From df3ad6e9b5d674796dadea5d4cc9fa110e3254ec Mon Sep 17 00:00:00 2001 From: Russ Allbery Date: Sat, 5 Jul 2008 16:26:32 -0700 Subject: [PATCH] Allow mailboxes to be either mode 600 or mode 660 Most mail systems these days do the mail delivery as the destination user and for those systems the principal of least privilege indicates that mailboxes should be mode 600. Permit either permission scheme and document the intent of both schemes in a footnote. Closes: #470994 --- policy.sgml | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/policy.sgml b/policy.sgml index 24c9072..f794ed5 100644 --- a/policy.sgml +++ b/policy.sgml @@ -8046,12 +8046,24 @@ http://localhost/doc/package/filename

- Mailboxes are generally mode 660 - user:mail unless the system - administrator has chosen otherwise. A MUA may remove a - mailbox (unless it has nonstandard permissions) in which - case the MTA or another MUA must recreate it if needed. - Mailboxes must be writable by group mail. + Mailboxes are generally either owned by user and mode + 600 or owned by user:mail and mode 660 + unless the system administrator has chosen otherwise + There are two traditional permission schemes for mail spools: + mode 600 with all mail delivery done by processes running as + the destination user, or mode 660 and owned by group mail with + mail delivery done by a process running as a system user in + group mail. Historically, Debian required mode 660 mail + spools to enable the latter model, but that model has become + increasingly uncommon and principal of least privilege + indicates that mail systems that use the first model should + use permissions of 600. If delivery to programs is permitted, + it's easier to keep the mail system secure if the delivery + agent runs as the destination user. Debian Policy therefore + permits either scheme. + . A MUA may remove a mailbox (unless it has + nonstandard permissions) in which case the MTA or another MUA + must recreate it if needed.

-- 2.39.5