Use pledge.

Index: src/drv_imap.c
--- src/drv_imap.c.orig
+++ src/drv_imap.c
@@ -45,6 +45,8 @@
 # include <Security/Security.h>
 #endif
 
+extern int needs_proc_exec;
+
 #ifdef HAVE_LIBSSL
 enum { SSL_None, SSL_STARTTLS, SSL_IMAPS };
 #endif
@@ -3768,6 +3770,8 @@ imap_parse_store( conffile_t *cfg, store_conf_t **stor
 #endif
 				143;
 	}
+	if (server->sconf.tunnel || server->user_cmd || server->pass_cmd)
+		needs_proc_exec = 1;
 	if (store) {
 		if (!store->server) {
 			store->server = nfmalloc( sizeof(sserver) );