FIX privsep.c, yes, vulnerability (wapiflapi)..

FIX privsep.c, yes, vulnerability (wapiflapi)..

wapiflapi (wapiflapi at yahoo dot fr) reported a vulnerability
when the privsep program is driven directly: it is possible to
pass a random string which includes path separators.

This random string is used to build the path name of a an
O_EXCLusively created file, which then is fchown()ed to the owner
of the mailbox the privsep child is to be used to create a lock
file for.  The exclusively created file is then removed, whether
the race has been won or not.

The privsep child will refuse to run unless the executing user
owns the mailbox file, that is, has read (or read/write, dependent
on mode), the target of the link will always be the name of said
mailbox with a ".lock" suffix (Unix dotlock locking).