mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

postfix: no reload for a map that did not change; DNS re-checks limited (audit W6/M9)

Browse Source 
Security audit 2026-10-17, findings W6/M9 (low), stage 4. Every
application, upstream, recipient or report-address save reloaded Postfix
through supervisord, and POST .../dns-recheck bypassed the five-minute
cache for up to ~14 resolver queries - both at whatever rate an
authenticated user pressed.

- writeChanged: each generated map is written only when its content
  differs from the file on disk, and Postfix is reloaded only when one was
  (sender map, inbound maps, DMARC maps). Health's Reload configuration
  ends with an explicit reload (app.Service.ReloadPostfix, SenderMaps
  gains Reload), so it still re-reads whatever is on disk. No debounce:
  with unchanged saves gone, a burst is real changes Postfix must see.
- auth.AllowDNSRecheck: twenty forced re-checks in 15 minutes per user;
  past that the outbound, inbound and settings re-check show the cached
  result without the "re-checked" flash, and the log says why.

Tests: TestARebuildThatChangesNothingDoesNotReload,
TestDNSRechecksArePerUser; the fakes gain Reload. Docs: guide § Overview
and Health; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 22:25:20 +03:00
co-authored by Claude Opus 5.5
parent dd950364a3
commit 668e299c69
18 changed files with 153 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -32,6 +32,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
a monitor next to it; the internet gets `404`.
- **Every container has a process ceiling** (audit I3): `pids_limit` 1024
for SelfPost, 256 for the proxies and rspamd, 64 for certbot.
- **A save that changes no map no longer reloads Postfix, and DNS
re-checks are limited** (audit W6/M9): every application, upstream,
recipient or report-address save reloaded Postfix, and *Re-check DNS*
bypassed the cache without limit. Now only a changed file is written and
reloaded (Health's *Reload configuration* always re-reads), and a user
re-checks twenty times in 15 minutes.
- **The TLS private key no longer has to be readable by Postfix** (audit
I1): the guide gave it to group 10998 for the panel's backup, and
`postfix` is in that group, so every Postfix daemon - an smtpd talking to