Subject: error when writing lock file

From: [email-masked] (John Barbee)
Date: Thu, 17 Sep 1998 21:47:11 -0700 (PDT)

will there be a real fix for this some time soon?  i went ahead and set
the sticky bit so now everyone and write whatever they want to mail.  it
almost seems better to change sendmail to move new mail to ~/mbox.  but
i'm sure there are other permission problems with that.  

is the mailbox locking feature really necessary?  it seems that pine can
work perfectly fine without it.

Bruno:

If you make pine sgid mail you have likely given everyone the ability to
read each others' mail, or at least the ability to delete it. To stop them
from being able to delete each other's mail, you'd need to add the sticky
bit to the spool directory. In which case you are back to fixing the
problem the other way.  The real fix is 01777 for your mail spool
directory.

Matt

On Fri, 24 Jul 1998, Bruno wrote:

> Date: Fri, 24 Jul 1998 22:07:52 -0700 (PDT)
> From: Bruno <[email-masked]>
> To: Pine Discussion Forum <[email-masked]>
> Subject: Re: Still Mailbox vulnerability on PINE4.01...
> 
> On Fri, 24 Jul 1998, Peter Green wrote:
> 
> > On Fri, 24 Jul 1998, SuperVisor de PINE wrote:
> > 
> > > 
> > > Hello, I'm volunteer tester of PINE software into two systems:
AIX4.1/3.2
> > > and NeXTstep 3.0 and I still see some extrange messages refering to
> > > Mailbox vulnerability just on AIX4.1 like this:
> > > 
> > > Mailbox vulnerable - error creating
/var/spool/mail/august.lock.901321877.1898

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------