[Dovecot] cgroup support

[Timo Sirainen]

On 1.2.2011, at 9.44, Andreas Pelme wrote:

> On 31 jan 2011, at 15:07, Timo Sirainen wrote:
>> With v2.0 the imap and post-login processes are both created by the dovecot process. So no parent-child relationship between them.
> 
> Would it be possible to specify an alternative mail_executable that wraps the imap/pop processes?

Maybe.

> I.e. something like:
> 
> protocol imap { mail_executable = cgroup_wrapper.sh }
> 
> cgroup_wrapper.sh:
> #!/bin/sh
> echo $$ > /cgroup/foo/bar/tasks
> exec /usr/libexec/dovecot/imap $*
> 
> Is the privileges dropped before mail_executable is called, or is it done in the mail_executable itself?

If you have virtual users, you can do:

service imap {
  executable = cgroup_wrapper.sh
  user = vmail
  drop_priv_before_exec = yes
}

With system users you can't do that.