Sendmail+smrsh - pod jakym uctem to spousti veci ?

[Lubos Kaspar]

> Date: Mon, 10 Apr 2000 22:32:46 +0200 (Czech Daylight Time)
> From: Petr Simek <petrsi na jcu.cz>
> To: sendmail na linux.cz
> Subject: Sendmail+smrsh - pod jakym uctem to spousti veci ?
> 
> Zkousim tu rozbehat listserv ve spolupraci se sendmailem 8.9.3 se smrsh.
> Udelal jsem link na program ktery to prijima ty zpravy ale pise mi to -
> 
>    ----- The following addresses had permanent fatal errors -----
> "|/var/spool/listserv/.bin/flist testing-request"
>     (expanded from: <testing-request na bf.jcu.cz>)
> 
>    ----- Transcript of session follows -----
> flist: Insufficient privileges to become "listserv"
> 550 "|/var/spool/listserv/.bin/flist testing-request"... Insufficient
> permission
> 
> Spoustene je to z aliases pres -
> 
> testing: "|/var/spool/listserv/.bin/flist testing"
> testing-request: "|/var/spool/listserv/.bin/flist testing-request"
> 
> a prava k programu jsou -
> 
> -rwsr-xr-x   1 listserv listserv    22892 Apr 26  1999 /var/spool/listserv/.bin/flist
> 
> 
> Tak mne napada pod jakym uid to vlastne sendmail spusti a pripadne jestli
> nevite jak to zmenit ? Jedna se o SmartList listserver .

Nevim jak v linuxu (napr. v HP-UX je to pod user=daemon), ale to
by melo byt velmi snadno zjistitelne: jako mailer=prog staci dat treba
uplne trivialni skriptik s nastavenim PATH a radkem typu
"id|mailx my_username" a s pravy 555.  Potencialni usernames by mely mit
(pouze pro ucely tohoto testu) nejaky "normalni" shell (ksh ap.)

BTW: /var/spool asi neni ten "pravy" strom na umisteni programu.

K smrsh: osobne se mi zda natolik "bezpecny", ze se pod nim neda delat
skoro nic. Mohl by zde prosim nekdo vysvetlit, v cem spocivaji udajna
nebezpeci pri pouziti "bezneho" shellu (ksh) jako mailer=prog? V man-page
k smrsh (HP-UX) jsou jakasi zaklinadla, ale konkretni objasneni rizik pouziti
beznych shellu chybeji (samozrejmosti jsou zakladni obezretnosti typu nastaveni
PATH, umask, nepouzivani env s daty z stdin, nepousteni stdin treba do "|sh"
ap.).
--
                                                Lubos Kaspar