From: Russ Allbery Date: Sat, 5 Jul 2008 23:26:32 +0000 (-0700) Subject: Allow mailboxes to be either mode 600 or mode 660 X-Git-Url: https://git.donarmstrong.com/?a=commitdiff_plain;h=df3ad6e9b5d674796dadea5d4cc9fa110e3254ec;p=debian%2Fdebian-policy.git Allow mailboxes to be either mode 600 or mode 660 Most mail systems these days do the mail delivery as the destination user and for those systems the principal of least privilege indicates that mailboxes should be mode 600. Permit either permission scheme and document the intent of both schemes in a footnote. Closes: #470994 --- diff --git a/policy.sgml b/policy.sgml index 24c9072..f794ed5 100644 --- a/policy.sgml +++ b/policy.sgml @@ -8046,12 +8046,24 @@ http://localhost/doc/package/filename

- Mailboxes are generally mode 660 - user:mail unless the system - administrator has chosen otherwise. A MUA may remove a - mailbox (unless it has nonstandard permissions) in which - case the MTA or another MUA must recreate it if needed. - Mailboxes must be writable by group mail. + Mailboxes are generally either owned by user and mode + 600 or owned by user:mail and mode 660 + unless the system administrator has chosen otherwise + There are two traditional permission schemes for mail spools: + mode 600 with all mail delivery done by processes running as + the destination user, or mode 660 and owned by group mail with + mail delivery done by a process running as a system user in + group mail. Historically, Debian required mode 660 mail + spools to enable the latter model, but that model has become + increasingly uncommon and principal of least privilege + indicates that mail systems that use the first model should + use permissions of 600. If delivery to programs is permitted, + it's easier to keep the mail system secure if the delivery + agent runs as the destination user. Debian Policy therefore + permits either scheme. + . A MUA may remove a mailbox (unless it has + nonstandard permissions) in which case the MTA or another MUA + must recreate it if needed.