alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

postfix: add setgid wrapper for postqueue/postdrop

Browse source 
Both postqueue[1] and postdrop[2] implement a subset of administration
task that are supposed to be run unprivileged users
and require the setgid bit to full-fill this task.

[1] http://www.postfix.org/postqueue.1.html
[2] http://www.postfix.org/postdrop.1.html
This commit is contained in:
Jörg Thalheim 2018-10-15 13:12:06 +01:00
parent b7d3974678
commit 91ddc9d27f
No known key found for this signature in database
GPG key ID: CA4106B8D7CC79FA
1 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
nixos/modules/services/mail/postfix.nix
View file

@ -602,7 +602,7 @@ in
target = "postfix";
};
# This makes comfortable for root to run 'postqueue' for example.
# This makes it comfortable to run 'postqueue/postdrop' for example.
systemPackages = [ pkgs.postfix ];
};
@ -616,6 +616,22 @@ in
setgid = true;
};
security.wrappers.postqueue = {
program = "postqueue";
source = "${pkgs.postfix}/bin/postqueue";
group = setgidGroup;
setuid = false;
setgid = true;
};
security.wrappers.postdrop = {
program = "postdrop";
source = "${pkgs.postfix}/bin/postdrop";
group = setgidGroup;
setuid = false;
setgid = true;
};
users.users = optional (user == "postfix")
{ name = "postfix";
description = "Postfix mail server user";