We would like to provide a self-service restore function to our users using their IMAP client of choice.. Our idea was to use a snapshot (under ZFS, btrfs, whatever) and have it available to the user in a namespace. Unfortunately, but understandably, dovecot doesn't like the mdbox structure to be read-only. Is there any chance to change that? In the meantime, we could use a read-write snapshot, but we wouldn't like the users to really do changes to that snapshot. Our next attempt is to use ACLs, but it's a bit hard to gt the ACLs to the correct place in the snapshots, at least for thousands of users. Our currents solution (in test) is a quick and dirty patch to introduce inheritance to the ACLs by walking up the directory tree, so we need only one ACL. A cleaner solution would be very much appreciated. Yours Jost Krieger -- | Helft Spam ausrotten! HTML in Mail ist unh?flich. | | Postmaster, JAPH, manchmal Wahrsager am RZ der RUB | | Wahre Worte sind nicht gef?llig, gef?llige Worte sind nicht wahr.| | Lao Tse, Tao Te King 81 |
On 28.11.2012, at 10.57, Jost Krieger wrote:> We would like to provide a self-service restore function to our users > using their IMAP client of choice.. > > Our idea was to use a snapshot (under ZFS, btrfs, whatever) and have it > available to the user in a namespace. > > Unfortunately, but understandably, dovecot doesn't like the mdbox > structure to be read-only. Is there any chance to change that?I think it would be possible. I already added some code for that, but apparently it wasn't enough and I stopped because it's a pretty low priority issue.. Anyway, I think the code changes would be pretty easy to do. So start finding the problematic parts and fixing them and sending me patches. :)> Our next attempt is to use ACLs, but it's a bit hard to gt the ACLs to > the correct place in the snapshots, at least for thousands of users. > > Our currents solution (in test) is a quick and dirty patch to introduce > inheritance to the ACLs by walking up the directory tree, so we need > only one ACL.For a long time I've wanted a "default acl" file that applies to the whole namespace. Never got around to implementing that either. Anyway, ACLs don't help when the reading code itself decides to write to indexes (which it does).
Am 28.11.2012 09:57, schrieb Jost Krieger:> We would like to provide a self-service restore function to our users > using their IMAP client of choice.. > > Our idea was to use a snapshot (under ZFS, btrfs, whatever) and have it > available to the user in a namespace. > > Unfortunately, but understandably, dovecot doesn't like the mdbox > structure to be read-only. Is there any chance to change that? > > In the meantime, we could use a read-write snapshot, but we wouldn't > like the users to really do changes to that snapshot. > > Our next attempt is to use ACLs, but it's a bit hard to gt the ACLs to > the correct place in the snapshots, at least for thousands of users. > > Our currents solution (in test) is a quick and dirty patch to introduce > inheritance to the ACLs by walking up the directory tree, so we need > only one ACL. > > A cleaner solution would be very much appreciated. > > Yours > Jost Krieger >a workaround perhaps is, postfix bcc archive mailboxes with a sieve rule which also sort mails spam/in/out/day/month/year in subfolders and then set subfolders acl read only for their related users ( scriptable at user creation time, and/or external sieve plugin),archive mailboxes may show up in their shared namespace then, also forbid pop3 download on the archive mailbox subfolders, if archive shouldnt exist for ever ,use dove expunge on the archive mailboxes/subfolders for x days/weeks/months/years ,whatever you prefer Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstra?e 15, 81669 M?nchen Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich