Re: Bug#470994: mail_spool default mode is 0660
reopen 470994
reassign 470994 debian-policy
thanks
On Sat, Mar 15, 2008 at 08:57:13AM +0100, Marc Haber wrote:
> On Sat, Mar 15, 2008 at 01:27:25AM +0100, Josip Rodin wrote:
> > The package's /etc/exim4/conf.d/transport/30_exim4-config_mail_spool
> > says:
> >
> > group = mail
> > mode = 0660
> > mode_fail_narrower = false
> >
> > Why is this so, again?
>
> Policy 11.6, paragraph 4, a MUST directive.
>
> Closing this bug.
Okay, given that I see no rationale for the sentence "Mailboxes must be
writable by group mail.", I'm reassigning this to debian-policy.
There is an ancient bug #24772 that was closed without a proper
justification (it appears to have been rejected because it was in limbo
with regard to the policy process).
In June 1999, Brock Rozen mentioned that "Pine 4.x series has issues
with perms on mailboxes". Can someone please comment if this has any
relevance today? Santiago, Asheesh?
If anyone else can name an application that requires such permissions,
please speak up...
And to quote my original report again...
> The [Exim] manual says that the default is to use the Exim
> group and mode 0600. I can't remember any reason why the mail group would be
> necessary, for anything other than creating the dot locks in the /var/mail
> directory, and that is allowed already by the directory permissions (it's
> g+w mail).
>
> I suppose using group 'mail' just makes sense, but why would we let the said
> group read and write user mailboxes? I suppose there could be some software
> that could need it, but if the common uses like mutt and dovecot don't need
> it, and indeed it only serves for privilege escalations in those setups,
> shouldn't the default be changed back to the more secure settings?
--
2. That which causes joy or happiness.
Reply to: