Re: Unit for getmail (was: daemontools)

On Thu 2018-02-01 03:12:48 +0100, Volker Wysk wrote:
> [Unit]
> Description=Getmail für [email protected]
> Wants=dovecot.service
> After=dovecot.service
>
> [Service]
> ExecStart=/usr/bin/getmail --getmaildir=/etc/getmail --rcfile=verteilerrc --idle INBOX
> Restart=always
>
> [Install]
> WantedBy=multi-user.target
> ----snip----
>
> This goes to /etc/systemd/system/getmail-verteiler.service. Then, it needs to be activated:
>
> systemctl enable verteilerrc.service
> systemctl start verteilerrc.service

this installs the service as a sytsem service, and it looks like it's
running as the superuser.  

That seems ill-advised.

I recommend making it a per-user service (not a system service).  in
that case, it would run as the user whose service it is.

Alternately, if you really need it to be a system service, you could
constrain its privileges by providing a User= directive (at least).  On
the principle of least privilege, you probably want to try to make sure
that such a system service can *only* inject mail into a specific
account, and is otherwise constrained by the local operating system from
doing any other (mis)behavior.

Additionally, the explicit dependency on the local dovecot service also
seems strange to me.  It's not clear to me that everyone who uses
getmail will want it to interact with dovecot.  if that's unique to your
setup, that's fine; but as an example for other people to use it seems
odd.

finally, can you explain why you use both --getmaildir and --rcfile ?
why not just --rcfile=/etc/getmail/verteilerrc ?

    --dkg