1

For years (with EL6 and before), I have successfully used entries like this in my /etc/aliases file:

bugs:       /var/spool/mail/bugs

The idea being mail to a non-user can be shoved into a file for later processing, or archiving. When using RHEL7 or CentOS7, these entries give the following two errors.

First, without creating the bugs file, maillog error "cannot create file exclusively: Permission denied":

May 16 12:17:04 foobar postfix/local[17510]: 3D313673442: to=<[email protected]>, relay=local, delay=0.12, delays=0.08/0.02/0/0.02, dsn=5.2.0, status=bounced (cannot append message to file /var/spool/mail/bugs: cannot create file exclusively: Permission denied)

Second, If I pre-create a file with reasonable ownership + context:

ls -l /var/spool/mail/bugs
-rw-rw----. 1 postfix mail 0 May  7 19:34 /var/spool/mail/bugs
ls -Z /var/spool/mail/bugs
-rw-rw----. postfix mail system_u:object_r:mail_spool_t:s0 /var/spool/mail/bugs

I get "unable to create lock file" error

May 16 12:11:43 foobar postfix/local[17422]: warning: unable to create lock file /var/spool/mail/bugs.lock: Permission denied

I am able to get the messages delivered to files with the following ghastly permissions (1777 and 666), however this is obviously not acceptable for security reasons:

# ll -d /var/spool/mail; ll /var/spool/mail/bugs
drwxrwxrwt. 2 root mail 52 May 16 13:36 /var/spool/mail
-rw-rw-rw-. 1 postfix mail 6913 May 16 13:31 /var/spool/mail/bugs

EL7 is postfix-2.10'ish, EL6 that works is postfix-2.6'ish.

2
  • 2
    Is your mail dir sticky and permissive? (chmod 1777 /var/spool/mail)
    – Drav Sloan
    May 16, 2016 at 17:07
  • No, but I made the change. In fact, I got it to "work" with 1777 on /var/spool/mail/ and 666 /var/spool/mail/bugs - this is obviously not acceptable as anyone can go digging into those files. Postfix is trying to act as some unknown user when delivering the message... but who?
    – Stickley
    May 16, 2016 at 17:43

1 Answer 1

1

The solution to this, without creating a new user, is to set in main.cf the parameter default_privs = mail.

Keep in mind that it is discouraged to use root or postfix for default_privs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .