At 4:58 PM -0400 9/23/96, Evan Champion wrote:
>Dave Wolfe wrote:
>> Maybe it's time to just fix the Perl programs to run setuid and do away
>> with wrapper?
>
>Do the programs need to run setuid at all?
>
>Assume: majordomo user is a member of group daemon
>/usr/local/majordomo tree is owned by majordomo:daemon
>all files that need to be read are at least 640
>all files that need to be written to are at least 660
>all files that need to be executed are at least 750
>umask is always 007 or less
>
>sendmail executes programs from /etc/aliases as daemon:daemon.
>
>It would seem that given the above configuration, no setuid programs are
>required.
>
>The only problem in the above may be that sendmail executes programs as
>a different uid/gid. In that case, just make sure the majordomo gid
>matches the gid sendmail uses.
Which is impossible if the mail comes from a local user on the machine. If
a local user sends the message, Sendmail runs with that user's UID/GID. It
only runs as daemon:daemon (or whatever you've set "Ou" and "Og" to in your
/etc/sendmail.cf file) if it thinks the mail isn't from a local user.
Majordomo needs to run setuid in order to have a consistent UID/GID for
updating files. When I wrote the original version, the perl that was
available at the time (4.019, I think) was broken such that setuid/setgid
scripts wouldn't work. This led me to create the 'wrapper' program, to do
all the UID/GID mucking before invoking perl & majordomo, thus avoiding
tripping perl's setuid/setgid code. Perl _should_ work for setuid/setgid
scripts now, but getting Majordomo to work under taintperl at this point
would probably be non-trivial. Like Jason says, probably should be a goal
for 2.0, probably not going to happen before then.
-Brent
----------------------+----------------------------+------------------------
Brent Chapman | Great Circle Associates | 1057 West Dana Street
Brent@GreatCircle.COM | http://www.greatcircle.com | Mountain View, CA 94041
----------------------+----------------------------+------------------------
Internet Tutorials from the Experts!
References:
|
|
