Skip to content

Fix sendmail executable permission check - #7483

Merged
BlackDex merged 2 commits into
dani-garcia:mainfrom
p-boenisch:fix/sendmail-executable-permissions
Aug 20, 2026
Merged

Fix sendmail executable permission check#7483
BlackDex merged 2 commits into
dani-garcia:mainfrom
p-boenisch:fix/sendmail-executable-permissions

Conversation

@p-boenisch

@p-boenisch p-boenisch commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Fixes #7445

The previous permission check inspected the Unix mode bits directly and
could reject commands that were executable by the current process.

Use nix::unistd::access with AccessFlags::X_OK to check whether the
sendmail command is executable by the running process.

Checks performed:

  • cargo fmt --check
  • cargo check --features sqlite
  • cargo test --features sqlite,mysql,postgresql
  • cargo clippy --features sqlite,mysql,postgresql -- -D warnings

@stefan0xC

Copy link
Copy Markdown
Contributor

As explained in the thread where I've suggested this fix #7445 (comment) this is not actually sufficient. Can you update your PR to use the access check from the suggested nix crate?

@p-boenisch

Copy link
Copy Markdown
Contributor Author

Thanks for the correction. I've replaced the mode-bit check with nix::unistd::access using AccessFlags::X_OK and added nix as a Unix-only dependency with the fs feature. All tests and Clippy checks pass locally.

@BlackDex
BlackDex force-pushed the fix/sendmail-executable-permissions branch from a93fedb to 352546e Compare August 20, 2026 15:21
@BlackDex
BlackDex merged commit 9e78911 into dani-garcia:main Aug 20, 2026
9 checks passed
dfunkt pushed a commit to dfunkt/vaultwarden that referenced this pull request Aug 20, 2026
* Fix sendmail executable permission check

* Use access check for sendmail command
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

USE_SENDMAIL rejects valid owner/group-only executable commands

3 participants