[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Exim permissions



    "jah" == jah pigeon <Pigeon> writes:

    jah> BUT... /usr/sbin/exim is setuid root. Huh?

Exim probably uses the root permission for very, very few things (like
opening port 25 when in daemon mode). It probably drops the root
permission as one of the first things it ever does.

    jah> So I wrote a little send.my.mail.c:

    jah> #include <stdio.h> #include <stdlib.h>

    jah> int main(void) { return (system("/usr/sbin/exim -qf")); }

    jah> and made the executable setuid root. Still doesn't work.

I have not read the exim source, but do try setting your real
user/group identities to the mail user/group (=8 on Debian) before the
system call. (man setuid, man setgid) It might work out.

I'm guessing here. I suspect exim is doing its best to avoid giving
you any permissions you don't need by dropping root and becoming the
real user as soon as and as much as it can. If you start it as the
mail user things might work better.

Remember that the setuid flag only sets the effective user identity,
the program can choose to drop it. It is probably what I would do if I
wrote the code.

Better still, use sudo and you will not have to do any C programming :-)

Cheers!
Shyamal



Reply to: