From a93fedb8633541c35faa5825e3011970af98bb30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20B=C3=B6nisch?= <patrick@boenisch.tech>
Date: Sun, 26 Jul 2026 12:36:29 +0200
Subject: [PATCH] Use access check for sendmail command

---
 Cargo.lock    | 19 +++++++++++++++++++
 Cargo.toml    |  1 +
 src/config.rs |  7 ++-----
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6b20797b..e37045ac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -928,6 +928,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -3221,6 +3227,18 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -5863,6 +5881,7 @@ dependencies = [
  "macros",
  "mimalloc",
  "moka",
+ "nix",
  "num-derive",
  "num-traits",
  "opendal",
diff --git a/Cargo.toml b/Cargo.toml
index db685864..b3b922d6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -58,6 +58,7 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 unstable = []
 
 [target."cfg(unix)".dependencies]
+nix = { version = "0.31.3", features = ["fs"] }
 # Logging
 syslog = "7.0.0"
 
diff --git a/src/config.rs b/src/config.rs
index 445e6b51..06958261 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1157,11 +1157,8 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
                     }
 
                     #[cfg(unix)]
-                    {
-                        use std::os::unix::fs::PermissionsExt;
-                        if metadata.permissions().mode() & 0o111 == 0 {
-                            err!(format!("sendmail command at `{path:?}` isn't executable"));
-                        }
+                    if nix::unistd::access(&path, nix::unistd::AccessFlags::X_OK).is_err() {
+                        err!(format!("sendmail command at `{path:?}` isn't executable"));
                     }
                 }
             }