1

I want to run some analytics on my mail.log (postfix 3.2.13 on Ubuntu 20.04 LTS) including updating a db of undeliverable emails, so I wrote script, excluded mail.log from the generic /var/log logrotate script and created a new /etc/lorotate.d/mail_log which ran the script in the post-rotate section. Although the script was getting invoked, it was unable to generate the db file:

postfix/postmap[540039]: fatal: open /etc/postfix/bad_recipients.db: Read-only file system

Thinking that this might actually be a permissions issue, I added a sudoers rule for the syslog user (the /var/log/mail files are owned by syslog user) and amended the logrotate script:

/var/log/mail.log
{
        rotate 30
        daily
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                /usr/lib/rsyslog/rsyslog-rotate
                sudo /usr/local/sbin/mailfail.sh
        endscript
}

But I still get the same error reported at the top of each mail.log (Read-only file system) and the database is not updated.

That the script is executing at all suggests its not a chroot or permissions or sudo misconfiguration issue on the script. The other files being written to have permissions for the syslog user (the user owning the log files).

Rsyslogd appears to be the only executable in the chain which is subject to an apparmor profile - but adding the path /etc/postfix* (rwk) to the profile and switching from enforce to complain had no impact on the error.

(running the script from the command works as expectd)

Improve this question

1 Answer 1

Reset to default
0

This is probably caused by systemd’s protection features, which are enabled for logrotate and Postfix. In particular, ProtectSystem, if set to “full” or “strict”, will result in /etc being read-only.

You should move anything you want to be able to modify to var, or if you can’t avoid changing /etc, override the relevant units (systemctl edit) to change ProtectSystem to “true”, which will protect /usr but not /etc.

Improve this answer
1
  • It was indeed systemd (so I need to add MAC to the list of things it does / I think it shouldn't :( ). I Left ProtectSystem=full (because its so obvious what that means </sarcasm>) and added ReadWritePaths=/etc/postfix/bad_recipients.db. Some fettling still required here, but you've put me on the right path. Ta.
    – symcbean
    Sep 23, 2021 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .