Bug 576190

Summary:	mail-filter/dcc-1.3.140-1: Everything as root (security problem)
Product:	Gentoo Linux	Reporter:	Walter <walter>
Component:	Current packages	Assignee:	Robin Johnson <robbat2>
Status:	UNCONFIRMED ---
Severity:	normal	CC:	candrews, net-mail+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Walter 2016-03-02 04:01:15 UTC

The package installs to run all daemons as root.

This is unnecessary and undesirable from a security standpoint.

Given that the only other bug currently out there for the package states an earlier version likely has an overflow, this is doubly the case.

The ebuild should be modified to add a dcc user and group, which should own /var/dcc and have read-only access to root-owned /etc/dcc

Permissions should be tested in milter and non-milter configurations.

Comment 1 Vladimir Datsevich 2016-10-01 14:52:58 UTC

Any news on this?