Bug#4354: movemail doesn't work
Mark W. Eichin writes (Re: Bug#4354: movemail doesn't work): [Ian:] Why does movemail need to be setuid root ?! Well, the package as I inherited had the following in debian.rules: ... # movemail is installed setuid so that POP can work. (This is # safe.) ... I suspect this has to do with using movemail locally on a machine which is also a pop server, but I haven't verified that. (The emacs build blessmail process will only make it setgid mail.) Anyone else remember? This sounds doubtful to me .. ... Still haven't heard from the original reporter what, if anything, explains why his movemail wasn't installed properly... He wasn't the guy on linux-security who unsetuidded everything and said none of his users had complained ... ? :-) Ian.
Bug#4354: movemail doesn't work
Michael Shields [EMAIL PROTECTED] writes: Package: emacs Version: 19.31-2 movemail complains about not being able to write a temp file in /var/spool/mail. One fix might be to make it setgid mail, iff the code is written to be sufficiently paranoid. As shipped, it *was* installed setuid root + setgid mail... could you check your installation and verify, and perhaps be more specific about movemail's complaint? Ack -- I'm embarassed. VM found another movemail in my path, a broken one, and used that instead. But this seem to have exposed a real bug: why *is* the real movemail suid root? -- Shields, CrossLink.
Bug#4354: movemail doesn't work
Mark W. Eichin writes (Bug#4354: movemail doesn't work): ... As shipped, it *was* installed setuid root + setgid mail... could you check your installation and verify, and perhaps be more specific about movemail's complaint? Also include the actual modes of your /var/spool/mail directory, and an indication of what you're using to invoke movemail. Why does movemail need to be setuid root ?! % ar p /p/a1/debian/mirror/binary/editors/emacs_19.31-2.deb data.tar.gz | tar tzvf - | grep movemail -rwsr-sr-x root/mail 14516 1996-06-03 00:05 usr/lib/emacs/19.31/i386-debian-linux/movemail You mean: dpkg --fsys-tarfile .../editors/emacs_19.31-2.deb |tar tzvf - |grep movemail or even, since you just wanted it listed: dpkg --contents .../editors/emacs_19.31-2.deb |grep movemail The `ar' format is a piece of internal knowledge which you shouldn't need to make use of. Ian.
Bug#4354: movemail doesn't work
Package: emacs Version: 19.31-2 movemail complains about not being able to write a temp file in /var/spool/mail. One fix might be to make it setgid mail, iff the code is written to be sufficiently paranoid. -- Shields, CrossLink.
Bug#4354: movemail doesn't work
Michael Shields writes: Package: emacs Version: 19.31-2 movemail complains about not being able to write a temp file in /var/spool/mail. One fix might be to make it setgid mail, iff the code is written to be sufficiently paranoid. That's odd. [EMAIL PROTECTED]:richard$ ls -l /usr/lib/emacs/19.31/i386-debian-linux/movemail -rwsr-sr-x 1 root mail14516 Jun 3 05:05 /usr/lib/emacs/19.31/i386-debian-linux/movemail* [EMAIL PROTECTED]:richard$ (I understood that the whole point of movemail was to separate out the bit of a mailer that needed to be setgid mail into a separate executable.) -- Richard Kettlewell [EMAIL PROTECTED] [EMAIL PROTECTED] http://www.elmail.co.uk/staff/richard/
