mail-filter/opendkim: new revision with a dedicated "opendkim" user.
Prior to this revision, the OpenDKIM daemon would run as the "milter"
user, which is a username shared by a few other related packages.
However, that user has the ability to read your private DKIM signing
keys, and no other services should have access to those. Thus, sharing
the user account creates a security risk. In the new revision, a
dedicated "opendkim" user is created for the OpenDKIM daemon. The
configuration, OpenRC service script, and systemd service files have
all been updated with the new user name.
In addition, the permissions on /var/lib/opendkim have been tightened
so members of the "opendkim" group can only read it by default. The
daemon does not need to modify your keys, in particular, and should
not be able to. One downside to this is that the "Statistics"
configuration directive that was enabled by default with USE=berkdb
will no longer work out-of-the-box. It will still work, but the
administrator will need to grant write access to the file that he
designates for the statistics data. But since it won't work without
some extra fiddling, it has been removed from the configuration file
that we install.
An ewarn notifies users who are upgrading of the account name change.
Closes: https://bugs.gentoo.org/629888
Signed-off-by: Michael Orlitzky <mjo@gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11