Finding sendmail during configure

[Erik Klavon]

On Thu, Sep 04, 2003 at 10:54:55AM -0700, Russ Allbery wrote:
> What do you think about the question of whether to look along the user's
> path or not?  One of the problems that I had with the original behavior
> (and have had since the beginning) is that the stated reason for it was to
> avoid using some random version of sendmail that the sysadmin didn't know
> they had installed, but we looked for sendmail on the path of the user
> doing the compile.  I think that's *far* more likely to pick up some
> broken sendmail than looking in /usr/sbin and /usr/lib.

Yeah, that isn't something I could stomach because its subject to too
many variables. Forrest gives a really good example of why this is not
a good idea (excerpted below).

Forrest J. Cavalier III  wrote:
> The goal of configure is to install software properly with as few
> surprises as possible. It is NOT a goal to do it in as few commands
> as possible, with the least amount of messages presented to the user
> (although autoconf is waaay too noisy.)

I agree (well, I don't think autoconf is too talkative, but anyway =).

> The "people who know enough to be concerned" are a fraction of those
> who install INN.  Is it a service to the rest (the majority) to
> silently pick a sendmail which is not trusted to be in the installer's
> path? 

No, it is certainly a disservice! Sorry I wasn't clear on this
point. I belive I advocated doing what everyone else does. I just
poked around a bit and it looks like only one package I have
recently compiled from source looks in the path for things like
sendmail. (There are cases of looking for build tools like cc in $PATH
if all else fails, which seems reasonable.) Is this behavior common or
recommended by some authority in autoconf?

> Consider that there are plenty of sites which have a junior
> admin using a root account set up by policy or a senior admin who
> carefully picked what was in the path.

A good example!
 
Russ Allbery wrote:
> It seems to me that if there's a broken sendmail in /usr/sbin or /usr/lib,
> the user is going to have a lot more problems than just an outside chance
> of a security hole via INN, given the amount of software that just assumes
> something that's command-line-compatible with sendmail is there
> (particularly in /usr/lib).

Yeah, I think I would notice quickly if sendmail in the usual places
was broken and I wasn't using some other mta.

Erik

-- 
erik         | "It is idle to think that, by means of words, | Maurice
  kl at von     | any real communication can ever pass | Maeterlinck
    eriq.org | from one [human] to another." | Silence