base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/entrypoint.sh

@@ -66,6 +66,31 @@ esac
 # mode 0o700".)
 chown panel:panel /data
 chmod 755 /data
+
+# What follows runs as root over a tree the panel user writes: /data is the
+# panel's, and so is /data/postfix. A symbolic link the panel put where a
+# directory or a file of its own is expected would lead root's mkdir, ": >",
+# chmod and chgrp to whatever it names (chmod follows a link; so do a
+# redirect and mkdir -p; chown -R and find do not descend into one given as
+# their operand). None of these paths is ever a link in a working
+# installation, so a link there is removed and the path made anew below.
+# (Security review of base-trixie, 2026-10-15: no escalation found, as the
+# TLS key copy and the read-only mounts stand, but nothing for root to
+# follow either.)
+drop_links() {
+	for p in "$@"; do
+		if [ -L "$p" ]; then
+			echo "entrypoint: removing the symbolic link $p" >&2
+			rm -f "$p"
+		fi
+	done
+}
+drop_links /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
+	/data/opendkim/keys /data/opendkim/KeyTable /data/opendkim/SigningTable \
+	/data/sasl/sasldb2 /data/postfix/queue \
+	/data/postfix/sender_login_maps /data/postfix/relay_domains \
+	/data/postfix/transport /data/postfix/relay_recipients /data/postfix/tls_policy \
+	/data/log/mail.log
 # Restored backups or previously-created state may contain panel-owned files
 # under /data; make sure they stay writable without disturbing anything that a
 # later phase deliberately hands to another service. /data/log is exempt: it is
@@ -73,7 +98,7 @@ chmod 755 /data
 # normalised on its own below, as are the trees shared through group selfpost.
 # A file's owner is a number: an entry whose user or group is not the panel's
 # by that number - unpacked by root, or written under another image whose
-# useradd gave the panel other ids (bookworm's 999:999, until 2.7.0) - is
+# image gave the panel other ids (999:999 until 2.7.0, 10999:10999 since) - is
 # handed over whole.
 find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name opendkim ! -name sasl ! -name antispam \
 	\( ! -user panel -o ! -group panel \) -exec chown -R panel:panel {} +