Subject: Re: Question on Procmail-2.82pre4 installation

From: [email-masked] (Stephen R. van den Berg)
Date: Wed, 9 Jun 1993 17:09:00 +0200

Steven D. Conniff <[email-masked]> wrote:

>Also, HIGHLY RECOMMENDED (type 'make suid' to execute it):
>chown root /net/cportprep/conniff/Install/bin/procmail
>chmod 4755 /net/cportprep/conniff/Install/bin/procmail

>Can someone (Stephen?) please explain to me why this step is HIGHLY
>RECOMMENDED?  I am assuming that this is not a major security hole.
>For example, by setting the UID to root upon execution, does this allow
>me to write to other people's directories through my .procmailrc file?
>I doubt it, but am still confused.

Of course it isn't a security hole :-).  I wouldn't *highly recommend* it
otherwise.

No, seriously, making procmail suid root has the following benifits:

- On systems that have a drwxrwxrwt /usr/spool/mail directory, this enables
  procmail to move bogus mailboxes out of the way (i.e. if the mailbox for
  the recipient is not owned by the recipient).
- It allows procmail to call the setgroups() function to setup permissions for
  additional groups the recipient might belong to.
- Provides you with the convenience that if you make small mistakes during
  the configuration of your mailagent (e.g. you call procmail from the
  mailagent with the wrong uid), procmail still works correctly.
- Provides you with the convenience that you can call procmail directly
  to deliver local mail (procmail -d recipient).
- Closes a security hole on some systems that use dynamically linked libraries.
  If a suid program is executed on such systems, the binary will use the
  predefined libraries instead of looking in the environment for library-paths.
  Procmail closes this hole internally after being started, but the problem
  is that it will already have been affected itself by that time if not
  executed suid or sgid.

And let me emphasise this again, no this does not open up security holes.
Procmail still has a very clear distinction between the rights of the
invoker and rights of the recipient.

The reason why I don't automatically let "make install" do the suid stuff
is because I think that this would be `unethical'.

-- 
Sincerely,                                  [email-masked]
           Stephen R. van den Berg (AKA BuGless).    [email-masked]

"I have a *cunning* plan!"