<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>We are thinking that we remove both this and CapabilityBoundingSet in next release, so feel free to remove them from the unit file.</div><div><br></div><div><br></div><div><br></div><div id="composer_signature"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">---<div>Aki Tuomi</div><div>Dovecot oy</div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: "Helmut K. C. Tessarek" <tessarek@evermeet.cx> </div><div>Date: 04/04/2018 09:44 (GMT+02:00) </div><div>To: dovecot@dovecot.org </div><div>Subject: Re: issue with sieve forwarding after upgrade to 0.5.1 </div><div><br></div></div>On 2018-04-04 01:54, B. Reino wrote:<br>> The new systemd service file has NoNewPrivileges set to true. You need<br>> to override that to false and then it should work again.<br><br>It seems that the NoNewPrivileges option messes with several things.<br>PAM authentication stopped working as well besides the fact that<br>CAP_AUDIT_WRITE is also missing in CapabilityBoundingSet.<br><br>I've opened a pull request https://github.com/dovecot/core/pull/71<br>Although I removed NoNewPrivileges altogether, since I didn't know what<br>to write in the comment.<br><br>The only thing I could think of was something along the lines:<br><br># If you want most things to stop working, set this to true<br><br>I thought this would be rather counterproductive, thus I removed it.<br><br>Maybe somebody else could enlighten me who came up with this default<br>setting and why it was set to true in the first place.<br><br>Cheers,<br> K. C.<br><br>-- <br>regards Helmut K. C. Tessarek KeyID 0x172380A011EF4944<br>Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944<br><br>/*<br> Thou shalt not follow the NULL pointer for chaos and madness<br> await thee at its end.<br>*/<br></body></html>