spamd running with virtual-config-dir mkdir error

[Giuseppe Ravasio]

[ Impact ]
The vconfig path could be tainted which would cause an error. This upload fixes that by untainting the path. This is done by a helper function to modify the path before attempting to use it.

This bug is low priority but is still helpful for certain users as it's easy to reproduce.

[ Where problems could occur ]

The only change here is to use a helper function Mail::SpamAssassin::Util::untaint_file_path which could introduce a regression if a bad filepath is returned.

[Test Plan]
In a terminal, run:
$ sudo apt-get install spamassassin
$ sudo spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-te\
ll -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D
$ cat > test.mbox <<EOF
From: test
To: test
Subject: test

test
EOF
$ spamc < test.mbox
$ sudo grep vconfig/ /var/log/mail.log

In the bugged case, the first terminal will show output like:

Jun 24 20:48:11 host spamd[1801774]: spamd: using default config for username: /var/lib/spamassassin/vconfig/username//user_prefs
Jun 24 20:48:11 host spamd[1801774]: config: using "/var/lib/spamassassin/vconfig/username/" for user state dir
Jun 24 20:48:11 host spamd[1801774]: config: mkdir /var/lib/spamassassin/vconfig/username/ failed: Insecure dependency in mkdir while running with -T switch at /usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm line 198, <GEN14> line 2.

In the fixed case, that last line won't be printed.

[Original Report]
Hi,
I'm installing our new relay and as before I'm running spamd with --virtual-config-dir option enabled:
"spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3"

It works well but it cannot create the vconfig dir if it's not existing.
I've put spamd in debug and the problem is with perl tainted:

config: mkdir /var/lib/spamassassin/vconfig/giuseppe/ failed: Insecure dependency in mkdir while running with -T switch at /usr/share/perl/5.26/File/Path.pm line 177, <GEN10> line 2.

I solved the problem running spamd without -T option (as arch linux is doing) but it could be great to fix this tainted variable.

Thanks
Giuseppe

PS: I reported the same bug to spamassassin bugtracking with ID 7646

[Giuseppe Ravasio (gravasio-kng)]

Hi,
I'm installin our new relay and as before I'm running spamd with --virtual-config-dir option enabled:
"spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3"

It works well but it cannot create the vconfig dir if it's not existing.
I've put spamd in debug and the problem is with perl tainted:

config: mkdir /var/lib/spamassassin/vconfig/giuseppe/ failed: Insecure dependency in mkdir while running with -T switch at /usr/share/perl/5.26/File/Path.pm line 177, <GEN10> line 2.

I solved the problem running spamd without -T option (as arch linux is doing) but it could be great to fix this tainted variable.

Thanks
Giuseppe

[Andreas Hasenack (ahasenack)]

Confirmed.

Steps to reproduce it, for others who, like me, are not familiar with spamassassin:

Start the daemon as root, with the given options plus debug:
spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D

Get some spam message from your spam folder. The raw message (in gmail, select "show original"). Copy it into a file, say spam.txt.

Run "tail -f /var/log/mail.log" in one terminal

Run spamc on that file as a regular user in another terminal:

spamc < spam.txt

Watch the log file and look for the error:
Oct 23 14:41:45 cosmic-spamassassin spamd[10067]: config: using "/var/lib/spamassassin/vconfig/ubuntu/" for user state dir
Oct 23 14:41:45 cosmic-spamassassin spamd[10067]: config: mkdir /var/lib/spamassassin/vconfig/ubuntu/ failed: Insecure dependency in mkdir while running with -T switch at /usr/share/perl/5.26/File/Path.pm line 1
77, <GEN9> line 2.

Also note that /var/lib/spamassassin/vconfig/ubuntu isn't created.

Edit /usr/sbin/spamd and remove "-T" from the shebang. Repeat the above steps. No error, and the directory will be created this time.

[Andreas Hasenack (ahasenack)]

This is confirmed for cosmic, btw, and the upcoming DD one too.

[Andreas Hasenack (ahasenack)]

No activity upstream yet, in the bug or in the svn repo.

[Andreas Hasenack (ahasenack)]

This is the debian bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454595

[Sergio Durigan Junior (sergiodj)]

Still present in Jammy; also confirmed in Bionic and Focal.

Unfortunately, there hasn't been any movement upstream regarding this bug.

[Apache-e (apache-e)]

Sending trunk/lib/Mail/SpamAssassin.pm
Transmitting file data .done
Committing transaction...
Committed revision 1899900.

[Robie Basak (racb)]

Fix available upstream so this should be trivial to cherry-pick now. It might be worth taking a briefly deeper look from a security perspective because of the force untaint.

In 3.5 years nobody else reported themselves as affected though.

@Giuseppe would you still benefit from this fix? If so I can flag it for someone's attention. If not, then any volunteer can drive it, but otherwise it'll be fixed in a future Ubuntu release that incorporates the next upstream release.

[Bryce Harrington (bryce)]

The patch from upstream that is said to fix this. (I've not tested it yet.)

[Paride Legovini (paride)]

Looks like the tasks and triage status of this bug are still correct: there's no new upstream version fixing the bug. There are traces of spamassassin 4.0.0 [1], but that's not going to be included in Kinetic, but likely in LL.

I agree with Robie's assessment: given that the impact of the bug appear to be low this issue is unlikely to be prioritized in the lack of user feedback.

[1] https://github.com/apache/spamassassin/releases/tag/spamassassin_release_4_0_0_rc_1

[Sergio Durigan Junior (sergiodj)]

SpamAssassin 4.0 was released back in December, and is going to be included in Lunar. I'm adding a task for Lunar and marking it as Fix Released to reflect this.

[Lena Voytek (lvoytek)]

Marking impish as won't fix since its no longer supported

[Timo Aaltonen (tjaalton)]

Hello Giuseppe, or anyone else affected,

Accepted spamassassin into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/spamassassin/3.4.6-1ubuntu0.22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Giuseppe, or anyone else affected,

Accepted spamassassin into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/spamassassin/3.4.6-1ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Giuseppe, or anyone else affected,

Accepted spamassassin into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/spamassassin/3.4.4-1ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lena Voytek (lvoytek)]

Verified for Kinetic:

$ lxc launch images:ubuntu/kinetic test-spamassassin-kinetic-fix
$ lxc exec test-spamassassin-kinetic-fix bash

# apt update && apt dist-upgrade -y

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update
# apt install spamassassin

# spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D

# cat > test.mbox <<EOF
From: test
To: test
Subject: test

test
EOF

# spamc < test.mbox
# grep vconfig/ /var/log/mail.log
Apr 3 19:13:42 test-spamassassin-kinetic-fix spamd[2727]: spamd: using default config for root: /var/lib/spamassassin/vconfig/root//user_prefs
Apr 3 19:13:42 test-spamassassin-kinetic-fix spamd[2727]: config: using "/var/lib/spamassassin/vconfig/root/" for user state dir
Apr 3 19:13:42 test-spamassassin-kinetic-fix spamd[2727]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks
Apr 3 19:13:42 test-spamassassin-kinetic-fix spamd[2727]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks

The failure does not show up here.

As a side note, when fully updating to proposed for all packages, /var/log/mail.log is not created. This is likely due to systemd updates in proposed. Restarting the container and running the commands leads to /var/log/mail.log being created and the fix works

[Mitchell Dzurick (mitchdz)]

Verified in Jammy:
# lxc launch images:ubuntu/jammy test-spamassassin-jammy-fix
# lxc exec test-spamassassin-jammy-fix bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update
# apt install spamassassin

# spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D

# cat > test.mbox <<EOF
From: test
To: test
Subject: test

test
EOF

# spamc < test.mbox
# grep vconfig/ /var/log/mail.log
Apr 3 19:37:08 test-spamassassin-jammy-fix spamd[2805]: spamd: using default config for root: /var/lib/spamassassin/vconfig/root//user_prefs
Apr 3 19:37:08 test-spamassassin-jammy-fix spamd[2805]: config: using "/var/lib/spamassassin/vconfig/root/" for user state dir
Apr 3 19:37:08 test-spamassassin-jammy-fix spamd[2805]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks
Apr 3 19:37:08 test-spamassassin-jammy-fix spamd[2805]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks

The failure does not show up here.

As a side note, when fully updating to proposed for all packages, /var/log/mail.log is not created. This is likely due to systemd updates in proposed. Restarting the container and running the commands leads to /var/log/mail.log being created and the fix works

[Mitchell Dzurick (mitchdz)]

Verified in Focal:
# lxc launch images:ubuntu/focal test-spamassassin-focal-fix
# lxc exec test-spamassassin-focal-fix bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update
# apt install spamassassin

# spamd -d --pidfile=/var/run/spamd.pid -c -x --virtual-config-dir=/var/lib/spamassassin/vconfig/%u/ --allow-tell -u debian-spamd -g debian-spamd --max-children=5 --min-children=3 --max-spare=3 -D

# cat > test.mbox <<EOF
From: test
To: test
Subject: test

test
EOF

# spamc < test.mbox
# grep vconfig/ /var/log/mail.log
Apr 3 19:50:42 test-spamassassin-focal-fix spamd[2554]: spamd: using default config for root: /var/lib/spamassassin/vconfig/root//user_prefs
Apr 3 19:50:42 test-spamassassin-focal-fix spamd[2554]: config: using "/var/lib/spamassassin/vconfig/root/" for user state dir
Apr 3 19:50:42 test-spamassassin-focal-fix spamd[2554]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks
Apr 3 19:50:42 test-spamassassin-focal-fix spamd[2554]: bayes: no dbs present, cannot tie DB R/O: /var/lib/spamassassin/vconfig/root//bayes_toks

The failure does not show up here.

As a side note, when fully updating to proposed for all packages, /var/log/mail.log is not created. This is likely due to systemd updates in proposed. Restarting the container and running the commands leads to /var/log/mail.log being created and the fix works

[Launchpad Janitor (janitor)]

This bug was fixed in the package spamassassin - 3.4.6-1ubuntu0.22.10.1

---------------
spamassassin (3.4.6-1ubuntu0.22.10.1) kinetic; urgency=medium

  * d/p/fix-mkpath-untainted.patch: fix spamd running with virtual-config-dir
    mkdir error (LP: #1799185)

 -- Mitchell Dzurick <email address hidden> Thu, 23 Mar 2023 13:06:03 -0700

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for spamassassin has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package spamassassin - 3.4.6-1ubuntu0.22.04.1

---------------
spamassassin (3.4.6-1ubuntu0.22.04.1) jammy; urgency=medium

  * d/p/fix-mkpath-untainted.patch: fix spamd running with virtual-config-dir
    mkdir error (LP: #1799185)

 -- Mitchell Dzurick <email address hidden> Thu, 23 Mar 2023 13:06:03 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package spamassassin - 3.4.4-1ubuntu1.2

---------------
spamassassin (3.4.4-1ubuntu1.2) focal; urgency=medium

  * d/p/fix-mkpath-untainted.patch: fix spamd running with virtual-config-dir
    mkdir error (LP: #1799185)

 -- Mitchell Dzurick <email address hidden> Fri, 24 Mar 2023 09:36:49 -0700

[Robie Basak (racb)]

Bionic has reached End of Standard Support now.