Re: Problem with /etc/security script?

[Robert Elz <kre%munnari.OZ.AU@localhost>]

    Date:        Sun, 7 Oct 2018 08:44:38 +0800 (+08)
    From:        Paul Goyette <paul%whooppee.com@localhost>
    Message-ID:  <Pine.NEB.4.64.1810070843070.1638%speedy.whooppee.com@localhost>

  | I _think_ there's something updated in pkgsrc which is doing this,

Probably.   That it is actually making lock suggests that it is in active
use - and it needs to be souething that rtouches mail, so that should
narrow the hunt (though it might be some kind of monitoring app, rather
than your actual mail client).

But I'd start with your MUA, write a tight lottle script

	while :
	do
		test -f /var/mail/paul.lock && echo LOCK
	done

and then simply read mail, and watch what happens...

Aside from the secirity report noise (it would not hurt to simply omit .lock
files though validatingthem would be even better - aside from their owner,
they should exist no more than a few seconds, so the ctime should be
very close to now)  this does not necessarily indicate a problem, I have
seen mal apps that (because of the confusion with how to lock over time)
simply use every possible method, always ...

kre