Re: SUID pop3 / imap4?

[xystrus]

On Wed, Apr 03, 2002 at 06:36:25PM +0300, Sergey Poznyakoff wrote:
> > The followup question is: Should the Makefile install it chmod +s, or
> > should just the Debian package do it?
> 
> I believe neither of them should do it. Pop3d is supposed to be
> started with root privileges. Installing it setuid requires careful
> analysis of possible security implications.

OYE.  I will reiterate:  THERE IS NO DIFFERENCE BETWEEN RUNNING AS ROOT AND
SUID.  If you have software that runs with root priviledges, you must
undergo a careful analysis of possible security implications whether or not
you got root priviledges via the SUID mechanism.  The same dangers apply to
any program that runs with root priviledges, i.e. it is the root priviledges
that are inherently dangerous, NOT the fact that the file is SUID.

Xy