[tpop3d-discuss] tpop3d, sendmail and owner of mailbox

[Paul Warren]

On Wed, Nov 14, 2001 at 12:36:57PM +0000, Chris Elsworth wrote:
> On Wed, Nov 14, 2001 at 09:51:47AM +0000, Chris Lightfoot wrote:
> 
> > The reason that mail-group can be chosen in the above way
> > is that on some systems, /var/spool/mail is group mail,
> > g+w, so that a program needs to be setgid mail to write a
> > lock file. On other systems, /var/spool/mail is 1777, a
> > far more sensible default, and anyone can write a lock
> > file into /var/spool/mail.
> 
> Not to start an argument or anything, but I share the view that the only 
> mode 1777 directory on the entire system should be /tmp.

Even having a world writable /tmp is a dangerous relic and should be
done away with.

> Any mode 1777 directory has the potential of being filled up (by anyone 
> who wants to), thus rendering the partition useless for valid applications 
> - I could fill up the drive with any old file in /var/spool/mail if its 
> mode 1777, and from that point on, nobody gets any mail.
> 
> Group mail, and g+w, is, in my opinion, the more sensible protection 
> scheme. Opinions will vary :)

I don't see what this gains you.  Either way you can fill up the disk
unless quotas are active, and if quotas are set up you can impose a
maximum on both size and number of files.

Paul