Bug#1089172: need for open-minded help with popularity-contest with systemd timer

On Sun, 26 Jul 2026 at 14:38:05 +0200, Marco d'Itri wrote:
>On Jul 26, Andreas Metzler <[email protected]> wrote:
>>(I do not think postfix has this problem, its sendmail writes a
>>file in the maildrop queue. Further processing happends by
>>pickup monitoring the maildrop queue and picking it up there, without
>>fork/exec.)
>
>Correct.

postfix does have a different problem for systemd services that is worth 
bearing in mind, though: the maildrop mechanism described above relies 
on some component having privileges (setgid mail if I remember correctly).

This is fine for a simple, un-hardened systemd service, but if a service 
has the NoNewPrivileges hardening option (or DynamicUser, which implies 
NoNewPrivileges), then that service will be unable to send mail by 
running postfix's sendmail program. See for example 
https://bugs.debian.org/998242, which despite its title did affect both 
exim and postfix.

     smcv