How to create Maildir directory with enough permissions for Postfix?

Question

I have CentOS 5.5 with Postfix installed on it. I want to use local delivery agent with default setting, but I want it to store mail with Maildir directory style mailboxes.

When I set the mailboxes to be stored ( as default ) in:

mail_spool_directory = /var/spool/mail/

And I manually create maildir, so it looks like this:

[root@dx2200 /]# ls -lah /var/spool/mail/
total 32K
drwxrwxr-x  4 root  mail 4.0K Mar 15 15:01 .
drwxr-xr-x 13 root  root 4.0K Mar 15 14:33 ..
drwxr-xr-x  5 root  root 4.0K Mar 15 14:52 marshra
drwxr-sr-x  5 pedro mail 4.0K Mar 15 15:01 pedro
[root@dx2200 /]# 
[root@dx2200 /]# ls -lah /var/spool/mail/pedro/
total 40K
drwxr-sr-x 5 pedro mail 4.0K Mar 15 15:01 .
drwxrwxr-x 4 root  mail 4.0K Mar 15 15:01 ..
drwxr-sr-x 2 pedro mail 4.0K Mar 15 15:01 cur
drwxr-sr-x 2 pedro mail 4.0K Mar 15 15:01 new
drwxr-sr-x 2 pedro mail 4.0K Mar 15 15:03 tmp
[root@dx2200 /]#

And then I try to send mail to local user pedro, the message is not being delivered, and my /var/log/maillog says:

Mar 15 15:11:00 dx2200 postfix/local[4266]: warning: maildir access problem for UID/GID=1014/1014: error writing message: Permission denied
Mar 15 15:11:00 dx2200 postfix/local[4266]: warning: perhaps you need to create the maildirs in advance
Mar 15 15:11:00 dx2200 postfix/local[4266]: 8D5D11310056: to=<[email protected]>, orig_to=<pedro>, relay=local, delay=0.04, delays=0.02/0.01/0/0.01, dsn=5.3.0, status=bounced (maildir delivery failed: error writing message: Permission denied)

I've had similar problem with virtual delivery agent, and changing virtual_mailbox_base from /var/spool/vmail to home directory /home/vmail did help. Do I have to do it also with local delivery agent ? AND IF SO - why can't I store mail in /var/spool ?

Answer 1

Edit: answer completely rewritten according to comments

The issue could be related to SELinux. You can run e.g. sestatus to check if it is enabled or disabled.

For maildir delivery, postfix changes to the corresponding user, so the destination directory needs to be writable by the user. This seems to be already the case. For privacy reason, I suggest chmod -R o-rwx /var/spool/mail/*

Just for completeness: If mbox files are used, the spool directory needs to be writable by the mail group which you get by using chmod -R g+rwX /var/spool/mail.

Answer 2

to allow SELinux policy write as a command line

semanage permissive -a postfix_local_t 

Answer 3

I had the same error with user directories under a subdir which had the wrong permissions. For example, the home dir for "user1" was /home/subdir/user1. And subdir had no execute permissions for "others".

chmod 755 /home/subdir

fixed the issue for me. The user directories are still with "700" permissions.

The error message was misleading because the permission denied was not on the user's directory but on a directory above it.

Answer 4

I've been having this exact same issue on CentOS 7. After hours of trying to figure it out. I turned off SELinux and it worked. So the issue it certainly SELinux.

To see if its enforcing type: getenforce

To turn it completely off just type: setenforce 0

Answer 5

your permissions:

drwxr-sr-x 2 pedro mail xxxx cur,new,tmp

only pedro(you) can write, mail(server) can only read.

1. change user to mail,
2. chmod 700
3. try again

Answer 6

I just tracked same issue down to postfix being unable to cope with the extended ACL's on the /home directory.

There WAS an ACL entry explicitly allowing a user to list and traverse it by the means of being in a specific group. But I had to add o=x to the list only to let posix go.