To ensure secure handling of
delivery, recipient addresses that are either a file or a program
require that sendmail perform delivery as the
owner of the file or program rather than as the user defined by the
DefaultUser option (DefaultUser).
A file address is one that begins with a /
character. A program address is one that begins with a
| character. Both characters are detected after
quotation marks have been stripped from the address.
To prevent potential security violations,
sendmail must take special precautions when
addresses in the qf file result from reading a
~/.forward or :include: file.
When such an address is to be placed into the qf
file (whether as a recipient's address in an
R line or as an error recipient's
address in an E line),
sendmail first places a C
line (for Controlling user) into the file and then the
recipient's address. The C line
specifies the owner of the ~/.forward or
:include: file:
Cgeorge
RPF:/u/users/george/mail/archive
Cben
RPF:|/u/users/ben/bin/mailfilter
Here, when sendmail later delivers to the
recipients in this qf file, it first converts its
user identity to that of the user george, then
resets itself back to being root again. The same
process repeats with the next recipient, except that
sendmail changes from root
to ben and back again. If there is no
C line preceding an R line, the
previous C line's value is
carried down:
Cgeorge
RPF:/u/users/george/mail/archive
RPF:|/u/users/ben/bin/mailfilter 
controlling user is george
The form of the C line in the
qf file is
Cuser prior to V8
Cuser:eaddr V8.1 through V8.7.5
Cuser:uid:gid:eaddr V8.7.6 and above
The C must begin the line and be immediately
followed by user, with no intervening
space. If no user follows the
C, any prior controlling user is cleared and the
identity that is used reverts to that specified by the
DefaultUser option (DefaultUser).
If present, the user is the login name of
the owner of the ~/.forward or
:include: file that yielded the address in the
next following R or E line. If
user is the name of a user who is unknown
to the system, prior to V8.7.6 and prior to V8.8 the effect was the
same as if it were missing. Beginning with V8.8 and V8.7.6, an
unknown user causes the identity to become
that of the uid and
gid. Beginning with V8
sendmail, an optional
eaddr might be last. If present, the
eaddr gives the address to use for error
messages.
There can be only one C line immediately preceding
each R and E line. Two
C lines in a row have the effect of the second
superseding the first.
