2

I'm trying to setup Postfix from Entware (a repo for embedded devices).

There is no SElinux involved and chroot is disabled in master.cf.

# postconf -n
command_directory = /opt/sbin
compatibility_level = 2
config_directory = /opt/etc/postfix
daemon_directory = /opt/libexec/postfix
data_directory = /opt/var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
default_database_type = cdb
inet_protocols = ipv4
mail_spool_directory = /opt/var/mail
manpage_directory = no
myhostname = domain.nl
mynetworks = 1.1.2.1,8.9.1.1
queue_directory = /opt/var/spool/postfix
shlib_directory = /opt/lib/postfix
smtputf8_enable = no
unknown_local_recipient_reject_code = 550

The issue is that postfix set-permissions isn't able to figure out the root user name. This distribution comes by default with a "root" user named "admin". At least I think that the user name is the issue, because of:

# postfix set-permissions
find: unknown user root
# ls -lah /opt/sbin/postdrop
-rwxr-xr-x    1 NewRootUser   root      246.8K Sep  8 22:33 /opt/sbin/postdrop

Regression

With the help of https://wiki.zimbra.com/wiki/Steps_to_fix_permission_and_ownership_of_Postfix_binaries_manually_due_to_bug_on_zmfixperm is tried to fix the differences (755 was already set):

# chown AdminUserName:postdrop /opt/sbin/postdrop
# chown AdminUserName:postdrop /opt/sbin/postqueue
# chmod g+s /opt/sbin/postdrop
# chmod g+s /opt/sbin/postqueue

Result:

# postfix check
postsuper: fatal: scan_dir_push: open directory defer: Permission denied

Question

How to make postfix set-permissions learn the new root user name?

Or how to manually do the steps that postfix set-permissions should do?

Or where in the postfix source code can one find the actions that are executed for flag set-permissions?

  • 4
    "renamed away from default "root".". This was a Known Bad Idea long ago. Most checks for root, or toor, or whatever, are actually checks for UID = 0, except for many hidden USERID = "root ". You'll never find them all. Renaming root is all problems, no benefit. – waltinator Sep 27 '18 at 16:37
  • github.com/vdukhovni/postfix/blob/… has one chown that brings $user in; apparently from the command-line, environment, or main.cf – Jeff Schaller Sep 29 '18 at 20:49
  • the permissions are stored in the inode, if somehow you can modify it to gain access to /etc/postfix/main.cf and /etc/postfix/master.cf to modify it manually via accessing the place it's stored in from other OS – Yousef Al-Hadhrami Sep 29 '18 at 22:06
  • or try using chmod from other operating system to give access to new renamed user – Yousef Al-Hadhrami Sep 29 '18 at 22:16
2
+50

Applications which expect and use user name root will understandably fail when there is no such user on the system. However, you can have more than one user with same UID. Usually, you should probably not configure the system with multiple user names with same UID, similarly as you should not rename root user.

You can add another UID 0 account, which has the username root. This possibly solves issues with applications which use user names instead of numeric UIDs. To add an alias root for UID 0 with disabled password and login, append following to /etc/passwd:

root:x:0:0:root:/root:/bin/false

Full syntax is explained in man 5 passwd.

  • With this /etc/passwd line, and a ln -s /opt/sbin/sendmail.postfix /opt/sbin/sendmail, I was able to postfix set-permissions and start postfix. – Pro Backup Oct 1 '18 at 20:27
1

First, let me echo other's point that renaming the root user is a bad idea. That said, if you're set on doing it...

Where in the postfix source code can one find the actions that are executed for flag set-permissions?

The command postfix set-permissions seems to be handled by postfix/conf/postfix-script, which in turn calls post-install create-missing:

set-permissions|upgrade-configuration)
    $daemon_directory/post-install create-missing "$@"
    ;;

https://github.com/vdukhovni/postfix/blob/bfff4380a3b6fac2513c73531ee3a79212c08660/postfix/conf/postfix-script#L376

https://github.com/vdukhovni/postfix/blob/bfff4380a3b6fac2513c73531ee3a79212c08660/postfix/conf/post-install#L245

You might have to search the repo for "root" and adjust anything that's expecting the administrator's username to be "root":

https://github.com/vdukhovni/postfix/search?p=3&q=root&unscoped_q=root

  • You answer says we are looking for z, and a leads to b leads to c, I am board, here are some links. – ctrl-alt-delor Oct 1 '18 at 18:37
  • The question was where in the source is set-permissions handled. Providing a link to that point seemed like a legitimate answer. Did I then trace that all the way down to some point where "root" is used? Clearly not. Might the original author be able to do that with a concrete starting point? Hopefully. – Andy Dalton Oct 1 '18 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.