01.12.2024 11:43, Bastien Roucariès wrote:
Le samedi 5 octobre 2024, 21:54:53 UTC Vincent Lefevre a écrit :
Package: postfix
Version: 3.9.0-3
Severity: normal
In Debian, several postfix services run in chroot. This may have been
good in the past, but this is now strongly discouraged by upstream and
yields various issues: see the postfix bug reports mentioning chroot.
Please disable chroot for all services (upstream's default).
I think we should move to bind mount or something like unshare
bind-mounting is definitely possible for the chroot setup -
to bind-mount things like [/usr]/lib/libnss-dns.so etc.
But this is already working for plain copy, and does not consume
much space, so I'd say "why bother".
For volatile things like /etc/resolv.conf which can change during
runtime, bind-mount wont help to keep the chrooted copy in-sync.
Especially with systemd-resolved, who does not notify the system
about changes in resolv.conf - but for this one, we've libnss-resolved
which does not require resolv.conf - though I haven't checked if it
will work for MX lookups and other non-A/AAAA queries.
Speaking of unshare, I for one don't see how it might help. But this
is definitely something to bring upstream, not on debian. And this
definitely a different topic from what's being discussed here about
chrooting (or not) postfix in debian by default.
/mjt
