dovecot - Jul 2014 - Exit status code 134; what is it, in the context of Dovecot Antispam plug-in?

Hello!

I just migrated from Ubuntu 12.04 LTS to 14.04 LTS and thereby from
Dovecot 2.0.19 to 2.2.9.

I've been using dovecot-antispam plugin with great success for the past
year with 2.0.19, but after this migration, I've been seeing the exit
status code 134 in the syslog when attempting to debug the Dovecot
Antispam plugin not working after the migration.

I have some debugging output in my pipe script; the output looks
something like this:

Copying message contents to temporary file for debugging purposes; file
is: /tmp/sendmail-msg-7662.txt
Checking if the command-line input argument string (--spam) contains the
string "ham" or "spam"
Mode is "SPAM"
Calling (as user vmail) '/usr/lib/dovecot/deliver -d
"sa-training at example.com" -m "Training.SPAM" -p
"/tmp/sendmail-msg-7662.txt"'
Exit status was 134

Yet, I'm able to copy the above command and execute it manually, via the
command-line, and it works (and by "works", I mean to say that the
behavior is correct and exactly as expected; I receive the "Spam"
email
at the designated mailbox). Here's how I'm calling it when it works
perfectly well (as "root"):

# su -c '/usr/lib/dovecot/deliver -d "sa-training at example.com"
-m
"Training.HAM" -p "/tmp/sendmail-msg-7460.txt"' vmail

Any idea what status 134 might be or how to work around it? It looks to
be some kind of "temporary failure exception", but that is less than
informative in this context.

"doveconf -n" output is appended.

Thanks for any help!

-Ben

# 2.2.9: /etc/dovecot/dovecot.conf
# OS: Linux 3.13.0-32-generic x86_64 Ubuntu 14.04.1 LTS
auth_mechanisms = plain login
disable_plaintext_auth = no
listen = *,[::]
log_timestamp = "%Y-%m-%d %H:%M:%S "
mail_privileged_group = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy include variables body enotify
environment mailbox date ihave
passdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
plugin {
  antispam_backend = pipe
  antispam_debug_target = syslog
  antispam_pipe_program = /bin/bash
  antispam_pipe_program_args = /usr/local/bin/sa-learn-pipe.sh
  antispam_pipe_program_notspam_arg = --ham
  antispam_pipe_program_spam_arg = --spam
  antispam_pipe_tmpdir = /tmp
  antispam_spam_pattern_ignorecase = SPAM;JUNK
  antispam_trash_pattern_ignorecase = trash;Deleted *
  antispam_verbose_debug = 1
  quota = dict:user::file:/var/vmail/%d/%n/.quotausage
  quota_rule2 = Trash:storage=+100M
  quota_rule3 = Junk:ignore
  quota_rule4 = INBOX:storage=+100M
  quota_warning = storage=100%% quota-reached 100 %u %d
  quota_warning2 = storage=95%% quota-warning 95 %u %d
  quota_warning3 = storage=80%% quota-warning 80 %u %d
  quota_warning4 = -storage=100%% quota-below below %u %d
  sieve = /var/vmail/%d/%n/.sieve
}
postmaster_address = postmaster at example.com
protocols = imap pop3 sieve
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0600
    user = vmail
  }
  user = root
}
service config {
  unix_listener config {
    group = vmail
    mode = 0600
    user = vmail
  }
}
service imap-login {
  client_limit = 1000
  process_limit = 500
}
service quota-below {
  executable = script /usr/local/bin/quota-below.sh
  unix_listener quota-below {
    group = vmail
    mode = 0666
    user = vmail
  }
  user = vmail
}
service quota-reached {
  executable = script /usr/local/bin/quota-reached.sh
  unix_listener quota-reached {
    group = vmail
    mode = 0666
    user = vmail
  }
  user = vmail
}
service quota-warning {
  executable = script /usr/local/bin/quota-warning.sh
  unix_listener quota-warning {
    group = vmail
    mode = 0666
    user = vmail
  }
  user = vmail
}
ssl_cert = </root/ssl/example.com/example.com.crt
ssl_key = </root/ssl/example.com/example.com.key
userdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
protocol imap {
  mail_plugins = quota imap_quota antispam
}
protocol pop3 {
  mail_plugins = quota
  pop3_uidl_format = %08Xu%08Xv
}
protocol lda {
  info_log_path   log_path   mail_plugins = sieve quota
}

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 28 Jul 2014, Ben Johnson wrote:
> I have some debugging output in my pipe script; the output looks
How does your script looks like?
> Copying message contents to temporary file for debugging purposes; file
> is: /tmp/sendmail-msg-7662.txt
> Checking if the command-line input argument string (--spam) contains the
> string "ham" or "spam"
> Mode is "SPAM"
> Calling (as user vmail) '/usr/lib/dovecot/deliver -d
> "sa-training@example.com" -m "Training.SPAM" -p
> "/tmp/sendmail-msg-7662.txt"'
> Exit status was 134
Check out your local /usr/include/sysexits.h, if the exit code is defined 
there. It's not in mine.
> Yet, I'm able to copy the above command and execute it manually, via
the
> command-line, and it works (and by "works", I mean to say that
the
> behavior is correct and exactly as expected; I receive the "Spam"
email
> at the designated mailbox). Here's how I'm calling it when it works
> perfectly well (as "root"):
>
> # su -c '/usr/lib/dovecot/deliver -d
"sa-training@example.com" -m
> "Training.HAM" -p "/tmp/sendmail-msg-7460.txt"'
vmail
>
> Any idea what status 134 might be or how to work around it? It looks to
> be some kind of "temporary failure exception", but that is less
than
> informative in this context.
>
> # 2.2.9: /etc/dovecot/dovecot.conf
> # OS: Linux 3.13.0-32-generic x86_64 Ubuntu 14.04.1 LTS
> plugin {
>  antispam_backend = pipe
>  antispam_debug_target = syslog
>  antispam_pipe_program = /bin/bash
>  antispam_pipe_program_args = /usr/local/bin/sa-learn-pipe.sh
>  antispam_pipe_program_notspam_arg = --ham
>  antispam_pipe_program_spam_arg = --spam
>  antispam_pipe_tmpdir = /tmp
>  antispam_spam_pattern_ignorecase = SPAM;JUNK
>  antispam_trash_pattern_ignorecase = trash;Deleted *
>  antispam_verbose_debug = 1
> }
>
- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBU9dJrnz1H7kL/d9rAQIskggAt2Otvh4sHZPrmYNm2aSiUwJqarmZmiLV
KrXuMwuvDs33Wd60Bihqjykw96fwz3v+jQuqx+t/V+uN/jRffFpp98aUA4rR9rZ6
AJ3HJfPTyf11Pi9cCG8EhqmY9amPRFrp1Ox+NCg4Jt2liUPzmdtPe6+OUR+QlUdR
Dr2Q6nyH+0sA948mnihJRVERf/oY+7/1s/UTLtCyyGGm4nXy9yoFWVeGxIybXF8G
HMH0I1CYCvKVtmh3o/6IaqJD7IIvJGcUPcEiSNtoKAUC5hu1IhwwkbZnD9IEiigG
HPDL0JIBZBleU8/6SC+e7eP7SF6deu4db1E/I45JVNOZLsZjzgtIVA==5sDi
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 28 Jul 2014, Ben Johnson wrote:
> I have some debugging output in my pipe script; the output looks
How does your script looks like?
> Copying message contents to temporary file for debugging purposes; file
> is: /tmp/sendmail-msg-7662.txt
> Checking if the command-line input argument string (--spam) contains the
> string "ham" or "spam"
> Mode is "SPAM"
> Calling (as user vmail) '/usr/lib/dovecot/deliver -d
> "sa-training at example.com" -m "Training.SPAM" -p
> "/tmp/sendmail-msg-7662.txt"'
> Exit status was 134
Check out your local /usr/include/sysexits.h, if the exit code is defined 
there. It's not in mine.
> Yet, I'm able to copy the above command and execute it manually, via
the
> command-line, and it works (and by "works", I mean to say that
the
> behavior is correct and exactly as expected; I receive the "Spam"
email
> at the designated mailbox). Here's how I'm calling it when it works
> perfectly well (as "root"):
>
> # su -c '/usr/lib/dovecot/deliver -d "sa-training at
example.com" -m
> "Training.HAM" -p "/tmp/sendmail-msg-7460.txt"'
vmail
>
> Any idea what status 134 might be or how to work around it? It looks to
> be some kind of "temporary failure exception", but that is less
than
> informative in this context.
>
> # 2.2.9: /etc/dovecot/dovecot.conf
> # OS: Linux 3.13.0-32-generic x86_64 Ubuntu 14.04.1 LTS
> plugin {
>  antispam_backend = pipe
>  antispam_debug_target = syslog
>  antispam_pipe_program = /bin/bash
>  antispam_pipe_program_args = /usr/local/bin/sa-learn-pipe.sh
>  antispam_pipe_program_notspam_arg = --ham
>  antispam_pipe_program_spam_arg = --spam
>  antispam_pipe_tmpdir = /tmp
>  antispam_spam_pattern_ignorecase = SPAM;JUNK
>  antispam_trash_pattern_ignorecase = trash;Deleted *
>  antispam_verbose_debug = 1
> }
>
- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBU9dJrnz1H7kL/d9rAQIskggAt2Otvh4sHZPrmYNm2aSiUwJqarmZmiLV
KrXuMwuvDs33Wd60Bihqjykw96fwz3v+jQuqx+t/V+uN/jRffFpp98aUA4rR9rZ6
AJ3HJfPTyf11Pi9cCG8EhqmY9amPRFrp1Ox+NCg4Jt2liUPzmdtPe6+OUR+QlUdR
Dr2Q6nyH+0sA948mnihJRVERf/oY+7/1s/UTLtCyyGGm4nXy9yoFWVeGxIybXF8G
HMH0I1CYCvKVtmh3o/6IaqJD7IIvJGcUPcEiSNtoKAUC5hu1IhwwkbZnD9IEiigG
HPDL0JIBZBleU8/6SC+e7eP7SF6deu4db1E/I45JVNOZLsZjzgtIVA==5sDi
-----END PGP SIGNATURE-----

On 7/29/2014 3:13 AM, Steffen Kaiser wrote:
> On Mon, 28 Jul 2014, Ben Johnson wrote:
> 
>> I have some debugging output in my pipe script; the output looks
> 
> How does your script looks like?
> 
http://pastebin.com/nh8SwQtw
>> Copying message contents to temporary file for debugging 
>> purposes; file is: /tmp/sendmail-msg-7662.txt Checking if the 
>> command-line input argument string (--spam) contains the string 
>> "ham" or "spam" Mode is "SPAM" Calling
(as user vmail)
>> '/usr/lib/dovecot/deliver -d "sa-training at example.com"
-m
>> "Training.SPAM" -p
"/tmp/sendmail-msg-7662.txt"' Exit status was
>> 134
> 
> Check out your local /usr/include/sysexits.h, if the exit code is 
> defined there. It's not in mine.
> 
Exit code 134 is not defined in /usr/include/sysexits.h on my system.
>> Yet, I'm able to copy the above command and execute it manually, 
>> via the command-line, and it works (and by "works", I mean to
>> say that the behavior is correct and exactly as expected; I
>> receive the "Spam" email at the designated mailbox).
Here's how
>> I'm calling it when it works perfectly well (as "root"):
> 
>> # su -c '/usr/lib/dovecot/deliver -d "sa-training at
example.com" -m
>> "Training.HAM" -p "/tmp/sendmail-msg-7460.txt"'
vmail
> 
>> Any idea what status 134 might be or how to work around it? It 
>> looks to be some kind of "temporary failure exception", but
that
>> is less than informative in this context.
> 
>> # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-32-generic 
>> x86_64 Ubuntu 14.04.1 LTS plugin { antispam_backend = pipe 
>> antispam_debug_target = syslog antispam_pipe_program = /bin/bash
>>  antispam_pipe_program_args = /usr/local/bin/sa-learn-pipe.sh 
>> antispam_pipe_program_notspam_arg = --ham 
>> antispam_pipe_program_spam_arg = --spam antispam_pipe_tmpdir = 
>> /tmp antispam_spam_pattern_ignorecase = SPAM;JUNK 
>> antispam_trash_pattern_ignorecase = trash;Deleted * 
>> antispam_verbose_debug = 1 }
> 
> 
> -- Steffen Kaiser
Is it possible that this is some kind of apparmor restriction? I ask
because apparmor is indeed installed on this machine.

If you examine the script source (cited above), you will see that I've
had to use "the hammer that is strace" to debug issues with Dovecot +
Antispam before... maybe it's worth trying in this case.

Happy to hear any further suggestions.

Thanks again,

-Ben