On Thu, 3 Jul 1997, Steven Clarke wrote:
> If I add the line
> security = setuid
> to the configuration file, email delivery works fine. If I omit the line
> and use the defaults, presumably "setreuid+setuid", I get the following
> error message.
<snip>
> I would prefer to use setreuid as it would seem to reduce process
> overheads but can't figure out what I need to change.
Asides:
-------
(1) You can find out the setting by running the command
exim -bP security
(2) Using "seteuid+setuid" will in fact do *more* work that
"setuid" on its own. You only save process overheads by using "seteuid"
on its own, but as been argued many times by the security experts, this
gives you a lot less security.
(3) Students of Murphy's Law may like to know that it is still operative.
Yesterday I decided to start freezing the code for the next release.
Today, two bugs have been reported...
The main issue:
---------------
> Exim seems to be setting the euid to that of the user to read the .forward
> file but not setting it back exim's uid to read the files needed by the
> rewriting code?
Indeed. The standard rewriting function is obeyed as part of the code
for processing .forward files.
On Thu, 3 Jul 1997, John Henders wrote:
> I agree that exim should
> probably switch back to it's own id at that point but I guess no one
> noticed before because everyone has these files readable.
Absolutely. I had overlooked this completely. My first thought about
fixing this was to move the rewriting until after the processing of the
.forward file, but this doesn't help because when processing the
"personal" condition in a filter file, Exim wants to rewrite the current
local part and domain in order to discover any variants.
I think what I will do, which is also the least disturbance to the code,
is to ensure that Exim switches back to its own id (or root if there
isn't one) while doing the expansion of a rewriting rule.
On Thu, 3 Jul 1997, Steven Clarke wrote:
> I try and avoid the politics of the situation and just implement the
> solutions.
Good Plan!
Philip
--
Philip Hazel University Computing Service,
ph10@??? New Museums Site, Cambridge CB2 3QG,
P.Hazel@??? England. Phone: +44 1223 334714
