Where does Pine create lockfiles, and what should that directorys permissions be?
To protect against conflicts with mail delivery by sendmail, which could cause INBOX corruption, Pine creates lockfiles in the directory /var/spool/mail [1]. The permission setting for that directory should be 1777 (world writable with the sticky bit set). The alternative would be to make all mail programs setgid to some special group — an unacceptable security risk in the opinion of the Pine developers [2]. By contrast, lockfiles created in the /tmp directory serve interlocking of different Pine sessions with each other, not of Pine with the Mail Delivery Agent. Lockfiles in the /tmp directory are mode 666 because of the case of shared folders (e.g., tenex format) and “kiss of death” functionality (UNIX mbox format and MMDF format). The lock needs to be accessible by processes which may be logged in as another user name; this is a tradeoff between security and functionality. [1] Versions of Pine prior to 3.92 did not warn users when locking in /var/spool/mail failed. [2] Some version
