Re: Limit user actions in .procmailrc

On Wed May 20 2015 10:46:58 [email protected] said:
> 
> [email protected] wrote to [email protected]
> [at 17:39 (-0500) on Tuesday, 19th May, 2015]:
> 
>> Based on the discussion at
>> http://serverfault.com/questions/579192/procmail-is-ignoring-user-settings
>> I get the impression that when using procmail as your LDA (which I
>> should have said I am) setting DROPPRIVS=no prevents any reading of a
>> user .procmailrc.  Which I think is the opposite of what you're
>> saying, but it's the end of the day, so my brain may be playing tricks
>> on me.
>> 
>> That said, I'm not finding anything authoritative to back that up (nor
>> have I tested it, since I don't have a good test system to try it on).
>> 
>> On Tue, 19 May 2015, Alan Clifford wrote:
>> 
>>> [email protected] wrote to [email protected]
>>> [at 16:17 (-0500) on Tuesday, 19th May, 2015]:
>>> 
>>>> Another idea that occurred to me would be to prevent .procmailrc
>>>> execution by setting DROPPRIVS equal to "no" in the system
>>>> /etc/procmailrc unless the LOGNAME value appears in a file that listed
>>>> allowed users?
>>> Wouldn't you set DROPPRIVS to yes then deliver mail from within /etc/procmailrc?  Then ~/.procmailrc wouldn't be run at all.
>>> Alan
>>> (  Please address personal email to alan+1@ as email to lists@
>>>  is only read from my subscribed lists. )
>> 
>> 
> 
>> From man procmailrc
> 
> "DROPPRIVS If set to `yes' procmail will drop all privileges it might have had (suid or sgid).  This is only useful if you want to guarantee that the bottom half of the /etc/procmailrc file is executed on behalf of the recipient."
> 
> My understanding is that as soon as the recipes in /etc/procmailrc have been done and the program moves on to the the user's ~/.procmailrc, any privileges are automatically dropped.

That is correct, but the user’s .procmailrc is only executed if the procmailrc does not deliver the message.

A simple way to prevent users from having a .procmailrc run is to set:

DROPPRIVS=YES
:0
$DEFAULT

in the procmailrc.


-- 
"It's like those French have a different word for *everything*" - Steve
Martin