bsd-mailx no longer supports sendmail options, thus breaking existing scripts (like Bootmail)

[Andreas Ntaflos]

The security update of bsd-mailx (8.1.2-0.20111106cvs-1ubuntu0.1 on Ubuntu 12.04) removes bsd-mailx's support for specifying sendmail options after "--" on the commandline.

This breaks any script that supplies classic sendmail options like -F or -f on the mail commandline. A prominent example is Bootmail, which calls mailx in the following way:

print_mail_text | sed -e "s/[^[:print:]]//g" | rootsign | mail -s "$subject" "$recipients" -- -F "Bootmail" -f "$FROM_MAIL"

Here the options -F and -f are used to set the From: header in the resulting mail message. This is now broken and results in error messages like these in /var/log/mail.log (on systems that run Postfix):

Jan 26 16:20:09 example01 postfix/error[31885]: 4351640CB7: to=<-<email address hidden>>, orig_to=<-F>, relay=none, delay=0.16, delays=0.12/0/0/0.05, dsn=5.1.3, status=bounced (bad address syntax)

Is this change going to stay for good? In that case we need to report a bug against the Bootmail package (and probably quite a few others) to change the mail commandline to use the "-a" commandline switch for specifying additional mail headers.

I find it disconcerting that a security update completely removes functionality that has been available and expected for many years without providing a proper compatibility layer. Is this really the way to do this?

[Robie Basak (racb)]

Relevant links:

http://www.ubuntu.com/usn/usn-2455-1/
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-7844.html

[Robie Basak (racb)]

> I find it disconcerting that a security update completely removes functionality that has been available and expected for many years without providing a proper compatibility layer. Is this really the way to do this?

What do you suggest instead?

[Marc Deslauriers (mdeslaur)]

The change was unfortunately needed to properly handle email addresses that start with "-".

Please file a bug against bootmail.

[Andreas Ntaflos (daff)]

Bug against Bootmail is here: https://bugs.launchpad.net/ubuntu/+source/bootmail/+bug/1414696

> What do you suggest instead?

I don't really have a suggestion and I am not disputing that this change was necessary.

But the USN description doesn't even mention that specifying sendmail options after "--" is no longer supported. After some back and forth (and seriously doubting my own sanity) I inferred that fact from the changelog which mentions a "83-nosendmail.patch". I just wish the USN advertised and documented this change and its full impact better.

[Marc Deslauriers (mdeslaur)]

Thanks for the suggestion, I've added a note to the USN to this effect.

[Robie Basak (racb)]

So I think it's a valid concern that this was broken, but the conclusion is that there's nothing that we can do about it since the choice is to leave users vulnerable or to break this edge case. Won't Fix seems appropriate.

[Andreas Ntaflos (daff)]

FWIW, I am content with the updated USN and agree with Won't Fix. Just wanted to raise the issue here in case I am not the only one bitten by this change.