[news.software.b] setuid relaynews in C news

rock@lighthouse.com (02/02/90)

We've been getting the following error when trying to post:

    relaynews: warning: renouncing setuid due to nonstandard NEWSPATH

I presume this is because I've installed both inews and relaynews in
funny places.  So, other than modifying the source or making
everything writable to everyone, how can I get posting to work?

Any help would be greatly appreciated.

Roger Rosner
Lighthouse Design, Ltd.
NeXT Mail: rock@lighthouse.com or ...!uunet!lighthouse!rock

henry@utzoo.uucp (Henry Spencer) (02/03/90)

In article <1990Feb2.024254.18816@lighthouse.com> rock@lighthouse.com writes:
>We've been getting the following error when trying to post:
>
>    relaynews: warning: renouncing setuid due to nonstandard NEWSPATH
>
>I presume this is because I've installed both inews and relaynews in
>funny places.  So, other than modifying the source or making
>everything writable to everyone, how can I get posting to work?

If you want to put things in funny places, you MUST MUST MUST do this by
telling build about it and having "subst" plug the required definitions
into various places.  Just moving things in an ad-hoc way doesn't work;
coordination is necessary, which is why "subst" exists.  In particular,
the shell "pathname subroutine" (the config file) and the C pathname
functions must agree.  You get this message because they don't agree,
which usually means you tried to make changes without using build.

Unless something odd is going on -- which is possible -- the fix is to
go back and reinstall C News, telling build where you want things to
go, without taking shortcuts.
-- 
1972: Saturn V #15 flight-ready|     Henry Spencer at U of Toronto Zoology
1990: birds nesting in engines | uunet!attcan!utzoo!henry henry@zoo.toronto.edu

allbery@NCoast.ORG (Brandon S. Allbery) (02/05/90)

As quoted from <1990Feb2.165403.17374@utzoo.uucp> by henry@utzoo.uucp (Henry Spencer):
+---------------
| the shell "pathname subroutine" (the config file) and the C pathname
| functions must agree.  You get this message because they don't agree,
| which usually means you tried to make changes without using build.
| Unless something odd is going on -- which is possible -- the fix is to
| go back and reinstall C News, telling build where you want things to
| go, without taking shortcuts.
+---------------

Wouldn't it be better to allow /usr/lib/news/bin/config to override the C
pathname functions, and only renounce setuid if either (a) the environment is
used to override it or (b) an alternative config file is specified, presumably
via the environment or a (new) command-line option?  I don't appreciate having
to rebuild umpty-thousand programs when I relocate things on ncoast (which I
will have to do anyway, because we ended up with three public local direct-
ories as a result of the chaos surrounding the move from the P/35, and C news
isn't the only offender in this regard).

Hardcoded pathnames are an evil which I prefer to avoid whenever possible.

++Brandon
-- 
Brandon S. Allbery    allbery@NCoast.ORG, BALLBERY (MCI Mail), ALLBERY (Delphi)
      uunet!cwjcc.cwru.edu!ncoast!allbery ncoast!allbery@cwjcc.cwru.edu

henry@utzoo.uucp (Henry Spencer) (02/06/90)

In article <1990Feb5.032137.4854@NCoast.ORG> allbery@ncoast.ORG (Brandon S. Allbery) writes:
>Wouldn't it be better to allow /usr/lib/news/bin/config to override the C
>pathname functions, and only renounce setuid if either (a) the environment is
>used to override it or (b) an alternative config file is specified, presumably
>via the environment or a (new) command-line option? ...

The problem is that the C configuration stuff came first, and .../bin/config
was somewhat of an afterthought.  I am in the process of rethinking this.
You're correct that there is no hazard unless (a) or (b) is involved.

There is a lesser problem in that things like manual pages know the paths,
and it's not so easy for them to pick up the config file.
-- 
SVR4:  every feature you ever |     Henry Spencer at U of Toronto Zoology
wanted, and plenty you didn't.| uunet!attcan!utzoo!henry henry@zoo.toronto.edu

allbery@NCoast.ORG (Brandon S. Allbery) (02/06/90)

As quoted from <1990Feb5.171912.8316@utzoo.uucp> by henry@utzoo.uucp (Henry Spencer):
+---------------
|In article <1990Feb5.032137.4854@NCoast.ORG> allbery@ncoast.ORG (Brandon S. Allbery) writes:
|>Wouldn't it be better to allow /usr/lib/news/bin/config to override the C
|>pathname functions, and only renounce setuid if either a) the environment is
|>used to override it or b) an alternative config file is specified, presumably
|>via the environment or a (new) command-line option? ...
| 
| The problem is that the C configuration stuff came first, and .../bin/config
| was somewhat of an afterthought.  I am in the process of rethinking this.
| You're correct that there is no hazard unless (a) or (b) is involved.
| 
| There is a lesser problem in that things like manual pages know the paths,
| and it's not so easy for them to pick up the config file.
+---------------

Considering the number of Usenet-distributed manpages I have that contain
hard-coded references to e.g. /usr/ucb/* (with the sole exception of UUNET,
I use only System III/V-based systems), I'm not too worried about this.

++Brandon
-- 
Brandon S. Allbery    allbery@NCoast.ORG, BALLBERY (MCI Mail), ALLBERY (Delphi)
      uunet!cwjcc.cwru.edu!ncoast!allbery ncoast!allbery@cwjcc.cwru.edu