From owner-freebsd-current Wed May 14 02:22:15 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id CAA00310 for current-outgoing; Wed, 14 May 1997 02:22:15 -0700 (PDT) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by hub.freebsd.org (8.8.5/8.8.5) with SMTP id CAA00288 for ; Wed, 14 May 1997 02:22:10 -0700 (PDT) Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id LAA06175 for current@FreeBSD.ORG; Wed, 14 May 1997 11:22:08 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.8.5/8.8.5) id LAA13987; Wed, 14 May 1997 11:19:27 +0200 (MET DST) Message-ID: <19970514111926.DF34579@uriah.heep.sax.de> Date: Wed, 14 May 1997 11:19:26 +0200 From: j@uriah.heep.sax.de (J Wunsch) To: current@FreeBSD.ORG Subject: Re: RELENG_2_2 References: <19970513071838.JT48650@uriah.heep.sax.de> <7493.863510486@time.cdrom.com> X-Mailer: Mutt 0.60_p2-3,5,8-9 Mime-Version: 1.0 X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: <7493.863510486@time.cdrom.com>; from Jordan K. Hubbard on May 13, 1997 01:01:26 -0700 Sender: owner-current@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk As Jordan K. Hubbard wrote: > But I'm still waiting for someone to explain to me how making dtmail > and/or some of the other mail agents suid root is any *less* of a > security hole and all exchanges to date have, rather frustratingly, > gone something like this: Thomas admitted that dtmail is unintelligible. This alone precludes it from becoming setid. > "Look, dtmail is the *only thing* which will even use this friggin' mail > group right now and so making it group writable by mail is hardly the > enormous security hole that everyone makes it out to be. You'd prefer > dtmail to be suid root?? What about things like popper? popper is _way_ smaller, basically intelligible, does not provide the usual dangerous interfaces of MUAs (like spawning shells etc.). I can live with 10 poppers being setuid root, if this saves me from an MUA being set[ug]id at all. > However, by doing this we're going to create a fork > since I *must* to have this problem solved for the FreeBSD Desktop/Pro > release and if there has to be something divergent in that version of > FreeBSD then diverge it will. I'm not willing to have dtmail broken > in this release and Thomas Roell cannot fix this "correctly" in the > time-span available to him, ... Did he ever try to hire someone to fix this particular problem? -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)