#931545 /usr/sbin/dovecot: after upgrade to buster dovecot refuses to start

Package:
dovecot-core
Source:
dovecot
Description:
secure POP3/IMAP server - core files
Submitter:
Date:
2019-12-16 07:39:08 UTC
Severity:
normal
#931545#5
Date:
2019-07-07 12:46:06 UTC
From:
To:
starting dovecot always results in the following error:

dovecot.service: Failed to set up mount namespacing: Permission denied
dovecot.service: Failed at step NAMESPACE spawning /usr/sbin/dovecot: Permission denied
#931545#10
Date:
2019-07-07 13:03:47 UTC
From:
To:
forgot to mention: dovecot runs in an LXC container
#931545#15
Date:
2019-07-07 14:15:36 UTC
From:
To:
have now installed sysvinit-core and purged systemd as a workaround
seems that there is some misconfiguration between systemd and dovecot
#931545#20
Date:
2019-12-16 07:29:44 UTC
From:
To:
Hi,

Apologies for the late response. For posterity, this error is because
systemd inside LXC cannot create additional namespaces under Debian's
default configuration. Dovecot's systemd unit uses some hardening
features which rely on systemd namespace support. There are 3 possible
workarounds for this:

 - Try enabling unprivileged userns cloning in the host kernel, by
   setting the kernel.unprivileged_userns_clone sysctl to 1. This is
   probably the least intrusive option, but I'm not 100% it will work.

 - Override and unset ProtectSystem, PrivateDevices and PrivateTmp in
   the systemd unit (preferrably using an override in
   /etc/systemd/dovecot.service.d). Note however that this will disable
   the last line of defense for a service running as root (but that's
   also what you get when you run under sysvinit).

 - Change your LXC container to a privileged one, which kinda beats the
   purpose.

Cheers,
Apollon