5 ms·
I wonder if instead of running a single mail delivery agent as root that can touch everything everywhere, a separate child process should run as that user and c
by anonsivalley652 7y ago
I wonder if instead of running a single mail delivery agent as root that can touch everything everywhere, a separate child process should run as that user and chroot/drop privs to where it can only write to mbox files and log if it can't. Or at least confine it to mbox files via SELinux, which still seems too open. Processes running as root for fs permissions reasons only is usually an ops smell that something wasn't architected or configured correctly.
- akira2501 7y agoI believe you're basically describing the architecture of qmail.
- anonsivalley652 7y agoNot even close. Qmail is quite different in that it uses maildirs instead of mbox and does a bunch of things differently including proprietary formats. And it's under-maintained and not widely used. I was only talking about the delivery of mail, not rearchitecting the world.
- edoceo 7y agoFor mail, they also need low ports, which typically requires root.
- e12e 7y agoNot for a long time - it can be fixed via capabilities and/or via firewall rules.
- e12e 7y ago> separate child process should run as that user and chroot/drop privs It was spawning such a process that actually was the problem in this case. I'm still a little baffled that things could go so wrong in handling input/parameters to system()... But it did. I'm not saying you're wrong - it's just that this concrete error happened in an odd place, as a result of changing to pretty much the architecture you mention (and only for mbox file delivery).