Re: Possible mail spool problem

[mlists () GIZMO KYRNET KG (CyberPsychotic)]

~ Following installation of suse 5.1, the setup software sets the mail spool
~ directory world writable, which has a potential of causing some security
~ problems.  although I have checked alot of possible forms of exploiting
~ this, there is probably some I have missed.  removing the o+w bit from the
~ directory will surely solve the problems.
~

They should have sticky bit set there as well (I don't have suse anywhere
around so can not check). However, many lattest mail clients (such as pine
3.96 and latter,procmail) attempt to create lock file in /var/spool/mail,
one of solutions for this problem would be to make this dir world writable
and sticky bit -- on.


Fyodor