I've used (Al)pine to read mail for more than 25 years. It is simple and
easy to use. However, on OpenBSD, it perpetually bitches about file
permissions on /var/mail as it cannot write lock files with 755 permissions.

The warning message every time you launch Alpine is as follows:

[Folder vulnerable - directory /var/mail must have 1777 protection]

Evidently, this comes down to the battle between security (someone miscreant
filling up /var) vs mailbox corruption. On OpenBSD /var/mail is set to 0755
for security purposes and that isn't changing.

Now, some time ago, a kind soul wrote a patch for Alpine to use lockspool(1)
on OpenBSD for mailbox locking and posted an extensive writeup about it.
I've linked to the patch below. This patch is over four years old and I was
shocked to find out that not only was it never merged into the tree, but it
appears to never have been shared with the mailing list that I could find.

It would be a tragedy for this code to be relegated to the dustbin of the
Internet, especially since it looks like this person put a lot of effort
into the fix. Does anyone know how we can get this to the attention of the
Alpine ports maintainer to finally fix this once and for all? Thanks.

Regards
Lloyd

Link to patches:

https://sourceopen.com/index.php/a-journey-with-the-alpine-mail-user-agent-mua-in-openbsd-or-how-to-safely-fix-folder-vulnerable-directory-var-mail-must-have-1777-protection/

Reply via email to