Re: [fetchmail-devel] Drop privileges

[Sunil S. <sh...@bo...>]

Hi Thomas,

Quoting from Thomas Jarosch's mail on Thu, Apr 30, 2009:
> We don't run fetchmail in daemon mode, we start it for a single run
> as it doesn't know if the online connection is available or if the
> mail system is currently reconfigured on our site. Basically fetchmail
> is controlled by another daemon.

You may still run fetchmail in daemon mode with a high poll interval:

$ fetchmail --daemon 86400               # poll just once a day ...

Whenever you are online, just wake it up:

$ fetchmail                              # ... or more

> The new features are completly optional and allow you to harden
> the security in basic setups if running in non-daemon mode.

Unfortunately, the sandbox is not going to work in two common setups
even in non-daemon mode:

1. POP3+UIDL: the idfile is read from /home/user/.fetchids and will be
written back to /sandbox/home/user/.fetchids. In effect, the idfile is
not getting updated at all!

2. MDA: this delivery program (like maildrop, procmail, or even a
user-defined script) is not going to work in the sandbox.

> If the normal fetchmail usage is the daemon mode,
> then I guess it's not very useful. Hmm.

Well, you too should try using the daemon mode...

-- 
Sunil Shetye.