POSTLIFT(8)                                                        POSTLIFT(8)

NAME
       postlift - Postfix client privilege elevator

SYNOPSIS
       postlift [-v] [-c config_dir]

DESCRIPTION
       This  program  implements an alternative privilege elevation method for
       systems that disable set-gid support.

       On these systems, postlift(8) replaces set-gid privilege elevation with
       a  client-server  mechanism.  An  unprivileged  Postfix  client command
       (postdrop(1), postlog(1) or postqueue(1)) connects to  the  postlift(8)
       service, requesting that postlift(8) runs the exact same command (post-
       drop(1) etc.) in a child process with "postdrop" user and group  privi-
       leges.

       These  elevated  privileges allow the child process to add a message to
       the protected Postfix maildrop queue, or to  interact  with  a  Postfix
       core daemon process. postlift(8) propagates the child process exit sta-
       tus back to the unprivileged client command.

       See the Postfix NO_NEW_PRIVILEGES_README documentation  for  background
       and for activating the postlift(8) service with systemd.

       Options:

       -c config_dir
              The main.cf configuration file is in the named directory instead
              of the default configuration directory.

       -v     Enable verbose  logging  for  debugging  purposes.  Multiple  -v
              options make the software increasingly verbose.

DIAGNOSTICS
       Problems are reported to the standard error stream.

BUGS
       Email   submissions  from  non-root  users  will  be  lost  before  the
       postlift(8) socket is activated.

       There is no standard API to request peer credentials for a  UNIX-domain
       connection.  Consequently,  this  program works only on FreeBSD, Linux,
       MacOS, NetBSD, OpenBSD, and Solaris systems released after 2007 or  so;
       on other systems all requests will fail.

ENVIRONMENT
       MAIL_CONFIG
              Directory with Postfix configuration files.

CONFIGURATION PARAMETERS
       The  following  main.cf parameters are especially relevant to this pro-
       gram.

       The text below provides only a parameter summary. See  postconf(5)  for
       more details including examples.

CONFIGURATION CONTROLS
       config_directory (see 'postconf -d' output)
              The  default  location of the Postfix main.cf and master.cf con-
              figuration files.

RESOURCE CONTROLS
       fork_attempts (5)
              The maximal number of attempts to fork() a child process.

       fork_delay (1s)
              The delay between attempts to fork() a child process.

CREDENTIAL CONTROLS
       default_privs (nobody)
              The default rights used  by  the  local(8)  delivery  agent  for
              delivery to an external file or command.

       mail_owner (postfix)
              The  UNIX  system  account  that owns the Postfix queue and most
              Postfix daemon processes.

       setgid_group (postdrop)
              The  group  ownership  of  set-gid  Postfix  commands   and   of
              group-writable Postfix directories.

SEE ALSO
       NO_NEW_PRIVILEGES_README, configuration and architecture
       postconf(5), Postfix configuration

LICENSE
       The Secure Mailer license must be distributed with this software.

HISTORY
       This service was introduced with Postfix version 3.12.

AUTHOR(S)
       Wietse Venema
       porcupine.org

                                                                   POSTLIFT(8)