Re: Unit for getmail (was: daemontools)

On Thu 2018-02-01 07:31:33 -0600, Charles Cazabon wrote:
> There are some use cases for getmail running as root; in particular, when you
> have a configuration where getmail is delivering mail to multiple users and it
> needs to change to a different delivered-to user for each message that it
> retrieves.  But you're right, as a general rule, getmail should be run with
> the minimum privileges that it requires for a given configuration.

if there are specific capabilities that it needs (e.g. just CAP_SETUID?)
then it's possible to set up a systemd unit file that is constrained to
just have that privilege (see AmbientCapabilities= and
CapabilityBoundingSet= in systemd.exec(5)).  That might be worth
exploring if designing a getmail daemon that needs to run in this
context.

> My other concern with the above is that it looks like it will spin as fast as
> it can, with systemd restarting it immediately after it exits.  Perhaps
> systemd will even detect it as a failing process if it exits too often too
> quickly?  How would one add a delay in between runs with a systemd unit file?

This is a totally reasonable concern, and the systemd developers have
taken it into account: see RestartSec= in systemd.service(5).

note that this is probably only relevant tfor the error case, though,
since the proposed unit file uses IMAP idle to just keep open a constant
connection.

hope these are useful pointers,

        --dkg