[gnu.emacs] emacs sendmail committing forgery

chet@arc.UUCP (Chet Wood) (05/04/89)

Several people at our organization use GNU emacs (18.53) for their mail.
Until recently, everyone logged in to the main mailhost Sun 3/280 for
mail purposes. Then we exported the mailhost's /var/spool/mail and
mounted it on all subsidiary machines. When sending mail to people
with a local address (e.g. "user"), from emacs running on a subsidiary
machine, the message arrives claiming to be _from_ the first person
on the "To: " line. An address of the form "user@machine" doesn't show
the problem. Nor does the problem show up when using bsd "mail" for
sending.

For example, the following was sent by chet to "news." It showed up in
news' mail as:

---------------------------------------------------------------
Message  5:
>From news Wed May  3 09:34:03 1989
Return-Path: <news>
Received: from sparcy.arc.UUCP by arc.UUCP (4.0/SMI-4.0)
        id AA09323; Wed, 3 May 89 09:34:02 PDT
Date: Wed, 3 May 89 09:34:02 PDT
From: news
Message-Id: <8905031634.AA09323@arc.UUCP>
Received: by sparcy.arc.UUCP (4.0/SMI-4.0)
        id AA02095; Wed, 3 May 89 09:35:51 PDT
To: news
Subject: from chet on sparcy using GNU emacs sendmail
Status: RO
----------------------------------------------------------------

To figure out whether the problem was with emacs or sendmail, I wrote
a little script to capture its own arguments, standard in, and
environment. I told emacs to invoke this script instead of
/usr/lib/sendmail, and sent mail.

The result?

----------------------------------------------------------------
ENVIRONMENT:
 (lots of stuff)

ARGS: -oi -t -oem -odb

STDIN:
To: news
Subject: blah blah

----------------------------------------------------------------

Looks OK to me. Is sendmail doing the forgery?  Hmmm... But when I
invoke /usr/lib/sendmail from the command line, with the same
environment, args, and input, the forgery does not occur. Everything
works fine.  How could emacs be invoking sendmail differently than I
can on the command line?  I own emacs, and it's not running setuid or
setgid.

Stumped,

Chet Wood                       ~                         (408)727-3357
     arc!chet@apple.COM         .  Advansoft Research Corporation
          chet@arc.UUCP         .       4301 Great America Parkway
               apple!arc!chet   .            Santa Clara, CA 95054, USA


Chet Wood                       ~                         (408)727-3357
     arc!chet@apple.COM         .  Advansoft Research Corporation
          chet@arc.UUCP         .       4301 Great America Parkway
               apple!arc!chet   .            Santa Clara, CA 95054, USA

benson@odi.com (Benson Margulies) (05/04/89)

   
   Several people at our organization use GNU emacs (18.53) for their mail.
   Until recently, everyone logged in to the main mailhost Sun 3/280 for
   mail purposes. Then we exported the mailhost's /var/spool/mail and
   mounted it on all subsidiary machines. When sending mail to people
   with a local address (e.g. "user"), from emacs running on a subsidiary
   machine, the message arrives claiming to be _from_ the first person
   on the "To: " line. An address of the form "user@machine" doesn't show
   the problem. Nor does the problem show up when using bsd "mail" for
   sending.
   

This is a bug in Sunos 4 sendmail. If getlogin() return 0, which it
does when stdin/out/err is a pipe of a pty without a utmp entry,
sendmail goes batshit. We hacked mail.el to add an explicit -f. 
Sun has acknowledged the bug, and promises a fix "sometime."

-- 
Benson I. Margulies

pdg@ihlpy.ATT.COM (Paul D. Guthrie) (05/05/89)

In article <276@arc.UUCP> chet@arc.UUCP (Chet Wood) writes:
>When sending mail to people
>with a local address (e.g. "user"), from emacs running on a subsidiary
>machine, the message arrives claiming to be _from_ the first person
>on the "To: " line. An address of the form "user@machine" doesn't show
>the problem. Nor does the problem show up when using bsd "mail" for
>sending.

We also see this problem, and I have also tried debugging this, 
from the shell, with no success.  It also does not happen
all of the time, but more often when you have more than
1 recipient specified.  Even changing the sendmail prog to
be a script to dump its input to disk, and then subsequently
running sendmail in debug mode does not reproduce this.

Any help would be appreciated.

-- 
Paul Guthrie
att!iexplode!pdg

chet@arc.UUCP (Chet Wood) (05/06/89)

In article <12678@ihlpy.ATT.COM>, pdg@ihlpy (Paul D. Guthrie) writes:
>In article <276@arc.UUCP> chet@arc.UUCP (Chet Wood) writes:
>>When sending mail to people
>>with a local address (e.g. "user"), from emacs running on a subsidiary
>>machine, the message arrives claiming to be _from_ the first person
>>on the "To: " line. An address of the form "user@machine" doesn't show
>>the problem. Nor does the problem show up when using bsd "mail" for
>>sending.
>
>We also see this problem, and I have also tried debugging this, 
>from the shell, with no success. 
>
>Any help would be appreciated.

benson@odi.UUCP (Benson Margulies) posted the definitive reply in
comp.emacs (for some reason.) Here is what he said in
<314@odi.ODI.COM>:

:This is a bug in Sunos 4 sendmail. If getlogin() return 0, which it
:does when stdin/out/err is a pipe of a pty without a utmp entry,
:sendmail goes batshit. We hacked mail.el to add an explicit -f. 
:Sun has acknowledged the bug, and promises a fix "sometime."

Thanks, Benson. Also, I'd like to thank Stephen Gildea and Anton Rang
for their help.
Chet Wood                       ~                         (408)727-3357
     arc!chet@apple.COM         .  Advansoft Research Corporation
          chet@arc.UUCP         .       4301 Great America Parkway
               apple!arc!chet   .            Santa Clara, CA 95054, USA

Gordon@ucl-cs.UUCP (05/08/89)

NOT using GNU Emacs 18.54.1 of Sat Apr 29 1989 on karl.stats.ucl.ac.uk (berkeley-unix)
for mail with mh-e.elc.

Could any else confirm the problem that mh-smail with SUN 4.0
will also fail?
Gordon. 

Surface mail: Dr. G.C.Joly, Department of Statistical Science,
      University College London, Gower Street, LONDON WC1E 6BT, U.K.
E-mail:  					   | Tel: +44 1 387 7050
 JANET (U.K. network) gordon@uk.ac.ucl.stats       |      extension 3636
       (Arpa/Internet form: gordon@stats.ucl.ac.uk)| FAX: +44 1 387 8057
Relays: ARPA @nsfnet-relay.ac.uk                   |
        EAN: @ean-relay.ac.uk                      |
	CSNET: %nsfnet-relay.ac.uk@relay.cs.net    |
        BITNET: %ukacrl.bitnet@cunyvm.cuny.edu, @ac.uk
        EARN: @ukacrl.bitnet, @AC.UK, @uk.ac.earn-relay
By uucp/Usenet: ....!uunet!mcvax!ukc!stats.ucl.ac.uk!gordon

barnett@crdgw1.crd.ge.com (Bruce G. Barnett) (05/17/89)

In article <314@odi.ODI.COM>, benson@odi (Benson Margulies) writes:

>This is a bug in Sunos 4 sendmail. If getlogin() return 0, which it
>does when stdin/out/err is a pipe of a pty without a utmp entry,
>sendmail goes batshit. We hacked mail.el to add an explicit -f.
>Sun has acknowledged the bug, and promises a fix "sometime."

Could you post this fix for the non-emacs hackers?

--
Bruce G. Barnett	<barnett@crdgw1.ge.com>  a.k.a. <barnett@[192.35.44.4]>
			uunet!crdgw1.ge.com!barnett barnett@crdgw1.UUCP

chet@arc.UUCP (Chet Wood) (05/18/89)

Here is my hack to sendmail.el to work around the SunOs4 sendmail bug.

Unfortunately, it looks like I forgot to save my original sendmail.el,
so diffs are not available. It shouldn't be too hard to figure out-- I
just commented out two lines.

The following starts on line 237 of the 18.54 version (18.53 is the
same, I think):

++++++++++++++++++++++++++++++++++++++++++++
;;;; Hack this out for Sun sendmail bug
;;;;			 (and (equal (user-real-login-name) "root")
			      (list "-f" (user-login-name))
;;;;			      )
			 ;; These mean "report errors by mail"
			 ;; and "deliver in background".
+++++++++++++++++++++++++++++++++++++++++++++

Enjoy.

Chet Wood
Chet Wood                       ~                         (408)727-3357
     arc!chet@apple.COM         .  Advansoft Research Corporation
          chet@arc.UUCP         .       4301 Great America Parkway
               apple!arc!chet   .            Santa Clara, CA 95054, USA