From owner-cvs-ports@FreeBSD.ORG  Tue May 25 03:04:26 2004
Return-Path: <owner-cvs-ports@FreeBSD.ORG>
Delivered-To: cvs-ports@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id C9F7A16A4CE; Tue, 25 May 2004 03:04:26 -0700 (PDT)
Received: from flappie.debank.tv (flappie.debank.tv [212.206.127.42])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 6AB5143D4C; Tue, 25 May 2004 03:04:26 -0700 (PDT)
	(envelope-from rob@debank.tv)
Received: from localhost (localhost.debank.tv [127.0.0.1])
	by flappie.debank.tv (Postfix) with ESMTP id F0DBE52BD;
	Tue, 25 May 2004 12:03:55 +0200 (CEST)
Received: from flappie.debank.tv ([127.0.0.1])
 by localhost (flappie.debank.tv [127.0.0.1]) (amavisd-new, port 10024)
 with LMTP id 20937-04; Tue, 25 May 2004 12:03:50 +0200 (CEST)
Received: by flappie.debank.tv (Postfix, from userid 80)
	id 516C9528D; Tue, 25 May 2004 12:03:50 +0200 (CEST)
Received: from 193.79.18.58
        (SquirrelMail authenticated user rob@debank.tv)
        by debank.tv with HTTP;
        Tue, 25 May 2004 12:03:50 +0200 (CEST)
Message-ID: <50813.193.79.18.58.1085479430.squirrel@debank.tv>
In-Reply-To: <40B3167F.8060509@fillmore-labs.com>
References: <200405242302.i4ON2NcJ063759@repoman.freebsd.org>   
    <ygehdu4ubgm.wl%ume@FreeBSD.org>
    <52001.193.79.18.58.1085477488.squirrel@debank.tv>
    <40B3167F.8060509@fillmore-labs.com>
Date: Tue, 25 May 2004 12:03:50 +0200 (CEST)
From: rob@debank.tv
To: "Oliver Eikemeier" <eikemeier@fillmore-labs.com>
User-Agent: SquirrelMail/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
Importance: Normal
X-Virus-Scanned: by amavisd-new at debank.tv
cc: rob@debank.tv
cc: cvs-ports@freebsd.org
cc: Pav Lucistnik <pav@freebsd.org>
cc: Hajimu UMEMOTO <ume@freebsd.org>
cc: ports-committers@freebsd.org
Subject: Re: cvs commit: ports/security/clamav-devel [...] pkg-install [...]
X-BeenThere: cvs-ports@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the ports tree <cvs-ports.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-ports>,
	<mailto:cvs-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-ports>
List-Post: <mailto:cvs-ports@freebsd.org>
List-Help: <mailto:cvs-ports-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-ports>,
	<mailto:cvs-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 25 May 2004 10:04:27 -0000

> rob@debank.tv wrote:
>
>>>Hi,
>>>
>>>>>>>>On Mon, 24 May 2004 16:02:23 -0700 (PDT)
>>>>>>>>Pav Lucistnik <pav@FreeBSD.org> said:
>>>
>>>[...]
>>>pav>   - Chmod 770 socket directory
>>>pav>   - Diff reduction against security/clamav port
>>>
>>>pav>   PR:             ports/67125
>>>pav>   Submitted by:   Rob Evers <rob@debank.tv> (maintainer)
>>>
>>>Could you please change mode of /var/run/clamd to 750?  Unless this
>>>change, sendmail complains about it and doesn't run.
>>>
>>>Index: pkg-install
>>>diff -u pkg-install.orig pkg-install
>>>--- pkg-install.orig	Tue May 25 15:57:11 2004
>>>+++ pkg-install	Tue May 25 17:56:03 2004
>>>@@ -38,7 +38,7 @@
>>>
>>> echo "===> Setting permissions..."
>>> mkdir -p "${CLAMRUN}"
>>>-chmod 770 "${CLAMRUN}"
>>>+chmod 750 "${CLAMRUN}"
>>> chown "${CLAMAVUSER}:${CLAMAVGROUP}" "${CLAMRUN}"
>>>
>>> mkdir -p "${CLAMLOG}"
>>>
>>>Sincerely,
>>>
>>>--
>>>Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
>>>ume@mahoroba.org  ume@{,jp.}FreeBSD.org
>>>http://www.imasy.org/~ume/
>>
>> I can confirm this,
>>
>> Sendmail doesn't like group writable socket directorys, please apply
>> this
>> fix. (Bump PORTREVISION)
>>
>> Rob Evers
>
> I still don't get the purpose of not allowing non-root processes
> to use clamav. This would break my exim installation, fortunately
> I'm using security/clamav, where this change hasn't been made.
>
> -Oliver
>


Isn't there a security risk allowing every user to read the clamd socket ?
(that's why I made this change).

Rob Evers.