cvs commit: ports/security/clamav-devel [...] pkg-install [...]

[rob at debank.tv]

> rob at debank.tv wrote:
>
>>>Hi,
>>>
>>>>>>>>On Mon, 24 May 2004 16:02:23 -0700 (PDT)
>>>>>>>>Pav Lucistnik <pav at FreeBSD.org> said:
>>>
>>>[...]
>>>pav>   - Chmod 770 socket directory
>>>pav>   - Diff reduction against security/clamav port
>>>
>>>pav>   PR:             ports/67125
>>>pav>   Submitted by:   Rob Evers <rob at debank.tv> (maintainer)
>>>
>>>Could you please change mode of /var/run/clamd to 750?  Unless this
>>>change, sendmail complains about it and doesn't run.
>>>
>>>Index: pkg-install
>>>diff -u pkg-install.orig pkg-install
>>>--- pkg-install.orig	Tue May 25 15:57:11 2004
>>>+++ pkg-install	Tue May 25 17:56:03 2004
>>>@@ -38,7 +38,7 @@
>>>
>>> echo "===> Setting permissions..."
>>> mkdir -p "${CLAMRUN}"
>>>-chmod 770 "${CLAMRUN}"
>>>+chmod 750 "${CLAMRUN}"
>>> chown "${CLAMAVUSER}:${CLAMAVGROUP}" "${CLAMRUN}"
>>>
>>> mkdir -p "${CLAMLOG}"
>>>
>>>Sincerely,
>>>
>>>--
>>>Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
>>>ume at mahoroba.org  ume@{,jp.}FreeBSD.org
>>>http://www.imasy.org/~ume/
>>
>> I can confirm this,
>>
>> Sendmail doesn't like group writable socket directorys, please apply
>> this
>> fix. (Bump PORTREVISION)
>>
>> Rob Evers
>
> I still don't get the purpose of not allowing non-root processes
> to use clamav. This would break my exim installation, fortunately
> I'm using security/clamav, where this change hasn't been made.
>
> -Oliver
>


Isn't there a security risk allowing every user to read the clamd socket ?
(that's why I made this change).

Rob Evers.