ambassador:/var/mail% /usr/sbin/vmm ld
Error: You are not root.
        Good bye!

I see no reason for this. Anyone with access to the vmm
configuration with the database data should be able to use vmm.

Even better would be if socket authentication was possible and
I could control using pg_hba and pg_ident who can connect to the
database.

The vmm package creates the group `vmm'. So you can add system users to
the vmm group.
Create a file, e.g. `vmm_sudoers'

,--[ vmm_sudoers ]--
| # vim: ft=sudoers
| Cmnd_Alias	VMM_CMD = /usr/sbin/vmm
| %vmm		ALL = NOPASSWD: VMM_CMD
`--

Admins who want to allow the usage of vmm for members of the vmm group
can execute:

	install -m 440 vmm_sudoers /etc/sudoers.d

Members of the group vmm will be able to execute vmm commands, e.g.:

	sudo vmm ld

Lazy users can create an alias:

	alias vmm='sudo /usr/sbin/vmm'

The vmm package then should suggest the sudo package.


Regards,
Pascal

I know about sudo, but I still wonder about the need for root rights
at all.

Access to the database credentials can be managed through filesystem
permissions.

So the next (and hopefully last) thing where we need root rights
seems to be the creation of domain directories, or even user
directories:

  Nov 26 02:55:21 ambassador dovecot: lmtp(20221): Error: user
  test@pantsfullofunix.net: Initialization failed: Namespace '':
  mkdir(/srv/vmm/6/70000/70000/Maildir) failed: Permission denied
  (euid=70000(test%pantsfullofunix.net)
  egid=70000(pantsfullofunix.net) missing +w perm: /srv/vmm/6/70000,
  dir owned by 0:70000 mode=0750)

I can't seem to find a way to tell lmtp to drop privileges only
after it verified existence of the target directories, and we don't
want to go the pam_session route.

If we can agree that it's best to run as little code as possible as
root, then maybe it would be best to factor out just the domain/user
directory creation to a script and letting vmm invoke that script,
either as setuid or with sudo, while the rest of vmm runs with user
privileges.