Re: Patch to run as "nullmail"

--2YJj5f1P6Th4nBRw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, May 31, 2005 at 02:13:42PM -0700, Clint Pachl wrote:
> I would agree somewhat, but wouldn't running nullmailer as a
> privileged user be an even bigger security risk?

Nullmailer will almost exclusively be run from pre-built startup
scripts, which are built by "experts".  I am under no illusions that the
nullmailer daemon is something than an end user would want to play with.
The end user just wants to be able to send mail.

> The code to change privileges IS IN the djb-esque tools, which wraps
> nullmailer-send. So how does that not add a "security problem" to the
> overall effect?

Because that code is in one place, not in every program that needs its
privileges reduced.  That way, if there are any issues with getting it
right, the problem is solved in one place and used everywhere.

>  I don't think adding a
> couple of lines directly to the app to change privilges adds much of a
> security risk.

Depends if there are any "gotchas" in changing privileges, and there
usually are.

The initial patch also hard-codes the "nullmail" name into the program,
which is also poor practice.

>  probably not much of a vulnerability.

I don't like "probably".

> The OpenBSD guys like to modify default network daemons to run as
> unprivilged users right out of the box, without user intervention.
> (ex: BIND named runs as named). I think this is smart and proactive
> security.

Here's another viewpoint: if the program is unprivileged even *before*
it starts, there is that one less possibility for it to fail to drop
privileges.

>  I don't want to run Daemon Tools on my servers.

You don't have to "run" the svscan/supervise components if you don't
want to (although it is highly advised, of course).  If you don't want
to even build the package, providing a replacement for all the packages
that do recommend using it (hint: not just nullmailer) shouldn't be very
hard given that you don't feel hesitant to patch C++.
--=20
Bruce Guenter <[email protected]> http://em.ca/~bruceg/ http://untroubled.org/
OpenPGP key: 699980E8 / D0B7 C8DD 365D A395 29DA  2E2A E96F B2DC 6999 80E8

--2YJj5f1P6Th4nBRw
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCnpo26W+y3GmZgOgRAgr8AKCUYy/1NL2r4TyP0uio4lFH4DbjNACfVbr+
48LNKZVja1/pUvkB7XaBxwo=
=ANSZ
-----END PGP SIGNATURE-----

--2YJj5f1P6Th4nBRw--