Re: Executing a sieve-extprograms pipe script as non-root

John Fawcett via dovecot <[email protected]>
Newsgroups gmane.mail.imap.dovecot
Message-ID <[email protected]>
On 05/03/2026 08:17, Aki Tuomi via dovecot wrote:
>> On 05/03/2026 01:00 EET rhi--- via dovecot <[email protected]> wrote:
>>
>>   
>>> Hello, have you put DROPPRIVS=yes in /etc/procmailrc
>> No. As I said above:
>>
>> Note that the `procmail` in the pstree output
>> above is really the wrapper script in /usr/lib/dovecot/sieve-pipe/procmail, not
>> /usr/bin/procmail.
> I am very puzzled how it can even run as root.
>
> Can you run dovecot with
>
> log_debug=category=lmtp
>
> and provide the resultant logs during delivery?
>
> Aki

Aki

this could be possible if lmtp was once root and dropped privileges via 
seteuid. When lmtp forks the external program (script in this case) it 
will take root privileges upon calling execvp.

John

_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.