Pkg exim4 users - Apr 2006 - /var/spool/exim4/input/... Permission denied

When I try to send an email I get back the error
2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool file
/var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission denied.
(that''s not a cut and paste, so might have goofs.  The // is in the
original).

This is on a newly created Debian testing system that I''m trying to
get working.  I''m seeing the errors from mutt ("output of the
delivery
process"); there doesn''t seem to be anything in the exim logs.

Any ideas what is going on?

/var/spool/exim4/input is owned by Debian-exim and has permissions
drwxr-x---, same as on another system in which everything is working
fine.  exim4-daemon-heavy 4.60-4.  The other system uses daemon-light.

Ross Boylan


P.S. I''m also having clock/time-zone problems.  Mentioning it just in
case this is some weird timestamp issue,

On 2006-04-17 Ross Boylan <ross@biostat.ucsf.edu>
wrote:
> When I try to send an email I get back the error
> 2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool file
> /var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission denied.
> (that''s not a cut and paste, so might have goofs.  The // is in
the
> original).
> This is on a newly created Debian testing system that I''m trying
to
> get working.  I''m seeing the errors from mutt ("output of the
delivery
> process"); there doesn''t seem to be anything in the exim
logs.
> Any ideas what is going on?
[...]

Hmm. Disk full, no more inodes (df -i), lost SUID bit on the binary?
How do the permissions of
/var/, /var/spool/, /var/spool/exim4/ and /var/spool/exim4/input look
like?
              cu andreas
-- 
The ''Galactic Cleaning'' policy undertaken by Emperor Zhark is
a personal
vision of the emperor''s, and its inclusion in this work does not
constitute
tacit approval by the author or the publisher for any such projects,
howsoever undertaken.                                (c) Jasper Ffforde

On Mon, Apr 17, 2006 at 09:16:02AM +0200, Andreas Metzler
wrote:
> On 2006-04-17 Ross Boylan <ross@biostat.ucsf.edu> wrote:
> > When I try to send an email I get back the error
> > 2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool file
> > /var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission denied.
> > (that''s not a cut and paste, so might have goofs.  The // is
in the
> > original).
> 
> > This is on a newly created Debian testing system that I''m
trying to
> > get working.  I''m seeing the errors from mutt ("output
of the delivery
> > process"); there doesn''t seem to be anything in the exim
logs.
> 
> > Any ideas what is going on?
> [...]
> 
> Hmm. Disk full, no more inodes (df -i), lost SUID bit on the binary?
> How do the permissions of
> /var/, /var/spool/, /var/spool/exim4/ and /var/spool/exim4/input look
> like?
>               cu andreas
Those checks appear below, but first, the most suspicious thing:
corn:~# reiserfsck /var
reiserfsck 3.6.19 (2003 www.namesys.com)

*************************************************************
** If you are using the latest reiserfsprogs and  it fails **
** please  email bug reports to reiserfs-list@namesys.com, **
** providing  as  much  information  as  possible --  your **
** hardware,  kernel,  patches,  settings,  all reiserfsck **
** messages  (including version),  the reiserfsck logfile, **
** check  the  syslog file  for  any  related information. **
** If you would like advice on using this program, support **
** is available  for $25 at  www.namesys.com/support.html. **
*************************************************************

Will read-only check consistency of the filesystem on /var
Will put log info to ''stdout''

Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes
bread: Cannot read the block (2): (Is a directory).
reiserfs_open: bread failed reading block 2
bread: Cannot read the block (16): (Is a directory).
reiserfs_open: bread failed reading block 16

reiserfs_open: the reiserfs superblock cannot be found on /var.
Failed to open the filesystem.

If the partition table has not been changed, and the partition is
valid  and  it really  contains  a reiserfs  partition,  then the
superblock  is corrupted and you need to run this utility with
--rebuild-sb.

-----------------------------------------------------------

The output from df -i looks screwy, but I seem to be able to copy
other files onto the partition.  It''s got so much on it because
I''m
using it for backup.

corn:~# df /var/spool/exim4/input
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/evms/Var         40958680  36864376   4094304  91% /var
corn:~# df -i !$
df -i /var/spool/exim4/input
Filesystem            Inodes   IUsed   IFree IUse% Mounted on
/dev/evms/Var              0       0       0    -  /var
corn:~# ls -l /usr/sbin/exim4
-rwsr-xr-x  1 root root 793248 2006-02-22 02:50 /usr/sbin/exim4
corn:~# ls -ld /var/spool/exim4/input
drwxr-x---  2 Debian-exim Debian-exim 48 2006-04-06 08:33 /var/spool/exim4/input
corn:~# ls -ld /var/spool/exim4/
drwxr-x---  5 Debian-exim Debian-exim 120 2006-02-14 06:10 /var/spool/exim4/
corn:~# ls -ld /var/spool/
drwxr-xr-x  6 root root 168 2006-02-14 14:11 /var/spool/
corn:~# ls -ld /var/
drwxr-xr-x  15 root root 344 2006-02-05 19:52 /var/
corn:~# ls -ld /
drwxr-xr-x  24 root root 696 2006-04-15 14:26 /

On 2006-04-18 Ross Boylan <ross@biostat.ucsf.edu>
wrote:
> On Mon, Apr 17, 2006 at 09:16:02AM +0200, Andreas Metzler wrote:
>> On 2006-04-17 Ross Boylan <ross@biostat.ucsf.edu> wrote:
>>> When I try to send an email I get back the error
>>> 2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool file
>>> /var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission denied.
[...]
> Those checks appear below, but first, the most suspicious thing:
[...]
> The output from df -i looks screwy, but I seem to be able to copy
> other files onto the partition.  It''s got so much on it because
I''m
> using it for backup.
[...]
> corn:~# df -i !$
> df -i /var/spool/exim4/input
> Filesystem            Inodes   IUsed   IFree IUse% Mounted on
> /dev/evms/Var              0       0       0    -  /var
That''s ok, exim should be able do deal with IFree=0 (if inodes
total=0, too)

echo foo | exim -d postmaster@localhost

might be more helpful.

(use any working local or non-local address for postmaster@localhost)

cu and- just fishing -reas
-- 
The ''Galactic Cleaning'' policy undertaken by Emperor Zhark is
a personal
vision of the emperor''s, and its inclusion in this work does not
constitute
tacit approval by the author or the publisher for any such projects,
howsoever undertaken.                                (c) Jasper Ffforde

On Tue, Apr 18, 2006 at 09:12:08AM +0200, Andreas Metzler
wrote:
> On 2006-04-18 Ross Boylan <ross@biostat.ucsf.edu> wrote:
> > On Mon, Apr 17, 2006 at 09:16:02AM +0200, Andreas Metzler wrote:
> >> On 2006-04-17 Ross Boylan <ross@biostat.ucsf.edu> wrote:
> >>> When I try to send an email I get back the error
> >>> 2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool
file
> >>> /var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission denied.
> [...]
> > Those checks appear below, but first, the most suspicious thing:
> [...]
Is the alarming looking output of reiserfsck not an indication of a
problem?
> > The output from df -i looks screwy, but I seem to be able to copy
> > other files onto the partition.  It''s got so much on it
because I''m
> > using it for backup.
> [...]
> > corn:~# df -i !$
> > df -i /var/spool/exim4/input
> > Filesystem            Inodes   IUsed   IFree IUse% Mounted on
> > /dev/evms/Var              0       0       0    -  /var
> 
> That''s ok, exim should be able do deal with IFree=0 (if inodes
> total=0, too)
> 
> echo foo | exim -d postmaster@localhost
> 
> might be more helpful.
> 
> (use any working local or non-local address for postmaster@localhost)
> 
I''m not sure what you mean by "working," since things seem
broken.

Thanks for helping me with this.

Ross

On 2006-04-18 Ross Boylan <ross@biostat.ucsf.edu>
wrote:
> On Tue, Apr 18, 2006 at 09:12:08AM +0200, Andreas Metzler wrote:
[...]
> Is the alarming looking output of reiserfsck not an indication of a
> problem?
I honestly do not know, I''ve never been brave enough to use ReiserFS
myself.
[...] 
>> echo foo | exim -d postmaster@localhost
>> might be more helpful.
>> (use any working local or non-local address for postmaster@localhost)
> I''m not sure what you mean by "working," since things
seem broken.
Any address that exim can route (You might have configured it to
only accept local mail and not to be able to send to internet hosts.)
      cu andreas
-- 
The ''Galactic Cleaning'' policy undertaken by Emperor Zhark is
a personal
vision of the emperor''s, and its inclusion in this work does not
constitute
tacit approval by the author or the publisher for any such projects,
howsoever undertaken.                                (c) Jasper Ffforde

Um 08:31 Uhr am 18.04.06 schrieb Ross Boylan:
> On Tue, Apr 18, 2006 at 09:12:08AM +0200, Andreas Metzler wrote:
>> On 2006-04-18 Ross Boylan <ross@biostat.ucsf.edu> wrote:
>>> On Mon, Apr 17, 2006 at 09:16:02AM +0200, Andreas Metzler wrote:
>>>> On 2006-04-17 Ross Boylan <ross@biostat.ucsf.edu> wrote:
>>>>> When I try to send an email I get back the error
>>>>> 2006-04-16 02:54:59 1FV3y7-0002Nr-PM Failed to create spool
file
>>>>> /var/spool/exim4/input//1FV3y7-0002Nr-PM-D: Permission
denied.
>>> Those checks appear below, but first, the most suspicious thing:
 
> Is the alarming looking output of reiserfsck not an indication of a 
> problem?
No, since you used it the wrong way. You have to use reiserfsck on the 
device (in your case /dev/evms/Var) and not on the directory the device is 
mounted on.

BTW: _Never_ check a live filesystem.
 
Gr??e,
S?

-- 
Sven Hartge -- professioneller Unix-Geek
Meine Gedanken im Netz: http://www.svenhartge.de/

Achtung, neue Mail-Adresse: sven@svenhartge.de

On Wed, Apr 19, 2006 at 08:28:39PM +0200, Andreas Metzler wrote:
... [offlist diagnosis of log file]
> 
> So exim has not got root priviledges even freshly after executing
> /usr/sbin/exim4. This is usually caused by the binary not being SUID
> root, however we already ruled that out. - Is perhaps /usr/sbin
> mounted with nosuid (e.g mount option user implies it)
> 
Yes.  I removed it (all of /usr), and all''s well.

I must have done that deliberately, in a fit of security
consciousness, but I''d completely forgotten.  Thanks for helping me
track that down.

I had sprinkled nosuid and nodev over lots of things; I''ve now removed
them.  I started with /usr, but then realized /var probably needs it
off too (since some stuff runs chroot there, or at least runs
there--hylafax, I think).  And maybe I''ll build something in
/usr/local that needs it.  So I just took it off everywhere.