"Eli's Procmail Stuff" <procmail(_at_)qz(_dot_)to> writes:
...
I have procmail invoked from a mailtable for a virtual domain.
Presently that runs as root, inherited from sendmail. I'd like to
have it run less privledged. I tried chown'ing the rc file to
the user I want used and setting "DROPPRIVS=yes". That didn't do
it. So I added "LOGNAME=user" and "USER=$LOGNAME" before the
DROPPRIVS assignment and that didn't work.
DROPPRIVS only has an effect inside the /etc/procmailrc used when
procmail is running in delivery mode (-d), not when it's running in
mailfilter mode (-m). USER and LOGNAME have no effect on the working
of DROPPRIVS, as procmail is just going to change to the uid/gid of the
user specified on the command line after the -d. Your mailtable entry
_should_ be specifying the procmail mailer, which runs procmail in
mailfilter mode.
If the following are true:
procmail is running in mailfilter mode
no assignments were given on the command line
the -p flag was _not_ specified
the rcfile specified is located under /etc/procmailrcs/ without
backwards references ("/../"s)
the rcfile is not a directory (duh!)
then procmail will assume the uid and gid of the owner of the rcfile.
If the rcfile is actually a symlink, the procmail will assume the uid
and gid of the link itself, not the underlying file.
If your OS allows anyone to give away ownership of files with chown, the
procmail adds the following restriction to those above:
/etc/procmailrcs must be owned by root and mode 700.
Does your setup meet all of the constraints?
...
procmail 3.10 (off the CD default, I'll be upgrading later)
...
procmail 3.10 has a major bug in the mailfilter code that makes it lose
all of the command line arguments that should have shown up in $1, $2,
$3, etc. Since $1 contains the envelope sender and $2 the envelope
recipient, you'll want to upgrade Real Soon Now. After all, you're
going to be ignoring the addresses in the header and routing the
messages based on the envelope recipients, right? (Nod your head up
and down here.)
Philip Guenther