On Fri, Sep 20, 2002 at 06:39:33PM +0700, Hengky wrote: > the basic is i like to create my own webmail, > and read from /var/spool/mail
If you insist on writing your own web mail application (there are free and commercial ones available, have you checked them out?) the best thing I can think of is not to access the spool directly but through an intermediary, such as POP3 or IMAP. This has several benefits: you don't have to deal with the underlying storage details, you have a structured and well-documented method of getting to the email, and your solution will prove more flexible because it won't necessarily need to run on the same server as the mail resides. > how to change the permission of the script so when people login he can > read from /var/spool/mail ( they own mailbox ) The only way to change your uid is to run as root and call setuid (or Perl's equivalent, assign to $>). This raises all sorts of issues. If your application spawns a sub-application that is setuid root then it has to communicate with that program via IPC (inter-process communication). If your application does everything it will need to run as root (not recommended for large applications; small easily audited code is preferable for applications running as root) then the web server will have to be running as root; the web server may not be properly secured for this. There is one additional method I can think of; have a daemon, running as root, that communicates over the network. This is POP3 and IMAP. > my perl not compile with suid ( for security problem, plz understand this) I expect you mean your Perl is not compiled with setuid bit support; that is, it doesn't set its uid if the script's setuid bit is set. This is only a problem if you go with the sub-application solution, and you want the sub-application to be written in Perl. Michael -- Administrator www.shoebox.net Programmer, System Administrator www.gallanttech.com -- -- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
