audit 2c: findings of the two reviews

Technical review (Opus, 11 findings, 2 medium) and security review (Fable,
no high or medium) of 3c86280..HEAD. Both confirm the port gives
dkim_mail_parse()'s result on every input it parses, and that no line the
check passes is signed with another domain's key.

- F1 (medium): OpenDKIM's parser takes lines no mail program reads as one
  address - "ceo@bank.com:me@mine.com", "Name <ceo@bank.com:me@mine.com>",
  "<b@evil.com, a@mine.com>", "ceo@bank.com <me@mine.com>",
  "ceo@bank.com@mine.com" - and signs for the last while a lenient reader
  shows the first. The line must now also be one address in RFC 5322's
  grammar (net/mail, display names in any charset passed through), at the
  domain OpenDKIM signs for. A quoted display name may still hold anything.
- F2 (medium): the bindings were asked about OpenDKIM's form of the
  address, quotes and all, so "x"@mine.com passed for an application
  holding @mine.com while x@mine.com belonged to another. They are now
  asked about the reader's address, its local part unquoted, as Postfix
  holds the envelope's.
- F3 / security (low): Bindings.Allowed and DomainOf fold case in ASCII
  only: Postfix folds as Unicode (casefold.c, ICU), but every key and
  login the panel writes is ASCII, and the Unicode fold let the Kelvin sign
  pass for "k" (net/mail then refuses such a line on the domain test).
- F4 (low): a TERM between "postfix start-fg &" and "child=$!" is no longer
  lost: the wrapper stops Postfix as soon as the pid is known.
- F5 (low): for startsecs after a start any failed reload passed as "not
  running". postfix-reload is now build/postfix-reload.sh: exit 75 when
  master -t says no master runs, else exec postfix reload; RunOnce returns
  EndError with the status, and only 75 is taken as done. supervisor.State
  goes.
- F6 (low): crashexit spares postfix-reload too - a reload that could not
  be spawned is reported to whoever asked, not a reason to stop the
  container.
- F7 (low): a certs/ that is itself a link is resolved before the walk
  (filepath.WalkDir does not follow its root).
- F8 (low): at shutdown the tailer reads what is left of the rotated
  file before saving its place. Not changed: a refusal line still waiting
  on the old file at shutdown is not kept - the panel writes refused rows
  itself, only a kill loses one, and that window is the minute's grace.
- F9 (low): pct read as text - empty or unreadable is 100, the rest held
  to 0..100.
- F10 (low): the directory is synced after sasldb2's rename.
- F11 (low): POSTFIX_STARTSECS by expr, so "010" or "08" in
  MILTER_WAIT_TIMEOUT are decimal, not octal or an error.
- Security (low): pagehide also empties defaultValue - the input's value
  attribute and the textarea's text - not only .value. A sasldb2.new left
  by a killed panel is removed at start (entrypoint) and never archived.
  security.md says that links under certs/ are followed and by whom they
  can be placed.

Tests: sender check cases for F1 (four lines), F2 (a bound address
quoted, for its owner and for another), F3; EndError's state and status;
pct cases. architecture.md and CHANGELOG describe the reader rule. Stand
(2026-10-15, make e2e, exit 0); go vet and go test ./... pass on the
server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/Dockerfile

@@ -120,6 +120,7 @@ COPY --chmod=0644 internal/web/view/static/OFL.txt /usr/share/doc/selfpost/OFL.t
 COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
 COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
 COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
+COPY --chmod=0755 build/postfix-reload.sh /usr/local/bin/postfix-reload.sh
 COPY --chmod=0755 build/postfix-config.sh /usr/local/bin/postfix-config.sh
 COPY --chmod=0755 build/postfix-cert-reload.sh /usr/local/bin/postfix-cert-reload.sh
 COPY --chmod=0755 build/logrotate-loop.sh /usr/local/bin/logrotate-loop.sh

build/crashexit.py

@@ -24,8 +24,10 @@ import os
 import signal
 import sys
 
-# Programs whose FATAL does not take the container down (build/supervisord.conf).
-SPARED = {"logrotate"}
+# Programs whose FATAL does not take the container down (build/supervisord.conf):
+# logrotate is not on the mail path, and postfix-reload runs on demand - a
+# reload it could not start is reported to whoever asked for it.
+SPARED = {"logrotate", "postfix-reload"}
 
 
 def write_stdout(s):

build/entrypoint.sh

@@ -101,6 +101,10 @@ mkdir -p /data/sasl
 chown -R panel:selfpost /data/sasl
 chmod 2750 /data/sasl
 [ -e /data/sasl/sasldb2 ] && chmod 0640 /data/sasl/sasldb2
+# The copy a password change is made on (internal/app, replaceSASLDB), left
+# by a panel killed mid-change: a second copy of every password, which the
+# next change would remove anyway.
+rm -f /data/sasl/sasldb2.new
 
 # Postfix state under /data (architecture.md § Persistence). The panel writes
 # sender_login_maps; Postfix owns the on-disk queue tree under queue/.
@@ -211,6 +215,8 @@ case "$wait_timeout" in
 	exit 1
 	;;
 esac
-export POSTFIX_STARTSECS=$((wait_timeout + 10))
+# expr, not $((...)): dash's arithmetic reads "010" as octal and refuses
+# "08"; expr takes decimal (review of stage 2c, F11).
+export POSTFIX_STARTSECS=$(expr "$wait_timeout" + 10)
 
 exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf

build/postfix-reload.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# The reload the panel asks supervisord for (program postfix-reload,
+# build/supervisord.conf; internal/supervisor RunOnce reads its exit status).
+#
+# Exit 75 says no Postfix master runs - it is stopped, or still in its start
+# behind the milter wait (build/postfix-wrapper.sh) - and the master that
+# starts next reads the files as they are now, so the panel takes that as
+# done. Anything else is "postfix reload" itself: 0, or its failure (Postfix
+# 3.7.11, conf/postfix-script, "reload": exit 1 when not running or when
+# postsuper fails; src/postfix/postfix.c, a main.cf it cannot read). "master
+# -t" exits 0, silently, while no master holds the lock (src/master/master.c,
+# test_lock). A master that stops between the two is a failure the panel
+# reports - the rarer mistake (review of stage 2c, F5).
+d=$(postconf -h daemon_directory) || exit 1
+if "$d/master" -t 2>/dev/null; then
+	echo "postfix-reload: Postfix is not running; its start reads the files" >&2
+	exit 75
+fi
+exec /usr/sbin/postfix reload

build/postfix-wrapper.sh

@@ -63,9 +63,15 @@ echo "postfix-wrapper: milter sockets ready, starting postfix"
 # holds the lock (src/master/master.c, test_lock).
 daemon_directory=$(postconf -h daemon_directory)
 child=
+stop_asked=
 stop_postfix() {
+	if [ -z "$child" ]; then
+		# Between "&" and "child=$!": stopped right after the pid is known.
+		stop_asked=1
+		return
+	fi
 	trap '' TERM INT
-	while [ -n "$child" ] && kill -0 "$child" 2>/dev/null; do
+	while kill -0 "$child" 2>/dev/null; do
 		if "$daemon_directory/master" -t 2>/dev/null; then
 			sleep 1
 		else
@@ -77,6 +83,9 @@ stop_postfix() {
 trap stop_postfix TERM INT
 postfix start-fg &
 child=$!
+if [ -n "$stop_asked" ]; then
+	stop_postfix
+fi
 # A trapped signal makes wait return at once, the trap is taken right after
 # (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
 # Otherwise wait returns when Postfix ended on its own: its status is this

build/supervisord.conf

@@ -99,16 +99,18 @@ stderr_logfile_maxbytes=0
 ; foreground process never reaches it (unlike OpenDKIM, which runs in the
 ; foreground as the supervised process itself). Instead the panel asks
 ; supervisord — over the group-accessible control socket — to run this program,
-; which executes the canonical `postfix reload` as root. autostart is off (it
-; only runs on demand) and a fast, clean exit is expected, so it never trips the
-; crashexit listener. (start-fg: see build/postfix-wrapper.sh. supervisor
+; which runs the canonical `postfix reload` as root - or exits 75 when no
+; master runs (build/postfix-reload.sh). autostart is off (it only runs on
+; demand). A program that cannot even be spawned twice in a row ends FATAL
+; (startretries=1); crashexit leaves that to the page that asked for the
+; reload, which reports it (build/crashexit.py; review of stage 2c, F6). (start-fg: see build/postfix-wrapper.sh. supervisor
 ; 4.2.5, supervisor/process.py, Subprocess.finish(): with startsecs=0 no exit
 ; counts as "too quickly", so even a failed run ends EXITED - never BACKOFF,
 ; never FATAL - with its exit status kept, which the panel reads
 ; (internal/supervisor, RunOnce). Its resting state is STOPPED until the first
 ; run, EXITED after it; assumptions C-V10.)
 [program:postfix-reload]
-command=/usr/sbin/postfix reload
+command=/usr/local/bin/postfix-reload.sh
 autostart=false
 autorestart=false
 startsecs=0