?build_with_mysql:1}0
BuildRequires: mysql-devel
Provides: exim = %version
%endif
%if %{?build_with_pgsql:1}0
BuildRequires: postgresql-devel
Provides: exim = %version
%endif
Summary: The Exim Mail Transfer Agent, a Replacement for sendmail
BuildRoot: %{_tmppath}/%{name}-%{version}-build
Source: exim-%{version}.tar.bz2
Source1: sysconfig.exim
Source2: exim.logrotate
Source11: exim.rc
Source12: permissions.exim
Source13: apparmor.usr.sbin.exim
Source20: http://www.logic.univie.ac.at/~ametzler/debian/exim4manpages/exim4-manpages.tar.bz2
Source30: eximstats-html-update.py
Source31: eximstats.conf
Patch: exim-4.12-tail.patch
Patch1: aa097c4c00f62487128d74f65c521f9e877b184f.diff
Patch2: 337e3505b0e6cd4309db6bf6062b33fa56e06cf8.diff
%if !%{?build_with_mysql:1}0 && !%{?build_with_pgsql:1}0
%package -n eximon
License: GPLv2+
Summary: Eximon, an graphical frontend to administer Exim's mail queue
Group: Productivity/Networking/Email/Servers
%package -n eximstats-html
License: GPLv2+
Summary: Create HTML reports of exim logs
Group: Productivity/Networking/Email/Servers
Requires: perl-GD perl-GDGraph perl-GDTextUtil
%endif
%description
Exim is a mail transport agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet. It is
freely available under the terms of the GNU General Public Licence. In
style, it is similar to Smail 3, but its facilities are more extensive.
In particular, it has options for verifying incoming sender and
recipient addresses, for refusing mail from specified hosts, networks,
or senders, and for controlling mail relaying.
Authors:
--------
Philip Hazel <ph10@cus.cam.ac.uk>
%if !%{?build_with_mysql:1}0 && !%{?build_with_pgsql:1}0
%description -n eximon
This allows administrators to view the exim agent's mail queue and
logs, and perform a variety of actions on queued messages, such as
freezing, bouncing and thawing messages, and even editing body and
header of mails.
Authors:
--------
Philip Hazel <ph10@cus.cam.ac.uk>
%description -n eximstats-html
If this package is installed alongside the exim MTA, and you enable
EXIM_REPORT_WEEKLY_HTML in /etc/sysconfig/exim, logrotate/cron will
create HTML reports in /srv/www/eximstats.
You can edit /etc/apache2/conf.d/eximstats.conf to configure your
webserver for the reports.
The script /usr/sbin/eximstats-html-update.py can create the reports
for log files that were rotated in the past. (You would only run this
once, if at all. The rest is done by logrotate / cron.)
Authors:
--------
Philip Hazel <ph10@cus.cam.ac.uk>
%endif
%prep
%setup -q -n exim-%{version}
%patch
%patch1 -p1
%patch1 -p2
# build with fPIE/pie on SUSE 10.0 or newer, or on any other platform
%if %{?suse_version:%suse_version}%{?!suse_version:99999} > 930
fPIE="-fPIE"
pie="-pie"
%endif
cat <<-EOF > Local/Makefile
# see src/EDITME for comments.
BIN_DIRECTORY=/usr/sbin
CONFIGURE_FILE=/etc/exim/exim.conf
EXIM_USER=mail
EXIM_GROUP=mail
SPOOL_DIRECTORY=/var/spool/exim
ROUTER_ACCEPT=yes
ROUTER_DNSLOOKUP=yes
ROUTER_IPLITERAL=yes
ROUTER_MANUALROUTE=yes
ROUTER_QUERYPROGRAM=yes
ROUTER_REDIRECT=yes
# ROUTER_IPLOOKUP=yes
TRANSPORT_APPENDFILE=yes
TRANSPORT_AUTOREPLY=yes
TRANSPORT_PIPE=yes
TRANSPORT_SMTP=yes
TRANSPORT_LMTP=yes
SUPPORT_MAILDIR=yes
SUPPORT_MAILSTORE=yes
SUPPORT_MBX=yes
LOOKUP_DBM=yes
LOOKUP_LSEARCH=yes
LOOKUP_CDB=yes
LOOKUP_DNSDB=yes
LOOKUP_DSEARCH=yes
LOOKUP_LDAP=yes
%if %{?build_with_mysql:1}0
LOOKUP_MYSQL=yes
%endif
%if %{?build_with_pgsql:1}0
LOOKUP_PGSQL=yes
%endif
LOOKUP_NIS=yes
# LOOKUP_NISPLUS=yes
# LOOKUP_ORACLE=yes
LOOKUP_PASSWD=yes
# LOOKUP_PGSQL=yes
# LOOKUP_WHOSON=yes
CYRUS_SASLAUTHD_SOCKET=/var/run/sasl2/mux
LDAP_LIB_TYPE=OPENLDAP2
# LOOKUP_INCLUDE=-I /usr/local/ldap/include -I /usr/local/mysql/include -I /usr/local/pgsql/include
# LOOKUP_LIBS=-L/usr/local/lib -lldap -llber -lmysqlclient -lpq
LOOKUP_LIBS=-lldap -llber
%if %{?build_with_mysql:1}0
LOOKUP_INCLUDE=-I /usr/include/mysql
LOOKUP_LIBS=-lldap -llber -lmysqlclient
%endif
%if %{?build_with_pgsql:1}0
LOOKUP_INCLUDE=-I /usr/include/pgsql
LOOKUP_LIBS=-lldap -llber -lpq
%endif
EXIM_MONITOR=eximon.bin
WITH_CONTENT_SCAN=yes
WITH_OLD_DEMIME=yes
AUTH_CRAM_MD5=yes
AUTH_PLAINTEXT=yes
# AUTH_SPA=yes
AUTH_DOVECOT=yes
SUPPORT_TLS=yes
TLS_LIBS=-lssl -lcrypto
INFO_DIRECTORY=%{_infodir}
LOG_FILE_PATH=/var/log/exim/%%s.log
EXICYCLOG_MAX=10
SYSLOG_LOG_PID=yes
COMPRESS_COMMAND=/bin/gzip
COMPRESS_SUFFIX=gz
ZCAT_COMMAND=/usr/bin/zcat
# SUPPORT_PAM=yes
# You probably need to add -lpam to EXTRALIBS
# RADIUS_CONFIG_FILE=/etc/radiusclient/radiusclient.conf
# CYRUS_PWCHECK_SOCKET=/var/pwcheck/pwcheck
# USE_TCP_WRAPPERS=yes
NO_SYMLINK=yes
CHOWN_COMMAND=/bin/chown
CHGRP_COMMAND=/bin/chgrp
MV_COMMAND=/bin/mv
RM_COMMAND=/bin/rm
PERL_COMMAND=/usr/bin/perl
# APPENDFILE_MODE=0600
# APPENDFILE_DIRECTORY_MODE=0700
# APPENDFILE_LOCKFILE_MODE=0600
# CONFIGURE_FILE_USE_NODE=yes
# CONFIGURE_FILE_USE_EUID=yes
# DELIVER_BUFFER_SIZE=8192
# EXIMDB_DIRECTORY_MODE=0750
# EXIMDB_MODE=0640
# EXIMDB_LOCKFILE_MODE=0640
# HEADER_MAXSIZE="(1024*1024)"
# INPUT_DIRECTORY_MODE=0750
# LOG_DIRECTORY_MODE=0750
# LOG_MODE=0640
# LOOKUP_TESTDB=yes
MAKE_SHELL=/bin/bash
# MAX_NAMED_LIST=16
# MAXINTERFACES=250
# MSGLOG_DIRECTORY_MODE=0750
# PERL_CC=
# PERL_CCOPTS=
# PERL_LIBS=
PID_FILE_PATH=/var/run/exim.pid
# SPOOL_DIRECTORY_MODE=0750
# SPOOL_MODE=0640
SUPPORT_MOVE_FROZEN_MESSAGES=yes
HAVE_IPV6=YES
CFLAGS=$RPM_OPT_FLAGS -Wall -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DLDAP_DEPRECATED $fPIE
EXTRALIBS=-ldl -L/usr/X11R6/%{_lib} $pie
EOF
touch Local/eximon.conf
rm -f doc/*.{orig,txt~}
%build
make
%install
mkdir -p $RPM_BUILD_ROOT/etc/init.d
mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
mkdir -p $RPM_BUILD_ROOT/usr/{bin,sbin,lib}
mkdir -p $RPM_BUILD_ROOT/var/log/exim
mkdir -p $RPM_BUILD_ROOT/var/spool/mail/
mkdir -p $RPM_BUILD_ROOT/var/adm/fillup-templates
mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
mkdir -p $RPM_BUILD_ROOT/usr/bin
make inst_dest=$RPM_BUILD_ROOT/usr/sbin \
inst_conf=$RPM_BUILD_ROOT/etc/exim/exim.conf \
inst_info=$RPM_BUILD_ROOT/%{_infodir} \
INSTALL_ARG=-no_chown install
mv $RPM_BUILD_ROOT/usr/sbin/exim-%{version}* $RPM_BUILD_ROOT/usr/sbin/exim
mv $RPM_BUILD_ROOT/etc/exim/exim.conf src/configure.default # with all substitutions done
install -m 755 %{S:11} $RPM_BUILD_ROOT/etc/init.d/exim
# aka...
for i in \
/usr/lib/sendmail \
/usr/bin/runq \
/usr/bin/rsmtp \
/usr/bin/mailq \
/usr/bin/newaliases
do
ln -sf ../sbin/exim $RPM_BUILD_ROOT$i
done
ln -sf exim $RPM_BUILD_ROOT/usr/sbin/sendmail
ln -sv ../../etc/init.d/exim $RPM_BUILD_ROOT/usr/sbin/rcexim
%if !%{?build_with_mysql:1}0 && !%{?build_with_pgsql:1}0
mv $RPM_BUILD_ROOT/usr/sbin/eximon* $RPM_BUILD_ROOT/usr/bin/
%else
rm $RPM_BUILD_ROOT/usr/sbin/eximon*
%endif
cp -p %{S:1} $RPM_BUILD_ROOT/var/adm/fillup-templates/sysconfig.exim
install -m 644 %{S:2} $RPM_BUILD_ROOT/etc/logrotate.d/exim
# man pages
mv doc/exim.8 $RPM_BUILD_ROOT/%{_mandir}/man8/
pod2man --center=EXIM --section=8 $RPM_BUILD_ROOT/usr/sbin/eximstats > $RPM_BUILD_ROOT/%{_mandir}/man8/eximstats.8
tar xvjf %{S:20}
cp -p exim4-manpages/* $RPM_BUILD_ROOT/%{_mandir}/man8/
for i in \
sendmail \
runq \
rsmtp \
mailq \
newaliases
do
ln -sf exim.8.gz $RPM_BUILD_ROOT/%{_mandir}/man8/$i.8.gz
done
for i in \
exim_dumpdb \
exim_fixdb \
exim_tidydb
do
ln -sf exim_db.8.gz $RPM_BUILD_ROOT/%{_mandir}/man8/$i.8.gz
done
perl -pi -e 's%/usr/share/doc/exim4%/usr/share/doc/packages/exim%g' `find $RPM_BUILD_ROOT/%{_mandir}/man8 -name "*.8"`
gzip -9 doc/*.txt
#
# package the utilities without executable permissions, to silence rpmlint warnings
chmod 644 util/*.{pl,sh} src/convert4r*
#
# since 10.0, the permissions file is packaged in the 'permissions' package
%if %{?suse_version:%suse_version}%{?!suse_version:99999} < 1000
install -m 0755 -d $RPM_BUILD_ROOT/etc/permissions.d
install -m 0644 $RPM_SOURCE_DIR/permissions.exim $RPM_BUILD_ROOT/etc/permissions.d/exim
%endif
# eximstats-html files
%if !%{?build_with_mysql:1}0 && !%{?build_with_pgsql:1}0
mkdir -p $RPM_BUILD_ROOT/srv/www/eximstats
mkdir -p $RPM_BUILD_ROOT/etc/apache2/conf.d/
cp -p $RPM_SOURCE_DIR/eximstats.conf $RPM_BUILD_ROOT/etc/apache2/conf.d/
install -m 0755 $RPM_SOURCE_DIR/eximstats-html-update.py $RPM_BUILD_ROOT/%{_sbindir}
%endif
# apparmor profile
install -D -m 0644 $RPM_SOURCE_DIR/apparmor.usr.sbin.exim $RPM_BUILD_ROOT/etc/apparmor/profiles/extras/usr.sbin.exim
%post
%run_permissions
if ! test -s etc/exim/exim.conf; then
if test -s etc/exim.conf; then
mv etc/exim.conf etc/exim/
echo moving exim.conf to /etc/exim/
else
cp -p usr/share/doc/packages/%{name}/configure.default etc/exim/exim.conf
echo copying default config file to /etc/exim/exim.conf
fi
fi
# create logfiles if missing
for i in var/log/exim/main.log var/log/exim/panic.log var/log/exim/reject.log; do
if ! test -e $i; then touch $i; chown mail:mail $i; chmod 640 $i ; fi
done
%{fillup_and_insserv exim}
exit 0
%if %{?suse_version:%suse_version}%{?!suse_version:0} > 820
%preun
%stop_on_removal exim
%endif
%postun
%if %{?suse_version:%suse_version}%{?!suse_version:0} > 820
%restart_on_update exim
%endif
%insserv_cleanup
%verifyscript
%verify_permissions -e /usr/sbin/exim
%clean
%files
%defattr(-,root,root)
%doc ACKNOWLEDGMENTS CHANGES LICENCE NOTICE README.UPDATING README
%doc doc
%doc src/configure.default
%doc build-Linux-*/convert4r{3,4}
%doc util
%doc %{_mandir}/man8/*
/usr/sbin/exicyclog
/usr/sbin/exigrep
/usr/sbin/exiqgrep
%verify(not mode) %attr(4755,root,root) /usr/sbin/exim
/usr/sbin/exim_*
/usr/sbin/eximstats
/usr/sbin/exinext
/usr/sbin/exipick
/usr/sbin/exiqsumm
/usr/sbin/exiwhat
%dir /etc/exim
%config /etc/init.d/exim
%config(noreplace) /etc/logrotate.d/exim
%if %{?suse_version:%suse_version}%{?!suse_version:99999} < 1000
%config(noreplace) /etc/permissions.d/exim
%endif
%dir /etc/apparmor
%dir /etc/apparmor/profiles
%dir /etc/apparmor/profiles/extras
%config(noreplace) /etc/apparmor/profiles/extras/usr.sbin.exim
/usr/sbin/rcexim
/usr/bin/mailq
/usr/bin/runq
/usr/bin/rsmtp
/usr/bin/newaliases
/usr/sbin/sendmail
/usr/lib/sendmail
/var/adm/fillup-templates/sysconfig.exim
%dir %attr(750,root,mail) /var/log/exim
%if !%{?build_with_mysql:1}0 && !%{?build_with_pgsql:1}0
%files -n eximon
%defattr(-,root,root)
/usr/bin/eximon
/usr/bin/eximon.bin
%files -n eximstats-html
%defattr(-,root,root)
%attr(0750,root,www) /srv/www/eximstats
/etc/apache2
/etc/apache2/conf.d
/etc/apache2/conf.d/eximstats.conf
%{_sbindir}/eximstats-html-update.py
%endif
%changelog