2 files changed, 27 insertions, 6 deletions

diff --git a/libexec/comsat/comsat.8 b/libexec/comsat/comsat.8
index 0b660352cd70..dd1c47de6f48 100644
--- a/libexec/comsat/comsat.8
+++ b/libexec/comsat/comsat.8
@@ -76,6 +76,13 @@ or
 .Dq Subject
 lines are not included in the displayed message.
 .Pp
+If the
+.Em user
+specified is logged in to the system and the associated terminal has
+the group execute bit turned on (by a
+.Dq Li biff b ) ,
+two bell characters (ASCII \\007) are printed on the user's terminal.
+.Pp
 If mailbox-name omitted, standard mailbox assumed.
 .Sh FILES
 .Bl -tag -width /var/mail/user -compact
diff --git a/libexec/comsat/comsat.c b/libexec/comsat/comsat.c
index a966002f28af..1221566c7736 100644
--- a/libexec/comsat/comsat.c
+++ b/libexec/comsat/comsat.c
@@ -211,7 +211,7 @@ notify(struct utmp *utp, char file[], off_t offset, int folder)
 		syslog(LOG_AUTH | LOG_NOTICE, "'/' in \"%s\"", tty);
 		return;
 	}
-	if (stat(tty, &stb) || !(stb.st_mode & S_IEXEC)) {
+	if (stat(tty, &stb) || !(stb.st_mode & (S_IXUSR | S_IXGRP))) {
 		dsyslog(LOG_DEBUG, "%s: wrong mode on %s", utp->ut_name, tty);
 		return;
 	}
@@ -228,11 +228,25 @@ notify(struct utmp *utp, char file[], off_t offset, int folder)
 	cr = ((tio.c_oflag & (OPOST|ONLCR)) == (OPOST|ONLCR)) ?  "\n" : "\n\r";
 	(void)strncpy(name, utp->ut_name, sizeof(utp->ut_name));
 	name[sizeof(name) - 1] = '\0';
-	(void)fprintf(tp, "%s\007New mail for %s@%.*s\007 has arrived%s%s%s:%s----%s",
-	    cr, name, (int)sizeof(hostname), hostname,
-	    folder ? cr : "", folder ? "to " : "", folder ? file : "",
-	    cr, cr);
-	jkfprintf(tp, name, file, offset);
+	switch (stb.st_mode & (S_IXUSR | S_IXGRP)) {
+	case S_IXUSR:
+	case (S_IXUSR | S_IXGRP):
+		(void)fprintf(tp, 
+		    "%s\007New mail for %s@%.*s\007 has arrived%s%s%s:%s----%s",
+		    cr, name, (int)sizeof(hostname), hostname,
+		    folder ? cr : "", folder ? "to " : "", folder ? file : "",
+		    cr, cr);
+		jkfprintf(tp, name, file, offset);
+		break;
+	case S_IXGRP:
+		(void)fprintf(tp, "\007");
+		(void)fflush(tp);      
+		(void)sleep(1);
+		(void)fprintf(tp, "\007");
+		break;
+	default:
+		break;
+	}	
 	(void)fclose(tp);
 	_exit(0);
 }