1. В /var/spool/postfix создаем директории dev и etc.
    В etc копируем файлы /etc/host.conf /etc/localtime /etc/services /etc/resolv.conf

2. Правим master.cf, ставим в колонке chroot символ 'y' у следующих процессов:
    smtp, pickup, cleanup, qmgr, rewrite, bounce, defer, trace, verify, flush, relay, showq, error
3. Активируем proxymap для чтения файлов из вне chroot окружения (/etc/passwd,
aliases, различные "map"-файлы), например:
    local_recipient_maps = $alias_maps proxy:unix:passwd.byname 
    relay_domains = $mydestination, proxy:hash:/usr/local/etc/postfix/relay_domains
    smtpd_sender_restrictions = check_sender_access proxy:hash:/usr/local/etc/postfix/ access, 
               reject_non_fqdn_sender, reject_unknown_sender_domain
    smtpd_client_restrictions = check_client_access proxy:hash:/usr/local/etc/postfix/access_clients,
               check_recipient_access proxy:hash:/usr/local/etc/postfix/spam_allowed,
               check_client_access proxy:hash:/usr/local/etc/postfix/antispam/blocklist/block_list,
               check_client_access proxy:hash:/usr/local/etc/postfix/antispam/blocklist/block_list_arc,
               check_client_access regexp:/usr/local/etc/postfix/dsl_stoplist.txt,
               reject_rbl_client rbl.test.ru
    smtpd_recipient_restrictions = check_recipient_access proxy:hash:/usr/local/etc/postfix/fullboxes,
               reject_non_fqdn_recipient,
               permit_mynetworks,
               reject_unknown_recipient_domain,
               reject_unauth_destination
    transport_maps = proxy:hash:/usr/local/etc/postfix/transport
    proxy_read_maps = $smtpd_helo_restrictions $smtpd_recipient_restrictions $smtpd_sender_restrictions \
               $smtpd_client_restrictions $local_recipient_maps $mydestination $virtual_alias_maps \
               $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps \
               $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps \
               $relocated_maps $transport_maps $mynetworks

3. Создаем дополнительный syslog сокет в chroot окружении:
    FreeBSD: "syslogd -l /var/spool/postfix/dev/log" 
    Linux: "syslogd -a /var/spool/postfix/dev/log"