> separate child process should run as that user and chroot/drop privs It was spawning such a process that actually was the problem in this case. I'm still a

> separate child process should run as that user and chroot/drop privs It was spawning such a process that actually was the problem in this case. I'm still a little baffled that things could go so wrong in handling input/parameters to system()... But it did. I'm not saying you're wrong - it's just that this concrete error happened in an odd place, as a result of changing to pretty much the architecture you mention (and only for mbox file delivery).