🚀 go-pugleaf

I ran across a similar problem with the 4.2BSD uucp, but it  didn't 
happen in quite the same way as you described.  Here's the bug report
I wrote up for it way back then.  (This was almost 2 years ago)




Index:	/usr/src/usr.bin/uucp/uuxqt.c 4.2BSD

Description:  I was just setting up our first uucp connections and
	was having trouble with a command like:

		uux "ukgs\!who >ukma\!~uucp/ukgs.who"

	[ukgs is a remote machine, ukma is the local machine,
	 ukgs is an 11/24 running 2.9BSD, ukma is a 750 running 4.2
	 -- David]

	It was going and doing the execute but decided it could not
	create the output file.  Looking at the code (Ours is that
	distributed from Berkeley with 4.2) I eventually found that
	uuxqt was checking if it could create the output file for
	any non-spool-area output file, even for files going to another
	system.  This doesn't make sense since uucp doesn't know
	anything about its rights to create a file on another system.

Repeat by:	Use the above command string.  (make sure who is 
	executable from remote).  Any command which produces output
	and sent back to another system will do.

Fix:	Apply the following code.  Your line numbers will vary with
	the mileage of your fingers and source file(s).

Notes:	I would appreciate any comments on this patch.  I don't know
	if it creates any gaping security holes or not.

------------------------------------------------------------------

[I think the diff was run in the wrong order... believe me, I know
better now... -- David]

*** uuxqt.c	Thu Aug 30 14:07:50 1984
--- uuxqt.c.orig	Sat Jul  2 21:06:25 1983
***************
*** 1,24
  #ifndef lint
  static char sccsid[] = "@(#)uuxqt.c	5.2 (Berkeley) 7/2/83";
  #endif
  
- /* CHANGES:
-  *---	[22-Aug-84 dsh]: Problem: Output files to be routed back to another
-  *	system are not being routed there.
-  *	Diagnosis:  The message being put in the log file is "who XQT DENIED".
-  *	The condition controlling the printing of this message is
-  *	"(argnok || badfiles)".  The value of argnok was tested by defining
-  *	ALLOK which caused argok() to not test anything it was given.  This
-  *	did not change the behavior of the program.  Looking further, I
-  *	noticed that for X_STDOUT, chkpth() and chkperm() were being called
-  *	when the output file was to be sent back to a remote system.
-  *	Fix:  Have the program check sysout to see if the file is to go
-  *	to another system and NOT execute chkpth() and chkperm() if so.
-  */
- 
- 
  #include "uucp.h"
  #include <sys/types.h>
  #include <sys/stat.h>
  #ifdef	NDIR
  #include "ndir.h"

--- 1,9 -----
  #ifndef lint
  static char sccsid[] = "@(#)uuxqt.c	5.2 (Berkeley) 7/2/83";
  #endif
  
  #include "uucp.h"
  #include <sys/types.h>
  #include <sys/stat.h>
  #ifdef	NDIR
  #include "ndir.h"
***************
*** 170,186
  				 * vanilla spool file.  DO check permissions
  				 * of writing on a non-vanilla file */
  				i = 1;
  				if (fout[0] != '~' || prefix(sysout, Myname))
  					i = expfile(fout);
- /* CHANGE [21-Aug-84 dsh]: Problem: files going back to another system
-  *	don't make it.
-  *	Fix: Check to make sure that file is going to this system 
-  *	before calling chkpth().
-  */
- 				if (!prefix(sysout, Myname))
- 					i=0;	/* sidesteps chkpth() */
  				if (i != 0
  				 && (chkpth("", "", fout)
  					|| chkperm(fout, (char *)1)))
  					badfiles = 1;
  				break;

--- 155,164 -----
  				 * vanilla spool file.  DO check permissions
  				 * of writing on a non-vanilla file */
  				i = 1;
  				if (fout[0] != '~' || prefix(sysout, Myname))
  					i = expfile(fout);
  				if (i != 0
  				 && (chkpth("", "", fout)
  					|| chkperm(fout, (char *)1)))
  					badfiles = 1;
  				break;


-- 
David Herron,  cbosgd!ukma!david, david@UKMA.BITNET, david@uky.csnet
							  ^
			Notice new and improved address---|

Postmaster for Kentucky
"'New and improved' is a misnomer" -- David Herron, 1986