Hi,
I try to migrate an old fashioned mailsystem to Debian 9.7 / dovecot
2.2.7. I "have" to cope with mbox for now. I try to get rid of Sun OS
5.9 sendmail before mbox to mdbox migration (I'm fine if you laugh
loudly ^^). Intended setup : 2 VM with exim (smtp in, smtp out roughly),
3 VM with dovecot (mbox, maildir, testbed), 1 VM with IMAP proxy and
LMTP proxy.
doveconf -n is at end of this mail. My test case is :
root@wagram:~# swaks --to tstifi04 --server imap --protocol lmtp
--header-X-Spam-Status yes
root@wagram:~#
(imap VM LMTP proxies to telegraphe5 VM in this test)
mbox folders are in users homedir, no generic "vmail" unix account. Real
posixAccounts in LDAP, NFS root_squashed.
sieve "fileinto "Junk" call goes wrong :
Feb 6 17:56:03 telegraphe5 dovecot: lmtp(tstifi04): Error:
PytSHqIRW1x2dgAA+Fldtw: sieve: msgid=unspecified: failed to store into
mailbox 'Junk': Read-only mbox
straced : https://pastebin.com/A53hDYnS
I may miss some configuration options... but I get stuck. I get to IRC
and it seems that there is no simple things to circumvent. I tried to
read some code path too.
https://wiki.dovecot.org/LMTP states :
Security
Unfortunately LMTP process currently needs to run as root, and only
temporarily drop privileges to users. Otherwise it couldn't handle
mail deliveries to more than a single user with different UID. If
you're using only a single global UID/GID, you can improve security by
running lmtp processes as that user:
service lmtp {
user = vmail
}
lmtp run as root, drop temporarily privileges. The point, IHMO, is lmtp
calls sieve code paths, that call some mbox saving function, that calls
libc/syscall access(). And this explicitly not consider effective uid/gid.
From strace (more in pastebin) :
[pid 30326] geteuid() = 0
[pid 30326] setresuid(-1, 20609, -1) = 0
[pid 30326] geteuid() = 20609
[pid 30326] access("/home/tstifi04/mail-imap/Junk", R_OK|W_OK) = -1
EACCES (Permission denied)
From man access
The check is done using the calling process's real UID and GID,
rather than the effective IDs as is done when actually
attempting an operation (e.g., open(2)) on the file.
Similarly, for the root user, the check uses the set of permitted
capabilities rather than the set of effective capabilities; and
for non-root users, the check uses an empty set of capa-
bilities.
I think that the process has effectively sufficient permissions to write
into the root_squashed file, and infortunately access() check another thing.
In dovecot sources, src/lib/eacces-error.c is aware of those "problems"
with access(), but I think that mbox and maybe other storage backends
don't use this for main codepath (like save a mail), but "only" for
smart log messages in some cases.
I may gone wrong while seeking about it. Do you see a configuration that
can use root squashed mboxes and LMTP ?
Should test_access() variant could be used as access() replacement ?
There is eaccess() and euidaccess() too but may be not portable enough
(_GNU_SOURCE only).
Regards,
Ludovic
telegraphe5:/dev/shm# mount | grep tstifi04
cifs1:/homeeleves/tstifi/tstifi04 on /home/tstifi04 type nfs
(rw,nosuid,nodev,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.29,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.29)
telegraphe5:/dev/shm# dovecot -n
# 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.16 (fed8554)
# OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.7
auth_debug = yes
auth_verbose = yes
default_client_limit = 10240
default_process_limit = 2048
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
mail_debug = yes
mail_fsync = always
mail_location =
mbox:~/mail-imap:INBOX=/var/mail/mailbox/%u:INDEX=/var/dovecot-indexes/%u
mail_nfs_storage = yes
mail_plugins = quota
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy
include variables body enotify environment mailbox date index ihave duplicate
mime foreverypart extracttext
mbox_write_locks = fcntl
mmap_disable = yes
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
plugin {
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
mail_log_fields = uid box msgid size
quota = count:Quota mail global
quota_rule = *:storage=100M
quota_rule2 = Trash:storage=+100M
quota_vsizes = yes
quota_warning = storage=95%% quota-warning 95 %u
quota_warning2 = storage=80%% quota-warning 80 %u
sieve =
file:/var/mail/mailconf/%1u/%u/sieve;active=/var/mail/mailconf/%1u/%u/.dovecot.sieve
sieve_after = /var/mail/mailconf/global/sieve/after.d/
sieve_before = /var/mail/mailconf/global/sieve/before.d/
sieve_global = /var/mail/mailconf/global/sieve
sieve_vacation_dont_check_recipient = yes
}
protocols = " imap lmtp sieve sieve"
service anvil {
unix_listener anvil-auth-penalty {
mode = 00
}
}
service imap-login {
inet_listener imap {
port = 0
}
}
service lmtp {
inet_listener lmtp {
port = 24
}
}
service managesieve {
process_limit = 16
}
service quota-warning {
executable = script /usr/local/bin/quota-warning.sh
unix_listener quota-warning {
mode = 0666
}
user = root
}
ssl = required
ssl_cert = </etc/ssl/local_certs/telegraphe5_cert.pem
ssl_key = # hidden, use -P to show it
syslog_facility = local0
userdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
verbose_proctitle = yes
protocol lmtp {
mail_plugins = quota sieve
}
protocol imap {
mail_max_userip_connections = 20
mail_plugins = quota imap_quota
}
telegraphe5:/dev/shm# grep -vE '^(#|$)' /etc/dovecot/dovecot-ldap.conf.ext
uris = ldaps://ldap-test.mines-albi.fr
tls_require_cert = hard
auth_bind = yes
base = ou=People,dc=enstimac,dc=fr
user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,\
dcMailQuota=quota_rule=*:bytes=%{ldap:dcMailQuota}M
user_filter = (&(objectClass=posixAccount)(|(uid=%n)(mail=%n...@mines-albi.fr)))
iterate_attrs = uid=user
iterate_filter = (objectClass=posixAccount)
telegraphe5:/dev/shm# ls -l /var/mail/mailconf/global/sieve/before.d/
total 0
telegraphe5:/dev/shm# ls -al /var/mail/mailconf/t/tstifi04/
total 44
drwx------ 3 tstifi04 ifie2012 4096 févr. 5 10:46 .
drwxrwxrwt 169 root root 16384 janv. 5 18:48 ..
lrwxrwxrwx 1 tstifi04 ifie2012 25 janv. 31 17:50 .dovecot.sieve ->
sieve/rainloop.user.sieve
-rw------- 1 tstifi04 ifie2012 1520 févr. 5 13:22 .dovecot.sieve.log
-rw------- 1 tstifi04 ifie2012 10336 févr. 5 10:46 .dovecot.sieve.log.0
-rw------- 1 tstifi04 ifie2012 172 janv. 31 17:56 .dovecot.svbin
drwx------ 3 tstifi04 ifie2012 4096 janv. 31 17:50 sieve
telegraphe5:/dev/shm# ls -al
/var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve
-rw------- 1 tstifi04 ifie2012 102 janv. 31 17:50
/var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve
telegraphe5:/dev/shm# cat
/var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve
# This is RainLoop Webmail sieve script.
# Please don't change anything here.
# RAINLOOP:SIEVE
telegraphe5:/dev/shm#
telegraphe5:/dev/shm# cat
/var/mail/mailconf/global/sieve/after.d/spam-into-junk.sieve
require ["fileinto"];
if header :is "X-Spam-Status" "Yes" {
fileinto "Junk";
stop;
}
