POSTLIFT(8)                                                        POSTLIFT(8)

NAME
       postlift - Postfix client privilege elevator

SYNOPSIS
       postlift [-v] [-c config_dir]

DESCRIPTION
       On  systems  that  disable set-gid privilege elevation, an unprivileged
       Postfix postdrop(1), postlog(1) and postqueue(1)  client  command  will
       connect  to  the  postlift(8) service, requesting that postlift(8) runs
       the same command (postdrop(1) etc.) in a child process with  "postdrop"
       user and group privileges.

       This  allows  the  elevated  child process to add a message to the pro-
       tected Postfix maildrop queue, or to interact with a Postfix core  dae-
       mon  process.  postlift(8) propagates the exit status from the elevated
       child process back to the unprivileged client command.

       See the Postfix NO_NEW_PRIVILEGES_README documentation  for  background
       and for activating the postlift(8) service with systemd.

       Options:

       -c config_dir
              The main.cf configuration file is in the named directory instead
              of the default configuration directory.

       -v     Enable verbose  logging  for  debugging  purposes.  Multiple  -v
              options make the software increasingly verbose.

DIAGNOSTICS
       Problems are reported to the standard error stream.

BUGS
       Temporary  limitation:  When  an unprivileged client command is waiting
       for an elevated child process, killing the unprivileged client will not
       terminate the elevated child. This can cause multiple processes to read
       from the same terminal simultaneously, making the terminal unusable. To
       minimize this risk, client commands that read from stdin will automati-
       cally time out after a few seconds if stdin is connected to a terminal.

       Email   submissions  from  non-root  users  will  be  lost  before  the
       postlift(8) socket is activated.

       There is no system-independent API to request peer  credentials  for  a
       UNIX-domain  socket.  Consequently, this program is broken on some ver-
       sions of some systems.

ENVIRONMENT
       MAIL_CONFIG
              Directory with Postfix configuration files.

CONFIGURATION PARAMETERS
       The following main.cf parameters are especially relevant to  this  pro-
       gram.

       The  text  below provides only a parameter summary. See postconf(5) for
       more details including examples.

       config_directory (see 'postconf -d' output)
              The default location of the Postfix main.cf and  master.cf  con-
              figuration files.

       mail_owner (postfix)
              The  UNIX  system  account  that owns the Postfix queue and most
              Postfix daemon processes.

       fork_attempts (5)
              The maximal number of attempts to fork() a child process.

       fork_delay (1s)
              The delay between attempts to fork() a child process.

       setgid_group (postdrop)
              The  group  ownership  of  set-gid  Postfix  commands   and   of
              group-writable Postfix directories.

SEE ALSO
       NO_NEW_PRIVILEGES_README, configuration and architecture
       postconf(5), Postfix configuration

LICENSE
       The Secure Mailer license must be distributed with this software.

HISTORY
       This service was introduced with Postfix version 3.12.

AUTHOR(S)
       Wietse Venema
       porcupine.org

                                                                   POSTLIFT(8)