From owner-freebsd-questions@FreeBSD.ORG  Tue Oct  7 21:13:42 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 21F2516A4B3
	for <questions@freebsd.org>; Tue,  7 Oct 2003 21:13:42 -0700 (PDT)
Received: from out003.verizon.net (out003pub.verizon.net [206.46.170.103])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5A11F43FBF
	for <questions@freebsd.org>; Tue,  7 Oct 2003 21:13:40 -0700 (PDT)
	(envelope-from mike@pcmedx.com)
Received: from duron.pcmedx.com ([4.46.22.189]) by out003.verizon.net
          (InterMail vM.5.01.05.33 201-253-122-126-133-20030313) with ESMTP
          id <20031008041337.TPJQ8791.out003.verizon.net@duron.pcmedx.com>;
          Tue, 7 Oct 2003 23:13:37 -0500
Received: from localhost (localhost [127.0.0.1])
	by duron.pcmedx.com (Postfix) with ESMTP
	id ECC6AAC48; Tue,  7 Oct 2003 21:13:36 -0700 (PDT)
Received: from mike (mike.pcmedx.com [192.168.240.244])
	by duron.pcmedx.com (Postfix) with SMTP
	id CD64AA93A; Tue,  7 Oct 2003 21:13:35 -0700 (PDT)
Message-ID: <001801c38d52$8bb4ea30$f4f0a8c0@pcmedx.com>
From: "Mike Maltese" <mike@pcmedx.com>
To: <questions@freebsd.org>
References:
	<20031008031656.GA1318@panix.com><000d01c38d4b$fcfd53f0$f4f0a8c0@pcmedx.com>
	<20031008040013.GA14912@panix.com>
Date: Tue, 7 Oct 2003 21:13:36 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Virus-Scanned: by amavisd (http://www.amavis.org) and f-prot
	(http://www.f-prot.com) at pcmedx.com
X-Authentication-Info: Submitted using SMTP AUTH at out003.verizon.net from
	[4.46.22.189] at Tue, 7 Oct 2003 23:13:37 -0500
cc: Joe Altman <fj@panix.com>
Subject: Re: Setting the sticky bit on /var/mail...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Oct 2003 04:13:42 -0000

> Absolutely you are correct, and the crowd goes wild with
> applause...thank you.
>

Glad it helped. =)

> I suppose it would be nice to know what set all of the following on
> /var/mail:
>
> opaque nodump uappnd uchg uunlnk
>
> because it sure wasn't me.
>
> Removing them allowed me to set the appropriate bit. Thanks again.

That strikes me as really strange. Any chance another user did this or that
the box was compromised? It seems to be no small coincidence that all the
flags you listed are the ones that don't require root privileges.