audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/crashexit.py

@@ -2,32 +2,51 @@
 """Supervisor event listener: bring the container down on unrecoverable failure.
 
 If a managed program of the mail path exhausts its restart retries and
-enters FATAL, this listener signals supervisord (its parent) to terminate, so
-the whole container exits and Docker's `restart` policy starts it again —
-rather than lingering "alive" with a dead Postfix/OpenDKIM/panel. logrotate is
-not on the mail path: its FATAL (a config it would ignore) stays on
-Server > Health, and mail keeps flowing (assumptions C-V5).
+enters FATAL, or keeps crashing - CRASH_LIMIT unexpected exits within
+CRASH_WINDOW seconds - this listener signals supervisord (its parent) to
+terminate, so the whole container exits and Docker's `restart` policy starts it
+again, rather than lingering "alive" with a dead Postfix/OpenDKIM/panel.
+FATAL alone did not cover the second: a program reaches FATAL only through
+exits before its startsecs, and one that crashed after it was restarted for
+ever (audit 2026-10-12, L32; supervisor 4.2.5, supervisor/process.py,
+Subprocess.finish()). logrotate is not on the mail path: its FATAL (a config
+it would ignore) stays on Server > Health, and mail keeps flowing
+(assumptions C-V5).
 
 Communication with supervisord uses the event listener protocol over stdin and
 stdout, so stdout must carry only protocol tokens.
 
 supervisor 4.2.5, docs/events.rst, "Event Listener Notification Protocol": the
 listener writes READY\\n, reads one header line of key:value tokens whose len
-is the payload's length, reads the payload, and answers "RESULT 2\\nOK".
-A PROCESS_STATE_FATAL payload is a token set, "processname:cat groupname:cat
-from_state:BACKOFF" (docs/events.rst; supervisor/events.py,
-ProcessStateEvent.payload()).
+is the payload's length and eventname the event's type, reads the payload, and
+answers "RESULT 2\\nOK". A PROCESS_STATE_FATAL payload is a token set,
+"processname:cat groupname:cat from_state:BACKOFF"; a PROCESS_STATE_EXITED one
+adds "expected:0" for an exit code the program's exitcodes do not list, "1"
+otherwise (docs/events.rst; supervisor/events.py, ProcessStateEvent.payload()).
 supervisord starts the listener as its own child, and on SIGTERM it shuts down
 (docs/running.rst, "Signals"); it is PID 1 here (build/entrypoint.sh, exec).
+
+CRASHEXIT_DRYRUN=1 writes "crashexit: would shut down" instead of signalling,
+for the test (build/crashexit_test.go).
 """
 import os
 import signal
 import sys
+import time
 
-# Programs whose FATAL does not take the container down (build/supervisord.conf):
-# logrotate is not on the mail path, and postfix-reload runs on demand - a
-# reload it could not start is reported to whoever asked for it.
-SPARED = {"logrotate", "postfix-reload"}
+# Programs whose failure does not take the container down
+# (build/supervisord.conf): logrotate is not on the mail path, postfix-reload
+# runs on demand - a reload it could not start is reported to whoever asked for
+# it - syslog-relay carries OpenDKIM's log lines, not mail, and cert-reload
+# looks for a renewed certificate once a day (a crash of it leaves the one
+# Postfix serves).
+SPARED = {"logrotate", "postfix-reload", "syslog-relay", "cert-reload"}
+
+# CRASH_LIMIT unexpected exits of one program within CRASH_WINDOW seconds are a
+# program that does not stay up. A program on the mail path restarts in
+# seconds; five times in ten minutes is no passing fault.
+CRASH_LIMIT = 5
+CRASH_WINDOW = 600
 
 
 def write_stdout(s):
@@ -35,7 +54,20 @@ def write_stdout(s):
     sys.stdout.flush()
 
 
+def say(s):
+    sys.stderr.write("crashexit: " + s + "\n")
+    sys.stderr.flush()
+
+
+def shut_down():
+    if os.environ.get("CRASHEXIT_DRYRUN") == "1":
+        say("would shut down")
+        return
+    os.kill(os.getppid(), signal.SIGTERM)
+
+
 def main():
+    crashes = {}  # program -> times of its unexpected exits in the window
     while True:
         # Tell supervisord we are ready for the next event.
         write_stdout("READY\n")
@@ -50,22 +82,32 @@ def main():
             pair.split(":", 1) for pair in payload.split() if ":" in pair
         )
         name = tokens.get("processname", "")
+        event = headers.get("eventname", "PROCESS_STATE_FATAL")
 
-        # We only subscribe to PROCESS_STATE_FATAL, so any event means a managed
-        # program can no longer be restarted.
-        if name in SPARED:
-            sys.stderr.write(
-                "crashexit: %s entered FATAL; it is not on the mail path, the "
-                "container stays up\n" % name
+        if event == "PROCESS_STATE_EXITED":
+            if name not in SPARED and tokens.get("expected") == "0":
+                now = time.monotonic()
+                times = [t for t in crashes.get(name, []) if now - t < CRASH_WINDOW]
+                times.append(now)
+                crashes[name] = times
+                if len(times) >= CRASH_LIMIT:
+                    say(
+                        "%s exited unexpectedly %d times in %d seconds; shutting down container"
+                        % (name, len(times), CRASH_WINDOW)
+                    )
+                    shut_down()
+                    crashes[name] = []
+        elif name in SPARED:
+            say(
+                "%s entered FATAL; it is not on the mail path, the container stays up"
+                % name
             )
-            sys.stderr.flush()
         else:
-            sys.stderr.write(
-                "crashexit: %s entered FATAL; shutting down container\n"
+            say(
+                "%s entered FATAL; shutting down container"
                 % (name or "a managed process")
             )
-            sys.stderr.flush()
-            os.kill(os.getppid(), signal.SIGTERM)
+            shut_down()
 
         write_stdout("RESULT 2\nOK")