Re: dot-qmail security

[Joel Eriksson]

On Sun, 14 Mar 1999, Vince Vielhaber wrote:

> On 15-Mar-99 Mate Wierdl wrote:
> > But if the users do not have shell access, how do they create .qmail files?
> 
> ftp it from their local machine.  They'll be able to at least forward mail
> and maybe do some simple lists, but I doubt they'd be able to do much more
> than that without a real shell assigned - or can they?

>From qmail-local.c:

     args[0] = "/bin/sh"; args[1] = "-c"; args[2] = prog; args[3] = 0;
     sig_pipedefault();
     execv(*args,args);
     strerr_die3x(111,"Unable to run /bin/sh: ",error_str(errno),". (#4.3.0)");

So, indeed they can.

> Vince.

/ Joel Eriksson