fetchmail-friends
[Top] [All Lists]

Re: [fetchmail]PATCH: --nopermcheck, security issues

2002-05-22 06:21:16
Mikhail,

On Mon, May 20, 2002 at 01:45:04AM +0400, Mikhail Zabaluev wrote:
I have stepped up as a maintainer of the fetchmail package for
the ALT Linux distribution. Among my first accomplishments on this
duty is a patch that allows skipping permission checks on
configuration files, by means of the "nopermcheck" option.
It's useful when one has a system-wide config file owned by
root, yet prefers to run fetchmail under a distinct user ID.
Another reason is that using 'versioninfo' flag
as a guide to skip checks doesn't seem very logical.
An exception is made for the UID file -- it's always checked
unless the version info mode is in effect. The patch is attached
below.

The above would be very useful for Cygwin running on platforms without
security (i.e., Windows 9x/Me) or when users explicitly disable security
(i.e., Windows NT/2000/XP with CYGWIN=nontsec) too.  However, skipping the
permissions check for the UID file is also needed for Cygwin.

Specifically, this means that the following hunk:

@@ -1152,7 +1153,7 @@
 
 #ifdef POP3_ENABLE
     /* initialize UID handling */
-    if (!versioninfo && (st = prc_filecheck(run.idfile, !versioninfo)) != 0)
+    if (!versioninfo && (st = prc_filecheck(run.idfile, TRUE)) != 0)
      exit(st);
     else
      initialize_saved_lists(querylist, run.idfile);

would need to change to:

@@ -1152,7 +1153,7 @@
 
 #ifdef POP3_ENABLE
     /* initialize UID handling */
-    if (!versioninfo && (st = prc_filecheck(run.idfile, !versioninfo)) != 0)
+    if (!versioninfo && (st = prc_filecheck(run.idfile, permcheck)) != 0)
                                                         ^^^^^^^^^
        exit(st);
     else
        initialize_saved_lists(querylist, run.idfile);

Another alternative is to use __CYGWIN__ conditional compilation guards
to enable skipping the permissions check for the UID file only for Cygwin.

Would you be willing to update your patch as suggested above?  Or, would
you prefer that I await the disposition of your original patch and then
submit my own Cygwin specific patch for consideration?

Thanks,
Jason


<Prev in Thread] Current Thread [Next in Thread>