Subject: tmail send to root

From: Eric Loveland <[email-masked]>
Date: Tue, 25 Nov 2003 12:23:26 -0500

I tried using tmail as a drop-in replacement for mail.local with sendmail under
FreeBSD 5.1 because my users' inboxes are in mbx format.  My problem is that
when my daily cron jobs run, the output is sent to my root account but the
messages are deferred with the following error:
tmail[61281]: mail to root prohibited
(tmail works fine with other accounts)

I noticed that tmail.c states: "big security hole if this is allowed" where it
fails with this message if mail is being sent to root. 

First of all, why is this a security hole and secondly, how can I use tmail
with
sendmail and still have my cron messages (and other mail sent to root) go to my
root mailbox?

Thanks,
Eric Loveland

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Tue, 25 Nov 2003 10:43:44 -0800 (Pacific Standard Time)

On Tue, 25 Nov 2003, Eric Loveland wrote:
> First of all, why is this a security hole and

If mail was allowed to root or any other UID 0 user, then tmail will
happily append to any file on the system.

> secondly, how can I use
> tmail with sendmail and still have my cron messages (and other mail sent
> to root) go to my root mailbox?

Don't read mail as root (or any other UID 0 user).  Don't deliver mail to
root (or any other UID 0 user).

Forward mail addressed to root to some userid which is not UID 0; this
also applies to postmaster, abuse, and other system mailboxes.

Use UID 0 solely for privileged system tasks.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.