Hey,
well many systems don't SETGID no more! Huch.
E.g., v14.8.3 WANT_PRIVSEP won't work on DragonFly BSD due to
that. So on [master] and attached a one-line change which will
try the privilege-separated dotlock program also if we can't write
to the target directory. (The patch applies only with a small
offset to v14.8.3 since [master] also performs better pathname
limit checking via pathconf(2) if available.)
?0[steffen@sherwood s-nail-14.8.3]$ patch -p1 < dotlock-access.diff
Even that doesn't help for e.g. OpenBSD, which now uses
root:wheel/0755 (at least by default). For this we'd need to
offer SETUID capability of the privsep dotlock. And whereas that
is fully implemented now (just fill in PRIVSEP_USER=) i have
disabled the actual C code again (via "#if 0" in privsep.c). The
reason is twofold: for one the current implementation is too
simple-minded, we setuid(2) to the SETUID user, but should of
course create the lock as the user who owns the mailbox for which
we create the lock, and second that would be too hacky to
implement now, mostly because we support $USER/-u USER but also
%USER; whereas the former two are checked against the system user
database upon startup and thus could be done right, the latter
i will have to think of.
E.g., what if the system crashes / there is a power failure when
we have created a lock file as "root" for "nobody"? The user will
have to ask the administrator to cleanup the lock file in order to
be able to modify her mailbox again! I really dislike this
scenario.
The pending OpenBSD S-nail package update disables the dotlock
program because it is useless there.
What else? On [master] there is an extension for -a to make it
possible to fixate the input character set of attachments and
avoid any character set conversion, e.g., "-a README=UTF-8": if
README=UTF-8 cannot be accessed then we search "=", shall we find
it we retry with "README" and a fixated character set UTF-8.
Primitive, but easier to use than batch mode and `~@'.
Puh, i come to an end!
Now for real: i wish you a nice summertime, as the fish are
jumping, and the cotton is high. And, mind you, unfortunately
there are also hanging strange fruits from the southern trees.
Ciao!
--steffen
commit fe30ad4
Author: Steffen (Daode) Nurpmeso <[email protected]>
Date: 2015-07-07 14:47:26 +0200
fio.c:_dotlock_main(): also try privsep child if cannot write to "."
---
fio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fio.c b/fio.c
index 549e664..55ca9a3 100644
--- a/fio.c
+++ b/fio.c
@@ -611,7 +611,7 @@ _dotlock_main(void)
if (fstat(fd, &stb) == -1)
goto jmsg;
- if (stb.st_uid != getuid() || stb.st_gid != getgid()) {
+ if (stb.st_uid != getuid() || stb.st_gid != getgid() || access(".", W_OK)) {
char itoabuf[64];
char const *args[11];
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
S-nail-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/s-nail-users
