mailx commandline broken after recent bsd-mailx security update

[Andreas Ntaflos]

bsd-mailx recently had a security update that completely removes support for specifying classic sendmail options after "--" on the command line. See http://changelogs.ubuntu.com/changelogs/pool/main/b/bsd-mailx/bsd-mailx_8.1.2-0.20111106cvs-1ubuntu0.1/changelog for 8.1.2-0.20111106cvs-1ubuntu0.1. This is on Ubuntu 12.04.

The update breaks the way Bootmail (and probably quite a few other scripts) constructs its mail messages. Currently it looks like this:

print_mail_text | sed -e "s/[^[:print:]]//g" | rootsign | mail -s "$subject" "$recipients" -- -F "Bootmail" -f "$FROM_MAIL"

The part after "--", i.e. the switches -F and -f, is now no longer supported by bsd-mailx and results in "bad address syntax" error messages in /var/log/mail.log:

Jan 26 16:20:09 example01 postfix/error[31885]: 4351640CB7: to=<-<email address hidden>>, orig_to=<-F>, relay=none, delay=0.16, delays=0.12/0/0/0.05, dsn=5.1.3, status=bounced (bad address syntax)

I reported a bug against bsd-mailx in https://bugs.launchpad.net/ubuntu/+source/bsd-mailx/+bug/1414684 because this change is obviously quite troublesome for any script that relies on mailx understanding sendmail options.

To fix this in Bootmail I propose using the "-a" commandline switch to set additional mail headers. Something like this:

print_mail_text | sed -e "s/[^[:print:]]//g" | rootsign | mail -s "$subject" -a "From: Bootmail <${FROM_MAIL}>" "$recipients"

This has the advantage that it works with (probably) all bsd-mailx versions and most other mailx variants as well, including those that never supported specifying sendmail options.

[Andreas Ntaflos (daff)]

I have implemented the proposed fix in our infrastructure by having Puppet modify the /usr/sbin/bootmail script and change the last line as specified above to use the "-a" option for setting the From: header:

print_mail_text | sed -e "s/[^[:print:]]//g" | rootsign | mail -s "$subject" -a "From: Bootmail <${FROM_MAIL}>" "$recipients"

Works well, FWIW.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.