drop privs

main
Florent Daigniere 2 years ago
parent bf588d19a4
commit 5da2ab8fd1

@ -7,6 +7,10 @@ postmaster_address = {{ POSTMASTER }}@{{ DOMAIN }}
hostname = {{ HOSTNAMES.split(",")[0] }} hostname = {{ HOSTNAMES.split(",")[0] }}
submission_host = {{ FRONT_ADDRESS }} submission_host = {{ FRONT_ADDRESS }}
default_internal_user = dovecot
default_login_user = mail
default_internal_group = dovecot
############### ###############
# Mailboxes # Mailboxes
############### ###############
@ -80,18 +84,13 @@ userdb {
} }
service auth { service auth {
user = dovecot
unix_listener auth-userdb { unix_listener auth-userdb {
} }
} }
service auth-worker { service auth-worker {
unix_listener auth-worker { unix_listener auth-worker {
user = dovecot
group = mail
mode = 0660
} }
user = mail
} }
############### ###############

@ -5,6 +5,7 @@ import glob
import multiprocessing import multiprocessing
import logging as log import logging as log
import sys import sys
from pwd import getpwnam
from podop import run_server from podop import run_server
from socrate import system, conf from socrate import system, conf
@ -12,7 +13,9 @@ from socrate import system, conf
log.basicConfig(stream=sys.stderr, level=os.environ.get("LOG_LEVEL", "WARNING")) log.basicConfig(stream=sys.stderr, level=os.environ.get("LOG_LEVEL", "WARNING"))
def start_podop(): def start_podop():
os.setuid(8) id_mail = getpwnam('mail')
os.setgid(id_mail.pw_gid)
os.setuid(id_mail.pw_uid)
url = "http://" + os.environ["ADMIN_ADDRESS"] + "/internal/dovecot/§" url = "http://" + os.environ["ADMIN_ADDRESS"] + "/internal/dovecot/§"
run_server(0, "dovecot", "/tmp/podop.socket", [ run_server(0, "dovecot", "/tmp/podop.socket", [
("quota", "url", url ), ("quota", "url", url ),
@ -35,7 +38,8 @@ for script_file in glob.glob("/conf/*.script"):
os.chmod(out_file, 0o555) os.chmod(out_file, 0o555)
# Run Podop, then postfix # Run Podop, then postfix
multiprocessing.Process(target=start_podop).start()
os.system("chown mail:mail /mail") os.system("chown mail:mail /mail")
os.system("chown -R mail:mail /var/lib/dovecot /conf") os.system("chown -R mail:mail /var/lib/dovecot /conf")
multiprocessing.Process(target=start_podop).start()
os.execv("/usr/sbin/dovecot", ["dovecot", "-c", "/etc/dovecot/dovecot.conf", "-F"]) os.execv("/usr/sbin/dovecot", ["dovecot", "-c", "/etc/dovecot/dovecot.conf", "-F"])

Loading…
Cancel
Save