Removed all unnecessary setuid/setgid calls. Using setuid as an

example and not showing the setgid analogues:

    1) setuid(getuid());
    This dropped privileges before an exec and is normally a
    good thing.  Except here, the return value isn't checked.
    And, we don't have any setuid programs in nmh now, so it was
    unnecessary.

    2) if (geteuid() == 0) setuid(pw->pw_uid);
    This would have been a security hole if the executable was
    setuid root because the user specifies the source of the pw
    data.  This was in slocal(1), which is not setuid, so this
    was certainly not needed.

    3) setuid(geteuid());
    This was in post(8) for when it called the sendmail
    executable directly (-mts sendmail or -mts sendmail/pipe.
    It's not necessary with modern sendmail or replacements.

diff --git a/mts/smtp/smtp.c b/mts/smtp/smtp.c
index 7177e5d..984f50d 100644 (file)
--- a/mts/smtp/smtp.c
+++ b/mts/smtp/smtp.c
@@ -481,8 +481,6 @@ sendmail_init (char *client, char *server, int watch, int verbose,
                vec[vecp++] = "-ov";
            vec[vecp++] = NULL;
 
-           setgid (getegid ());
-           setuid (geteuid ());
            execvp (sendmail, vec);
            fprintf (stderr, "unable to exec ");
            perror (sendmail);

diff --git a/sbr/context_save.c b/sbr/context_save.c
index d7d87e4..9105a59 100644 (file)
--- a/sbr/context_save.c
+++ b/sbr/context_save.c
@@ -87,8 +87,6 @@ m_chkids (void)
        case 0:
            /* It's not necessary to call unregister_for_removal(0)
                because the child calls _exit() in context_save(). */
-           setgid (getgid ());
-           setuid (getuid ());
            break;
 
        default:

diff --git a/sbr/makedir.c b/sbr/makedir.c
index 67f69c8..a5386f2 100644 (file)
--- a/sbr/makedir.c
+++ b/sbr/makedir.c
@@ -89,9 +89,6 @@ makedir (char *dir)
                return 0;
                
            case 0:
-               setgid (getgid ());
-               setuid (getuid ());
-               
                execl ("/bin/mkdir", "mkdir", dir, (void *) NULL);
                execl ("/usr/bin/mkdir", "mkdir", dir, (void *) NULL);
                fprintf (stderr, "unable to exec ");

diff --git a/uip/popsbr.c b/uip/popsbr.c
index 714a8da..be0540c 100644 (file)
--- a/uip/popsbr.c
+++ b/uip/popsbr.c
@@ -435,9 +435,6 @@ pop_init (char *host, char *port, char *user, char *pass, char *proxy,
        int inpipe[2];    /* for reading from the server */
        int outpipe[2];    /* for sending to the server */
 
-       /* first give up any root priviledges we may have for rpop */
-       setuid(getuid());
-
        pipe(inpipe);
        pipe(outpipe);
 

diff --git a/uip/slocal.c b/uip/slocal.c
index eaa7cb7..a807d81 100644 (file)
--- a/uip/slocal.c
+++ b/uip/slocal.c
@@ -34,10 +34,6 @@
 #include <sys/ioctl.h>
 #include <fcntl.h>
 
-/* Hopefully, grp.h declares initgroups().  If we run into a platform
-   where it doesn't, we could consider declaring it here as well. */
-#include <grp.h>
-
 /* This define is needed for Berkeley db v2 and above to
  * make the header file expose the 'historical' ndbm APIs.
  * We define it unconditionally because this is simple and
@@ -282,12 +278,6 @@ main (int argc, char **argv)
        chdir ("/");
     umask (0077);
 
-    if (geteuid() == 0) {
-       setgid (pw->pw_gid);
-       initgroups (pw->pw_name, pw->pw_gid);
-       setuid (pw->pw_uid);
-    }
-    
     if (info == NULL)
        info = "";