5.8 The smrsh Program

The sendmail program normally runs any program it finds in the user's ~/.forward file. A cracker can attack any user, including root, by having permission to modify the user's ~/.forward file. Consider the following modifications, for example:

\user
|"/usr/ucb/vacation user"                                OK
|"/tmp/x.sh"                                             an attack!
|"cp /bin/sh /home/george/.x; chmod u+s /home/george/.x" an attack!

As an aid in preventing such attacks, V8.1 sendmail first offered the smrsh (sendmail restricted shell) program. V8.7 sendmail offered the smrsh feature (see Section 5.8.2) as an easy way to install smrsh with your mc configuration file.

5.8.1 Build smrsh

The smrsh program is supplied in source form with the sendmail distribution in the smrsh directory. The README file in that directory describes how to compile and install smrsh, and tells how it can be used with all versions of sendmail. Note that the instructions we give you here refer to V8.9 and above.

To build smrsh just execute the following in the smrsh directory:

% ./Build

There is very little to tune inside smrsh at build time. You might wish to predefine ALLOWSEMI as a way to allow semicolons inside command-lines, but this is not recommended because it makes the job of smrsh harder and less secure. In the rare event you need to allow semicolons, however, you can add the following line to your m4 build file:

APPENDDEF(`conf_smrsh_ENVDEF', `-DALLOWSEMI')

You might also want to change the directory where smrsh will look for its approved executable programs. The default directory is preset in include/sm/conf.h for each operating system. That default can be changed with the SMRSH_CMDDIR macro like this:

APPENDDEF(`conf_smrsh_ENVDEF', `-DSMRSH_CMDDIR="/etc/mail/smrsh"')

You might also need to change the default path that smrsh passes to the Bourne shell (/bin/sh) just before that shell is called to execute its approved programs. The default preset in include/sm/conf.h for each operating system and can be changed like this:

APPENDDEF(`conf_smrsh_ENVDEF', `-DSMRSH_PATH="/usr/bin:/usr/sbin"')

This SMRSH_PATH macro should not be changed if your environment must remain secure. The entry /usr/local/bin should almost never appear in this list.

To install smrsh, simply type:

# ./Build install

This will install smrsh in a directory that is considered most appropriate for your system (usually /usr/lib, or /libexec, or /usr/ucblib). If you wish to install smrsh in a different directory you can do so by defining the following in your m4 build file:

define(`confEBINDIR', `/usr/sbin')

But beware, this will also redefine where mail.local is installed and will require you to modify your mc configuration file to indicate this new location.

5.8.2 Configure to Use smrsh

After you have built and installed srmsh (see the previous section), and after you have populated its approved directory (see the following section), you can include support for it in your m4 configuration file with the smrsh feature:

FEATURE(`smrsh')
MAILER(`local')

Note that the smrsh feature must precede the local delivery agent declaration. If these lines are reversed, the following error will print when you run Build:

*** FEATURE(smrsh) must occur before MAILER(local)

If you installed smrsh in a location other than its default, you will need to add an argument to the smrsh feature:^[10]

^[10] You can also achieve this by using the confEBINDIR compile-time macro, but that macro is not favored because it also affects the mail.local program.

FEATURE(`smrsh', `/usr/sbin/smrsh')

Use of smrsh is recommended by CERT, so you are encouraged to use this feature if possible.

5.8.3 Populate its Directory

Before users can start putting programs in their ~/.forward files, you need to populate the smrsh-approved program directory. You should never put programs in that directory that can generate a shell or that are shell-like programs (such as perl). Good programs that are likely candidates for the approved program directory are vacation and slocal.^[11]

^[11] Note that procmail is not a good candidate because it can run anything, including a shell.

You place a program into the smrsh-approved program directory by symbolically linking it there. Consider the vacation program, for example:

# cd /usr/adm/sm.bin
# ln -s /usr/ucb/vacation .

Note that, although you should not put carefully vetted shell programs in that directory, it is OK to put shell scripts there—that is, scripts that begin with the special "#!" instruction at the top.

5.8.4 How smrsh Works

Once smrsh is installed and sendmail is configured to use it, and after its approved program directory is populated, smrsh can begin to do its job. Thereafter, whenever smrsh is called to run a program, smrsh strips the leading path from the program name and looks for that program in its special /usr/adm/sm.bin directory. If the program is not found in that directory, the message bounces. Thus, with the ~/.forward line:

|"/tmp/x.sh"

and if x.sh is not in the /usr/adm/sm.bin directory, smrsh causes the email message to bounce with the following error:

smrsh: /usr/adm/sm.bin/x.sh: not available for sendmail programs

The smrsh program also screens out program lines that contain suspicious characters. Consider:

|"cp /bin/sh /home/george/.x; chmod u+s /home/george/.x"

In this instance, smrsh would reject the command line (and thus bounce the message) because it contained a semicolon character:

smrsh: cannot use ; in command

The smrsh program will reject any command line that contains any of the following special characters as well as the newline (\n) and carriage-return (\r) characters:

`<>;$( )

Beginning with V8.10, smrsh allows the && and || expressions so that ~/.forward file entries such as the following will work:

|"exec /usr/local/bin/archivemail /usr/local/mailarchive/user || exit 75"

Here, || means that if the archivemail program fails, the shell command will exit with a 75 value. This tells sendmail to defer the message back to its queue, instead of bouncing it.

Note that programs following an && or || expression must also be allowed by the smrsh program.