--- sendmail-8.12.9/smrsh/smrsh.8.orig Fri Aug 6 05:55:35 2004 +++ sendmail-8.12.9/smrsh/smrsh.8 Sun Jan 12 03:38:34 2014 @@ -18,28 +18,21 @@ .B smrsh .B \-c command + .SH DESCRIPTION -The -.I smrsh -program is intended as a replacement for -.I sh -for use in the ``prog'' mailer in -.IR sendmail (8) +.LP +The smrsh program is intended as a replacement for sh +for use in the ``prog'' mailer in \fBsendmail\fR(8) configuration files. It sharply limits the commands that can be run using the -``|program'' syntax of -.I sendmail +``|program'' syntax of sendmail in order to improve the over all security of your system. Briefly, even if a ``bad guy'' can get sendmail to run a program -without going through an alias or forward file, -.I smrsh +without going through an alias or forward file, smrsh limits the set of programs that he or she can execute. .PP -Briefly, -.I smrsh -limits programs to be in a single directory, -by default -/usr/adm/sm.bin, +Briefly, smrsh limits programs to be in a single directory, by default +\fB/var/adm/sm.bin\fR, allowing the system administrator to choose the set of acceptable commands, and to the shell builtin commands ``exec'', ``exit'', and ``echo''. It also rejects any commands with the characters @@ -56,43 +49,27 @@ and ``vacation'' all actually forward to -``/usr/adm/sm.bin/vacation''. +``/var/adm/sm.bin/vacation''. .PP System administrators should be conservative about populating the sm.bin directory. -For example, a reasonable additions is -.IR vacation (1), +For example, a reasonable additions is \fBvacation\fR(1), and the like. No matter how brow-beaten you may be, never include any shell or shell-like program -(such as -.IR perl (1)) -in the -sm.bin -directory. +(such as perl) in the sm.bin directory. Note that this does not restrict the use of shell or perl scripts in the sm.bin directory (using the ``#!'' syntax); it simply disallows execution of arbitrary programs. -Also, including mail filtering programs such as -.IR procmail (1) -is a very bad idea. -.IR procmail (1) -allows users to run arbitrary programs in their -.IR procmailrc (5). -.SH COMPILATION -Compilation should be trivial on most systems. -You may need to use \-DSMRSH_PATH=\e"\fIpath\fP\e" -to adjust the default search path -(defaults to ``/bin:/usr/bin:/usr/ucb'') -and/or \-DSMRSH_CMDDIR=\e"\fIdir\fP\e" -to change the default program directory -(defaults to ``/usr/adm/sm.bin''). +Also, including mail filtering programs such as \fBprocmail\fR(1) +is a very bad idea. procmail allows users to run arbitrary programs in their +\fBprocmailrc\fR(5). + .SH FILES -/usr/adm/sm.bin \- default directory for restricted programs on most OSs -.PP -/var/adm/sm.bin \- directory for restricted programs on HP UX and Solaris -.PP -/usr/libexec/sm.bin \- directory for restricted programs on FreeBSD (>= 3.3) and DragonFly BSD +.TP +\fB/var/adm/sm.bin\fR +directory for restricted programs .SH SEE ALSO -sendmail(8) +.LP +\fBsendmail\fR(8)