Re: need for open-minded help with popularity-contest with systemd timer

--+xH732yN3U/kFq0J
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Jul 30, Simon McVittie <[email protected]> wrote:

>No, if you exec /usr/sbin/sendmail, the MTA infrastructure has the=20
>option to log facts about that sendmail process, such as your uid (and=20
>in theory other facts like process ID, whether you're in a container=20
>or cgroup, AppArmor profile and so on), in mail.log or the message=20
>headers or whatever place its implementor thinks is most appropriate.=20
This is true[1], but I do not think that it is the main point.

The big benefit of /usr/sbin/sendmail over connecting to a daemon is=20
that mail will not be lost when the daemon is not available.
Or at least I remember that this was part of the rationale for Postfix=20
being designed this way 30 years ago: mail can always be queued to=20
/var/spool/postfix/maildrop/.
And of course being able to do this from an unprivileged process=20
requires to either use a sgid helper (the default) or a 1777 directory=20
(not the default, because it allows a local DoS).

[1] but also: UNIX domain sockets and SO_PEERCRED.

--=20
ciao,
Marco

--+xH732yN3U/kFq0J
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQnKUXNg20437dCfobLPsM64d7XgQUCam+OUwAKCRDLPsM64d7X
gQxAAP9WtaWAH7iToxmM0tiveToGoZq8ZsUukum/5lL/srumtwD7BG9iRA0cU7bX
CkYkOk1bYQj8USu4Mqoa1nnvyKvYqAs=
=zZYF
-----END PGP SIGNATURE-----

--+xH732yN3U/kFq0J--