Running dovecot 1.2.4 on FreeBSD using Postfix. Everything works fine
normally, but deliver is executable by world.

This is not normally a problem, as I don't run deliver SetUID root.

But for whatever reason, when deliver is called by something that IS
SetUID root I get the following error:

/usr/local/libexec/dovecot/deliver must not be both world-executable
and setuid-root. This allows root exploits. See
http://wiki.dovecot.org/LDA#multipleuids

Deliver's permissions look like this:

-r-xr-xr-x

While the program calling deliver has permissions like this:

-r-s--x---

If it isn't possible for deliver to differentiate between being called
by setuid root programs and being setuid root itself I don't think it
should be doing that particular security check. Alternatively, there
should be an option to turn that particular check off, but what little
I saw of the source code and found searching the documentation told me
that there doesn't seem to be such an option already.

I also couldn't find any mention that this is fixed by 1.2.5 or 1.2.6.

Thomas Berezansky Merrimack Valley Library Consortium