dovecot-1.1: mail_chroot no longer needs to be in valid_chroot_d...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-1.1/rev/1f982f1201ef
changeset: 7257:1f982f1201ef
user:      Timo Sirainen <tss at iki.fi>
date:      Sat Feb 16 16:27:11 2008 +0200
description:
mail_chroot no longer needs to be in valid_chroot_dirs.

diffstat:

2 files changed, 6 insertions(+), 4 deletions(-)
dovecot-example.conf      |    3 ++-
src/master/mail-process.c |    7 ++++---

diffs (37 lines):

diff -r 39c2f2adfed1 -r 1f982f1201ef dovecot-example.conf
--- a/dovecot-example.conf	Sat Feb 16 16:24:20 2008 +0200
+++ b/dovecot-example.conf	Sat Feb 16 16:27:11 2008 +0200
@@ -363,7 +363,8 @@
 
 # ':' separated list of directories under which chrooting is allowed for mail
 # processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
-# This setting doesn't affect login_chroot or auth chroot variables.
+# This setting doesn't affect login_chroot, mail_chroot or auth chroot
+# settings.
 # WARNING: Never add directories here which local users can modify, that
 # may lead to root exploit. Usually this should be done only if you don't
 # allow shell access for users. <doc/wiki/Chrooting.txt>
diff -r 39c2f2adfed1 -r 1f982f1201ef src/master/mail-process.c
--- a/src/master/mail-process.c	Sat Feb 16 16:24:20 2008 +0200
+++ b/src/master/mail-process.c	Sat Feb 16 16:27:11 2008 +0200
@@ -614,9 +614,6 @@ create_mail_process(enum process_type pr
 			return MASTER_LOGIN_STATUS_INTERNAL_ERROR;
 	}
 
-	if (*chroot_dir == '\0' && *set->mail_chroot != '\0')
-		chroot_dir = set->mail_chroot;
-
 	if (*chroot_dir != '\0') {
 		if (!validate_chroot(set, chroot_dir)) {
 			i_error("Invalid chroot directory '%s' (user %s) "
@@ -630,6 +627,10 @@ create_mail_process(enum process_type pr
 				chroot_dir, user);
 			return MASTER_LOGIN_STATUS_INTERNAL_ERROR;
 		}
+	} else if (*set->mail_chroot != '\0') {
+		/* mail_chroot setting's value doesn't need to be in
+		   valid_chroot_dirs. */
+		chroot_dir = set->mail_chroot;
 	}
 
 	if (!dump_capability) {