Subject: RE: read only #public?

From: Donald Buczek <[email-masked]>
Date: Fri, 19 Mar 1999 17:49:06 +0100

Mark Cirspin wrote (long ago - Mar 98) :

> OK, thanks.  I'll make LOGINPW=sec be the standard.  DEC was insistant that I
> use the SIA routines, but it seems that they don't really work.  We've had
> problems with them here too.

I used the imapd of a rather old version of c-client (4.1 BETA)
for a long time without any problems. When other users started to
use imap, they found deleted mails were reappearing in their
mailbox.

Of course, first I blamed the netscape-client. Then I analyzed the
protocol and discovered that it was a server bug (users folders were
wrongly selected READ-ONLY). Installing 4.5 fixed it.

Anyway, I tracked it down later and the bug is related to SIA. Searching
though your c-client archives and comment in osdep/unix/Makefile, I
found you had unresolved problems with it before.

I case you are still interested:

sia_become_user() doesn't change the real user id. This is documented,
but not very clearly. sia_become_user(3) says, it uses sia_ses_launch().
Quote sia_ses_launch(3):

> On the return from sia_ses_launch(), the effective UID (EUID) has been set
> to the UID of the user for this session.  Generally, a
> setreuid(geteuid(),geteuid()) follows this return setting both the real
> user ID (RUID) and effective user ID (EUID) to the effective user ID
> (EUID). The remaining processing is utility dependent.

reasoning: it is up the application, wether it wants to permanently
drop root privileges or not. imapd failed to do so, which was a
security risk.

The current module for os4, log_sec.c, uses setuid(), which changes
both euid and ruid when called as root.

Additionally the unix mailbox driver unix.c uses the system call
access() to check for mailbox access. This function checks access
against the ruid - not against the euid.

Checking access against 'root' instead of the logged in user
may improve privilege (David Henrys problem) or reduce privilege
(my problem - home directories are on nfs server, most of them
exported to map remote root to anonymous).

I'd vote that sia_xxx is to complicated and non-standard to use.
setreuid() should do.

IMO, using access() to check access to the mailbox is also wrong.
access() checks against the ruid, because it has a very special
purpose: to allow suid-programs to check, whether the caller had access
to the file, before the uid was changed. The best general way to
check access to a file is to try to open it. This covers anything
( including acls, read-only filesystems , remote files systems
with other security semantic etc.)

btw: Thanks to everybody who is involved in the development of this
great software ! Thanks for making it available.

Ciao
  Donald

[ dear listserv, this is a retry and its raining here. ]

-- 
Donald Buczek
[email-masked]
+49 30 8413 1433