Adding upstream version 3.7.10.upstream/3.7.10

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 1931 insertions, 0 deletions

diff --git a/src/postmulti/.indent.pro b/src/postmulti/.indent.pro
new file mode 120000
index 0000000..5c837ec
--- /dev/null
+++ b/src/postmulti/.indent.pro
@@ -0,0 +1 @@
+../../.indent.pro
\ No newline at end of file
diff --git a/src/postmulti/Makefile.in b/src/postmulti/Makefile.in
new file mode 100644
index 0000000..f2e3680
--- /dev/null
+++ b/src/postmulti/Makefile.in
@@ -0,0 +1,87 @@
+SHELL	= /bin/sh
+SRCS	= postmulti.c 
+OBJS	= postmulti.o 
+HDRS	= 
+TESTSRC	= 
+DEFS	= -I. -I$(INC_DIR) -D$(SYSTYPE)
+CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
+FILES	= Makefile $(SRCS) $(HDRS)
+INC_DIR	= ../../include
+TESTPROG=
+PROG	= postmulti
+LIBS	= ../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \
+	../../lib/lib$(LIB_PREFIX)util$(LIB_SUFFIX)
+
+.c.o:;	$(CC) $(CFLAGS) -c $*.c
+
+$(PROG):	$(OBJS) $(LIBS)
+	$(CC) $(CFLAGS) $(SHLIB_RPATH) -o $@ $(OBJS) $(LIBS) $(SYSLIBS)
+
+$(OBJS): ../../conf/makedefs.out
+
+Makefile: Makefile.in
+	cat ../../conf/makedefs.out $? >$@
+
+test:	$(TESTPROG)
+
+tests:
+
+root_tests:
+
+update: ../../bin/$(PROG)
+
+../../bin/$(PROG): $(PROG)
+	cp $(PROG) ../../bin
+
+printfck: $(OBJS) $(PROG)
+	rm -rf printfck
+	mkdir printfck
+	sed '1,/^# do not edit/!d' Makefile >printfck/Makefile
+	set -e; for i in *.c; do printfck -f .printfck $$i >printfck/$$i; done
+	cd printfck; make "INC_DIR=../../../include" `cd ..; ls *.o`
+
+shar:
+	@shar $(FILES)
+
+lint:
+	lint $(SRCS)
+
+clean:
+	rm -f *.o *core $(PROG) $(TESTPROG) junk
+	rm -rf printfck
+
+tidy:	clean
+
+depend: $(MAKES)
+	(sed '1,/^# do not edit/!d' Makefile.in; \
+	set -e; for i in [a-z][a-z0-9]*.c; do \
+	    $(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
+	    -e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
+	    -e 's/o: \.\//o: /' -e p -e '}' ; \
+	done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+	@$(EXPORT) make -f Makefile.in Makefile 1>&2
+
+# do not edit below this line - it is generated by 'make depend'
+postmulti.o: ../../include/argv.h
+postmulti.o: ../../include/check_arg.h
+postmulti.o: ../../include/clean_env.h
+postmulti.o: ../../include/htable.h
+postmulti.o: ../../include/mail_conf.h
+postmulti.o: ../../include/mail_params.h
+postmulti.o: ../../include/mail_parm_split.h
+postmulti.o: ../../include/mail_version.h
+postmulti.o: ../../include/maillog_client.h
+postmulti.o: ../../include/msg.h
+postmulti.o: ../../include/msg_vstream.h
+postmulti.o: ../../include/mymalloc.h
+postmulti.o: ../../include/name_code.h
+postmulti.o: ../../include/ring.h
+postmulti.o: ../../include/safe.h
+postmulti.o: ../../include/stringops.h
+postmulti.o: ../../include/sys_defs.h
+postmulti.o: ../../include/vbuf.h
+postmulti.o: ../../include/vstream.h
+postmulti.o: ../../include/vstring.h
+postmulti.o: ../../include/vstring_vstream.h
+postmulti.o: ../../include/warn_stat.h
+postmulti.o: postmulti.c
diff --git a/src/postmulti/postmulti.c b/src/postmulti/postmulti.c
new file mode 100644
index 0000000..5adcd27
--- /dev/null
+++ b/src/postmulti/postmulti.c
@@ -0,0 +1,1843 @@
+/*++
+/* NAME
+/*	postmulti 1
+/* SUMMARY
+/*	Postfix multi-instance manager
+/* SYNOPSIS
+/* .fi
+/* .ti -4
+/*	\fBEnabling multi-instance management:\fR
+/*
+/*	\fBpostmulti\fR \fB-e init\fR [\fB-v\fR]
+/*
+/* .ti -4
+/*	\fBIterator mode:\fR
+/*
+/*	\fBpostmulti\fR \fB-l\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR]
+/*	[\fB-i \fIname\fR]
+/*
+/*	\fBpostmulti\fR \fB-p\fR [\fB-av\fR] [\fB-g \fIgroup\fR]
+/*	[\fB-i \fIname\fR] \fIpostfix-command...\fR
+/*
+/*	\fBpostmulti\fR \fB-x\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR]
+/*	[\fB-i \fIname\fR] \fIunix-command...\fR
+/*
+/* .ti -4
+/*	\fBLife-cycle management:\fR
+/*
+/*	\fBpostmulti\fR \fB-e create\fR [\fB-av\fR]
+/*	[\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR]
+/*	[\fB-I \fIname\fR] [\fIparam=value\fR ...]
+/*
+/*	\fBpostmulti\fR \fB-e import\fR [\fB-av\fR]
+/*	[\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR]
+/*	[\fB-I \fIname\fR] [\fBconfig_directory=\fI/path\fR]
+/*
+/*	\fBpostmulti\fR \fB-e destroy\fR [\fB-v\fR] \fB-i \fIname\fR
+/*
+/*	\fBpostmulti\fR \fB-e deport\fR [\fB-v\fR] \fB-i \fIname\fR
+/*
+/*	\fBpostmulti\fR \fB-e enable\fR [\fB-v\fR] \fB-i \fIname\fR
+/*
+/*	\fBpostmulti\fR \fB-e disable\fR [\fB-v\fR] \fB-i \fIname\fR
+/*
+/*	\fBpostmulti\fR \fB-e assign\fR [\fB-v\fR] \fB-i \fIname\fR
+/*	[\fB-I \fIname\fR] [-G \fIgroup\fR]
+/* DESCRIPTION
+/*	The \fBpostmulti\fR(1) command allows a Postfix administrator
+/*	to manage multiple Postfix instances on a single host.
+/*
+/*	\fBpostmulti\fR(1) implements two fundamental modes of
+/*	operation.  In \fBiterator\fR mode, it executes the same
+/*	command for multiple Postfix instances.  In \fBlife-cycle
+/*	management\fR mode, it adds or deletes one instance, or
+/*	changes the multi-instance status of one instance.
+/*
+/*	Each mode of operation has its own command syntax. For this
+/*	reason, each mode is documented in separate sections below.
+/* BACKGROUND
+/* .ad
+/* .fi
+/*	A multi-instance configuration consists of one primary
+/*	Postfix instance, and one or more secondary instances whose
+/*	configuration directory pathnames are recorded in the primary
+/*	instance's main.cf file. Postfix instances share program
+/*	files and documentation, but have their own configuration,
+/*	queue and data directories.
+/*
+/*	Currently, only the default Postfix instance can be used
+/*	as primary instance in a multi-instance configuration. The
+/*	\fBpostmulti\fR(1) command does not currently support a \fB-c\fR
+/*	option to select an alternative primary instance, and exits
+/*	with a fatal error if the \fBMAIL_CONFIG\fR environment
+/*	variable is set to a non-default configuration directory.
+/*
+/*	See the MULTI_INSTANCE_README tutorial for a more detailed
+/*	discussion of multi-instance management with \fBpostmulti\fR(1).
+/* ITERATOR MODE
+/* .ad
+/* .fi
+/*	In iterator mode, \fBpostmulti\fR performs the same operation
+/*	on all Postfix instances in turn.
+/*
+/*	If multi-instance support is not enabled, the requested
+/*	command is performed just for the primary instance.
+/* .PP
+/*	Iterator mode implements the following command options:
+/* .SH "Instance selection"
+/* .IP \fB-a\fR
+/*	Perform the operation on all instances. This is the default.
+/* .IP "\fB-g \fIgroup\fR"
+/*	Perform the operation only for members of the named \fIgroup\fR.
+/* .IP "\fB-i \fIname\fR"
+/*	Perform the operation only for the instance with the specified
+/*	\fIname\fR.  You can specify either the instance name
+/*	or the absolute pathname of the instance's configuration
+/*	directory.  Specify "-" to select the primary Postfix instance.
+/* .IP \fB-R\fR
+/*	Reverse the iteration order. This may be appropriate when
+/*	updating a multi-instance system, where "sink" instances
+/*	are started before "source" instances.
+/* .sp
+/*	This option cannot be used with \fB-p\fR.
+/* .SH "List mode"
+/* .IP \fB-l\fR
+/*	List Postfix instances with their instance name, instance
+/*	group name, enable/disable status and configuration directory.
+/* .SH "Postfix-wrapper mode"
+/* .IP "\fB-p \fIpostfix-command\fR"
+/*	Invoke \fBpostfix(1)\fR to execute \fIpostfix-command\fR.
+/*	This option implements the \fBpostfix-wrapper\fR(5) interface.
+/* .RS
+/* .IP \(bu
+/*	With "start"-like commands, "postfix check" is executed for
+/*	instances that are not enabled. The full list of commands
+/*	is specified with the postmulti_start_commands parameter.
+/* .IP \(bu
+/*	With "stop"-like commands, the iteration order is reversed,
+/*	and disabled instances are skipped. The full list of commands
+/*	is specified with the postmulti_stop_commands parameter.
+/* .IP \(bu
+/*	With "reload" and other commands that require a started
+/*	instance, disabled instances are skipped. The full list of
+/*	commands is specified with the postmulti_control_commands
+/*	parameter.
+/* .IP \(bu
+/*	With "status" and other commands that don't require a started
+/*	instance, the command is executed for all instances.
+/* .RE
+/* .IP
+/*	The \fB-p\fR option can also be used interactively to
+/*	start/stop/etc.  a named instance or instance group. For
+/*	example, to start just the instances in the group "msa",
+/*	invoke \fBpostmulti\fR(1) as follows:
+/* .RS
+/* .IP
+/*	# postmulti -g msa -p start
+/* .RE
+/* .SH "Command mode"
+/* .IP "\fB-x \fIunix-command\fR"
+/*	Execute the specified \fIunix-command\fR for all Postfix instances.
+/*	The command runs with appropriate environment settings for
+/*	MAIL_CONFIG, command_directory, daemon_directory,
+/*	config_directory, queue_directory, data_directory,
+/*	multi_instance_name, multi_instance_group and
+/*	multi_instance_enable.
+/* .SH "Other options"
+/* .IP \fB-v\fR
+/*	Enable verbose logging for debugging purposes. Multiple
+/*	\fB-v\fR options make the software increasingly verbose.
+/* LIFE-CYCLE MANAGEMENT MODE
+/* .ad
+/* .fi
+/*	With the \fB-e\fR option \fBpostmulti\fR(1) can be used to
+/*	add or delete a Postfix instance, and to manage the
+/*	multi-instance status of an existing instance.
+/* .PP
+/*	The following options are implemented:
+/* .SH "Existing instance selection"
+/* .IP \fB-a\fR
+/*	When creating or importing an instance, place the new
+/*	instance at the front of the secondary instance list.
+/* .IP "\fB-g \fIgroup\fR"
+/*	When creating or importing an instance, place the new
+/*	instance before the first secondary instance that is a
+/*	member of the specified group.
+/* .IP "\fB-i \fIname\fR"
+/*	When creating or importing an instance, place the new
+/*	instance before the matching secondary instance.
+/* .sp
+/*	With other life-cycle operations, apply the operation to
+/*	the named existing instance.  Specify "-" to select the
+/*	primary Postfix instance.
+/* .SH "New or existing instance name assignment"
+/* .IP "\fB-I \fIname\fR"
+/*	Assign the specified instance \fIname\fR to an existing
+/*	instance, newly-created instance, or imported instance.
+/*	Instance
+/*	names other than "-" (which makes the instance "nameless")
+/*	must start with "postfix-".  This restriction reduces the
+/*	likelihood of name collisions with system files.
+/* .IP "\fB-G \fIgroup\fR"
+/*	Assign the specified \fIgroup\fR name to an existing instance
+/*	or to a newly created or imported instance.
+/* .SH "Instance creation/deletion/status change"
+/* .IP "\fB-e \fIaction\fR"
+/*	"Edit" managed instances. The following actions are supported:
+/* .RS
+/* .IP \fBinit\fR
+/*	This command is required before \fBpostmulti\fR(1) can be
+/*	used to manage Postfix instances.  The "postmulti -e init"
+/*	command updates the primary instance's main.cf file by
+/*	setting:
+/* .RS
+/* .IP
+/* .nf
+/*	multi_instance_wrapper =
+/*		${command_directory}/postmulti -p --
+/*	multi_instance_enable = yes
+/* .fi
+/* .RE
+/* .IP
+/*	You can set these by other means if you prefer.
+/* .IP \fBcreate\fR
+/*	Create a new Postfix instance and add it to the
+/*	multi_instance_directories parameter of the primary instance.
+/*	The "\fB-I \fIname\fR" option is recommended to give the
+/*	instance a short name that is used to construct default
+/*	values for the private directories of the new instance. The
+/*	"\fB-G \fIgroup\fR" option may be specified to assign the
+/*	instance to a group, otherwise, the new instance is not a
+/*	member of any group.
+/* .sp
+/*	The new instance main.cf is the stock main.cf with the
+/*	parameters that specify the locations of shared files cloned
+/*	from the primary instance.  For "nameless" instances, you
+/*	should manually adjust "syslog_name" to yield a unique
+/*	"logtag" starting with "postfix-" that will uniquely identify
+/*	the instance in the mail logs. It is simpler to assign the
+/*	instance a short name with the "\fB-I \fIname\fR" option.
+/* .sp
+/*	Optional "name=value" arguments specify the instance
+/*	config_directory, queue_directory and data_directory.
+/*	For example:
+/* .RS
+/* .IP
+/* .nf
+/*	# postmulti -I postfix-mumble \e
+/*		-G mygroup -e create \e
+/*		config_directory=/my/config/dir \e
+/*		queue_directory=/my/queue/dir \e
+/*		data_directory=/my/data/dir
+/* .fi
+/* .RE
+/* .IP
+/*	If any of these pathnames is not supplied, the program
+/*	attempts to generate the missing pathname(s) by taking the
+/*	corresponding primary instance pathname, and replacing the
+/*	last pathname component by the value of the \fB-I\fR option.
+/* .sp
+/*	If the instance configuration directory already exists, and
+/*	contains both a main.cf and master.cf file, \fBcreate\fR
+/*	will "import" the instance as-is. For existing instances,
+/*	\fBcreate\fR and \fBimport\fR are identical.
+/* .IP \fBimport\fR
+/*	Import an existing instance into the list of instances
+/*	managed by the \fBpostmulti\fR(1) multi-instance manager.
+/*	This adds the instance to the multi_instance_directories
+/*	list of the primary instance.  If the "\fB-I \fIname\fR"
+/*	option is provided it specifies the new name for the instance
+/*	and is used to define a default location for the instance
+/*	configuration directory	(as with \fBcreate\fR above).  The
+/*	"\fB-G \fIgroup\fR" option may be used to assign the instance
+/*	to a group. Add a "\fBconfig_directory=\fI/path\fR" argument
+/*	to override a default pathname based on "\fB-I \fIname\fR".
+/* .IP \fBdestroy\fR
+/*	Destroy a secondary Postfix instance. To be a candidate for
+/*	destruction an instance must be disabled, stopped and its
+/*	queue must not contain any messages. Attempts to destroy
+/*	the primary Postfix instance trigger a fatal error, without
+/*	destroying the instance.
+/* .sp
+/*	The instance is removed from the primary instance main.cf
+/*	file's alternate_config_directories parameter and its data,
+/*	queue and configuration directories are cleaned of files
+/*	and directories created by the Postfix system. The main.cf
+/*	and master.cf files are removed from the configuration
+/*	directory even if they have been modified since initial
+/*	creation. Finally, the instance is "deported" from the list
+/*	of managed instances.
+/* .sp
+/*	If other files are present in instance private directories,
+/*	the directories may not be fully removed, a warning is
+/*	logged to alert the administrator. It is expected that an
+/*	instance built using "fresh" directories via the \fBcreate\fR
+/*	action will be fully removed by the \fBdestroy\fR action
+/*	(if first disabled). If the instance configuration and queue
+/*	directories are populated with additional files	(access and
+/*	rewriting tables, chroot jail content, etc.) the instance
+/*	directories will not be fully removed.
+/* .sp
+/*	The \fBdestroy\fR action triggers potentially dangerous
+/*	file removal operations. Make sure the instance's data,
+/*	queue and configuration directories are set correctly and
+/*	do not contain any valuable files.
+/* .IP \fBdeport\fR
+/*	Deport a secondary instance from the list of managed
+/*	instances. This deletes the instance configuration directory
+/*	from the primary instance's multi_instance_directories list,
+/*	but does not remove any files or directories.
+/* .IP \fBassign\fR
+/*	Assign a new instance name or a new group name to the
+/*	selected instance.  Use "\fB-G -\fR" to specify "no group"
+/*	and "\fB-I -\fR" to specify "no name".  If you choose to
+/*	make an instance "nameless", set a suitable syslog_name in
+/*	the corresponding main.cf file.
+/* .IP \fBenable\fR
+/*	Mark the selected instance as enabled. This just sets the
+/*	multi_instance_enable parameter to "yes" in the instance's
+/*	main.cf file.
+/* .IP \fBdisable\fR
+/*	Mark the selected instance as disabled. This means that
+/*	the instance will not be started etc. with "postfix start",
+/*	"postmulti -p start" and so on. The instance can still be
+/*	started etc. with "postfix -c config-directory start".
+/* .SH "Other options"
+/* .IP \fB-v\fR
+/*	Enable verbose logging for debugging purposes. Multiple
+/*	\fB-v\fR options make the software increasingly verbose.
+/* .RE
+/* ENVIRONMENT
+/* .ad
+/* .fi
+/*	The \fBpostmulti\fR(1) command exports the following environment
+/*	variables before executing the requested \fIcommand\fR for a given
+/*	instance:
+/* .IP \fBMAIL_VERBOSE\fR
+/*	This is set when the -v command-line option is present.
+/* .IP \fBMAIL_CONFIG\fR
+/*	The location of the configuration directory of the instance.
+/* CONFIGURATION PARAMETERS
+/* .ad
+/* .fi
+/* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
+/*	The default location of the Postfix main.cf and master.cf
+/*	configuration files.
+/* .IP "\fBdaemon_directory (see 'postconf -d' output)\fR"
+/*	The directory with Postfix support programs and daemon programs.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment variables that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
+/* .IP "\fBmulti_instance_directories (empty)\fR"
+/*	An optional list of non-default Postfix configuration directories;
+/*	these directories belong to additional Postfix instances that share
+/*	the Postfix executable files and documentation with the default
+/*	Postfix instance, and that are started, stopped, etc., together
+/*	with the default Postfix instance.
+/* .IP "\fBmulti_instance_group (empty)\fR"
+/*	The optional instance group name of this Postfix instance.
+/* .IP "\fBmulti_instance_name (empty)\fR"
+/*	The optional instance name of this Postfix instance.
+/* .IP "\fBmulti_instance_enable (no)\fR"
+/*	Allow this Postfix instance to be started, stopped, etc., by a
+/*	multi-instance manager.
+/* .IP "\fBpostmulti_start_commands (start)\fR"
+/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats
+/*	as "start" commands.
+/* .IP "\fBpostmulti_stop_commands (see 'postconf -d' output)\fR"
+/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats
+/*	as "stop" commands.
+/* .IP "\fBpostmulti_control_commands (reload flush)\fR"
+/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager
+/*	treats as "control" commands, that operate on running instances.
+/* .IP "\fBsyslog_facility (mail)\fR"
+/*	The syslog facility of Postfix logging.
+/* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
+/*	A prefix that is prepended to the process name in syslog
+/*	records, so that, for example, "smtpd" becomes "prefix/smtpd".
+/* .PP
+/*	Available in Postfix 3.0 and later:
+/* .IP "\fBmeta_directory (see 'postconf -d' output)\fR"
+/*	The location of non-executable files that are shared among
+/*	multiple Postfix instances, such as postfix-files, dynamicmaps.cf,
+/*	and the multi-instance template files main.cf.proto and master.cf.proto.
+/* .IP "\fBshlib_directory (see 'postconf -d' output)\fR"
+/*	The location of Postfix dynamically-linked libraries
+/*	(libpostfix-*.so), and the default location of Postfix database
+/*	plugins (postfix-*.so) that have a relative pathname in the
+/*	dynamicmaps.cf file.
+/* FILES
+/*	$meta_directory/main.cf.proto, stock configuration file
+/*	$meta_directory/master.cf.proto, stock configuration file
+/*	$daemon_directory/postmulti-script, life-cycle helper program
+/* SEE ALSO
+/*	postfix(1), Postfix control program
+/*	postfix-wrapper(5), Postfix multi-instance API
+/* README FILES
+/* .ad
+/* .fi
+/*	Use "\fBpostconf readme_directory\fR" or "\fBpostconf
+/*	html_directory\fR" to locate this information.
+/* .nf
+/* .na
+/*	MULTI_INSTANCE_README, Postfix multi-instance management
+/* HISTORY
+/* .ad
+/* .fi
+/*	The \fBpostmulti\fR(1) command was introduced with Postfix
+/*	version 2.6.
+/* LICENSE
+/* .ad
+/* .fi
+/*	The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/*	Victor Duchovni
+/*	Morgan Stanley
+/*
+/*	Wietse Venema
+/*	IBM T.J. Watson Research
+/*	P.O. Box 704
+/*	Yorktown Heights, NY 10598, USA
+/*
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
+/*--*/
+
+/* System library. */
+
+#include <sys_defs.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <vstream.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <ctype.h>
+#ifdef USE_PATHS_H
+#include <paths.h>
+#endif
+#include <stddef.h>
+
+/* Utility library. */
+
+#include <msg.h>
+#include <msg_vstream.h>
+#include <vstream.h>
+#include <vstring_vstream.h>
+#include <stringops.h>
+#include <clean_env.h>
+#include <argv.h>
+#include <safe.h>
+#include <mymalloc.h>
+#include <htable.h>
+#include <name_code.h>
+#include <ring.h>
+#include <warn_stat.h>
+
+/* Global library. */
+
+#include <mail_version.h>
+#include <mail_params.h>
+#include <mail_conf.h>
+#include <mail_parm_split.h>
+#include <maillog_client.h>
+
+/* Application-specific. */
+
+ /*
+  * Configuration parameters, specific to postmulti(1).
+  */
+char   *var_multi_start_cmds;
+char   *var_multi_stop_cmds;
+char   *var_multi_cntrl_cmds;
+
+ /*
+  * Shared directory pathnames.
+  */
+typedef struct {
+    const char *param_name;
+    char  **param_value;
+} SHARED_PATH;
+
+static SHARED_PATH shared_dir_table[] = {
+    VAR_COMMAND_DIR, &var_command_dir,
+    VAR_DAEMON_DIR, &var_daemon_dir,
+    VAR_META_DIR, &var_meta_dir,
+    VAR_SHLIB_DIR, &var_shlib_dir,
+    0,
+};
+
+ /*
+  * Actions.
+  */
+#define ITER_CMD_POSTFIX	(1<<0)	/* postfix(1) iterator mode */
+#define ITER_CMD_LIST		(1<<1)	/* listing iterator mode */
+#define ITER_CMD_GENERIC	(1<<2)	/* generic command iterator mode */
+
+#define ITER_CMD_MASK_ALL \
+    (ITER_CMD_POSTFIX | ITER_CMD_LIST | ITER_CMD_GENERIC)
+
+#define EDIT_CMD_CREATE		(1<<4)	/* create new instance */
+#define EDIT_CMD_IMPORT		(1<<5)	/* import existing instance */
+#define EDIT_CMD_DESTROY	(1<<6)	/* destroy instance */
+#define EDIT_CMD_DEPORT		(1<<7)	/* export instance */
+#define EDIT_CMD_ENABLE		(1<<8)	/* enable start/stop */
+#define EDIT_CMD_DISABLE	(1<<9)	/* disable start/stop */
+#define EDIT_CMD_ASSIGN		(1<<10)	/* assign name/group */
+#define EDIT_CMD_INIT		(1<<11)	/* hook into main.cf */
+
+#define EDIT_CMD_MASK_ADD	(EDIT_CMD_CREATE | EDIT_CMD_IMPORT)
+#define EDIT_CMD_MASK_DEL	(EDIT_CMD_DESTROY | EDIT_CMD_DEPORT)
+#define EDIT_CMD_MASK_ASSIGN	(EDIT_CMD_MASK_ADD | EDIT_CMD_ASSIGN)
+#define EDIT_CMD_MASK_ENB	(EDIT_CMD_ENABLE | EDIT_CMD_DISABLE)
+#define EDIT_CMD_MASK_ALL \
+    (EDIT_CMD_MASK_ASSIGN | EDIT_CMD_MASK_DEL | EDIT_CMD_MASK_ENB | \
+	EDIT_CMD_INIT)
+
+ /*
+  * Edit command to number mapping, and vice versa.
+  */
+static NAME_CODE edit_command_table[] = {
+    "create", EDIT_CMD_CREATE,
+    "import", EDIT_CMD_IMPORT,
+    "destroy", EDIT_CMD_DESTROY,
+    "deport", EDIT_CMD_DEPORT,
+    "enable", EDIT_CMD_ENABLE,
+    "disable", EDIT_CMD_DISABLE,
+    "assign", EDIT_CMD_ASSIGN,
+    "init", EDIT_CMD_INIT,
+    0, -1,
+};
+
+#define EDIT_CMD_CODE(str) \
+	name_code(edit_command_table, NAME_CODE_FLAG_STRICT_CASE, (str))
+#define EDIT_CMD_STR(code)	str_name_code(edit_command_table, (code))
+
+ /*
+  * Mandatory prefix for non-empty instance names.
+  */
+#ifndef NAME_PREFIX
+#define NAME_PREFIX "postfix-"
+#endif
+#define HAS_NAME_PREFIX(name) \
+     (strncmp((name), NAME_PREFIX, sizeof(NAME_PREFIX)-1) == 0)
+#define NEED_NAME_PREFIX(name) \
+    ((name) != 0 && strcmp((name), "-") != 0 && !HAS_NAME_PREFIX(name))
+#define NAME_SUFFIX(name) ((name) + sizeof(NAME_PREFIX) - 1)
+
+ /*
+  * In-core instance structure. Only private information is kept here.
+  */
+typedef struct instance {
+    RING    ring;			/* linkage. */
+    char   *config_dir;			/* private */
+    char   *queue_dir;			/* private */
+    char   *data_dir;			/* private */
+    char   *name;			/* null or name */
+    char   *gname;			/* null or group */
+    int     enabled;			/* start/stop enable */
+    int     primary;			/* special */
+} INSTANCE;
+
+ /*
+  * Managed instance list (edit mode and iterator mode).
+  */
+static RING instance_hd[1];		/* instance list head */
+
+#define RING_TO_INSTANCE(ring_ptr)	RING_TO_APPL(ring_ptr, INSTANCE, ring)
+#define RING_PTR_OF(x)			(&((x)->ring))
+
+#define FOREACH_INSTANCE(entry) \
+    for ((entry) = instance_hd; \
+	 ((entry) = ring_succ(entry)) != instance_hd;)
+
+#define FOREACH_SECONDARY_INSTANCE(entry) \
+    for ((entry) = ring_succ(instance_hd); \
+	 ((entry) = ring_succ(entry)) != instance_hd;)
+
+#define NEXT_ITERATOR_INSTANCE(flags, entry) \
+    (((flags) & ITER_FLAG_REVERSE) ? ring_pred(entry) : ring_succ(entry))
+
+#define FOREACH_ITERATOR_INSTANCE(flags, entry) \
+    for ((entry) = instance_hd; \
+	((entry) = NEXT_ITERATOR_INSTANCE(flags, (entry))) != instance_hd;)
+
+ /*
+  * Instance selection. One can either select all instances, select by
+  * instance name, or select by instance group.
+  */
+typedef struct {
+    int     type;			/* see below */
+    char   *name;			/* undefined or name */
+} INST_SELECTION;
+
+#define INST_SEL_NONE		0	/* default: no selection */
+#define INST_SEL_ALL		1	/* select all instances */
+#define INST_SEL_NAME		2	/* select instance name */
+#define INST_SEL_GROUP		3	/* select instance group */
+
+ /*
+  * Instance name assignment. Each instance may be assigned an instance name
+  * (this must be globally unique within a multi-instance cluster) or an
+  * instance group name (this is intended to be shared). Externally, empty
+  * names may be represented as "-". Internally, we use "" only, to simplify
+  * the code.
+  */
+typedef struct {
+    char   *name;			/* null or assigned instance name */
+    char   *gname;			/* null or assigned group name */
+} NAME_ASSIGNMENT;
+
+ /*
+  * Iterator controls for non-edit commands. One can reverse the iteration
+  * order, or give special treatment to disabled instances.
+  */
+#define ITER_FLAG_DEFAULT	0	/* default setting */
+#define ITER_FLAG_REVERSE	(1<<0)	/* reverse iteration order */
+#define ITER_FLAG_CHECK_DISABLED (1<<1)	/* check disabled instances */
+#define ITER_FLAG_SKIP_DISABLED	(1<<2)	/* skip disabled instances */
+
+ /*
+  * Environment export controls for edit commands. postmulti(1) exports only
+  * things that need to be updated.
+  */
+#define EXP_FLAG_MULTI_DIRS	(1<<0)	/* export multi_instance_directories */
+#define EXP_FLAG_MULTI_NAME	(1<<1)	/* export multi_instance_name */
+#define EXP_FLAG_MULTI_GROUP	(1<<2)	/* export multi_instance_group */
+
+ /*
+  * To detect conflicts, each instance name and each shared or private
+  * pathname is registered in one place, with its owner. Everyone must
+  * register their claims when they join, and will be rejected in case of
+  * conflict.
+  * 
+  * Each claim value involves a parameter value (either a directory name or an
+  * instance name). Each claim owner is the config_directory pathname plus
+  * the parameter name.
+  * 
+  * XXX: No multi.cf lock file, so this is not race-free.
+  */
+static HTABLE *claim_table;
+
+#define IS_CLAIMED_BY(name) \
+    (claim_table ? htable_find(claim_table, (name)) : 0)
+
+ /*
+  * Forward references.
+  */
+static int iterate_command(int, int, char **, INST_SELECTION *);
+static int match_instance_selection(INSTANCE *, INST_SELECTION *);
+
+ /*
+  * Convenience.
+  */
+#define INSTANCE_NAME(i) ((i)->name ? (i)->name : (i)->config_dir)
+#define STR(buf)	vstring_str(buf)
+
+/* register_claim - register claim or bust */
+
+static void register_claim(const char *instance_path, const char *param_name,
+			           const char *param_value)
+{
+    const char *myname = "register_claim";
+    char   *requestor;
+    const char *owner;
+
+    /*
+     * Sanity checks.
+     */
+    if (instance_path == 0 || *instance_path == 0)
+	msg_panic("%s: no or empty instance pathname", myname);
+    if (param_name == 0 || *param_name == 0)
+	msg_panic("%s: no or empty parameter name", myname);
+    if (param_value == 0)
+	msg_panic("%s: no parameter value", myname);
+
+    /*
+     * Make a claim or report a conflict.
+     */
+    if (claim_table == 0)
+	claim_table = htable_create(100);
+    requestor = concatenate(instance_path, ", ", param_name, (char *) 0);
+    if ((owner = htable_find(claim_table, param_value)) == 0) {
+	(void) htable_enter(claim_table, param_value, requestor);
+    } else if (strcmp(owner, requestor) == 0) {
+	myfree(requestor);
+    } else {
+	msg_fatal("instance %s, %s=%s conflicts with instance %s=%s",
+		instance_path, param_name, param_value, owner, param_value);
+    }
+}
+
+/* claim_instance_attributes - claim multiple private instance attributes */
+
+static void claim_instance_attributes(INSTANCE *ip)
+{
+
+    /*
+     * Detect instance name or pathname conflicts between this instance and
+     * other instances. XXX: No multi.cf lock file, so this is not race-free.
+     */
+    if (ip->name)
+	register_claim(ip->config_dir, VAR_MULTI_NAME, ip->name);
+    register_claim(ip->config_dir, VAR_CONFIG_DIR, ip->config_dir);
+    register_claim(ip->config_dir, VAR_QUEUE_DIR, ip->queue_dir);
+    register_claim(ip->config_dir, VAR_DATA_DIR, ip->data_dir);
+}
+
+/* alloc_instance - allocate a single instance object */
+
+static INSTANCE *alloc_instance(const char *config_dir)
+{
+    INSTANCE *ip = (INSTANCE *) mymalloc(sizeof(INSTANCE));
+
+    ring_init(RING_PTR_OF(ip));
+    ip->config_dir = config_dir ? mystrdup(config_dir) : 0;
+    ip->queue_dir = 0;
+    ip->data_dir = 0;
+    ip->name = 0;
+    ip->gname = 0;
+    ip->enabled = 0;
+    ip->primary = 0;
+
+    return (ip);
+}
+
+#if 0
+
+/* free_instance - free a single instance object */
+
+static void free_instance(INSTANCE *ip)
+{
+
+    /*
+     * If we continue after secondary main.cf file read error, we must be
+     * prepared for the case that some parameters may be missing.
+     */
+    if (ip->name)
+	myfree(ip->name);
+    if (ip->gname)
+	myfree(ip->gname);
+    if (ip->config_dir)
+	myfree(ip->config_dir);
+    if (ip->queue_dir)
+	myfree(ip->queue_dir);
+    if (ip->data_dir)
+	myfree(ip->data_dir);
+    myfree((void *) ip);
+}
+
+#endif
+
+/* insert_instance - insert instance before selected location, claim names */
+
+static void insert_instance(INSTANCE *ip, INST_SELECTION *selection)
+{
+    RING   *old;
+
+#define append_instance(ip) insert_instance((ip), (INST_SELECTION *) 0)
+
+    /*
+     * Insert instance before the selected site.
+     */
+    claim_instance_attributes(ip);
+    if (ring_succ(instance_hd) == 0)
+	ring_init(instance_hd);
+    if (selection && selection->type != INST_SEL_NONE) {
+	FOREACH_SECONDARY_INSTANCE(old) {
+	    if (match_instance_selection(RING_TO_INSTANCE(old), selection)) {
+		ring_prepend(old, RING_PTR_OF(ip));
+		return;
+	    }
+	}
+	if (selection->type != INST_SEL_ALL)
+	    msg_fatal("No matching secondary instances");
+    }
+    ring_prepend(instance_hd, RING_PTR_OF(ip));
+}
+
+/* create_primary_instance - synthetic entry for primary instance */
+
+static INSTANCE *create_primary_instance(void)
+{
+    INSTANCE *ip = alloc_instance(var_config_dir);
+
+    /*
+     * There is no need to load primary instance parameter settings from
+     * file. We already have the main.cf parameters of interest in memory.
+     */
+#define SAVE_INSTANCE_NAME(val) (*(val) ? mystrdup(val) : 0)
+
+    ip->name = SAVE_INSTANCE_NAME(var_multi_name);
+    ip->gname = SAVE_INSTANCE_NAME(var_multi_group);
+    ip->enabled = var_multi_enable;
+    ip->queue_dir = mystrdup(var_queue_dir);
+    ip->data_dir = mystrdup(var_data_dir);
+    ip->primary = 1;
+    return (ip);
+}
+
+/* load_instance - read instance parameters from config_dir/main.cf */
+
+static INSTANCE *load_instance(INSTANCE *ip)
+{
+    VSTREAM *pipe;
+    VSTRING *buf;
+    char   *name;
+    char   *value;
+    ARGV   *cmd;
+    int     count = 0;
+    static NAME_CODE bool_code[] = {
+	CONFIG_BOOL_YES, 1,
+	CONFIG_BOOL_NO, 0,
+	0, -1,
+    };
+
+    /*
+     * Expand parameter values in the context of the target main.cf file.
+     */
+#define REQUEST_PARAM_COUNT 5			/* # of requested parameters */
+
+    cmd = argv_alloc(REQUEST_PARAM_COUNT + 3);
+    name = concatenate(var_command_dir, "/", "postconf", (char *) 0);
+    argv_add(cmd, name, "-xc", ip->config_dir,
+	     VAR_QUEUE_DIR, VAR_DATA_DIR,
+	     VAR_MULTI_NAME, VAR_MULTI_GROUP, VAR_MULTI_ENABLE,
+	     (char *) 0);
+    myfree(name);
+    pipe = vstream_popen(O_RDONLY, CA_VSTREAM_POPEN_ARGV(cmd->argv),
+			 CA_VSTREAM_POPEN_END);
+    argv_free(cmd);
+    if (pipe == 0)
+	msg_fatal("Cannot parse %s/main.cf file: %m", ip->config_dir);
+
+    /*
+     * Read parameter settings from postconf. See also comments below on
+     * whether we should continue or skip groups after error instead of
+     * bailing out immediately.
+     */
+    buf = vstring_alloc(100);
+    while (vstring_get_nonl(buf, pipe) != VSTREAM_EOF) {
+	if (split_nameval(STR(buf), &name, &value))
+	    msg_fatal("Invalid %s/main.cf parameter: %s",
+		      ip->config_dir, STR(buf));
+	if (strcmp(name, VAR_QUEUE_DIR) == 0 && ++count)
+	    ip->queue_dir = mystrdup(value);
+	else if (strcmp(name, VAR_DATA_DIR) == 0 && ++count)
+	    ip->data_dir = mystrdup(value);
+	else if (strcmp(name, VAR_MULTI_NAME) == 0 && ++count)
+	    ip->name = SAVE_INSTANCE_NAME(value);
+	else if (strcmp(name, VAR_MULTI_GROUP) == 0 && ++count)
+	    ip->gname = SAVE_INSTANCE_NAME(value);
+	else if (strcmp(name, VAR_MULTI_ENABLE) == 0 && ++count) {
+	    /* mail_conf_bool(3) is case insensitive! */
+	    ip->enabled = name_code(bool_code, NAME_CODE_FLAG_NONE, value);
+	    if (ip->enabled < 0)
+		msg_fatal("Unexpected %s/main.cf entry: %s = %s",
+			  ip->config_dir, VAR_MULTI_ENABLE, value);
+	}
+    }
+    vstring_free(buf);
+
+    /*
+     * XXX We should not bail out while reading a bad secondary main.cf file.
+     * When we manage dozens or more instances, the likelihood increases that
+     * some file will be damaged or missing after a system crash. That is not
+     * a good reason to prevent undamaged Postfix instances from starting.
+     */
+    if (count != REQUEST_PARAM_COUNT)
+	msg_fatal("Failed to obtain all required %s/main.cf parameters",
+		  ip->config_dir);
+
+    if (vstream_pclose(pipe))
+	msg_fatal("Cannot parse %s/main.cf file", ip->config_dir);
+    return (ip);
+}
+
+/* load_all_instances - compute list of Postfix instances */
+
+static void load_all_instances(void)
+{
+    INSTANCE *primary_instance;
+    char  **cpp;
+    ARGV   *secondary_names;
+
+    /*
+     * Avoid unexpected behavior when $multi_instance_directories contains
+     * only comma characters. Count the actual number of elements, before we
+     * decide that the list is empty.
+     */
+    secondary_names = argv_split(var_multi_conf_dirs, CHARS_COMMA_SP);
+
+    /*
+     * First, the primary instance.  This is synthesized out of thin air.
+     */
+    primary_instance = create_primary_instance();
+    if (secondary_names->argc == 0)
+	primary_instance->enabled = 1;		/* Single-instance mode */
+    append_instance(primary_instance);
+
+    /*
+     * Next, instances defined in $multi_instance_directories. Note:
+     * load_instance() has side effects on the global config dictionary, but
+     * this does not affect the values that have already been extracted into
+     * C variables.
+     */
+    for (cpp = secondary_names->argv; *cpp != 0; cpp++)
+	append_instance(load_instance(alloc_instance(*cpp)));
+
+    argv_free(secondary_names);
+}
+
+/* match_instance_selection - match all/name/group constraints */
+
+static int match_instance_selection(INSTANCE *ip, INST_SELECTION *selection)
+{
+    char   *iname;
+    char   *name;
+
+    /*
+     * When selecting (rather than assigning names) an instance, we match by
+     * the instance name, config_directory path, or the instance name suffix
+     * (name without mandatory prefix). Selecting "-" selects the primary
+     * instance.
+     */
+    switch (selection->type) {
+    case INST_SEL_NONE:
+	return (0);
+    case INST_SEL_ALL:
+	return (1);
+    case INST_SEL_GROUP:
+	return (ip->gname != 0 && strcmp(selection->name, ip->gname) == 0);
+    case INST_SEL_NAME:
+	name = selection->name;
+	if (*name == '/' || ip->name == 0)
+	    iname = ip->config_dir;
+	else if (!HAS_NAME_PREFIX(name) && HAS_NAME_PREFIX(ip->name))
+	    iname = NAME_SUFFIX(ip->name);
+	else
+	    iname = ip->name;
+	return (strcmp(name, iname) == 0
+		|| (ip->primary && strcmp(name, "-") == 0));
+    default:
+	msg_panic("match_instance_selection: unknown selection type: %d",
+		  selection->type);
+    }
+}
+
+/* check_setenv - setenv() with extreme prejudice */
+
+static void check_setenv(const char *name, const char *value)
+{
+#define CLOBBER 1
+    if (setenv(name, value, CLOBBER) < 0)
+	msg_fatal("setenv: %m");
+}
+
+/* prepend_command_path - prepend command_directory to PATH */
+
+static void prepend_command_path(void)
+{
+    char   *cmd_path;
+
+    /*
+     * Carefully prepend "$command_directory:" to PATH. We can free the
+     * buffer after check_setenv(), since the value is copied there.
+     */
+    cmd_path = safe_getenv("PATH");
+    cmd_path = concatenate(var_command_dir, ":", (cmd_path && *cmd_path) ?
+			   cmd_path : ROOT_PATH, (char *) 0);
+    check_setenv("PATH", cmd_path);
+    myfree(cmd_path);
+}
+
+/* check_shared_dir_status - check and claim shared directories */
+
+static void check_shared_dir_status(void)
+{
+    struct stat st;
+    const SHARED_PATH *sp;
+
+    /*
+     * XXX Avoid false conflicts with meta_directory. This usually overlaps
+     * with other directories, typically config_directory, shlib_directory or
+     * daemon_directory.
+     */
+    for (sp = shared_dir_table; sp->param_name; ++sp) {
+	if (sp->param_value[0][0] != '/')	/* "no" or other special */
+	    continue;
+	if (stat(sp->param_value[0], &st) < 0)
+	    msg_fatal("%s = '%s': directory not found: %m",
+		      sp->param_name, sp->param_value[0]);
+	if (!S_ISDIR(st.st_mode))
+	    msg_fatal("%s = '%s' is not a directory",
+		      sp->param_name, sp->param_value[0]);
+	if (strcmp(sp->param_name, VAR_META_DIR) == 0)
+	    continue;
+	register_claim(var_config_dir, sp->param_name, sp->param_value[0]);
+    }
+}
+
+/* check_safe_name - allow instance or group name with only "safe" characters */
+
+static int check_safe_name(const char *s)
+{
+#define SAFE_PUNCT	"!@%-_=+:./"
+    if (*s == 0)
+	return (0);
+    for (; *s; ++s) {
+	if (!ISALNUM(*s) && !strchr(SAFE_PUNCT, *s))
+	    return (0);
+    }
+    return (1);
+}
+
+/* check_name_assignments - Check validity of assigned instance or group name */
+
+static void check_name_assignments(NAME_ASSIGNMENT *assignment)
+{
+
+    /*
+     * Syntax check the assigned instance name. This name is also used to
+     * generate directory pathnames, so we must not allow "/" characters.
+     * 
+     * The value "" will clear the name and is always valid. The command-line
+     * parser has already converted "-" into "", to simplify implementation.
+     */
+    if (assignment->name && *assignment->name) {
+	if (!check_safe_name(assignment->name))
+	    msg_fatal("Unsafe characters in new instance name: '%s'",
+		      assignment->name);
+	if (strchr(assignment->name, '/'))
+	    msg_fatal("Illegal '/' character in new instance name: '%s'",
+		      assignment->name);
+	if (NEED_NAME_PREFIX(assignment->name))
+	    msg_fatal("New instance name must start with '%s'",
+		      NAME_PREFIX);
+    }
+
+    /*
+     * Syntax check the assigned group name.
+     */
+    if (assignment->gname && *assignment->gname) {
+	if (!check_safe_name(assignment->gname))
+	    msg_fatal("Unsafe characters in '-G %s'", assignment->gname);
+    }
+}
+
+/* do_name_assignments - assign instance/group names */
+
+static int do_name_assignments(INSTANCE *target, NAME_ASSIGNMENT *assignment)
+{
+    int     export_flags = 0;
+
+    /*
+     * The command-line parser has already converted "-" into "", to simplify
+     * implementation.
+     */
+    if (assignment->name
+	&& strcmp(assignment->name, target->name ? target->name : "")) {
+	register_claim(target->config_dir, VAR_MULTI_NAME, assignment->name);
+	if (target->name)
+	    myfree(target->name);
+	target->name = SAVE_INSTANCE_NAME(assignment->name);
+	export_flags |= EXP_FLAG_MULTI_NAME;
+    }
+    if (assignment->gname
+	&& strcmp(assignment->gname, target->gname ? target->gname : "")) {
+	if (target->gname)
+	    myfree(target->gname);
+	target->gname = SAVE_INSTANCE_NAME(assignment->gname);
+	export_flags |= EXP_FLAG_MULTI_GROUP;
+    }
+    return (export_flags);
+}
+
+/* make_private_path - generate secondary pathname using primary as template */
+
+static char *make_private_path(const char *param_name,
+			               const char *primary_value,
+			               NAME_ASSIGNMENT *assignment)
+{
+    char   *path;
+    char   *base;
+    char   *end;
+
+    /*
+     * The command-line parser has already converted "-" into "", to simplify
+     * implementation.
+     */
+    if (assignment->name == 0 || *assignment->name == 0)
+	msg_fatal("Missing %s parameter value", param_name);
+
+    if (*primary_value != '/')
+	msg_fatal("Invalid default %s parameter value: '%s': "
+		  "specify an absolute pathname",
+		  param_name, primary_value);
+
+    base = mystrdup(primary_value);
+    if ((end = strrchr(base, '/')) != 0) {
+	/* Drop trailing slashes */
+	if (end[1] == '\0') {
+	    while (--end > base && *end == '/')
+		*end = '\0';
+	    end = strrchr(base, '/');
+	}
+	/* Drop last path component */
+	while (end > base && *end == '/')
+	    *end-- = '\0';
+    }
+    path = concatenate(base[1] ? base : "", "/",
+		       assignment->name, (char *) 0);
+    myfree(base);
+    return (path);
+}
+
+/* assign_new_parameter - assign new instance private name=value */
+
+static void assign_new_parameter(INSTANCE *new, int edit_cmd,
+				         const char *arg)
+{
+    char   *saved_arg;
+    char   *name;
+    char   *value;
+    char   *end;
+    char  **target = 0;
+
+    /*
+     * With "import", only config_directory is specified on the command line
+     * (either explicitly as config_directory=/path/name, or implicitly as
+     * instance name). The other private directory pathnames are taken from
+     * the existing instance's main.cf file.
+     * 
+     * With "create", all private pathname parameters are specified on the
+     * command line, or generated from an instance name.
+     */
+    saved_arg = mystrdup(arg);
+    if (split_nameval(saved_arg, &name, &value))
+	msg_fatal("Malformed parameter setting '%s'", arg);
+
+    if (strcmp(VAR_CONFIG_DIR, name) == 0) {
+	target = &new->config_dir;
+    } else if (edit_cmd != EDIT_CMD_IMPORT) {
+	if (strcmp(VAR_QUEUE_DIR, name) == 0) {
+	    target = &new->queue_dir;
+	} else if (strcmp(VAR_DATA_DIR, name) == 0) {
+	    target = &new->data_dir;
+	}
+    }
+    if (target == 0)
+	msg_fatal("Parameter '%s' not valid with action %s",
+		  name, EDIT_CMD_STR(edit_cmd));
+
+    /*
+     * Extract and assign the parameter value. We do a limited number of
+     * checks here. Conflicts between instances are checked by the caller.
+     * More checks may be implemented in the helper script if inspired.
+     */
+    if (*value != '/')
+	msg_fatal("Parameter setting '%s' is not an absolute path", name);
+
+    /* Tolerate+trim trailing "/" from readline completion */
+    for (end = value + strlen(value) - 1; end > value && *end == '/'; --end)
+	*end = 0;
+
+    /* No checks here for "/." or other shoot-foot silliness. */
+    if (end == value)
+	msg_fatal("Parameter setting '%s' is the root directory", name);
+
+    if (*target)
+	myfree(*target);
+    *target = mystrdup(value);
+
+    /*
+     * Cleanup.
+     */
+    myfree(saved_arg);
+}
+
+/* assign_new_parameters - initialize new instance private parameters */
+
+static void assign_new_parameters(INSTANCE *new, int edit_cmd,
+			           char **argv, NAME_ASSIGNMENT *assignment)
+{
+    const char *owner;
+
+    /*
+     * Sanity check the explicit parameter settings. More stringent checks
+     * may take place in the helper script.
+     */
+    while (*argv)
+	assign_new_parameter(new, edit_cmd, *argv++);
+
+    /*
+     * Initialize any missing private directory pathnames, using the primary
+     * configuration directory parameter values as a template, and using the
+     * assigned instance name to fill in the blanks.
+     * 
+     * When importing an existing instance, load private directory pathnames
+     * from its main.cf file.
+     */
+    if (new->config_dir == 0)
+	new->config_dir =
+	    make_private_path(VAR_CONFIG_DIR, var_config_dir, assignment);
+    /* Needed for better-quality error message. */
+    if ((owner = IS_CLAIMED_BY(new->config_dir)) != 0)
+	msg_fatal("new %s=%s is already in use by instance %s=%s",
+		  VAR_CONFIG_DIR, new->config_dir, owner, new->config_dir);
+    if (edit_cmd != EDIT_CMD_IMPORT) {
+	if (new->queue_dir == 0)
+	    new->queue_dir =
+		make_private_path(VAR_QUEUE_DIR, var_queue_dir, assignment);
+	if (new->data_dir == 0)
+	    new->data_dir =
+		make_private_path(VAR_DATA_DIR, var_data_dir, assignment);
+    } else {
+	load_instance(new);
+    }
+}
+
+/* export_helper_environment - update environment settings for helper command */
+
+static void export_helper_environment(INSTANCE *target, int export_flags)
+{
+    ARGV   *import_env;
+    VSTRING *multi_dirs;
+    const SHARED_PATH *sp;
+    RING   *entry;
+
+    /*
+     * Environment import filter, to enforce consistent behavior whether this
+     * command is started by hand, or at system boot time. This is necessary
+     * because some shell scripts use environment settings to override
+     * main.cf settings.
+     */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    clean_env(import_env->argv);
+    argv_free(import_env);
+
+    /*
+     * Prepend $command_directory: to PATH. This supposedly ensures that
+     * naive programs will execute commands from the right Postfix version.
+     */
+    prepend_command_path();
+
+    /*
+     * The following ensures that Postfix's own programs will target the
+     * primary instance.
+     */
+    check_setenv(CONF_ENV_PATH, var_config_dir);
+
+    /*
+     * Export the parameter settings that are shared between instances.
+     */
+    for (sp = shared_dir_table; sp->param_name; ++sp)
+	check_setenv(sp->param_name, sp->param_value[0]);
+
+    /*
+     * Export the target instance's private directory locations.
+     */
+    check_setenv(VAR_CONFIG_DIR, target->config_dir);
+    check_setenv(VAR_QUEUE_DIR, target->queue_dir);
+    check_setenv(VAR_DATA_DIR, target->data_dir);
+
+    /*
+     * With operations that add or delete a secondary instance, we export the
+     * modified multi_instance_directories parameter value for the primary
+     * Postfix instance.
+     */
+    if (export_flags & EXP_FLAG_MULTI_DIRS) {
+	multi_dirs = vstring_alloc(100);
+	FOREACH_SECONDARY_INSTANCE(entry) {
+	    if (VSTRING_LEN(multi_dirs) > 0)
+		VSTRING_ADDCH(multi_dirs, ' ');
+	    vstring_strcat(multi_dirs, RING_TO_INSTANCE(entry)->config_dir);
+	}
+	check_setenv(VAR_MULTI_CONF_DIRS, STR(multi_dirs));
+	vstring_free(multi_dirs);
+    }
+
+    /*
+     * Export updates for the instance name and group. Empty value (or no
+     * export) means don't update, "-" means clear.
+     */
+    if (export_flags & EXP_FLAG_MULTI_NAME)
+	check_setenv(VAR_MULTI_NAME, target->name && *target->name ?
+		     target->name : "-");
+
+    if (export_flags & EXP_FLAG_MULTI_GROUP)
+	check_setenv(VAR_MULTI_GROUP, target->gname && *target->gname ?
+		     target->gname : "-");
+
+    /*
+     * If we would implement enable/disable commands by exporting the updated
+     * parameter value, then we could skip commands that have no effect, just
+     * like we can skip "assign" commands that make no change.
+     */
+}
+
+/* install_new_instance - install and return newly created instance */
+
+static INSTANCE *install_new_instance(int edit_cmd, char **argv,
+				              INST_SELECTION *selection,
+				              NAME_ASSIGNMENT *assignment,
+				              int *export_flags)
+{
+    INSTANCE *new;
+
+    new = alloc_instance((char *) 0);
+    check_name_assignments(assignment);
+    assign_new_parameters(new, edit_cmd, argv, assignment);
+    *export_flags |=
+	(do_name_assignments(new, assignment) | EXP_FLAG_MULTI_DIRS);
+    insert_instance(new, selection);
+    return (new);
+}
+
+/* update_instance - update existing instance, return export flags */
+
+static int update_instance(INSTANCE *target, NAME_ASSIGNMENT *assignment)
+{
+    int     export_flags;
+
+    check_name_assignments(assignment);
+    export_flags = do_name_assignments(target, assignment);
+    return (export_flags);
+}
+
+/* select_existing_instance - return instance selected for management */
+
+static INSTANCE *select_existing_instance(INST_SELECTION *selection,
+					          int unlink_flag,
+					          int *export_flags)
+{
+    INSTANCE *selected = 0;
+    RING   *entry;
+    INSTANCE *ip;
+
+#define DONT_UNLINK	0
+#define DO_UNLINK	1
+
+    if (selection->type != INST_SEL_NAME)
+	msg_fatal("Select an instance via '-i name'");
+
+    /* Find the selected instance and its predecessor */
+    FOREACH_INSTANCE(entry) {
+	if (match_instance_selection(ip = RING_TO_INSTANCE(entry), selection)) {
+	    selected = ip;
+	    break;
+	}
+    }
+
+    if (selected == 0)
+	msg_fatal("No instance named %s", selection->name);
+
+    if (unlink_flag) {
+	/* Splice the target instance out of the list */
+	if (ring_pred(entry) == instance_hd)
+	    msg_fatal("Cannot remove the primary instance");
+	if (selected->enabled)
+	    msg_fatal("Cannot remove enabled instances");
+	ring_detach(entry);
+	if (export_flags == 0)
+	    msg_panic("select_existing_instance: no export flags");
+	*export_flags |= EXP_FLAG_MULTI_DIRS;
+    }
+    return (selected);
+}
+
+/* manage - create/destroy/... manage instances */
+
+static NORETURN manage(int edit_cmd, int argc, char **argv,
+		               INST_SELECTION *selection,
+		               NAME_ASSIGNMENT *assignment)
+{
+    char   *cmd;
+    INSTANCE *target;
+    int     export_flags;
+
+    /*
+     * Edit mode is not subject to iterator controls.
+     */
+#define NO_EXPORT_FLAGS		((int *) 0)
+    export_flags = 0;
+
+    switch (edit_cmd) {
+    case EDIT_CMD_INIT:
+	target = create_primary_instance();
+	break;
+
+    case EDIT_CMD_CREATE:
+    case EDIT_CMD_IMPORT:
+	load_all_instances();
+	target = install_new_instance(edit_cmd, argv, selection,
+				      assignment, &export_flags);
+	break;
+
+    case EDIT_CMD_ASSIGN:
+	load_all_instances();
+	target =
+	    select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS);
+	export_flags |= update_instance(target, assignment);
+	if (export_flags == 0)
+	    exit(0);
+	break;
+
+    case EDIT_CMD_DESTROY:
+    case EDIT_CMD_DEPORT:
+	load_all_instances();
+	target = select_existing_instance(selection, DO_UNLINK, &export_flags);
+	break;
+
+    default:
+	load_all_instances();
+	target =
+	    select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS);
+	break;
+    }
+
+    /*
+     * Set up the helper script's process environment, and execute the helper
+     * script.
+     */
+#define HELPER "postmulti-script"
+
+    export_helper_environment(target, export_flags);
+    cmd = concatenate(var_daemon_dir, "/" HELPER, (char *) 0);
+    execl(cmd, cmd, "-e", EDIT_CMD_STR(edit_cmd), (char *) 0);
+    msg_fatal("%s: %m", cmd);
+}
+
+/* run_user_command - execute external command with requested MAIL_CONFIG env */
+
+static int run_user_command(INSTANCE *ip, int iter_cmd, int iter_flags,
+			            char **argv)
+{
+    WAIT_STATUS_T status;
+    int     pid;
+    int     wpid;
+
+    /*
+     * Set up a process environment. The postfix(1) command needs MAIL_CONFIG
+     * (or the equivalent command-line option); it overrides everything else.
+     * 
+     * postmulti(1) typically runs various Postfix utilities (postsuper, ...) in
+     * the context of one or more instances. It can also run various scripts
+     * on the users PATH. So we can't clobber the user's PATH, but do want to
+     * make sure that the utilities in $command_directory are always found in
+     * the right place (or at all).
+     */
+    switch (pid = fork()) {
+    case -1:
+	msg_warn("fork %s: %m", argv[0]);
+	return -1;
+    case 0:
+	check_setenv(CONF_ENV_PATH, ip->config_dir);
+	if (iter_cmd != ITER_CMD_POSTFIX) {
+	    check_setenv(VAR_DAEMON_DIR, var_daemon_dir);
+	    check_setenv(VAR_COMMAND_DIR, var_command_dir);
+	    check_setenv(VAR_CONFIG_DIR, ip->config_dir);
+	    check_setenv(VAR_QUEUE_DIR, ip->queue_dir);
+	    check_setenv(VAR_DATA_DIR, ip->data_dir);
+	    check_setenv(VAR_MULTI_NAME, ip->name ? ip->name : "");
+	    check_setenv(VAR_MULTI_GROUP, ip->gname ? ip->gname : "");
+	    check_setenv(VAR_MULTI_ENABLE, ip->enabled ?
+			 CONFIG_BOOL_YES : CONFIG_BOOL_NO);
+	    prepend_command_path();
+	}
+
+	/*
+	 * Replace: postfix -- start ... With: postfix -- check ...
+	 */
+	if (iter_cmd == ITER_CMD_POSTFIX
+	    && (iter_flags & ITER_FLAG_CHECK_DISABLED) && !ip->enabled)
+	    argv[2] = "check";
+
+	execvp(argv[0], argv);
+	msg_fatal("execvp %s: %m", argv[0]);
+    default:
+	do {
+	    wpid = waitpid(pid, &status, 0);
+	} while (wpid == -1 && errno == EINTR);
+	return (wpid == -1 ? -1 :
+		WIFEXITED(status) ? WEXITSTATUS(status) : 1);
+    }
+}
+
+/* word_in_list - look up command in start, stop, or control list */
+
+static int word_in_list(char *cmdlist, const char *cmd)
+{
+    char   *saved;
+    char   *cp;
+    char   *elem;
+
+    cp = saved = mystrdup(cmdlist);
+    while ((elem = mystrtok(&cp, CHARS_COMMA_SP)) != 0 && strcmp(elem, cmd) != 0)
+	 /* void */ ;
+    myfree(saved);
+    return (elem != 0);
+}
+
+/* iterate_postfix_command - execute postfix(1) command */
+
+static int iterate_postfix_command(int iter_cmd, int argc, char **argv,
+				           INST_SELECTION *selection)
+{
+    int     exit_status;
+    char   *cmd;
+    ARGV   *my_argv;
+    int     iter_flags;
+
+    /*
+     * Override the iterator controls.
+     */
+    if (word_in_list(var_multi_start_cmds, argv[0])) {
+	iter_flags = ITER_FLAG_CHECK_DISABLED;
+    } else if (word_in_list(var_multi_stop_cmds, argv[0])) {
+	iter_flags = ITER_FLAG_SKIP_DISABLED | ITER_FLAG_REVERSE;
+    } else if (word_in_list(var_multi_cntrl_cmds, argv[0])) {
+	iter_flags = ITER_FLAG_SKIP_DISABLED;
+    } else {
+	iter_flags = 0;
+    }
+
+    /*
+     * Override the command line in a straightforward manner: prepend
+     * "postfix --" to the command arguments. Other overrides (environment,
+     * start -> check) are implemented below the iterator.
+     */
+#define POSTFIX_CMD	"postfix"
+
+    my_argv = argv_alloc(argc + 2);
+    cmd = concatenate(var_command_dir, "/" POSTFIX_CMD, (char *) 0);
+    argv_add(my_argv, cmd, "--", (char *) 0);
+    myfree(cmd);
+    while (*argv)
+	argv_add(my_argv, *argv++, (char *) 0);
+
+    /*
+     * Execute the command for all applicable Postfix instances.
+     */
+    exit_status =
+	iterate_command(iter_cmd, iter_flags, my_argv->argv, selection);
+
+    argv_free(my_argv);
+    return (exit_status);
+}
+
+/* list_instances - list all selected instances */
+
+static void list_instances(int iter_flags, INST_SELECTION *selection)
+{
+    RING   *entry;
+    INSTANCE *ip;
+
+    /*
+     * Iterate over the selected instances.
+     */
+    FOREACH_ITERATOR_INSTANCE(iter_flags, entry) {
+	ip = RING_TO_INSTANCE(entry);
+	if (match_instance_selection(ip, selection))
+	    vstream_printf("%-15s %-15s %-9s %s\n",
+			   ip->name ? ip->name : "-",
+			   ip->gname ? ip->gname : "-",
+			   ip->enabled ? "y" : "n",
+			   ip->config_dir);
+    }
+    if (vstream_fflush(VSTREAM_OUT))
+	msg_fatal("error writing output: %m");
+}
+
+/* iterate_command - execute command for selected instances */
+
+static int iterate_command(int iter_cmd, int iter_flags, char **argv,
+			           INST_SELECTION *selection)
+{
+    int     exit_status = 0;
+    int     matched = 0;
+    RING   *entry;
+    INSTANCE *ip;
+
+    /*
+     * Iterate over the selected instances.
+     */
+    FOREACH_ITERATOR_INSTANCE(iter_flags, entry) {
+	ip = RING_TO_INSTANCE(entry);
+	if ((iter_flags & ITER_FLAG_SKIP_DISABLED) && !ip->enabled)
+	    continue;
+	if (!match_instance_selection(ip, selection))
+	    continue;
+	matched = 1;
+
+	/* Run the requested command */
+	if (run_user_command(ip, iter_cmd, iter_flags, argv) != 0)
+	    exit_status = 1;
+    }
+    if (matched == 0)
+	msg_fatal("No matching instances");
+
+    return (exit_status);
+}
+
+/* iterate - Iterate over all or selected instances */
+
+static NORETURN iterate(int iter_cmd, int iter_flags, int argc, char **argv,
+			        INST_SELECTION *selection)
+{
+    int     exit_status;
+
+    /*
+     * In iterator mode, no selection means wild-card selection.
+     */
+    if (selection->type == INST_SEL_NONE)
+	selection->type = INST_SEL_ALL;
+
+    /*
+     * Load the in-memory instance table from main.cf files.
+     */
+    load_all_instances();
+
+    /*
+     * Iterate over the selected instances.
+     */
+    switch (iter_cmd) {
+    case ITER_CMD_POSTFIX:
+	exit_status = iterate_postfix_command(iter_cmd, argc, argv, selection);
+	break;
+    case ITER_CMD_LIST:
+	list_instances(iter_flags, selection);
+	exit_status = 0;
+	break;
+    case ITER_CMD_GENERIC:
+	exit_status = iterate_command(iter_cmd, iter_flags, argv, selection);
+	break;
+    default:
+	msg_panic("iterate: unknown mode: %d", iter_cmd);
+    }
+    exit(exit_status);
+}
+
+static NORETURN usage(const char *progname)
+{
+    msg_fatal("Usage:"
+	      "%s -l [-v] [-a] [-g group] [-i instance] | "
+	      "%s -p [-v] [-a] [-g group] [-i instance] command... | "
+	      "%s -x [-v] [-a] [-i name] [-g group] command... | "
+	      "%s -e action [-v] [-a] [-i name] [-g group] [-I name] "
+	      "[-G group] [param=value ...]",
+	      progname, progname, progname, progname);
+}
+
+MAIL_VERSION_STAMP_DECLARE;
+
+/* main - iterate commands over multiple instance or manage instances */
+
+int     main(int argc, char **argv)
+{
+    int     fd;
+    struct stat st;
+    char   *slash;
+    char   *config_dir;
+    int     ch;
+    static const CONFIG_STR_TABLE str_table[] = {
+	VAR_MULTI_START_CMDS, DEF_MULTI_START_CMDS, &var_multi_start_cmds, 0, 0,
+	VAR_MULTI_STOP_CMDS, DEF_MULTI_STOP_CMDS, &var_multi_stop_cmds, 0, 0,
+	VAR_MULTI_CNTRL_CMDS, DEF_MULTI_CNTRL_CMDS, &var_multi_cntrl_cmds, 0, 0,
+	0,
+    };
+    int     instance_select_count = 0;
+    int     command_mode_count = 0;
+    INST_SELECTION selection;
+    NAME_ASSIGNMENT assignment;
+    int     iter_flags = ITER_FLAG_DEFAULT;
+    int     cmd_mode = 0;
+    int     code;
+
+    selection.type = INST_SEL_NONE;
+    assignment.name = assignment.gname = 0;
+
+    /*
+     * Fingerprint executables and core dumps.
+     */
+    MAIL_VERSION_STAMP_ALLOCATE;
+
+    /*
+     * Be consistent with file permissions.
+     */
+    umask(022);
+
+    /*
+     * To minimize confusion, make sure that the standard file descriptors
+     * are open before opening anything else. XXX Work around for 44BSD where
+     * fstat can return EBADF on an open file descriptor.
+     */
+    for (fd = 0; fd < 3; fd++)
+	if (fstat(fd, &st) == -1
+	    && (close(fd), open("/dev/null", O_RDWR, 0)) != fd)
+	    msg_fatal("open /dev/null: %m");
+
+    /*
+     * Set up diagnostics. XXX What if stdin is the system console during
+     * boot time? It seems a bad idea to log startup errors to the console.
+     * This is UNIX, a system that can run without hand holding.
+     */
+    if ((slash = strrchr(argv[0], '/')) != 0 && slash[1])
+	argv[0] = slash + 1;
+    if (isatty(STDERR_FILENO))
+	msg_vstream_init(argv[0], VSTREAM_ERR);
+    maillog_client_init(argv[0], MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK);
+
+    /*
+     * Check the Postfix library version as soon as we enable logging.
+     */
+    MAIL_VERSION_CHECK;
+
+    /*
+     * Process main.cf parameters. This is done before the GETOPT() loop to
+     * improve logging. This assumes that no command-line option can affect
+     * parameter processing.
+     */
+    mail_conf_read();
+    get_mail_conf_str_table(str_table);
+    maillog_client_init(argv[0], MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK);
+
+    if ((config_dir = getenv(CONF_ENV_PATH)) != 0
+	&& strcmp(config_dir, DEF_CONFIG_DIR) != 0)
+	msg_fatal("Non-default configuration directory: %s=%s",
+		  CONF_ENV_PATH, config_dir);
+
+    /*
+     * Parse switches. Move the above mail_conf_read() block after this loop,
+     * if any command-line option can affect parameter processing.
+     */
+    while ((ch = GETOPT(argc, argv, "ae:g:i:G:I:lpRvx")) > 0) {
+	switch (ch) {
+	default:
+	    usage(argv[0]);
+	    /* NOTREACHED */
+	case 'a':
+	    if (selection.type != INST_SEL_ALL)
+		instance_select_count++;
+	    selection.type = INST_SEL_ALL;
+	    break;
+	case 'e':
+	    if ((code = EDIT_CMD_CODE(optarg)) < 0)
+		msg_fatal("Invalid '-e' edit action '%s'. Specify '%s', "
+			  "'%s', '%s', '%s', '%s', '%s', '%s' or '%s'",
+			  optarg,
+			  EDIT_CMD_STR(EDIT_CMD_CREATE),
+			  EDIT_CMD_STR(EDIT_CMD_DESTROY),
+			  EDIT_CMD_STR(EDIT_CMD_IMPORT),
+			  EDIT_CMD_STR(EDIT_CMD_DEPORT),
+			  EDIT_CMD_STR(EDIT_CMD_ENABLE),
+			  EDIT_CMD_STR(EDIT_CMD_DISABLE),
+			  EDIT_CMD_STR(EDIT_CMD_ASSIGN),
+			  EDIT_CMD_STR(EDIT_CMD_INIT));
+	    if (cmd_mode != code)
+		command_mode_count++;
+	    cmd_mode = code;
+	    break;
+	case 'g':
+	    instance_select_count++;
+	    selection.type = INST_SEL_GROUP;
+	    selection.name = optarg;
+	    break;
+	case 'i':
+	    instance_select_count++;
+	    selection.type = INST_SEL_NAME;
+	    selection.name = optarg;
+	    break;
+	case 'G':
+	    if (assignment.gname != 0)
+		msg_fatal("Specify at most one '-G' option");
+	    assignment.gname = strcmp(optarg, "-") == 0 ? "" : optarg;
+	    break;
+	case 'I':
+	    if (assignment.name != 0)
+		msg_fatal("Specify at most one '-I' option");
+	    assignment.name = strcmp(optarg, "-") == 0 ? "" : optarg;
+	    break;
+	case 'l':
+	    if (cmd_mode != ITER_CMD_LIST)
+		command_mode_count++;
+	    cmd_mode = ITER_CMD_LIST;
+	    break;
+	case 'p':
+	    if (cmd_mode != ITER_CMD_POSTFIX)
+		command_mode_count++;
+	    cmd_mode = ITER_CMD_POSTFIX;
+	    break;
+	case 'R':
+	    iter_flags ^= ITER_FLAG_REVERSE;
+	    break;
+	case 'v':
+	    msg_verbose++;
+	    check_setenv(CONF_ENV_VERB, "");
+	    break;
+	case 'x':
+	    if (cmd_mode != ITER_CMD_GENERIC)
+		command_mode_count++;
+	    cmd_mode = ITER_CMD_GENERIC;
+	    break;
+	}
+    }
+
+    /*
+     * Report missing arguments, or wrong arguments in the wrong context.
+     */
+    if (instance_select_count > 1)
+	msg_fatal("Specity no more than one of '-a', '-g', '-i'");
+
+    if (command_mode_count != 1)
+	msg_fatal("Specify exactly one of '-e', '-l', '-p', '-x'");
+
+    if (cmd_mode == ITER_CMD_LIST && argc > optind)
+	msg_fatal("Command not allowed with '-l'");
+
+    if (cmd_mode == ITER_CMD_POSTFIX || cmd_mode == ITER_CMD_GENERIC)
+	if (argc == optind)
+	    msg_fatal("Command required with '-p' or '-x' option");
+
+    if (cmd_mode == ITER_CMD_POSTFIX || (cmd_mode & EDIT_CMD_MASK_ALL))
+	if (iter_flags != ITER_FLAG_DEFAULT)
+	    msg_fatal("The '-p' and '-e' options preclude the use of '-R'");
+
+    if ((cmd_mode & EDIT_CMD_MASK_ASSIGN) == 0
+	&& (assignment.name || assignment.gname)) {
+	if ((cmd_mode & EDIT_CMD_MASK_ALL) == 0)
+	    msg_fatal("Cannot assign instance name or group without '-e %s'",
+		      EDIT_CMD_STR(EDIT_CMD_ASSIGN));
+	else
+	    msg_fatal("Cannot assign instance name or group with '-e %s'",
+		      EDIT_CMD_STR(cmd_mode));
+    }
+    if (cmd_mode & EDIT_CMD_MASK_ALL) {
+	if (cmd_mode == EDIT_CMD_ASSIGN
+	    && (assignment.name == 0 && assignment.gname == 0))
+	    msg_fatal("Specify new instance name or group with '-e %s'",
+		      EDIT_CMD_STR(cmd_mode));
+
+	if ((cmd_mode & ~EDIT_CMD_MASK_ADD) != 0 && argc > optind)
+	    msg_fatal("Parameter overrides not valid with '-e %s'",
+		      EDIT_CMD_STR(cmd_mode));
+    }
+
+    /*
+     * Sanity checks.
+     */
+    check_shared_dir_status();
+
+    /*
+     * Iterate over selected instances, or manipulate one instance.
+     */
+    if (cmd_mode & ITER_CMD_MASK_ALL)
+	iterate(cmd_mode, iter_flags, argc - optind, argv + optind, &selection);
+    else
+	manage(cmd_mode, argc - optind, argv + optind, &selection, &assignment);
+}