procmail
[Top] [All Lists]

security in /etc/procmailrc

1998-07-30 11:27:02
Someone suggested,

| >   - If you get really desparate, how about putting the line...
| >
| > INCLUDERC=$HOME/.procmailrc
| >
| > ...into the master .procmailrc file?

and Chris Lindsey asked,

| What user does it run this as?  Not the userid of the envelope
| recipient, right?  So this could be a potential security
| problem...

OK then ...

  DROPPRIVS=yes
  INCLUDERC=$HOME/.procmailrc

If procmail knows the envelope recipient in order to determine whose home
is "$HOME", then it knows whose privileges to take when it drops those of
root.