unsuiding MH's pop (was How Debian Linux could be made more secure)

[apharris@burrito.onshore.com (Adam P. Harris)]

I agree that non-essential binaries should not be setuid root; I'm
planning to contribute to this by removing setuid bit on two of the
four setuids that mh currently ships.

        suidregister -s mh /usr/bin/mh/inc root mail 2755
        suidregister -s mh /usr/bin/mh/msgchk root mail 2755

These are good and have to be setgid.

        suidregister -s mh /usr/lib/mh/popwrd root root 4755
        suidregister -s mh /usr/lib/mh/spop root root 4755

These are for the MH pop server, which is deprecated anyway; I'm
planning on shipping these but without any setuidness, and give the
user instructions on how to enable them.

Sound good?  Any MH users object?

.....A. P. Harris...apharris@onShore.com...<URL:http://www.onShore.com/>


--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org