[comp.mail.elm] Is GNU Cause of Security Problems???

mike@ists (Mike Clarkson) (05/28/88)

In article <238@corona.pb>, michael@pbinfo.UUCP (Michael Schmidt) writes:
> Neulich schrieb chris@mimsy.UUCP (Chris Torek):
>   Note that if you are running 4.3BSD, you should define MAIL_USE_FLOCK
>   and that the resulting program should not be setuid.
> 
> And using s-bsd4-3.h at least doesn't hurt under SunOS 3.4. So
> you can use 'flock' and there is no need for movemail to be
> setuid.
> 
> 	Michael Schmidt

Can somebody set me straight on this? Just because the system has flock
doesn't mean that the /bin/mail on the system uses it.  On a Sun,
/bin/mail uses lock files (/usr/spool/mail/fredboobar.lock).  See the
man page for /bin/mail.  If your code uses flock, /bin/mail won't
neccessarily honour it.  Note that the default for GNU on a Sun does
*not* use FLOCK. 

Add to this two further complications: on a Sun, whether you use /bin/mail
or /usr/ucb/mail depends on your path.  Does /usr/ucb/mail use FLOCK or
spool lock files?  And if you are running on a Sun, there's probably
another Sun or two on your network.  If you run movemail on a client,
you can run into real problems if you are sharing /usr/spool/mail over NFS.
If you are running movemail on the client with FLOCK defined,
and the server is trying to write to your mail file, the server can do
what it likes.  You'd have to have everyone using lockf to stop this.
(See the man pages on flock for this.)

This is an important issue, because not only can your mailbox get trashed,
but other people are starting to use the movemail code for other mailers
as well.  Elm just had patches posted to use the movemail code for that
mailer.

On Suns (sun 3.5), we run movemail sgid daemon, and /usr/spool/mail 775, 
with no FLOCK defined.  We share our mailhost's /usr/spool/mail with the
clients over NFS.  Does anyone have sources handy to see how /bin/mail 
and /usr/ucb/mail do file locking on a Sun?






-- 
Mike Clarkson					mike@ists.UUCP
Institute for Space and Terrestrial Science	mike@ists.yorku.ca
York University, North York, Ontario,		uunet!mnetor!yunexus!ists!mike
CANADA M3J 1P3					+1 (416) 736-5611