[Dovecot] How to achieve proper privilege separation?

[Timo Sirainen]

On 23.2.2012, at 7.20, Tóth Attila wrote:

> I'm using a simple mbox config with regular Unix users and pam
> authentication.
> 
> I'm also using grsecurity. That's why I see what dovecot does in which
> users' name. As times goes by and new versions are coming I can
> frustratedly see, that more and more tasks are performed as root. Why?

Less tasks should be running as root now. The master process code is a lot smaller.

> When I used 1.x series of Dovecot, imap process started in the name of the
> user whose mbox was accessed.
> Now I can see, that nearly every task is performed by root. Why? It even
> tampers with the mail directories of each user as root instead of the user
> as it was usual long before.

The imap process starts as root, does a userdb lookup and then drops privileges to that user. It worked this way before too, only the userdb lookup code was done by master process.