On Sun, 26 Jul 2026 at 14:38:05 +0200, Marco d'Itri wrote:
On Jul 26, Andreas Metzler <[email protected]> wrote:
(I do not think postfix has this problem, its sendmail writes a
file in the maildrop queue. Further processing happends by
pickup monitoring the maildrop queue and picking it up there, without
fork/exec.)
Correct.
postfix does have a different problem for systemd services that is worth
bearing in mind, though: the maildrop mechanism described above relies
on some component having privileges (setgid mail if I remember correctly).
This is fine for a simple, un-hardened systemd service, but if a service
has the NoNewPrivileges hardening option (or DynamicUser, which implies
NoNewPrivileges), then that service will be unable to send mail by
running postfix's sendmail program. See for example
https://bugs.debian.org/998242, which despite its title did affect both
exim and postfix.
smcv
