Re: dot-qmail security

[Mark Delany]

At 06:25 PM 3/15/99 -0700, Scott D. Yelich wrote:
>> That you think qmail-local has some divine way of knowing what exactly you 
>> wish to constrain is endowing it with too much prescience.
>
>
>Not really.  Have it look up digital signatures for programs it runs.
>If the signature is missing or has changed, don't run the program.

Yep. In Unixland we call them permissions.

You don't want the user to be able to run the program, permission the 
program/directory away from them. Unix has all the capabilities needed to 
control access on the filesystem, I wouldn't expect that qmail should need 
to invent any more.


Regards.