Exim processes running as root and mailnull

[Escaflowne]

Hello!

Here's a simple question (simple, but I can't seem to find the answer): why are some of exim's processes running as user mailnull and some as user root?

And here's a bonus question: is this normal?

Exim 4.62 on a FreeBSD 4.9 box.

 

[websupport]

Don't worry

Hello,

It's important to know what processes are running on your server, so you can
spot any abnormalities and potential security breaches.

Root and mailnull are the normal processes. Don't worry about it.
mailnull is a mail user account, used for exim.

 

[chirpy]

It is normal. Like several server daemons (such as httpd) they have an initial process that runs up under the root account so that they can access the necessary system files. They then launch child processes under a non-priveleged user account for the processing work. The reason they do this is simple - security. Because these processes usually process data derived from an untrusted source, i.e. the internet, should then ever be compromised, then the hacker would usually only have access to the non-privileged account instead of the root account.