22

✏️ Editing: sieve_extprograms.txt

Sieve Extprograms plugin for Pigeonhole

Relevant specifications
=======================

doc/rfc/spec-bosch-sieve-extprograms.txt

Introduction
============

Sieve (RFC 5228) is a highly extensible machine language specifically tailored
for internet message filtering. For the Dovecot Secure IMAP server, Sieve
support is provided by the Pigeonhole Sieve plugin. This package includes a
plugin for Pigeonhole called "sieve_extprograms", which extends the Sieve 
filtering implementation with action commands for invoking a predefined set of
external programs. Messages can be piped to or filtered through those programs
and string data can be input to and retrieved from those programs.

The Sieve language is explicitly designed to be powerful enough to be useful yet
limited in order to allow for a safe server-side filtering system. Therefore,
the base specification of the language makes it impossible for users to do
anything more complex (and dangerous) than write simple mail filters. One of the
consequences of this security-minded design is that users cannot execute
external programs from their mail filter. Particularly for server-side filtering
setups in which mail accounts have no corresponding system account, allowing the
execution of arbitrary programs from the mail filter can be a significant
security risk. However, such functionality can also be very useful, for instance
to easily implement a custom action or external effect that Sieve normally
cannot provide.

The "sieve_extprograms" plugin provides an extension to the Sieve filtering
language adding new action commands for invoking a predefined set of external
programs. To mitigate the security concerns, the external programs cannot be
chosen arbitrarily; the available programs are restricted through administrator
configuration.

This extension is specific to the Pigeonhole Sieve implementation for the
Dovecot Secure IMAP server. It will therefore most likely not be supported by
web interfaces or GUI-based Sieve editors. This extension is primarily meant for
use in small setups or global scripts that are managed by the systems
administrator.

Implementation Status
---------------------

The "vnd.dovecot.pipe", "vnd.dovecot.filter" and "vnd.dovecot.execute" Sieve
language extensions introduced by this plugin are vendor-specific with draft
status and their implementation for Pigeonhole is experimental, which means that
the language extensions are still subject to change and that the current
implementation is not thoroughly tested.

Configuration
=============

The plugin is activated by adding it to the sieve_plugins setting:

sieve_plugins = sieve_extprograms

This plugin registers the "vnd.dovecot.pipe", "vnd.dovecot.filter" and
"vnd.dovecot.execute" extensions with the Sieve interpreter. However, these
extensions are not enabled by default and thus need to be enabled explicitly. It
is recommended to restrict the use of these extensions to global context by
adding these to the "sieve_global_extensions" setting. If personal user scripts
also need to directly access external programs, the extensions need to be added
to the "sieve_extensions" setting.

The commands introduced by the Sieve language extensions in this plugin can
directly pipe a message or string data to an external program (typically a shell
script) by forking a new process. Alternatively, these can connect to a unix
socket behind which a Dovecot script service is listening to start the external
program, e.g. to execute as a different user or for added security.

The program name specified for the new Sieve "pipe", "filter" and "execute"
commands is used to find the program or socket in a configured directory.
Separate directories are specified for the sockets and the directly executed
binaries. The socket directory is searched first. Since the use of "/" in
program names is prohibited, it is not possible to build a hierarchical
structure.

Directly forked programs are executed with a limited set of environment
variables: HOME, USER, HOST, SENDER, RECIPIENT and ORIG_RECIPIENT. Programs
executed through the script-pipe socket service currently have no environment
set at all.

If a shell script is expected to read a message or string data, it must fully
read the provided input until the data ends with EOF, otherwise the Sieve action
invoking the program will fail. The action will also fail when the shell script
returns a nonzero exit code. Standard output is available for returning a
message (for the filter command) or string data (for the execute command) to the
Sieve interpreter. Standard error is written to the LDA log file.

The three extensions introduced by this plugin - "vnd.dovecot.pipe",
"vnd.dovecot.filter" and "vnd.dovecot.pipe" - each have separate but similar
configuration. The settings that specify a time period are specified in
s(econds), unless followed by a d(ay), h(our) or m(inute) specifier character.
The following configuration settings are used, for which "<extension>" in the
setting name is replaced by either "pipe", "filter" or "execute" depending on
which extension is being configured.

sieve_<extension>_socket_dir =
  Points to a directory relative to the Dovecot base_dir where the plugin looks
  for script service sockets.

sieve_<extension>_bin_dir =
  Points to a directory where the plugin looks for programs (shell scripts) to
  execute directly and pipe messages to.

sieve_<extension>_exec_timeout = 10s
  Configures the maximum execution time after which the program is forcibly
  terminated.

sieve_<extension>_input_eol = crlf
  Determines the end-of-line character sequence used for the data piped to
  external programs. The default is currently "crlf", which represents a
  sequence of the carriage return (CR) and line feed (LF) characters. This
  matches the Internet Message Format (RFC5322) and what Sieve itself uses as a
  line ending. Set this setting to "lf" to use a single LF character instead.

Examples
--------

Example 1: socket service for "pipe" and "execute"

plugin {
  sieve = ~/.dovecot.sieve

sieve_plugins = sieve_extprograms
  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute

# pipe sockets in /var/run/dovecot/sieve-pipe
  sieve_pipe_socket_dir = sieve-pipe

# execute sockets in /var/run/dovecot/sieve-execute
  sieve_execute_socket_dir = sieve-execute
}

service sieve-pipe-script {
  # This script is executed for each service connection
  executable = script /usr/lib/dovecot/sieve-extprograms/sieve-pipe-action.sh

# use some unprivileged user for execution
  user = dovenull

# socket name is program-name in Sieve (without sieve-pipe/ prefix)
  unix_listener sieve-pipe/sieve-pipe-script {
  }
}

service sieve-execute-action {
  # This script is executed for each service connection
  executable = script /usr/lib/dovecot/sieve-extprograms/sieve-execute-action.sh

# use some unprivileged user for execution
  user = dovenull

# socket name is program-name in Sieve (without sieve-execute/ prefix)
  unix_listener sieve-execute/sieve-execute-action {
  }
}

Example 2: direct execution for "pipe" and "filter"

plugin {
  sieve = ~/.dovecot.sieve

sieve_plugins = sieve_extprograms
  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter

# This directory contains the scripts that are available for the pipe command.
  sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe

# This directory contains the scripts that are available for the filter
  # command.
  sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
}

Using
=====

Refer to doc/rfc/spec-bosch-sieve-extprograms.txt for a specification of the
Sieve language extensions.

MR SKB