dovecot - Aug 2011 - sievec - manual compile of global sieve scripts?

How do you compile global scripts using the sievec command without 
making the script directory owned (and group writable) by the vmail user?

http://wiki2.dovecot.org/Pigeonhole/Sieve/Usage

# cd /etc/dovecot/sieve/before/
# (edit some script like spam.sieve that runs for everyone)
# /usr/local/bin/sievec spam.sieve spam.svbin

sievec(root): Error: sieve: binary save: failed to create temporary 
file: open(spam.svbin.hostname.26921.) in directory 
/etc/dovecot/sieve/before failed: Permission denied (euid=5000(vmail) 
egid=5000(vmail) missing +w perm: /etc/dovecot/sieve/before, euid is not 
dir owner)

# ls -la /etc/dovecot/sieve/before/
drwxrwxr-x 2 root root 4096 Aug  1 15:56 .
drwxr-xr-x 5 root root 4096 Aug  1 13:23 ..
-rw-rw-r-- 1 root root  477 Aug  1 15:33 spam.sieve

Or do I just make the /etc/dovecot/sieve/ tree owned and writable by the 
vmail:vmail user? (Which worked, but seems like a bad idea.)

Output of dovecot -n

# 2.0.13: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.18-274.el5 x86_64 Red Hat Enterprise Linux Server 
release 5.7 (Tikanga)
auth_verbose_passwords = sha1
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
listen = 127.0.0.1, 1.2.3.4
mail_gid = vmail
mail_home = /var/vmail/%d/%n
mail_location = maildir:~/Maildir
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope 
encoded-character vacation subaddress comparator-i;ascii-numeric 
relational regex imap4flags copy include variables body enotify 
environment mailbox date
mbox_write_locks = fcntl
passdb {
   args = /etc/dovecot/conf.d/dovecot-sql.conf.ext
   driver = sql
}
plugin {
   sieve = ~/.dovecot.sieve
   sieve_after = /etc/dovecot/sieve/after/
   sieve_before = /etc/dovecot/sieve/before/
   sieve_dir = ~/sieve
   sieve_global_dir = /etc/dovecot/sieve/globalinclude/
}
protocols = imap pop3 lmtp sieve
service auth {
   unix_listener /var/spool/postfix/private/auth {
     mode = 0666
   }
   unix_listener auth-userdb {
     group = vmail
     user = vmail
   }
}
service imap-login {
   process_min_avail = 5
}
service pop3-login {
   inet_listener pop3 {
     address = 1.2.3.4
   }
   inet_listener pop3s {
     address = 1.2.3.4
   }
}
ssl = required
ssl_cert = </etc/pki/tls/private/certs/example_com.crt
ssl_key = </etc/pki/tls/private/example_com.key
protocol lda {
   log_path = /var/log/dovecot/dovecot-lda
   mail_plugins = " sieve"
}

On 8/1/2011 10:11 PM, Thomas Harold wrote:
> How do you compile global scripts using the sievec command without 
> making the script directory owned (and group writable) by the vmail user?
>
> http://wiki2.dovecot.org/Pigeonhole/Sieve/Usage
>
> # cd /etc/dovecot/sieve/before/
> # (edit some script like spam.sieve that runs for everyone)
> # /usr/local/bin/sievec spam.sieve spam.svbin
>
> sievec(root): Error: sieve: binary save: failed to create temporary 
> file: open(spam.svbin.hostname.26921.) in directory 
> /etc/dovecot/sieve/before failed: Permission denied (euid=5000(vmail) 
> egid=5000(vmail) missing +w perm: /etc/dovecot/sieve/before, euid is 
> not dir owner)
Why are you executing sievec as vmail in the first place? You should be 
able to run it as root or any other user you use to manage global sieve 
scripts.
> # ls -la /etc/dovecot/sieve/before/
> drwxrwxr-x 2 root root 4096 Aug  1 15:56 .
> drwxr-xr-x 5 root root 4096 Aug  1 13:23 ..
> -rw-rw-r-- 1 root root  477 Aug  1 15:33 spam.sieve
>
> Or do I just make the /etc/dovecot/sieve/ tree owned and writable by 
> the vmail:vmail user? (Which worked, but seems like a bad idea.)
It is a bad idea. Vmail would only need read access.

Regards,

Stephan

Mine has always behaved like this.

It looks up the root user in the auth database from the dovecot  
config, and attemps to change to that user, and in this type of case  
that would be vmail.

Then it attempts to check the mail_home and kind of fails, unless you  
give vmail permission to that path that would be created using the  
root user.


Quoting Thomas Harold <thomas-lists at nybeta.com>:
> On 8/2/2011 8:45 AM, Stephan Bosch wrote:
>>
>> What versions of Dovecot (obviously v2.0+) and Pigeonhole are you using
>> and what is your config (show dovecot -n output) ?
>>
>> I suspect there may be a bug.
>>
>
> dovecot-2.0-pigeonhole-0.2.3 - downloaded and compiled from source  
> this week.  The dovecot package itself comes from ATRPMs and is  
> 2.0.13.
>
> Name       : dovecot
> Arch       : x86_64
> Epoch      : 1
> Version    : 2.0.13
> Release    : 1_129.el5
> Size       : 5.1 M
> Repo       : installed
> Summary    : Dovecot Secure imap server
> URL        : http://www.dovecot.org/
> License    : MIT
>
> Name       : dovecot-devel
> Arch       : x86_64
> Epoch      : 1
> Version    : 2.0.13
> Release    : 1_129.el5
> Size       : 667 k
> Repo       : installed
> Summary    : Libraries and headers for Dovecot
> URL        : http://www.dovecot.org/
> License    : MIT
>
> Output of dovecot -n
>
> # 2.0.13: /etc/dovecot/dovecot.conf
> # OS: Linux 2.6.18-274.el5 x86_64 Red Hat Enterprise Linux Server  
> release 5.7 (Tikanga)
> auth_verbose_passwords = sha1
> lda_mailbox_autocreate = yes
> lda_mailbox_autosubscribe = yes
> listen = 127.0.0.1, 1.2.3.4
> mail_gid = vmail
> mail_home = /var/vmail/%d/%n
> mail_location = maildir:~/Maildir
> mail_uid = vmail
> managesieve_notify_capability = mailto
> managesieve_sieve_capability = fileinto reject envelope  
> encoded-character vacation subaddress comparator-i;ascii-numeric  
> relational regex imap4flags copy include variables body enotify  
> environment mailbox date
> mbox_write_locks = fcntl
> passdb {
>   args = /etc/dovecot/conf.d/dovecot-sql.conf.ext
>   driver = sql
> }
> plugin {
>   sieve = ~/.dovecot.sieve
>   sieve_after = /etc/dovecot/sieve/after/
>   sieve_before = /etc/dovecot/sieve/before/
>   sieve_dir = ~/sieve
>   sieve_global_dir = /etc/dovecot/sieve/globalinclude/
> }
> protocols = imap pop3 lmtp sieve
> service auth {
>   unix_listener /var/spool/postfix/private/auth {
>     mode = 0666
>   }
>   unix_listener auth-userdb {
>     group = vmail
>     user = vmail
>   }
> }
> service imap-login {
>   process_min_avail = 5
> }
> service pop3-login {
>   inet_listener pop3 {
>     address = 1.2.3.4
>   }
>   inet_listener pop3s {
>     address = 1.2.3.4
>   }
> }
> ssl = required
> ssl_cert = </etc/pki/tls/private/certs/example_com.crt
> ssl_key = </etc/pki/tls/private/example_com.key
> protocol lda {
>   log_path = /var/log/dovecot/dovecot-lda
>   mail_plugins = " sieve"
> }