Allow mailboxes to be either mode 600 or mode 660

Most mail systems these days do the mail delivery as the destination
user and for those systems the principal of least privilege indicates
that mailboxes should be mode 600.  Permit either permission scheme
and document the intent of both schemes in a footnote.

Closes: #470994

diff --git a/policy.sgml b/policy.sgml
index 24c90727e276c2d748c889ed17679a326f08693f..f794ed557fa84dcb9cedd8f19aa27a8664dc4e24 100644 (file)
--- a/policy.sgml
+++ b/policy.sgml
@@ -8046,12 +8046,24 @@ http://localhost/doc/<var>package</var>/<var>filename</var>
        </p>
 
        <p>
-         Mailboxes are generally mode 660
-         <tt><var>user</var>:mail</tt> unless the system
-         administrator has chosen otherwise.  A MUA may remove a
-         mailbox (unless it has nonstandard permissions) in which
-         case the MTA or another MUA must recreate it if needed.
-         Mailboxes must be writable by group mail.
+         Mailboxes are generally either owned by <var>user</var> and mode
+         600 or owned by <tt><var>user</var>:mail</tt> and mode 660
+         unless the system administrator has chosen otherwise<footnote>
+           There are two traditional permission schemes for mail spools:
+           mode 600 with all mail delivery done by processes running as
+           the destination user, or mode 660 and owned by group mail with
+           mail delivery done by a process running as a system user in
+           group mail.  Historically, Debian required mode 660 mail
+           spools to enable the latter model, but that model has become
+           increasingly uncommon and principal of least privilege
+           indicates that mail systems that use the first model should
+           use permissions of 600.  If delivery to programs is permitted,
+           it's easier to keep the mail system secure if the delivery
+           agent runs as the destination user.  Debian Policy therefore
+           permits either scheme.
+         </footnote>. A MUA may remove a mailbox (unless it has
+         nonstandard permissions) in which case the MTA or another MUA
+         must recreate it if needed.
        </p>
 
        <p>