Network-wide Mail Spool?
James E. Leinweber
jiml at uwslh.slh.wisc.edu
Wed Nov 14 18:05:48 AEST 1990
karl_kleinpaste at cis.ohio-state.edu writes:
>Any reason why one couldn't place symlinks: ...
[making /usr/spool/mail/someone a link to ~someone/.newmail]
Mail is a traditional source of security holes in Unix, particularly in the
presence of symbolic links. Be very careful around scenarios such as:
rm .newmail; ln -s /etc/passwd .newmail
echo "cracked::0:0:::/tmp" | mail $USER
If the mail delivery agent runs set-uid root, and the directory containing
the mail box is writeable by the user, and symbolic links are allowed in
mailbox paths, it had better be a community of trusted users. Also, if the
user mailbox lives under their home directory and you have disk quotas,
you could run into denial of service security risks too.
--
Jim Leinweber (608)262-0736 State Lab. of Hygiene/U. of Wisconsin - Madison
jiml at sente.slh.wisc.edu uunet!uwvax!uwslh!jiml fax:(608)262-3257
More information about the Comp.unix.admin
mailing list