Actually, I have been working on just this thing. The easiest way I found that was secure (not changing the permissions of the aliases file) was to have a cron job run by the root every 30 minutes that updated the aliases file. I am using a virtual email domain for this project, but this could work with the standard system aliases as well. Like so:
Cron job:
15,45 /usr/bin/mysql -B -N -uUSERNAME -pPASSWORD DATABASENAME < /root/vemail.sql > /etc/vmail/aliases.somedomain.com
contents of vemail.sql:
select concat(user_name, ":"), email from usertable;
To do it with the system aliases, you would have to add a newaliases command to the cronjob, I would write a script for it, say it is called "updateEmail":
Cron Job:
15,45 /root/updateEmail
contents of updateEmail:
/usr/bin/mysql -B -N -uUSERNAME -pPASSWORD DATABASENAME < /root/vemail.sql > /etc/vmail/aliases.somedomain.com;
newaliases;
Hope this helps!
D