I believe the correct thing in this case would be to assign DROPPRIVS
before assigning INCLUDERC; otherwise the $HOME/procmailrc.sms file may be
executed with root permissions, which would be a Bad Thing if the user is
allowed to include shell commands etc.
yes, this is true but as I did mention before my users do not have shell
and they cannot run any commands
procmail mailing list