From 05dba91fcb152e1941e7f7f145b1d830c5e8f6d0 Mon Sep 17 00:00:00 2001
From: David Levine <levinedl@acm.org>
Date: Sun, 2 Feb 2014 09:58:45 -0600
Subject: [PATCH] Removed all unnecessary setuid/setgid calls.  Using setuid as
 an example and not showing the setgid analogues:

    1) setuid(getuid());
    This dropped privileges before an exec and is normally a
    good thing.  Except here, the return value isn't checked.
    And, we don't have any setuid programs in nmh now, so it was
    unnecessary.

    2) if (geteuid() == 0) setuid(pw->pw_uid);
    This would have been a security hole if the executable was
    setuid root because the user specifies the source of the pw
    data.  This was in slocal(1), which is not setuid, so this
    was certainly not needed.

    3) setuid(geteuid());
    This was in post(8) for when it called the sendmail
    executable directly (-mts sendmail or -mts sendmail/pipe.
    It's not necessary with modern sendmail or replacements.
---
 mts/smtp/smtp.c    |  2 --
 sbr/context_save.c |  2 --
 sbr/makedir.c      |  3 ---
 uip/popsbr.c       |  3 ---
 uip/slocal.c       | 10 ----------
 5 files changed, 20 deletions(-)

diff --git a/mts/smtp/smtp.c b/mts/smtp/smtp.c
index 7177e5d5..984f50d3 100644
--- a/mts/smtp/smtp.c
+++ b/mts/smtp/smtp.c
@@ -481,8 +481,6 @@ sendmail_init (char *client, char *server, int watch, int verbose,
 		vec[vecp++] = "-ov";
 	    vec[vecp++] = NULL;
 
-	    setgid (getegid ());
-	    setuid (geteuid ());
 	    execvp (sendmail, vec);
 	    fprintf (stderr, "unable to exec ");
 	    perror (sendmail);
diff --git a/sbr/context_save.c b/sbr/context_save.c
index d7d87e45..9105a596 100644
--- a/sbr/context_save.c
+++ b/sbr/context_save.c
@@ -87,8 +87,6 @@ m_chkids (void)
 	case 0:
 	    /* It's not necessary to call unregister_for_removal(0)
                because the child calls _exit() in context_save(). */
-	    setgid (getgid ());
-	    setuid (getuid ());
 	    break;
 
 	default:
diff --git a/sbr/makedir.c b/sbr/makedir.c
index 67f69c86..a5386f22 100644
--- a/sbr/makedir.c
+++ b/sbr/makedir.c
@@ -89,9 +89,6 @@ makedir (char *dir)
 		return 0;
 		
 	    case 0:
-		setgid (getgid ());
-		setuid (getuid ());
-		
 		execl ("/bin/mkdir", "mkdir", dir, (void *) NULL);
 		execl ("/usr/bin/mkdir", "mkdir", dir, (void *) NULL);
 		fprintf (stderr, "unable to exec ");
diff --git a/uip/popsbr.c b/uip/popsbr.c
index 714a8da7..be0540c7 100644
--- a/uip/popsbr.c
+++ b/uip/popsbr.c
@@ -435,9 +435,6 @@ pop_init (char *host, char *port, char *user, char *pass, char *proxy,
        int inpipe[2];	  /* for reading from the server */
        int outpipe[2];    /* for sending to the server */
 
-       /* first give up any root priviledges we may have for rpop */
-       setuid(getuid());
-
        pipe(inpipe);
        pipe(outpipe);
 
diff --git a/uip/slocal.c b/uip/slocal.c
index eaa7cb7c..a807d816 100644
--- a/uip/slocal.c
+++ b/uip/slocal.c
@@ -34,10 +34,6 @@
 #include <sys/ioctl.h>
 #include <fcntl.h>
 
-/* Hopefully, grp.h declares initgroups().  If we run into a platform
-   where it doesn't, we could consider declaring it here as well. */
-#include <grp.h>
-
 /* This define is needed for Berkeley db v2 and above to
  * make the header file expose the 'historical' ndbm APIs.
  * We define it unconditionally because this is simple and
@@ -282,12 +278,6 @@ main (int argc, char **argv)
 	chdir ("/");
     umask (0077);
 
-    if (geteuid() == 0) {
-	setgid (pw->pw_gid);
-	initgroups (pw->pw_name, pw->pw_gid);
-	setuid (pw->pw_uid);
-    }
-    
     if (info == NULL)
 	info = "";
 
-- 
2.56.0