summaryrefslogtreecommitdiff
blob: af38319aee098713bd7e459011f121b853720cbd (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
diff --git a/HISTORY b/HISTORY
index 73db63f..bfc98a1 100644
--- a/HISTORY
+++ b/HISTORY
@@ -13599,3 +13599,9 @@ Apologies for any names omitted.
 	prevent dovecot-auth memory wastage. Timo Sirainen.  File:
 	xsasl/xsasl_dovecot_server.c.
 
+20080725
+
+	Paranoia: defer delivery when a mailbox file is not owned
+	by the recipient. Requested by Sebastian Krahmer, SuSE.
+	Specify "strict_mailbox_ownership=no" to ignore ownership
+	discrepancies.  Files: local/mailbox.c, virtual/mailbox.c.
diff --git a/RELEASE_NOTES b/RELEASE_NOTES
index cf371e5..fb5f4cd 100644
--- a/RELEASE_NOTES
+++ b/RELEASE_NOTES
@@ -11,6 +11,14 @@ instead, a new snapshot is released.
 The mail_release_date configuration parameter (format: yyyymmdd)
 specifies the release date of a stable release or snapshot release.
 
+Incompatibility with Postfix 2.4.7
+==================================
+
+When a mailbox file is not owned by its recipient, the local and
+virtual delivery agents now log a warning and defer delivery.
+Specify "strict_mailbox_ownership = no" to ignore such ownership
+discrepancies.
+ 
 Incompatibility with Postfix 2.4.4
 ==================================
 
diff --git a/html/local.8.html b/html/local.8.html
index de3fd4f..9cece01 100644
--- a/html/local.8.html
+++ b/html/local.8.html
@@ -394,6 +394,12 @@ LOCAL(8)                                                              LOCAL(8)
               attempt; do not update  the  Delivered-To:  address
               while expanding aliases or .forward files.
 
+       Available in Postfix version 2.4.7-r1 and later:
+
+       <b><a href="postconf.5.html#strict_mailbox_ownership">strict_mailbox_ownership</a> (yes)</b>
+              Defer delivery when a mailbox file is not owned  by
+              its recipient.
+
 <b>DELIVERY METHOD CONTROLS</b>
        The  precedence  of <a href="local.8.html"><b>local</b>(8)</a> delivery methods from high to
        low is: aliases, .forward  files,  <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>,
@@ -532,6 +538,12 @@ LOCAL(8)                                                              LOCAL(8)
               agent allows in $name expansions of $<a href="postconf.5.html#command_execution_directory">command_execu</a>-
               <a href="postconf.5.html#command_execution_directory">tion_directory</a>.
 
+       Available in Postfix version 2.4.7-r1 and later:
+
+       <b><a href="postconf.5.html#strict_mailbox_ownership">strict_mailbox_ownership</a> (yes)</b>
+              Defer  delivery when a mailbox file is not owned by
+              its recipient.
+
 <b>MISCELLANEOUS CONTROLS</b>
        <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
               The  default  location  of  the Postfix <a href="postconf.5.html">main.cf</a> and
diff --git a/html/postconf.5.html b/html/postconf.5.html
index a19b6b3..7952563 100644
--- a/html/postconf.5.html
+++ b/html/postconf.5.html
@@ -11602,6 +11602,17 @@ This feature is available in Postfix 2.0 and later.
 
 </DD>
 
+<DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
+(default: yes)</b></DT><DD>
+
+<p> Defer delivery when a mailbox file is not owned by its recipient.
+The default setting is not backwards compatible.  </p>
+
+<p> This feature is available in Postfix 2.4.7-r1 and later. </p>
+
+
+</DD>
+
 <DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
 (default: no)</b></DT><DD>
 
diff --git a/html/virtual.8.html b/html/virtual.8.html
index 3d7e526..0341911 100644
--- a/html/virtual.8.html
+++ b/html/virtual.8.html
@@ -200,9 +200,15 @@ VIRTUAL(8)                                                          VIRTUAL(8)
               destination  for  final  delivery to domains listed
               with $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
 
+       Available in Postfix version 2.4.7-r1 and later:
+
+       <b><a href="postconf.5.html#strict_mailbox_ownership">strict_mailbox_ownership</a> (yes)</b>
+              Defer delivery when a mailbox file is not owned  by
+              its recipient.
+
 <b>LOCKING CONTROLS</b>
        <b><a href="postconf.5.html#virtual_mailbox_lock">virtual_mailbox_lock</a> (see 'postconf -d' output)</b>
-              How to lock a UNIX-style <a href="virtual.8.html"><b>virtual</b>(8)</a> mailbox  before
+              How  to lock a UNIX-style <a href="virtual.8.html"><b>virtual</b>(8)</a> mailbox before
               attempting delivery.
 
        <b><a href="postconf.5.html#deliver_lock_attempts">deliver_lock_attempts</a> (20)</b>
@@ -210,41 +216,41 @@ VIRTUAL(8)                                                          VIRTUAL(8)
               sive lock on a mailbox file or <a href="bounce.8.html"><b>bounce</b>(8)</a> logfile.
 
        <b><a href="postconf.5.html#deliver_lock_delay">deliver_lock_delay</a> (1s)</b>
-              The time between attempts to acquire  an  exclusive
+              The  time  between attempts to acquire an exclusive
               lock on a mailbox file or <a href="bounce.8.html"><b>bounce</b>(8)</a> logfile.
 
        <b><a href="postconf.5.html#stale_lock_time">stale_lock_time</a> (500s)</b>
-              The  time  after  which  a  stale exclusive mailbox
+              The time after  which  a  stale  exclusive  mailbox
               lockfile is removed.
 
 <b>RESOURCE AND RATE CONTROLS</b>
        <b><a href="postconf.5.html#virtual_destination_concurrency_limit">virtual_destination_concurrency_limit</a>   ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destina</a>-</b>
        <b><a href="postconf.5.html#default_destination_concurrency_limit">tion_concurrency_limit</a>)</b>
-              The maximal number of parallel  deliveries  to  the
-              same  destination  via the virtual message delivery
+              The  maximal  number  of parallel deliveries to the
+              same destination via the virtual  message  delivery
               transport.
 
        <b><a href="postconf.5.html#virtual_destination_recipient_limit">virtual_destination_recipient_limit</a>     ($<a href="postconf.5.html#default_destination_recipient_limit">default_destina</a>-</b>
        <b><a href="postconf.5.html#default_destination_recipient_limit">tion_recipient_limit</a>)</b>
-              The maximal number of recipients per  delivery  via
+              The  maximal  number of recipients per delivery via
               the virtual message delivery transport.
 
        <b><a href="postconf.5.html#virtual_mailbox_limit">virtual_mailbox_limit</a> (51200000)</b>
-              The  maximal size in bytes of an individual mailbox
+              The maximal size in bytes of an individual  mailbox
               or maildir file, or zero (no limit).
 
 <b>MISCELLANEOUS CONTROLS</b>
        <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
-              The default location of  the  Postfix  <a href="postconf.5.html">main.cf</a>  and
+              The  default  location  of  the Postfix <a href="postconf.5.html">main.cf</a> and
               <a href="master.5.html">master.cf</a> configuration files.
 
        <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
-              How  much time a Postfix daemon process may take to
-              handle a request  before  it  is  terminated  by  a
+              How much time a Postfix daemon process may take  to
+              handle  a  request  before  it  is  terminated by a
               built-in watchdog timer.
 
        <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
-              The  maximal  number  of  digits  after the decimal
+              The maximal number  of  digits  after  the  decimal
               point when logging sub-second delay values.
 
        <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
@@ -252,33 +258,33 @@ VIRTUAL(8)                                                          VIRTUAL(8)
               over an internal communication channel.
 
        <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
-              The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
+              The maximum amount of time  that  an  idle  Postfix
+              daemon  process  waits  for  an incoming connection
               before terminating voluntarily.
 
        <b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
+              The maximal number of incoming connections  that  a
+              Postfix  daemon  process will service before termi-
               nating voluntarily.
 
        <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        <b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b>
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
               The syslog facility of Postfix logging.
 
        <b><a href="postconf.5.html#syslog_name">syslog_name</a> (postfix)</b>
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 <b>SEE ALSO</b>
@@ -291,20 +297,20 @@ VIRTUAL(8)                                                          VIRTUAL(8)
        <a href="VIRTUAL_README.html">VIRTUAL_README</a>, domain hosting howto
 
 <b>LICENSE</b>
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 <b>HISTORY</b>
-       This  delivery  agent  was originally based on the Postfix
-       local delivery agent. Modifications  mainly  consisted  of
-       removing  code  that either was not applicable or that was
-       not safe in this context: aliases,  ~user/.forward  files,
+       This delivery agent was originally based  on  the  Postfix
+       local  delivery  agent.  Modifications mainly consisted of
+       removing code that either was not applicable or  that  was
+       not  safe  in this context: aliases, ~user/.forward files,
        delivery to "|command" or to /file/name.
 
        The <b>Delivered-To:</b> message header appears in the <b>qmail</b> sys-
        tem by Daniel Bernstein.
 
-       The <b>maildir</b> structure  appears  in  the  <b>qmail</b>  system  by
+       The  <b>maildir</b>  structure  appears  in  the  <b>qmail</b> system by
        Daniel Bernstein.
 
 <b>AUTHOR(S)</b>
diff --git a/man/man5/postconf.5 b/man/man5/postconf.5
index 7af763b..ba9f36a 100644
--- a/man/man5/postconf.5
+++ b/man/man5/postconf.5
@@ -7062,6 +7062,11 @@ This feature should not be enabled on a general purpose mail server,
 because it is likely to reject legitimate email.
 .PP
 This feature is available in Postfix 2.0 and later.
+.SH strict_mailbox_ownership (default: yes)
+Defer delivery when a mailbox file is not owned by its recipient.
+The default setting is not backwards compatible.
+.PP
+This feature is available in Postfix 2.4.7-r1 and later.
 .SH strict_mime_encoding_domain (default: no)
 Reject mail with invalid Content-Transfer-Encoding: information
 for the message/* or multipart/* MIME content types.  This blocks
diff --git a/man/man8/local.8 b/man/man8/local.8
index 4452007..5af15a9 100644
--- a/man/man8/local.8
+++ b/man/man8/local.8
@@ -412,6 +412,10 @@ Update the \fBlocal\fR(8) delivery agent's idea of the Delivered-To:
 address (see prepend_delivered_header) only once, at the start of
 a delivery attempt; do not update the Delivered-To: address while
 expanding aliases or .forward files.
+.PP
+Available in Postfix version 2.4.7-r1 and later:
+.IP "\fBstrict_mailbox_ownership (yes)\fR"
+Defer delivery when a mailbox file is not owned by its recipient.
 .SH "DELIVERY METHOD CONTROLS"
 .na
 .nf
@@ -510,7 +514,7 @@ Restrict \fBlocal\fR(8) mail delivery to external commands.
 Restrict \fBlocal\fR(8) mail delivery to external files.
 .IP "\fBcommand_expansion_filter (see 'postconf -d' output)\fR"
 Restrict the characters that the \fBlocal\fR(8) delivery agent allows in
-$name expansions of $mailbox_command.
+$name expansions of $mailbox_command and $command_execution_directory.
 .IP "\fBdefault_privs (nobody)\fR"
 The default rights used by the \fBlocal\fR(8) delivery agent for delivery
 to external file or command.
@@ -522,6 +526,10 @@ Available in Postfix version 2.2 and later:
 .IP "\fBexecution_directory_expansion_filter (see 'postconf -d' output)\fR"
 Restrict the characters that the \fBlocal\fR(8) delivery agent allows
 in $name expansions of $command_execution_directory.
+.PP
+Available in Postfix version 2.4.7-r1 and later:
+.IP "\fBstrict_mailbox_ownership (yes)\fR"
+Defer delivery when a mailbox file is not owned by its recipient.
 .SH "MISCELLANEOUS CONTROLS"
 .na
 .nf
diff --git a/man/man8/virtual.8 b/man/man8/virtual.8
index b45ac26..22e41b5 100644
--- a/man/man8/virtual.8
+++ b/man/man8/virtual.8
@@ -213,6 +213,10 @@ mail is delivered via the $virtual_transport mail delivery transport.
 .IP "\fBvirtual_transport (virtual)\fR"
 The default mail delivery transport and next-hop destination for
 final delivery to domains listed with $virtual_mailbox_domains.
+.PP
+Available in Postfix version 2.4.7-r1 and later:
+.IP "\fBstrict_mailbox_ownership (yes)\fR"
+Defer delivery when a mailbox file is not owned by its recipient.
 .SH "LOCKING CONTROLS"
 .na
 .nf
diff --git a/mantools/postlink b/mantools/postlink
index b4771d9..e2503ca 100755
--- a/mantools/postlink
+++ b/mantools/postlink
@@ -496,6 +496,7 @@ while (<>) {
     s;\bstrict_8bitmime\b;<a href="postconf.5.html#strict_8bitmime">$&</a>;g;
     s;\bstrict_8bitmime_body\b;<a href="postconf.5.html#strict_8bitmime_body">$&</a>;g;
     s;\bstrict_mime_encoding_domain\b;<a href="postconf.5.html#strict_mime_encoding_domain">$&</a>;g;
+    s;\bstrict_mailbox_ownership\b;<a href="postconf.5.html#strict_mailbox_ownership">$&</a>;g;
     s;\bstrict_rfc821_envelopes\b;<a href="postconf.5.html#strict_rfc821_envelopes">$&</a>;g;
     s;\bsun_mailtool_compatibility\b;<a href="postconf.5.html#sun_mailtool_compatibility">$&</a>;g;
     s;\bswap_bangpath\b;<a href="postconf.5.html#swap_bangpath">$&</a>;g;
diff --git a/proto/postconf.proto b/proto/postconf.proto
index f5a90ed..7761e7e 100644
--- a/proto/postconf.proto
+++ b/proto/postconf.proto
@@ -10586,3 +10586,10 @@ to the SASL authcid, but this causes inter-operability problems
 with some SMTP servers. </p>
 
 <p> This feature is available in Postfix 2.4.4 and later. </p>
+
+%PARAM strict_mailbox_ownership yes
+
+<p> Defer delivery when a mailbox file is not owned by its recipient.
+The default setting is not backwards compatible.  </p>
+
+<p> This feature is available in Postfix 2.4.7-r1 and later. </p>
diff --git a/src/global/mail_params.h b/src/global/mail_params.h
index 2785921..9cf6216 100644
--- a/src/global/mail_params.h
+++ b/src/global/mail_params.h
@@ -2783,6 +2783,13 @@ extern char *var_milt_v;
 #define DEF_INT_FILT_CLASSES		""
 extern char *var_int_filt_classes;
 
+ /*
+  * Mailbox ownership.
+  */
+#define VAR_STRICT_MBOX_OWNER	"strict_mailbox_ownership"
+#define DEF_STRICT_MBOX_OWNER	1
+extern bool var_strict_mbox_owner;
+
 /* LICENSE
 /* .ad
 /* .fi
diff --git a/src/global/mail_version.h b/src/global/mail_version.h
index ae94ab9..7ceadad 100644
--- a/src/global/mail_version.h
+++ b/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20080131"
-#define MAIL_VERSION_NUMBER	"2.4.7"
+#define MAIL_RELEASE_DATE	"20080726"
+#define MAIL_VERSION_NUMBER	"2.4.7-r1"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/src/local/local.c b/src/local/local.c
index 557be6f..72ea49f 100644
--- a/src/local/local.c
+++ b/src/local/local.c
@@ -378,6 +378,10 @@
 /*	address (see prepend_delivered_header) only once, at the start of
 /*	a delivery attempt; do not update the Delivered-To: address while
 /*	expanding aliases or .forward files.
+/* .PP
+/*	Available in Postfix version 2.4.7-r1 and later:
+/* .IP "\fBstrict_mailbox_ownership (yes)\fR"
+/*	Defer delivery when a mailbox file is not owned by its recipient.
 /* DELIVERY METHOD CONTROLS
 /* .ad
 /* .fi
@@ -468,7 +472,7 @@
 /*	Restrict \fBlocal\fR(8) mail delivery to external files.
 /* .IP "\fBcommand_expansion_filter (see 'postconf -d' output)\fR"
 /*	Restrict the characters that the \fBlocal\fR(8) delivery agent allows in
-/*	$name expansions of $mailbox_command.
+/*	$name expansions of $mailbox_command and $command_execution_directory.
 /* .IP "\fBdefault_privs (nobody)\fR"
 /*	The default rights used by the \fBlocal\fR(8) delivery agent for delivery
 /*	to external file or command.
@@ -480,6 +484,10 @@
 /* .IP "\fBexecution_directory_expansion_filter (see 'postconf -d' output)\fR"
 /*	Restrict the characters that the \fBlocal\fR(8) delivery agent allows
 /*	in $name expansions of $command_execution_directory.
+/* .PP
+/*	Available in Postfix version 2.4.7-r1 and later:
+/* .IP "\fBstrict_mailbox_ownership (yes)\fR"
+/*	Defer delivery when a mailbox file is not owned by its recipient.
 /* MISCELLANEOUS CONTROLS
 /* .ad
 /* .fi
@@ -641,6 +649,7 @@ int     var_mailtool_compat;
 char   *var_mailbox_lock;
 int     var_mailbox_limit;
 bool    var_frozen_delivered;
+bool    var_strict_mbox_owner;
 
 int     local_cmd_deliver_mask;
 int     local_file_deliver_mask;
@@ -887,6 +896,7 @@ int     main(int argc, char **argv)
 	VAR_STAT_HOME_DIR, DEF_STAT_HOME_DIR, &var_stat_home_dir,
 	VAR_MAILTOOL_COMPAT, DEF_MAILTOOL_COMPAT, &var_mailtool_compat,
 	VAR_FROZEN_DELIVERED, DEF_FROZEN_DELIVERED, &var_frozen_delivered,
+	VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner,
 	0,
     };
 
diff --git a/src/local/mailbox.c b/src/local/mailbox.c
index 92bd79d..d35ef66 100644
--- a/src/local/mailbox.c
+++ b/src/local/mailbox.c
@@ -194,6 +194,12 @@ static int deliver_mailbox_file(LOCAL_STATE state, USER_ATTR usr_attr)
 	    vstream_fclose(mp->fp);
 	    dsb_simple(why, "5.2.0",
 		       "destination %s is not a regular file", mailbox);
+	} else if (var_strict_mbox_owner && st.st_uid != usr_attr.uid) {
+	    vstream_fclose(mp->fp);
+	    dsb_simple(why, "4.2.0",
+		       "destination %s is not owned by recipient", mailbox);
+	    msg_warn("specify \"%s = no\" to ignore mailbox ownership mismatch",
+		     VAR_STRICT_MBOX_OWNER);
 	} else {
 	    end = vstream_fseek(mp->fp, (off_t) 0, SEEK_END);
 	    mail_copy_status = mail_copy(COPY_ATTR(state.msg_attr), mp->fp,
diff --git a/src/virtual/mailbox.c b/src/virtual/mailbox.c
index 09fc54b..f0ad6eb 100644
--- a/src/virtual/mailbox.c
+++ b/src/virtual/mailbox.c
@@ -125,6 +125,12 @@ static int deliver_mailbox_file(LOCAL_STATE state, USER_ATTR usr_attr)
 	    msg_warn("recipient %s: destination %s is not a regular file",
 		     state.msg_attr.rcpt.address, usr_attr.mailbox);
 	    dsb_simple(why, "5.3.5", "mail system configuration error");
+	} else if (var_strict_mbox_owner && st.st_uid != usr_attr.uid) {
+	    vstream_fclose(mp->fp);
+	    dsb_simple(why, "4.2.0",
+	      "destination %s is not owned by recipient", usr_attr.mailbox);
+	    msg_warn("specify \"%s = no\" to ignore mailbox ownership mismatch",
+		     VAR_STRICT_MBOX_OWNER);
 	} else {
 	    end = vstream_fseek(mp->fp, (off_t) 0, SEEK_END);
 	    mail_copy_status = mail_copy(COPY_ATTR(state.msg_attr), mp->fp,
diff --git a/src/virtual/virtual.c b/src/virtual/virtual.c
index 7d6e1b8..57b4098 100644
--- a/src/virtual/virtual.c
+++ b/src/virtual/virtual.c
@@ -183,6 +183,10 @@
 /* .IP "\fBvirtual_transport (virtual)\fR"
 /*	The default mail delivery transport and next-hop destination for
 /*	final delivery to domains listed with $virtual_mailbox_domains.
+/* .PP
+/*	Available in Postfix version 2.4.7-r1 and later:
+/* .IP "\fBstrict_mailbox_ownership (yes)\fR"
+/*	Defer delivery when a mailbox file is not owned by its recipient.
 /* LOCKING CONTROLS
 /* .ad
 /* .fi
@@ -329,6 +333,7 @@ char   *var_virt_mailbox_base;
 char   *var_virt_mailbox_lock;
 int     var_virt_mailbox_limit;
 char   *var_mail_spool_dir;		/* XXX dependency fix */
+bool    var_strict_mbox_owner;
 
  /*
   * Mappings.
@@ -504,6 +509,10 @@ int     main(int argc, char **argv)
 	VAR_VIRT_MAILBOX_LOCK, DEF_VIRT_MAILBOX_LOCK, &var_virt_mailbox_lock, 1, 0,
 	0,
     };
+    static const CONFIG_BOOL_TABLE bool_table[] = {
+	VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner,
+	0,
+    };
 
     /*
      * Fingerprint executables and core dumps.
@@ -513,6 +522,7 @@ int     main(int argc, char **argv)
     single_server_main(argc, argv, local_service,
 		       MAIL_SERVER_INT_TABLE, int_table,
 		       MAIL_SERVER_STR_TABLE, str_table,
+		       MAIL_SERVER_BOOL_TABLE, bool_table,
 		       MAIL_SERVER_PRE_INIT, pre_init,
 		       MAIL_SERVER_POST_INIT, post_init,
 		       MAIL_SERVER_PRE_ACCEPT, pre_accept,