Your message dated Sun, 13 Mar 2005 16:00:17 +0100
with message-id <[EMAIL PROTECTED]>
and subject line Bug#299312: spamassassin: spamd should probably not run as root
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 13 Mar 2005 13:57:00 +0000
>From [EMAIL PROTECTED] Sun Mar 13 05:57:00 2005
Return-path: <[EMAIL PROTECTED]>
Received: from pooh.kjernsmo.net [217.77.32.186]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DATaW-0000a7-00; Sun, 13 Mar 2005 05:57:00 -0800
Received: from ti100710a080-7632.bb.online.no ([85.165.29.208]
helo=owl.kjernsmo.net)
by pooh.kjernsmo.net with esmtp (Exim 4.44)
id 1DATa0-0007Cw-Ku
for [EMAIL PROTECTED]; Sun, 13 Mar 2005 14:56:28 +0100
Received: from kjetil by owl.kjernsmo.net with local (Exim 3.36 #1 (Debian))
id 1DATZV-0001Ja-00
for <[EMAIL PROTECTED]>; Sun, 13 Mar 2005 14:55:57 +0100
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: spamassassin: spamd should probably not run as root
X-Debbugs-CC: Kjetil Kjernsmo <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
From: Kjetil Kjernsmo <[EMAIL PROTECTED]>
Date: Sun, 13 Mar 2005 14:55:57 +0100
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE,
X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: spamassassin
Version: 3.0.2-1
Severity: important
Tags: security upstream
There is an upstream bug that we probably should follow closely, as it
may have security implications, namely this bug:
http://bugzilla.spamassassin.org/show_bug.cgi?id=4086
Apparently, spamd children get root after processing a message, and
this could potentially help an attacker if there are security problems
with SA.
On my system, it looks like spamd runs as root from the start, but it
may just be that the change happens quickly enough so that I don't see
it.
If a fix is found before the release of Sarge, it may be a good idea
to backport it, I guess. One could also investigate whether a
Debian-specific fix is possible, but I'm not up to that task... :-)
Kjetil
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (990, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.8.2004-09-07-13.owl.1.oss
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages spamassassin depends on:
ii debconf 1.4.30.11 Debian configuration management sy
ii libdigest-sha1-perl 2.10-1 NIST SHA-1 message digest algorith
ii libhtml-parser-perl 3.45-1 A collection of modules that parse
ii perl [libstorable-perl] 5.8.4-6 Larry Wall's Practical Extraction
ii spamc 3.0.2-1 Client for SpamAssassin spam filte
-- debconf information:
* spamassassin/upgrade/2.40:
spamassassin/upgrade/2.40w:
* spamassassin/upgrade/cancel: Continue
* spamassassin/upgrade/2.42: No
spamassassin/upgrade/2.42m:
spamassassin/upgrade/2.42u:
---------------------------------------
Received: (at 299312-done) by bugs.debian.org; 13 Mar 2005 15:01:22 +0000
>From [EMAIL PROTECTED] Sun Mar 13 07:01:22 2005
Return-path: <[EMAIL PROTECTED]>
Received: from pooh.kjernsmo.net [217.77.32.186]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DAUao-00073I-00; Sun, 13 Mar 2005 07:01:22 -0800
Received: from ti100710a080-7632.bb.online.no ([85.165.29.208])
by pooh.kjernsmo.net with esmtp (Exim 4.44)
id 1DAUaH-0007O6-B4
for [EMAIL PROTECTED]; Sun, 13 Mar 2005 16:00:49 +0100
From: Kjetil Kjernsmo <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Re: Bug#299312: spamassassin: spamd should probably not run as root
Date: Sun, 13 Mar 2005 16:00:17 +0100
User-Agent: KMail/1.7.1
References: <[EMAIL PROTECTED]>
In-Reply-To: <[EMAIL PROTECTED]>
OpenPGP: id=0x5AA3F2C5FFBEA046CEEACB6D944FC6A76A6A0BBC;
url=http://www.kjetil.kjernsmo.net/pgp.asc
X-FOAF: http://www.kjetil.kjernsmo.net/foaf.rdf
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
On s=F8ndag 13 mars 2005, 14:55, Kjetil Kjernsmo wrote:
> On my system, it looks like spamd runs as root from the start, but it
> may just be that the change happens quickly enough so that I don't
> see it.
Duh. */me whacks himself with a cluebat, and goes to RTFM*
I was a bit overeager this time.... Obviously it doesn't have anything=20
to do with that. It has to do with that I'm not running with -u....=20
Though I thought I had. Well, now I do. Sorry about the noise.
Cheers,=20
Kjetil
=2D-=20
Kjetil Kjernsmo
Astrophysicist/IT Consultant/Skeptic/Ski-orienteer/Orienteer/Mountaineer
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
Homepage: http://www.kjetil.kjernsmo.net/ OpenPGP KeyID: 6A6A0BBC
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
