Re: link() security

[Patrick J. LoPresti]

xystrus <[e-mail]> writes:

> Many linux systems, like Slackware and SuSE, favor the permissions
> 1777 for the mail spool directory.  This is a good policy from a
> security perspective, as it prevents mail utilities from requiring
> SUID/SGID root or mail privileges to create a user's spool and/or lock
> files.

Actually, that is a horrible policy from a security perspective.  The
shared mail spool itself is a poor design and always has been.

A better design is to use a separate spool directory for each user
(/var/spool/mail/user/ or ~user/mail/ or somesuch), and only allow
that user to access it at all.  This solves *all* of the security
problems you mention:

   *) It avoids attacks based on race conditions, because you cannot
      create files in somebody else's spool.

   *) Admins can manage space with quotas or partitions just like they
      do for user home directories (i.e., it is a solved problem).

   *) You cannot link() to somebody else's spool file because you
      cannot even read the directory in which it resides.

The solution to a fundamentally broken spool design is to fix that
design, not to patch the kernel in nonstandard ways to plug just one
of its multiple flaws.

And yes, there are MTAs which use a directory per user by default.
Fix your MTA, do not hack the kernel.

All just My Opinion, of course.

 - Pat