Re: getmail configuration problem with "%(recipient)" and "%(local)" in [destination] MDA_external

Martin Gregorie <[email protected]> wrote:
> 
> I revised my getmail script extensively: its destination is now a
> MultiSorter with two MDA_external  branches: 

That sounds good.

> 'landout' branch. Initially it complained about being unable to access the
> destination mailbox, so I added the 'user' and 'group' assignments, but it
> is now complaining that it can't execute them:
> 
> "Delivery error (command procmail 858311 error (127, exec of command
> procmail failed (change UID/GID to 1528/100 failed ([Errno 1] Operation not
> permitted))))".
> 
> I've assumed, because getmail accepts the user and group requests, that it
> can therefore apply them to running procmail, but evidently this isn't the
> case, so how should I make this happen?

That's a Unix-ism.  Regular unprivileged users cannot change their UID/GID.
You need to run getmail as a user that has the privilege to change UID -- that
can be by running as root, or by granting a special capability to a non-root
users that allows this.  The latter is beyond the scope of the getmail mailing
list; see your OS's reference documentation if you want to chase that.  Most
people just run getmail as root if they want it to change UIDs.

Note that if you run getmail as root, you should configure it to change to a
non-root user for *every* command-based delivery.  Invoking external programs
as root unnecessarily, particularly with untrusted input, is a very bad idea.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------