Red Hat Bugzilla – Bug 9701
permissions in /usr/bin/rnews, /var/spool/news/incoming conflict with /etc/cron.daily/inn-cron-rnews
Last modified: 2008-05-01 11:37:54 EDT
The file /etc/cron.daily/inn-cron-rnews invokes rnews -U. However, since
it's in /etc/cron.daily rather than in news' crontab, it runs as root
instead of as news. That's mostly OK since rnews is setuid news. What
rnews is *not*, however, is setgid news, and that's a problem, since it
means that once rnews finishes processing a file in
/var/spool/news/incoming, it can't delete it.
Either rnews should be made setgid news, or the rnews -U should be run out
of a news crontab file instead of out of /etc/cron.daily.