[Dovecot] imapc vs auth-userdb security

Hello,

with imapc settings coming from userdb (individual configuration necessary) there exists a security problem if access to auth-userdb socket is given to normal (shell) users:

testuser@host:~$ doveadm user user1 userdb: lpmail uid : 1000 gid : 1111 home : /home/user1 namespace : gmail namespace/gmail/list: yes namespace/gmail/subscriptions: no namespace/gmail/separator: . namespace/gmail/prefix: INBOX.gmail. namespace/gmail/location: imapc:~/Maildir/gmail imapc_host: imap.gmail.com imapc_user: someuser@gmail.com imapc_password: cleartextpassword! imapc_ssl : imaps imapc_ssl_ca_dir: /etc/ssl/certs imapc_port: 993

Lutz