Problem when both sendmail and mimedefang runs as unpriviledged user

permissionssendmail

I'm trying to implement an anti-spam solution and according to advices I get here from answers to my other questions, I have decided to go for sendmail+mimedefang+spamassassin.

But currently I'm stuck with quite simple permission problem:

  1. By default, MIMEdefang is run as "defang" user, so it creates it's socket with following permissions:

    srwxr-x— 1 defang defang 0 Mar 3 16:42 /var/spool/MIMEDefang/mimedefang.sock

  2. If sendmail is run as root, there is no problem, but if it is run as unprivileged user, then it complain about lack of permissions for mimedefang socket:

    NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 1870: Xmimedefang: local socket name /var/spool/MIMEDefang/mimedefang.sock unsafe: Permission denied

I have already tried following solutions for this problem:

  1. run sendmail as root. Works ok, but is rather unacceptable, as I want to avoid running my daemons as root

  2. run sendmail as defang or run mimedefang as the same user as sendmail. Seems ok, but also want to avoid this, as there are too many configurations files, directories, etc., which would require changing permissions and/or ownership, so whole process became much error prone.

  3. Simply change permission of socket file, but it is recreated every time mimedefang starts. I could modify accordingly appropriate scripts in /etc/init.d but again wan't to avoid this because my changes may be loosed with future updates of those packages.

Could you suggest any other solution? Are there available any options in sendmail or mimedefang, which are related with permissions?

Best Answer

Sendmail runs as root and forks whenever needed processes to run as another user (smmsp, smmta, etc). So yes, run it as root and make sure you are running the latest version. If you want to run sendmail as non-root, make that user part of the defang group. Notice that the defang group also has read rights on the socket.

EDIT: (after reading the comments bellow) To make the socket group read-write you have to use umask appropriately before starting the milter (See the Notes section in the link provided).

Related Topic