current/SOURCES/postfix-chroot.sh

#!/bin/sh
#
# postfix-chroot.sh - enable or disable Postfix chroot
#
# (C) 2003 Luca Berra <bluca@vodka.it>
#
# originally based on postfix-chroot.sh
# (C) 2003 Simon J Mudd <sjmudd@pobox.com>
#
# This script is intended to enable you to enable or disable the Postfix
# chroot environment.
#
# License:
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of the GNU General Public License
#    as published by the Free Software Foundation; either version 2
#    of the License, or (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You may have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
#    USA.
#
#    An on-line copy of the GNU General Public License can be found
#    http://www.fsf.org/copyleft/gpl.html.

usage () {
    myname=${0##*/}
    cat <<EOF
Usage: $myname [-q|-h] {enable|disable|update|check|check_update}

    Options:
        -h      - this help
        -q      - do not issue action/error messages
    Commands:
        enable  - setup Postfix chroot (removing the previous setup)
        disable - remove Postfix chroot
        update  - update files in Postfix chroot
        check   - check differences between files in chroot and system
        check_update   - check differences between files in chroot and system
                         and update if needed
EOF
}

# print an error message and exit
error () {
    echo "Error: $@" >&2
    exit 1
}

# print a warning message
warn () {
    echo "Warning: $@" >&2
}

# if $verbose==1 print message ($2) otherwise do nothing
info () {
    [ "$verbose" = 1 ] && echo "$@" >&2 || :
}

# Link source file to chroot directory if possible. If the source is a
# symbolic link, make a copy of the link in the chroot directory,
# otherwise copy the file.
copy() {
    local T L
    if [ -n "$2" ]; then
        T=${chroot%/}/${2#/}
    else
        T=${chroot%/}/${1#/}
    fi
    info "  $1 -> $T"
    mkdir -p ${T%/*}
    if [ -L $1 ]; then
        L=`readlink -f $1`
        ln -sf $L $T
        copy $L
    else
        ln -f $1 $T 2>/dev/null || \
            cp -pf $1 $T
    fi
}

rmtree() {
    local d=${1#$chroot}/
    while [ -n "${d%/*}" ]; do
        rmdir ${chroot}${d} 2>/dev/null || return 1
    done
}    

remove() {
    local L
    local f=${1#$chroot}
    f=${chroot%/}/${f#/}
    if [ -L $f ]; then
        L=`readlink -f $f`
        [ -f ${chroot}$L ] && rm -f ${chroot}$L
        rmtree ${chroot}${L%/*}
        rm -f $f
    elif [ -f $f ];then
        rm -f $f
    fi
    rmtree ${f%/*}
}

# update syslog configuration (rsyslog, sysklogd or syslog-ng)
update_sysklogd() {
    local SYSLOGD_OPTIONS=""
    local NEW_SYSLOGD_OPTIONS=""

    [ -s /etc/sysconfig/syslog ] && . /etc/sysconfig/syslog

    case $1 in
        enable)
            if ! grep -qs "^[[:space:]]*SYSLOGD_OPTIONS" /etc/sysconfig/syslog ; then
                    info "Adding SYSLOGD_OPTIONS in the /etc/sysconfig/syslog file."
                    echo "SYSLOGD_OPTIONS=\"-a ${chroot}/dev/log\"" >> /etc/sysconfig/syslog
                    service_restart_syslog=1
            else
                    if ! grep -q "^[[:space:]]*SYSLOGD_OPTIONS=.*-a ${chroot}/dev/log" /etc/sysconfig/syslog; then
                    NEW_SYSLOGD_OPTIONS="${SYSLOGD_OPTIONS} -a ${chroot}/dev/log"
                    sed -i -e "s!^[[:space:]]*SYSLOGD_OPTIONS=.*\$!SYSLOGD_OPTIONS=\"${NEW_SYSLOGD_OPTIONS}\"!" /etc/sysconfig/syslog
                    service_restart_syslog=1
                    fi
            fi
            ;;
        disable)
            NEW_SYSLOGD_OPTIONS="`echo ${SYSLOGD_OPTIONS} | sed -e \"s! *-a ${chroot}/dev/log!!\"`"
            if [ "${NEW_SYSLOGD_OPTIONS}" != "${SYSLOGD_OPTIONS}" ]; then
                    sed -i -e "s!^[[:space:]]*SYSLOGD_OPTIONS=.*\$!SYSLOGD_OPTIONS=\"${NEW_SYSLOGD_OPTIONS}\"!" /etc/sysconfig/syslog
                    service_restart_syslog=1
            fi
            ;;
    esac
}

update_rsyslog() {
# note: we use a single configuration file for all postfix instances, to avoid issue in case an instance is renamed
    case $1 in
        enable)
            if ! grep -qs "\$AddUnixListenSocket ${chroot}/dev/log" /etc/rsyslog.d/postfix.conf; then
                echo "\$AddUnixListenSocket ${chroot}/dev/log" >> /etc/rsyslog.d/postfix.conf
                service_restart_rsyslog=1
            fi
        ;;
        disable)
            if grep -qs "\$AddUnixListenSocket ${chroot}/dev/log" /etc/rsyslog.d/postfix.conf; then
                sed -i -e "\!\$AddUnixListenSocket ${chroot}/dev/log!d" /etc/rsyslog.d/postfix.conf
                [ -f /etc/rsyslog.d/postfix.conf -a ! -s /etc/rsyslog.d/postfix.conf ] && rm -f /etc/rsyslog.d/postfix.conf
                service_restart_rsyslog=1
            fi
        ;;
    esac
}
update_syslogng_old() {
    case $1 in
        enable)
            if ! grep -q -E "(unix-stream|file)[[:space:]]*\([[:space:]]*([\"'])${chroot}/dev/log\2" /etc/syslog-ng.conf; then
                if [ ! -e ${confdir}/syslog-ng.conf ]; then
                    warn "cannot find ${confdir}/syslog-ng.conf, instance will not log properly"
                elif [ -s ${confdir}/syslog-ng.conf ]; then
                    sed -e "s!@CHROOT@!${chroot}!" -e "s!@CONFDIR@!${confdir}!" -e "/^@/d" ${confdir}/syslog-ng.conf >> /etc/syslog-ng.conf
                    service_restart_syslog_ng=1
                fi
            fi
            ;;
        disable)
            if grep -q "^# BEGIN: Automatically added by postfix chroot setup script for ${chroot}\$" /etc/syslog-ng.conf; then
                sed -i -e "\!^# BEGIN: Automatically added by postfix chroot setup script for ${chroot}\$!,\!^# END ${chroot}\$!d" /etc/syslog-ng.conf
                service_restart_syslog_ng=1
            elif grep -q "^# BEGIN: Automatically added by postfix chroot setup script\$" /etc/syslog-ng.conf; then
                sed -i -e '/^# BEGIN: Automatically added by postfix chroot setup script$/,/^# END$/d' /etc/syslog-ng.conf
                service_restart_syslog_ng=1
            fi
            ;;
    esac
}
update_syslogng() {
# note: we use a single configuration file for all postfix instances, to avoid issue in case an instance is renamed
    case $1 in
        enable)
            if ! grep -qs -E "(unix-stream|file)[[:space:]]*\([[:space:]]*([\"'])${chroot}/dev/log\2" /etc/syslog-ng.d/postfix_chroot.conf; then
                # we need to give a different name to each source
                local instance_name=`postconf -c ${confdir} -h multi_instance_name 2>/dev/null`
                echo "# BEGIN: Automatically added by postfix chroot setup script for ${chroot}" >> /etc/syslog-ng.d/postfix_chroot.conf
                echo "source s_postfix_chroot${instance_name:+_$instance_name} { unix-stream(\"${chroot}/dev/log\"); };" >> /etc/syslog-ng.d/postfix_chroot.conf
                echo "# END ${chroot}" >> /etc/syslog-ng.d/postfix_chroot.conf
                service_restart_syslog_ng=1
            fi
            ;;
        disable)
            if grep -qs "^# BEGIN: Automatically added by postfix chroot setup script for ${chroot}\$" /etc/syslog-ng.d/postfix_chroot.conf; then
                sed -i -e "\!^# BEGIN: Automatically added by postfix chroot setup script for ${chroot}\$!,\!^# END ${chroot}\$!d" /etc/syslog-ng.d/postfix_chroot.conf
                [ -f /etc/syslog-ng.d/postfix_chroot.conf -a ! -s /etc/syslog-ng.d/postfix_chroot.conf ] && rm -f /etc/syslog-ng.d/postfix_chroot.conf
                service_restart_syslog_ng=1
            fi
            ;;
    esac
}
update_syslog() {
    case $1 in
        enable)
            mkdir -p ${chroot}/dev 2>/dev/null
            ;;
        disable)
            rm -f ${chroot}/dev/log 2>/dev/null
            rmdir ${chroot}/dev 2>/dev/null
            ;;
    esac
    [ -f '/etc/sysconfig/syslog' ] && update_sysklogd $1
    [ -f '/etc/sysconfig/rsyslog' ] && update_rsyslog $1
    if [ -f '/etc/syslog-ng.conf' ]; then 
        if [ -d '/etc/syslog-ng.d' ]; then
            update_syslogng_old disable # clean cruft if upgraded syslog-ng version
            update_syslogng $1
        else
            update_syslogng_old $1
        fi
    fi
}

##########################################################################
#
# remove chroot jail

remove_chroot () {
    verbose=1

    [ "$1" = "quiet" ] && verbose=0
    [ "$1" = "noconf" ] && verbose=0 && noconf=1

    info "removing chroot from: ${chroot}"

    # remove system files
    info "remove system files from chroot"
    for i in ${BASE_FILES} \
            etc/passwd etc/group \
            etc/samba/smb.conf etc/samba/lmhosts \
            etc/ldap.conf ; do
        remove $i
    done

    info "remove additional files from chroot"
    for i in $ADDITIONAL_FILES; do
        # in case we have /path/file=/newpath/newfile
        remove ${i##*=}
    done

    info "removing chroot libraries from: ${chroot}"

    # remove nss libraries
    libs=""
    for l in ${chroot}/${_lib}/lib*.so* ${chroot}/usr/${_lib}/lib*.so*; do
        [ -f $l ] && \
            libs="$libs $l `ldd $l | awk -v c=${chroot} '{print c $3}'`"
    done
    
    if [ -n "$libs" ]; then
        info "remove nss files from chroot"
        for l in $libs; do
            remove $l
        done
    fi

    info "remove system directories from chroot"
    for dir in var/lib/sasl2 var/lib var usr/share/zoneinfo \
        usr/share usr/${_lib} usr ${_lib} etc; do
        [ -d ${chroot}/${dir} ] && \
            info "  ${chroot}/${dir}" && \
            rmtree ${chroot}/${dir}
    done

    [ "$noconf" = "1" ] && return
    
    # remove chroot settings from master.cf
    awk -v ALWAYS_CHROOT_PROGRAM="$ALWAYS_CHROOT_PROGRAM" \
        -v ALWAYS_CHROOT_SERVICE="$ALWAYS_CHROOT_SERVICE" '
            BEGIN                   { IFS="[ \t]+"; OFS="\t"; }
            /^#/                    { print; next; }
            /^ /                    { print; next; }
            $1 ~ ALWAYS_CHROOT_SERVICE    { print; next; }
            $8 ~ ALWAYS_CHROOT_PROGRAM    { print; next; }
            $5 == "y"               { $5="n"; print $0; next; }
                                    { print; }
        ' ${confdir}/master.cf.${bckext} > ${confdir}/master.cf
}

#
##########################################################################

##########################################################################
#
# setup chroot jail

setup_chroot () {
    verbose=1

    [ -n "$1" ] && [ "$1" = quiet ] && verbose=0

    # Check master.cf is where we expect it
    [ -f ${confdir}/master.cf ] || error "${confdir}/master.cf missing, exiting"
    info "setting up chroot at: ${chroot}"

    # copy system files into chroot environment
    info "copy system files into chroot"
    for i in ${BASE_FILES}; do
        [ -e ${i} ] && copy ${i}
    done

    info "copy additional files into chroot"
    for i in $ADDITIONAL_FILES; do
        # in case we have /path/file=/newpath/newfile
        copy ${i%%=*} ${i##*=}
    done

    # for sasl
    mkdir -p ${chroot}/var/lib/sasl2 2>/dev/null

    # for ldaps
    mkdir -p ${chroot}/dev
    cp -af /dev/urandom ${chroot}/dev

    # check smtpd's dependencies to determine which libraries
    # don't need to be copied into the chroot

    smtpd=`${postconf} -c ${confdir} -h daemon_directory`/smtpd
    if [ ! -x "${smtpd}" ];then
        warn "cannot find \$daemon_directory/smtpd"
    fi

    # check also dynamic maps dependencies
    [ -s ${confdir}/dynamicmaps.cf ] && \
        dynmaps=`awk '/^[[:space:]]*#/ {next} {print $2}' ${confdir}/dynamicmaps.cf`

    prunedeps="none"
    for i in ${smtpd} ${dynmaps}; do
        prunedeps=`echo $prunedeps;/usr/bin/ldd $i | awk '/\// {print $(NF-1)}'`
    done

    nss_libs=
    for i in ${nss_databases}; do
        nss=`[ -s /etc/nsswitch.conf ] && \
            awk -v db=$i: -v IGNORE_NSS_LIBS="${IGNORE_NSS_LIBS}" '
            /^[[:space:]]*#/ {next}
            $1 == db {
                for (i=2;i<=NF;i++) {
                    if (match($i,"#")) {next}
                    if (!match($i,"=") && !match($i,IGNORE_NSS_LIBS)) {print $i}
                }
            } ' /etc/nsswitch.conf`
        [ -z "$nss" ] && eval `echo nss=\\\$nss_default_$i`
        nss_libs="$nss_libs $nss"
    done

    libs=
    for i in ${nss_libs}; do
        case $i in
            wins) conf="/etc/samba/smb.conf /etc/samba/lmhosts" ;;
            ldap) conf="/etc/ldap.conf" ;; # i purposefully ignore copying of /etc/ldap.secret
            *) conf="" ;;
        esac
        l=/${_lib}/libnss_$i.$nss_soname
        [ -e ${l} -a "${libs##*$l*}" == "${libs}" ] && \
            libs=`echo $conf; echo $l;echo $libs;/usr/bin/ldd $l | awk '/\// {print $(NF-1)}'`
    done

    #now copy nss libraries and dependencies if we don't already have them loaded
    info "copy nss libraries into chroot"
    for i in $libs; do
        [ -n "${prunedeps##*$i*}" ] && copy ${i}
    done

    # chroot master.cf change all lines except pipe, local, proxymap,
    # virtual and spawn
    awk -v NEVER_CHROOT_PROGRAM="$NEVER_CHROOT_PROGRAM" \
        -v NEVER_CHROOT_SERVICE="$NEVER_CHROOT_SERVICE" '
            BEGIN                   { IFS="[ \t]+"; OFS="\t"; }
            /^#/                    { print; next; }
            /^ /                    { print; next; }
            $1 ~ NEVER_CHROOT_SERVICE    { print; next; }
            $8 ~ NEVER_CHROOT_PROGRAM    { print; next; }
            $5 == "n"               { $5="y"; print $0; next; }
                                    { print; }
        ' ${confdir}/master.cf.${bckext} > ${confdir}/master.cf
}

#
##########################################################################

##########################################################################
#
# check files in chroot

check_files() {
    local i j f rc
    rc=0
    for i in ${BASE_FILES} ${ADDITIONAL_FILES}; do
        f=${i%%=*}
        f=${f#/}
        i=${i##*=}
        i=${i#/}
        if [ -f /${i} -a ! -f ${chroot%/}/${f} ]; then
            info "file ${chroot%/}/${i} missing"
            rc=1
        fi
    done
    cd $chroot || return 1
    for i in `find bin etc lib sbin usr -type f -print 2>/dev/null`; do
        f=$i
        for j in ${ADDITIONAL_FILES}; do
            [ "$i" = "${j%%=*}" ] && f=${i##*=}
        done
        if [ -f /$f ]; then
            cmp -s $i /$f || {
                info "files ${chroot%/}/${i} and /${f#/} differ"
                rc=1
            }
        fi
    done

    if [ ! -d  ${chroot%/}/var/lib/sasl2 ]; then
            info "directory ${chroot%/}/var/lib/sasl2 missing"
            rc=1
    fi

    if [ ! -c  ${chroot%/}/dev/urandom ]; then
            info "device file ${chroot%/}/dev/urandom missing"
            rc=1
    fi

    return $rc
}

#
##########################################################################

##########################################################################
#
# create/update /etc/sysconfig/postfix

create_sysconfig() {
    cat > /etc/sysconfig/postfix <<-EOF
        # this file is automatically generated by postfix-chroot.sh
        # you can modify the parameters and they will be mantained
        # comments will not be preserved

        # use postfix-chroot.sh to change this
        CHROOT=${CHROOT}
        # this are regular expressions matching a whole line
        NEVER_CHROOT_PROGRAM='${NEVER_CHROOT_PROGRAM}'
        ALWAYS_CHROOT_PROGRAM='${ALWAYS_CHROOT_PROGRAM}'
        NEVER_CHROOT_SERVICE='${NEVER_CHROOT_SERVICE}'
        ALWAYS_CHROOT_SERVICE='${ALWAYS_CHROOT_SERVICE}'
        # nss names as they would appear in nsswitch.conf
        IGNORE_NSS_LIBS='${IGNORE_NSS_LIBS}'
        # space separated list of full pathname of file you want to be copied
        # use /path/file=/newpath/newfile for path mappings
        ADDITIONAL_FILES='${ADDITIONAL_FILES}'
        # Automatically rebuild maps at daemon startup
        REBUILD_ALIASES=${REBUILD_ALIASES}
        REBUILD_MAPS=${REBUILD_MAPS}
        # Multi instance support in initscripts and chroot. If disabled only
        # default instance will be started/stopped automatically
        MANAGE_MULTI_INSTANCES=${MANAGE_MULTI_INSTANCES}
        # The following two variables are used to limit the instances (or
        # groups of) that are started/stopped automatically. Put space
        # separated lists of instance or group _names_ there.
        MANAGE_ONLY_INSTANCES='${MANAGE_ONLY_INSTANCES}'
        MANAGE_ONLY_INSTANCE_GROUPS='${MANAGE_ONLY_INSTANCE_GROUPS}'
        # Space separated list of instance configuration _directories_
        # that will not be chrooted
        DONT_CHROOT_INSTANCES='${DONT_CHROOT_INSTANCES}'

EOF
}

#
##########################################################################


default_config_directory=/etc/postfix
verbose=1
[ "$1" = "-q" ] && { quiet=quiet; verbose=0; shift; }
[ "$1" = "-h" ] && { usage; exit 0; }

[ -z "$1" -o -n "$3" ] && { usage; exit 1; }

if [ -n "$2" ]; then
    config_directory="$2"
else
    config_directory=${default_config_directory}
fi

[ "$UID" = "0" ] || error "your must be root to run this script"

_lib=`rpm --eval '%_lib'`
postconf=/usr/sbin/postconf
[ -x ${postconf} ] || error "can not find postconf"
[ -d "${config_directory}" -a -s "${config_directory}/main.cf" -a -s "${config_directory}/master.cf" ] || error "${config_directory} is not a postfix configuration directory"

if [ "${config_directory}" == "${default_config_directory}" -a "`postconf -c ${config_directory} -h multi_instance_enable 2>/dev/null`" = "yes" ]; then
    multi_instance_directories=`postconf -c ${config_directory} -h multi_instance_directories 2>/dev/null`
fi

# defaults
CHROOT=0
NEVER_CHROOT_PROGRAM='^(proxymap|local|pipe|virtual|spawn)$'
NEVER_CHROOT_SERVICE='^cyrus$'
ALWAYS_CHROOT_PROGRAM='^$'
ALWAYS_CHROOT_SERVICE='^$'
IGNORE_NSS_LIBS='^(mdns.*|ldap|db|wins)$'
ADDITIONAL_FILES=''
REBUILD_ALIASES=1
REBUILD_MAPS=1
MANAGE_MULTI_INSTANCES=1
MANAGE_ONLY_INSTANCES=''
MANAGE_ONLY_INSTANCE_GROUPS=''
DONT_CHROOT_INSTANCES=''
[ -s /etc/sysconfig/postfix ] && . /etc/sysconfig/postfix

BASE_FILES='/etc/localtime /etc/host.conf /etc/resolv.conf /etc/nsswitch.conf /etc/hosts /etc/services'

# defaults for NSS
# do i really need to look at passwd and group?
nss_databases='passwd group hosts services'
nss_default_passwd="compat"
nss_default_group="compat"
nss_default_hosts="dns files"
nss_default_services="nis files"
nss_soname=so.2

bckext=`date '+%Y%m%d-%H%M'`

get_chroot() {
    local dir
    for dir in ${DONT_CHROOT_INSTANCES}; do
        [ "${confdir}" == "${dir}" ] && return
    done
    if [ "${config_directory}" != "${confdir}" -a "`postconf -c ${confdir} -h multi_instance_enable 2>/dev/null`" != "yes" ]; then
        info "skipping disabled instance ${confdir}"
        return
    fi
        
    local chroot=`${postconf} -c ${confdir} -h queue_directory 2>/dev/null`
    if [ -z "${chroot}" ]; then
        warn "chroot (${chroot}) is not defined"
        return
    fi
    if [ "${chroot}" = "/" ]; then
        warn "chroot (${chroot}) is set to /"
        return
    fi
    if [ ! -d "${chroot}" ]; then
        warn "chroot (${chroot}) is not a directory"
        return
    fi
    echo ${chroot}
}

enable_chroot() {
    for confdir in ${config_directory} ${multi_instance_directories}; do
        chroot=`get_chroot`
        [ -z "${chroot}" ] && continue

        cp -p ${confdir}/master.cf ${confdir}/master.cf.${bckext}
        remove_chroot noconf
        setup_chroot $quiet
        cmp -s ${confdir}/master.cf ${confdir}/master.cf.${bckext} && rm -f ${confdir}/master.cf.${bckext}
        [ -f ${confdir}/master.cf.${bckext} ] && info "${confdir}/master.cf backed up as ${confdir}/master.cf.${bckext}"
        update_syslog enable
    done
}

disable_chroot() {
    for confdir in ${config_directory} ${multi_instance_directories}; do
        chroot=`get_chroot`
        [ -z "${chroot}" ] && continue

        update_syslog disable
        cp -p ${confdir}/master.cf ${confdir}/master.cf.${bckext}
        remove_chroot ${1}
        cmp -s ${confdir}/master.cf ${confdir}/master.cf.${bckext} && rm -f ${confdir}/master.cf.${bckext}
        [ -f ${confdir}/master.cf.${bckext} ] && info "${confdir}/master.cf backed up as ${confdir}/master.cf.${bckext}"
    done
}

delete_chroot() {
    for confdir in ${config_directory} ${multi_instance_directories}; do
        chroot=`get_chroot`
        [ -z "${chroot}" ] && continue

        cp -p ${confdir}/master.cf ${confdir}/master.cf.${bckext}
        update_syslog disable
        remove_chroot noconf
    done
}

check_chroot() {
    for confdir in ${config_directory} ${multi_instance_directories}; do
        chroot=`get_chroot`
        [ -z "${chroot}" ] && continue

        check_files
    done
}

update_chroot() {
    for confdir in ${config_directory} ${multi_instance_directories}; do
        chroot=`get_chroot`
        [ -z "${chroot}" ] && continue

        check_files && continue

        cp -p ${confdir}/master.cf ${confdir}/master.cf.${bckext}
        remove_chroot noconf
        setup_chroot $quiet
        cmp -s ${confdir}/master.cf ${confdir}/master.cf.${bckext} && rm -f ${confdir}/master.cf.${bckext}
        [ -f ${confdir}/master.cf.${bckext} ] && info "${confdir}/master.cf backed up as ${confdir}/master.cf.${bckext}"
        update_syslog enable
    done
}

# create readable directories into the chroot
umask 022

# See how we were called.
case "$1" in
    enable)
        CHROOT=1
        create_sysconfig
        enable_chroot
        ;;
    disable)
        CHROOT=0
        create_sysconfig
        disable_chroot $quiet
        ;;
    remove)
        # used by rpm preuninstall script
        delete_chroot
        _noreload=1
        ;;
    update)
        if [ $CHROOT = 0 ];then
            info "chroot disabled in /etc/sysconfig/postfix"
            exit 0
        else
            enable_chroot
        fi
        ;;
    check)
        if [ $CHROOT = 0 ];then
            info "chroot disabled in /etc/sysconfig/postfix"
            exit 0
        else
            check_chroot
            _noreload=1
        fi
    ;;
    check_update)
        if [ $CHROOT = 0 ];then
            info "chroot disabled in /etc/sysconfig/postfix"
            exit 0
        else
            update_chroot
        fi
    ;;
    *)
        usage
        exit 1
        ;;
esac

[ -n "${service_restart_syslog}" ] && service syslog condrestart
[ -n "${service_restart_rsyslog}" ] && service rsyslog condrestart
[ -n "${service_restart_syslog_ng}" ] && service syslog-ng condrestart
[ -z "${_noreload}" -a -f /var/lock/subsys/postfix ] && service postfix reload

exit 0

# vim:ts=8:sw=4