From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.43) id 1Dv7JS-00026E-8v for garchives@archives.gentoo.org; Wed, 20 Jul 2005 05:40:10 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.4/8.13.4) with SMTP id j6K5d2uj023817; Wed, 20 Jul 2005 05:39:02 GMT Received: from spieden.seattleserver.com (spieden.seattleserver.com [216.57.201.54]) by robin.gentoo.org (8.13.4/8.13.4) with ESMTP id j6K5bJtM018974 for ; Wed, 20 Jul 2005 05:37:20 GMT Received: (qmail 7379 invoked from network); 20 Jul 2005 05:36:39 +0000 Received: from pool-71-113-83-88.sttlwa.dsl-w.verizon.net (HELO akureyri.seattleserver.com) (cshobe@seattleserver.com@71.113.83.88) by spieden.seattleserver.com with RC4-MD5 encrypted SMTP; 20 Jul 2005 05:36:39 +0000 From: Casey Allen Shobe Organization: SeattleServer.com, Inc. To: gentoo-dev@lists.gentoo.org Subject: Re: [gentoo-dev] VPopmail - SUID vchkpw Date: Wed, 20 Jul 2005 05:37:19 +0000 User-Agent: KMail/1.8.1 References: <200507200132.30745.lists@seattleserver.com> <20050720024334.GA26639@curie-int.orbis-terrarum.net> In-Reply-To: <20050720024334.GA26639@curie-int.orbis-terrarum.net> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200507200537.19793.lists@seattleserver.com> X-Archives-Salt: 2c246401-5ab6-45d0-b814-24c60dec0bb9 X-Archives-Hash: af20820eccd3f21f942ebe9add42a361 On Wednesday 20 July 2005 02:43, Robin H. Johnson wrote: > This problem IS fixed in ~arch: > > line 190 of both vpopmail-5.4.10.ebuild and > vpopmail-5.4.9-r2.ebuild: chmod 4711 ${D}${VPOP_HOME}/bin/vchkpw Ahh okay, that explains things a bit. I'm using x86, which means 5.4.6. > So if this is still a problem in arch, but works in ~arch, you > SHOULD file a bug report. Why not just wait for the newer releases to make it to arch? > However the original reasoning for vchkpw NOT being setuid was > that setuid is NOT always needed depending on which backend you > are using. I can confirm that - bincimap and qmail-pop3d run as root, so the setuid bit is not necessary. I believe this is also the case for dovecot 1.0 beta releases, though there are no ebuilds for them so I haven't yet tested (<1.0 releases use libvpopmail directly instead of the checkpassword interface). However it is necessary for any server running as a non-root user, i.e. qmail-smtpd. Thus I believe this should have the same treatment as binaries like chsh - they won't work for non-root users without the setuid bit, but running as a non-root user is generally accepted. If I want to be paranoid (which I am), I can use suidctl (which I do), and only uncomment the binary when I discover the need to. There's not really any reverse of suidctl to my awareness. Nor is there a use flag for qmail or similar on vpopmail, but the vpopmail ebuild requires qmail regardless of USE settings (postfix support is not present), so at least in the current state, since the package is built for qmail, it should assume qmail's non-root qmail-smtpd will need to access vchkpw. I would encourage making vchkpw suid even if postfix is supported and used instead of qmail, because there are other softwares (i.e. IMAP & POP servers) which have a checkpassword interface which do may not run as the root user. > And as I've mentioned before I'd like MORE reports of packages > working well before they are moved to stable arch. Without those > stable working reports I don't have any means to judge just how > much testing has been done on a package, other than my own use of > a package (and as such I do leave things longer than the 30 days, > because I don't entirely trust them). This sounds like a request for the QA team. I tend to stay away from most ~arch packages simply because most of our systems are live production servers, but I'd be happy to test-drive new ebuilds of vpopmail if it would help get new versions into the stable tree faster. Cheers, -- Casey Allen Shobe | http://casey.shobe.info cshobe@seattleserver.com | cell 425-443-4653 AIM & Yahoo: SomeLinuxGuy | ICQ: 1494523 SeattleServer.com, Inc. | http://www.seattleserver.com -- gentoo-dev@gentoo.org mailing list