Re: [Nmh-workers] Questionable code in m_chkids() in sbr/context_save.c

[Neil W Rickert]

Ken Hornstein <address@hidden> wrote on May 16, 2005:

>(AFAIK sendmail and friends always run stuff under the user's real and
>effective uid, so I don't think slocal should ever be setuid).

If you run "slocal" from ".forward", then it runs as the recipient
(the person using ".forward").  But there are advantages to running
slocal as a mailer defined in sendmail.cf

Current sendmail allows you to run as the recipient, even when
defined as a mailer.  However there was a time when sendmail would
run a mailer as either the sender uid or daemon, but would not run as
the recipient uid.  You could set sendmail to run it with sendmail's
permissions, which in effect made slocal setuid root for that
invocation.

We must also remember that there are other MTAs than sendmail.

 -NWR