On systems that systems disable set-gid privilege elevation, Postfix
may use an alternative privilege elevation method that is implemented
with a new postlift(8) service. As of Postfix 3.12, this alternative
method is supported only on Linux environments using systemd.
Zone 1 Zone 2 Zone 3
user UID "postdrop" UID "postfix" UID
user GID "postdrop" GID "postfix" GID
mail(1) pickup(8)
mailx(1) postdrop(1) postdrop(1) postlogd(8)
sendmail(1) -> postlog(1) -> postlift(8) -> postlog(1) -> qmgr(8)
mailq(1) postqueue(1) postqueue(1) flush(8)
showq(8)
When set-gid privileges are disabled, an unprivileged postdrop(1),
postlog(1), or postqueue(1) client process will connect to the
postlift (8) service (managed by systemd), requesting that postlift(8)
runs the same command (postdrop(1) etc.) in a process with "postdrop"
privileges. This allows the elevated process to add a message to
the protected maildrop queue, or to interact with a core daemon
process.
https://www.postfix.org/NO_NEW_PRIVILEGES_README.html#postlift
https://www.postfix.org/postlift.8.html
Source code is available as postfix-3.12-20261015-nonprod-postlift.tar.gz
(with PGP/GPG signatures).
Unfortunately, parts of this code are highly OS dependent and compile
only on Linux. I expect that a "production" release should at least
compile and work on {Free,Net,Open}BSD, MacOS, and Solaris.
https://www.postfix.org/NO_NEW_PRIVILEGES_README.html#native-integration
has some ideas for using this code on OSes without systemd. I may get
to that with a later non-production release.
Wietse
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
