Subject: Re: Error Condition Re: Re: Pine lockfile (again) (fwd)

From: Michael Abbott <[email-masked]>
Date: Mon, 10 Mar 2003 08:01:09 +0000 (GMT)

> FYI
> [email-masked]: You are not subscribed to [email-masked].
Ach.  Shall I forward your reply to me to the list for you?  I guess you
ought to subscribe :)

> > 1.  Running pine SGID (as suggested in my patch) is a *bad* idea --
> >     Mats Dufberg <[email-masked]>;
> Agreed.
Ok.  I don't see the hazard in this particular application (since the mail
group has very little access to anything anyway), but I suppose as an
entity that's shared between every user it's a potential loophole?

> > 2.  RedHat has no problem with the spool set to "0775 root:mail" --
> >     Mike A. Harris <[email-masked]>
>
> Default permissions for /var/mail on FreeBSD are the same, and I don't get
> any warnings like the one mentioned. If Michael wants to follow up with
> me, I'm glad to do that. Basically I need to know what the directory
> permissions on /var/mail were previously, and how they got that way. If
> anything comes of that, I'll pass it along.

When I upgraded my FreeBSD 4.7 to the latest patch and portupgraded pine
the problem returned.  So let me try a little experimentation:

First the starting condition (this is with my fix implemented):
	$ ls -ld /var/mail
	drwxrwxr-t  2 root  mail  512 Mar 10 07:42 /var/mail
	$ ls -l /usr/local/bin/pine
	-r-xr-sr-x  1 root  mail  4234672 Feb 17 08:11 /usr/local/bin/pine
	$ pine
Nothing unexpected is reported on startup.

Now to exercise the issue:
	# chmod g-s /usr/local/bin/pine
	$ pine
Pine reports:
   [Folder vulnerable - directory /var/mail must have 1777 protection]

This only seems to happen if there is incoming mail in my inbox.  So, this
is annoying, so I'll put the s bit back:
	# chmod g+s /usr/local/bin/pine

Basic information about my system:
	$ uname -a
	FreeBSD saturn.araneidae.co.uk 4.7-RELEASE-p7 FreeBSD 4.7-RELEASE-p7 #3: Tue Mar  4 15:45:27 GMT 2003
	[email-masked]:/usr/obj/usr/src/sys/GENERIC  i386
	$ pine -v
	Pine 4.53 built Mon Feb 17 08:11:03 GMT 2003 on saturn.araneidae.co.uk

> I'm not sure there is an issue.

I don't really understand what's happening here, but it looks strange to
me.  Do you get this report, or is it peculiar to my installation?

> http://www.freebsd.org/cgi/cvsweb.cgi/ports/mail/pine4/?f=h#dirlist,

Oh my goodness me.  I didn't realise there were quite so many patches.
Whoo!
    I'm not a pine developer, so I probably can't contribute much here...