Red Hat Bugzilla – Bug 427561
alpine warns about 1777 protection on /var/spool/mail at startup
Last modified: 2012-01-15 18:21:42 EST
Description of problem: Every time alpine starts up, I get the message: [Folder vulnerable - directory /var/spool/mail must have 1777 protection] Version-Release number of selected component (if applicable): alpine-1.00-2.fc8 How reproducible: Always. Steps to Reproduce: 1. Start up alpine. Actual results: Alpine warns [Folder vulnerable - directory /var/spool/mail must have 1777 protection] Expected results: Alpine works without warnings with the normal system permissions (775 on my system). I would rather not make /var/spool/mail world-writable (even with the sticky bit). If that's the only solution, presumably the Fedora-installed default permissions should be changed. Additional info: http://bugs.donarmstrong.com/cgi-bin/bugreport.cgi?bug=414264 describes the same issue. We were previously using pine 4.64 (from the old Dag repository) which did not have this problem. Since /usr/bin/pine in that package is not setgid mail, I suspect it includes a patch to either fix the locking or just ignore the warning.
Rex, what did you do with livna pine on this issue?
nothing.
In case it wasn't obvious, our users run pine/alpine directly on our mail server, so it accesses the mailboxes directly, not via IMAP. Does the "nothing" in comment #2 mean that Livna pine also reports the same warning, and users are just supposed to ignore it, or that no patch was necessary because for some reason pine doesn't have this warning?
sorry, too terse, second try. Yes, pine had the same error/warning, and I did nothing to address this there.
Ben, this warning is likely coming from the imap server, not the clients running alpine. Are you using uw-imap?
No, that's impossible, because alpine is accessing the mailboxes directly, not via IMAP. See comment #3.
my bad. :)
OK, so I poked around in the dag pine package some more, and found that it does include patches to fix the locking: http://dag.wieers.com/rpm/packages/pine/pine.spec I'm not familiar with the pine/alpine code, but it looks like they're making it use flock or fcntl somewhere.
Yes, Dag's pine is *heavily* patched. We want to stay as close as possible to upstream though. Rex, it looks like uw-imap-utils includes setgid mail mlock. Ben, can you see if installing uw-imap-utils makes alpine quiet down?
I think it'll issue the warning regardless, but I'd love to be wrong.
Well I found at least one distro is patching this issue: http://www.mail-archive.com/pld-cvs-commit@lists.pld-linux.org/msg117316.html MRC has this message in alpine-1.00/imap/src/osdep/unix/env_unix.c : /* Note: setting disableLockWarning means that you assert that the * so-modified copy of this software will NEVER be used: * 1) in conjunction with any software which expects .lock files * 2) to access NFS-mounted files and directories * * Unless both of these conditions apply, then do not set this flag. * Instead, read the FAQ (item 7.10) and either use 1777 protection * on the mail spool, or install mlock. * * In addition, by setting this flag you also agree that you are fully * legally and morally responsible when (not if) mail files are damaged * as the result of your choice. * * The mlock tool exists for a reason. Use it. */
(In reply to comment #9) I agree - it'd be great not to have huge patches in the package. The Dag pine package also includes a setgid mail mlock, so that's probably what makes it work. I tried the uw-imap-utils package, and yes - the alpine warning does subsequently go away. So that seems like a perfect solution, thanks! (Perhaps it's too much to have the alpine package require uw-imap-utils, but it could be recommended in the docs or package description.)
Great! I'll make a note that uw-imap-utils is suggested if you're running alpine against a local /var/spool/mail/ INBOX. (By the way, alpine and uw-imap share the same IMAP processing code, so it's the same mlock.) I'll close this bug as NOTABUG too.
alpine-2.02-3.el4 has been submitted as an update for Fedora EPEL 4. https://admin.fedoraproject.org/updates/alpine-2.02-3.el4
alpine-2.02-3.el4 has been pushed to the Fedora EPEL 4 stable repository. If problems still persist, please make note of it in this bug report.