Subject: Security question

From: Paul Ortyl <[email-masked]>
Date: Wed, 20 May 1998 23:59:21 +0200 (CEST)

I had a general security problem with deleting my mailbox.
(sendmail could write to the mailbox a moment before another program
truncated the mailbox file).

	The only solution was (as I managed to find) to create lock file
in the "/var/spool/mail" directory -- system flock() didn't work because
of setuid root sendmail.

	I checked that PINE tries to create such lock file, but fails
because of lack of permission to write to /var/spool/mail directory.

Now the QUESTION:
the mailbox directory has such permissions:
drwxrwxr-x   2 root     mail         1024 May 19 19:07 mail/
to make PINE secure in locking mailbox the administrator must create such
permissions to pine:
-rwxr-sr-x   1 root     mail      1418564 Mar  9 19:59 /usr/bin/pine
    ^^^                 ^^^^
As I checked in Slackware and RedHat (== Linux) releases PINE does not have
such permissions.

Is it done because of "security hole" or mistake in creating packages.
Other words is PINE SECURE tool when run with  setgid mail group  by
ordinary users (especially when pine starts other programs as
childprocesses (if it does -- Im not a specialist in u**x programming.))

If you know the answer or have some suggestion I would be pleased if you
could send it to my address -- I am not permanent subscriber of this
mailing list.

TIA

					Paul Ortyl

---
Paul Ortyl <mailto:[email-masked]>
  Technical University of Gdańsk, Telecomunications Faculty
---

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------