dovecot - Sep 2012 - ChgrpNoPerm issue

I have dovecot version 2.0.9 

I am confused about this article
http://wiki2.dovecot.org/Errors/ChgrpNoPerm 

my mail_location mbox:~/mymail:INBOX=/var/mail/%u 

So my inbox is at var/mail/ and my
imap folder is /home/user/mymail 

The problem is /var/mail (Owner is
useraccount and the group us mail) , and here comes the problem
Dovecot
keeps trying to chown the imap folder inside the homedirectory with
user:mail account and since
And this is the reason of error that appears
in my log file. 

The option mail_access_groups=mail solve the problem..
but I read it is not secure..
With my current configutation, users login
with imap to read mail , can they use
any the mail_access_groups=mail
and read other poeple mail ? does my configutation
is a shard mailbox
and could be unsecure.. 

my main quesion , for my current configuration
, can i use mail_access_groups=mail safely or can
some user use this to
read other people mail ? attached my configuration. 

why didnot have
this issue with uw-imapd? and why dovecot try to chown the .imap 
folder
with the mail group ? 

dovecot -n output is 

# 2.0.9:
/etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-279.2.1.el6.x86_64 x86_64
CentOS release 6.3 (Final) 
disable_plaintext_auth = no
mail_debug yes
mail_location = mbox:~/mymail:INBOX=/var/mail/%u
mbox_write_locks fcntl
passdb {
 driver = pam
}
ssl_cert </etc/pki/dovecot/certs/dovecot.pem
ssl_key </etc/pki/dovecot/private/dovecot.pem
userdb {
 driver passwd
}
protocol pop3 {
 pop3_uidl_format = %08Xu%08Xv
}
[ 
 Robert

Robert JR <roundcube222 at alaadin.org> writes:
> The problem is /var/mail (Owner is
> useraccount and the group us mail) , and here comes the problem
> Dovecot
> keeps trying to chown the imap folder inside the homedirectory with
> user:mail account and since
> And this is the reason of error that appears
> in my log file.
Dovecot is trying to keep the permission of your index caches consistent
with that of your mailbox it indexes.  The INBOX index cache is kept in
your user's mail directory (as per your default settings), although you
can change that location.
> The option mail_access_groups=mail solve the problem..
> but I read it is not secure..
> With my current configutation, users login
> with imap to read mail , can they use
> any the mail_access_groups=mail
> and read other poeple mail ?
Yes, that's the security problem.
> does my configutation
> is a shard mailbox
> and could be unsecure..
Could not parse your question/comment.
> why didnot have
> this issue with uw-imapd? and why dovecot try to chown the .imap 
> folder
> with the mail group ?
uw-imapd was not as picky.  The extra consideration for group ownership
is so that shared access to mailbox files, and their associated index
caches, remain consistent.   For example, if you shared a mailbox among
your colleagues in group "staff" and the mailbox has
group=staff,perm=g+rw,
then the index caches will inherit those permissions, and members of
group staff can access mailbox and indices alike.

[You later write ...]
> Sep 9 11:22:30 dovecot: pop3(r): Error:
> fchown(/home/r/.imap/INBOX/dovecot.index.log.newlock, -1, 12(mail))
> failed: Operation not permitted (egid=501(r), group based on
> /var/mail/r) 
> 
> i know that chmod 0600 /var/mail , will solve the problem
> and i will no longer receive the above errors again
You also have to make sure that autocreated INBOXs (i.e. a brand
new account) does not start out with anything other than 0600.
You may have to use dovecot's LDA or twist your LDA's arm to create
mailboxes that way.

I guess you can also avoid these errors by using memory indices, but
you forego the advantages of persistent indices.
> But my question is
> that incase i did not set chmod /var/mail 0600, can i ignore such
> errors, is these errors harmful ? if this errors keep coming and i
> ignored them would this cause mbx corruption .. please advise
No, you can't ignore these errors.  They will break IMAP access to
those mailboxes (as you will find out).

Joseph Tam <jtam.home at gmail.com>