Postfix
NoNewPrivileges support Postfix
NoNewPrivileges support This document presents an alternative privilege elevation mechanism for systems that disable set-gid privilege elevation.
Historically, a user request travels through three security zones on its way to a Postfix core daemon process:
Zone 1
user UID
user GIDZone 2
user UID
Set-gid "postdrop"Zone 3
"postfix" UID
"postfix" GIDmail(1)
mailx(1)
sendmail(1)
mailq(1)-> postdrop(1)
postlog(1)
postqueue(1)-> pickup(8)
postlogd(8)
qmgr(8)
flush(8)
showq(8)
Zone 1 contains Non-Postfix utilities such as mail(1) and mailx(1), alongside Postfix helper programs such as sendmail(1) and mailq(1) that operate without Postfix-specific user or group privileges. Because Zone 1 processes cannot directly access Postfix queues or other Postfix-internal resources, they must request service through Zone 2.
Zone 2 contains the maildrop queue and Postfix client processes including postdrop(1), postlog(1) and postqueue(1). While the processes retain the UID of the invoking user, they run with set-gid "postdrop" group privileges. This allows them to access the maildrop queue and specific Postfix core daemon processes.
Zone 3 contains all other Postfix queues and all core daemon processes. Following initialization, these processes run with "postfix" user and group privileges. Some daemon processes (not shown in the figure) may temporarily impersonate a specific user account when delivering mail or running non-Postfix code.
The setgid-based, three-zone, architecture has several key benefits. These will need to be preserved on systems that don't support set-gid privileges:
This approach provides defense in depth: an attacker needs to exploit two vulnerabilities to compromise a core daemon process.
Zone 2 can accept email submissions from Zone 1 even when the Postfix system is down and no Zone 3 processes are running. This is possible because the set-gid privilege allows the postdrop(1) command to deposit messages into the protected maildrop queue.
Zone 2 enforces a per-client-UID concurrency limit based on the host's per-user process limit, as each service request requires a distinct Zone 2 set-gid process. However, this may not be an effective deterrent against overload, because per-user process limits vary wildly between UNIX-like systems.
Zone 2 enforces low-level input validation before a request reaches Zone 3.
Zone 2 enforcement resists tampering by unprivileged users, because Zone 2 processes run with distinct UIDs and GIDs from Zone 1.
Some systems disable set-gid privilege elevation, for example using "NoNewPrivileges=yes" or the "nosuid" file system mount option. On these systems, Postfix may use an alternative privilege elevation method that is implemented with the postlift(8) service, changing the architecture as shown below. As of Postfix 3.12, this alternative method is supported only on Linux environments using systemd.
Zone 1
user UID
user GID
Zone 2
"postdrop" UID
"postdrop" GIDZone 3
"postfix" UID
"postfix" GIDmail(1)
mailx(1)
sendmail(1)
mailq(1)-> postdrop(1)
postlog(1)
postqueue(1)-> postlift(8) -> postdrop(1)
postlog(1)
postqueue(1)-> pickup(8)
postlogd(8)
qmgr(8)
flush(8)
showq(8)
When set-gid privileges are disabled, a postdrop(1), postlog(1), or postqueue(1) client process with Zone 1 privileges will connect to the Zone 2 postlift(8) service, requesting that postlift(8) runs the same command (postdrop(1) etc.) in a process with Zone 2 privileges. This allows the elevated process to add a message to the protected maildrop queue, or to interact with a Zone 3 core daemon process. postlift(8) propagates the exit status from the elevated process back to the Zone 1 client process.
The super-user ("root") is excluded from postlift(8) privilege elevation. Because root already has sufficient privileges, its Zone 1 postdrop(1), postlog(1), or postqueue(1) processes can directly access the maildrop queue or a Zone 3 process. This eliminates a postlift(8) start-up dependency and avoids some implementation complexity.
The alternative architecture can provide benefits comparable to the architecture based on set-gid privilege elevation:
(better) Disabling set-gid support eliminates many attacks on commands like postdrop(1). However, the three-zone architecture remains necessary for systems that lack support for alternative privilege elevation mechanisms. Thus, postdrop(1) and similar commands must keep enforcing admission and input validation policies.
(worse) Zone 2 can accept email submissions from Zone 1 while the Postfix system is down, under two conditions:
Root-privileged processes: accepted at any time.
Non-root processes: accepted only after a system start-up target activates the postlift(8) socket. Other submissions will be lost.
Note: some boot-time activity may generate email before a "network" or "multi-user" start-up target activates the postlift(8) socket.
(better) Zone 2 can enforce a per-client-UID concurrency limit before a request reaches Zone 3, relying on systemd or similar infrastructure for enforcement instead of host-based process limits.
(same) Zone 2 enforces low-level input validation before a request reaches Zone 3.
(same) Zone 2 enforcement resists tampering by unprivileged users, because Zone 2 processes run with distinct UIDs and GIDs from Zone 1.
To run postlift(8) under systemd, follow the steeps below:
Verify that your system has a "postdrop" username with the same group ID as the "postdrop" group, and with a different UID than the "postfix" account. The table shows an example.
| Entity | File | UID | GID | Notes |
|---|---|---|---|---|
| "postfix" user | /etc/passwd | 1001 | 1001 | Different UID and GID than the "postdrop"
user. DO NOT CHANGE an existing "postfix" user. |
| "postdrop" user | /etc/passwd | 1002 | 1002 | Different UID and GID than the "postfix"
user. Same GID as the "postdrop" group. |
| "postdrop" group | /etc/group | 1002 | Same GID as the "postdrop" user. DO NOT CHANGE an existing "postdrop" group. |
It is OK when your system is different, as long as the numbers are different between the "postfix" and "postdrop" users, and as long as the "postdrop" user's GID is the same as the "postdrop" group's GID (though they don't have to be 1002).
Caution: DO NOT CHANGE an existing "postdrop" group.
Caution: DO NOT CHANGE an existing "postfix" user.
Create a file /usr/lib/systemd/system/postlift.socket with the following content:
[Unit] Description=Postfix postlift Socket Documentation=man:postlift(8) [Socket] Accept=yes RemoveOnStop=yes ListenStream=/var/run/postfix/postlift.socket # MaxConnectionsPerSource must be less than MaxConnections (default 64) MaxConnectionsPerSource=30 [Install] WantedBy=sockets.target
Create a file /usr/lib/systemd/system/postlift@.service with the following content:
[Unit] Description=Postfix postlift helper Documentation=man:postlift(8) Requires=postlift.socket [Service] # DO NOT run as "postfix" (i.e. core daemon privilege). User=postdrop Group=postdrop ExecStart=/usr/libexec/postfix/postlift Type=simple StandardInput=socket StandardOutput=socket # Only stderr goes to journal for logging StandardError=journal SyslogFacility=mail
Read the new configuration:
# systemctl daemon-reload
Enable the postlift socket:
# systemctl enable --now postlift.socket
Verify the socket status. The expected output looks like:
# systemctl status postlift.socket
● postlift.socket - Postfix postlift Socket
Loaded: loaded (/usr/lib/systemd/system/postlift.socket; enabled; preset: disabled)
Active: active (listening) since Mon 2026-09-28 15:50:21 EDT; 1 week 5 days ago
Invocation: 157533134c214bccaf5fa1fc6031e29c
Docs: man:postlift(8)
Listen: /var/run/postfix/postlift.socket (Stream)
Accepted: 158; Connected: 0;
Sep 28 15:50:21 mail.example.org systemd[1]: Listening on postlift.socket - Postfix postlift Socket.
In case of problems, first look for Postfix logging (in /var/log/maillog or the like). If that does not reveal the problem cause, verify the socket status as shown above and look for failed service instances. These have names like postlift@xx-xx-xx.service. Examine each failed instance with a command like:
# systemctl status postlift@xx-xx-xx.service
and review the error logging at the bottom of the output.
On systems without systemd, partial functionality may be implemented using the Postfix spawn(8) service. Historically, this service accepts connections on a private or public (but still protected) socket, and executes a configured program with specific privileges. Making this work with postlift(8) requires additional Postfix features:
An additional master(5) listen socket type, distinct from the existing "private" or "public" types. This socket type must be world-writable and hosted in a directory with world read-with-execute permission, so that it is accessible to unprivileged Zone 1 client commands like postdrop(1).
An additional spawn(8)-with-postlift(8) service entry in the default master.cf file, plus new code for "postfix upgrade-configuration" that adds the service entry to existing master.cf files.
Additional code for spawn(8) integration with the existing anvil(8) service. This limits the per-userID concurrency for requests originating from Zone 1.
Support for multiple Postfix instances that are managed with postmulti(1):
(Alternative 1) Each Postfix instance has its own spawn(8)-with-postlift(8) service, with a UNIX-domain socket under its own $queue_directory. This requires no additional code.
(Alternative 2) One shared spawn(8)-with-postlift(8) service, owned by the default Postfix instance, with a UNIX-domain socket:
(Alternative 2a) In a non-Postfix location like /var/run/postfix/postlift.socket. This requires additional master(5) syntax to support a service with an absolute pathname.
(Alternative 2b) Under the default $queue_directory. Finding that socket requires additional code for the non-default Postfix instances.
A down-side is that a spawn(8) daemon remains unavailable until Postfix starts. Consequently, Zone 1 email submissions from non-root processes will fail to enter the queue while Postfix is not running, either during maintenance or during system start-up. Because Postfix typically launches with a "network" or "multi-user" start-up target, early boot-time email messages from non-root users may be dropped.
Thorsten Kukuk proposed a systemd integration for the postdrop(1) command which inspired the postlift(8) design.
Wietse generalized the approach in multiple dimensions:
Multiple client support: one postlift(8) configuration can elevate privileges for postdrop(1), postlog(1) and postqueue(1).
Multiple instance support: one systemd postlift(8) socket supports multiple Postfix instances that are managed with postmulti(1).