[Dovecot] Dovecot not handling r/o mailboxes completely, and problem with ACL as a workaround

[Adam McDougall]

First of all, I think dovecot is really fantastic and I have thanks for all
the hard work.  I think it will be the best fit for my ~5000 users when I 
have it setup completely.  We normally have approx 500 concurrent IMAP
connections during the day.  

I am trying to convert from courier-imap to dovecot, but I have an issue with
public namespace folders that are not writable by certain users.  Please let me
know if I need to provide more information or how I can help solve this issue.

In courier-imap, we were able to take advantage of the maildir structure 
and standard unix users/groups to allow 'decsstaff' members to have full write 
access while 'decsall' members only have r/o unless also a member of 
'decsstaff':

-rw-rw-r--  1 postlocal  decsstaff  37597 May  5 23:37 
/egr/mail/shared/decs/.support.In/cur/1178422658.M533373P54269.ice
drwxrwxr-x  2 postlocal  decsstaff  24576 May  5 23:37 
/egr/mail/shared/decs/.support.In/cur
drwxrws---  6 postlocal  decsall  4096 Apr 22 18:08 /egr/mail/shared/decs/.support.In
drwxrwsr-x  34 postlocal  wheel  4096 May  1 07:23 /egr/mail/shared/decs

In short, upper directories are used to limit world access to just one group 
'decsall', and once inside, r/o world access could be used as an anonymous 
substitution for 'decsall' and the group permissions would allow writing by 
'decsstaff'.  I don't know how courier stores and checks mail directory 
permissions, but it was aware when a user would not be able to delete or change 
messages and would return a READ-ONLY imap error when an attempt to change a 
message occurred (courier returns this in the IMAP response to update mail flags 
to reflect that the client wants to move to delete a mail).  I understand that 
imap clients will usually only set status as read or deleted first and only try 
to delete an email for real on expunge, but it seems dovecot does not try to 
detect if a message is modifyable before it is too late for the user to find 
out.  What happens is a user appears to be able to mark messages read, move them 
to another folder, or delete them (another way of moving to another folder eg. 
Trash).  The user is clueless that the changes will not occur, and only finds 
out later when they reload the folder to find the messages back, or tries to 
expunge and get an unhelpful 'internal error' from dovecot (I can help trace 
this situation if it helps, but I think that stage should not be reached if 
things were working right).  My configuration has the public folder control and 
indexes inside a user's home directory, so it will always be possible for 
dovecot to record message status changes, however I do not think dovecot should 
update the control and indexes to reflect an IMAP operation that is not allowed 
to complete due to restricted permissions on the actual email file.  I suppose 
dovecot would have to check the permissions on mail message files.

As a workaround, I wondered if I could apply dovecot ACLs to the public folders 
to reinforce my intentions of only allowing readonly access to certain users. If 
ACLs worked, I could even use it as a viable alternative to the unix permissions 
on the maildir contents and avoid using more unix groups than necessary.  For 
most of our shared mailboxes, there will only be a few persons with write 
access, and up to a dozen people with read access, so even if I have to list 
every user seperately I could.  However, I have not been able to get ACLs to do 
anything useful for me, and I hesitate to use the feature to work around might 
be a configuration error or bug.  It is also more convenient for my migration 
procedure if I do not have to modify file permissions or structure during 
downtime to switch to dovecot.  I am still not sure how dovecot ACLs affect the 
actual permissons of dovecot processes.  I have mostly tried placing a 
dovecot-acl file in the maildir directory (alongside cur, tmp, new) and dovecot 
seems to be reading it according to the log, however I am not getting expected 
results from the ACLs.  If the unix permissions allow a client to enter 'cur' 
and read mails, the mail client thinks it can delete or move them (until 
expunge) no matter even if I put acl entries with only 'r' permission.

ACL questions (which might help others understand better as well):
Is a 'user=foo rl' entry supposed to remove any possible write permissions in a 
maildir covered by such an ACL for user foo?  If not, shouldn't it at least 
enforce restrictions on the available mail metadata which is more likely to be 
writable by the user?

Is it even possible for an ACL to grant additional permissions above what is 
granted to a user by standard unix permissions?

Does an empty ACL equate to the exact permissions granted by unix, and should an 
admin try to design an ACL to modify as little as possible, or should the admin 
try to use enough acl entries to form a complete description of the desired 
resulting permissions? I get the impression that broad ACLs should be listed 
first, and more specific ACLS listed below can add or remove ACL permissions 
applied earlier in the file as a 'last match' case.

Should the acl plugin be able to print a summary of the resulting permissions in 
the log (with mail_debug=yes) when accessing a folder with an ACL?


A snip from logs, I generated alot today and I'm not sure which portions
would be most useful so I'll start with this:
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): acl: initializing backend with data: vfile:/usr/local/etc/dovecot-acls
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): acl: acl username = mcdouga9
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): acl: owner username =
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): acl vfile: Global ACL directory: /usr/local/etc/dovecot-acls
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): Namespace: type=public, prefix=#shared/decs/, sep=/, inbox=no, hidden=no, subscriptions=no
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): maildir: data=/egr/mail/shared-dovecot2/decs:CONTROL=/home/mcdouga9/Maildir/dovecot/public/control/decs:INDEX=/home/mcdouga9/Maildir/dovecot/public/indexes/decs
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): maildir: root=/egr/mail/shared-dovecot2/decs, index=/home/mcdouga9/Maildir/dovecot/public/indexes/decs, control=/home/mcdouga9/Maildir/dovecot/public/control/decs, inbox=
May  6 15:20:08 gribble dovecot: IMAP(mcdouga9): opendir(/egr/mail/shared-dovecot2/decs/tmp) failed: Permission denied


# dovecot --version
1.0.0

The reason I have so many public spaces below, is to match the existing
directory structure we setup for courier, and also to help us keep the
directory listing more tidy since otherwise we would end up with many folders
all under one directory.  Some of them have monthly rotation and it could get
out of hand if we did not split them up.  I understand it makes things more 
difficult for the global acl list at present, if I were to use it, but 
I may not have any conflicting folder names at this time. 

# dovecot -n
# /usr/local/etc/dovecot.conf
ssl_cert_file: /usr/local/etc/apache2/ssl/mail.egr.msu.edu.pem
ssl_key_file: /usr/local/etc/apache2/ssl/mail.egr.msu.edu.pem
login_dir: /var/run/dovecot/login
login_executable: /usr/local/libexec/dovecot/imap-login
verbose_proctitle: yes
first_valid_uid: 1000
first_valid_gid: 0
mail_location: 
maildir:~/Maildir:CONTROL=%h/Maildir/dovecot/private/control:INDEX=%h/Maildir/dovecot/private/indexes
mail_debug: yes
mmap_disable: yes
maildir_copy_with_hardlinks: yes
mail_plugins: acl
mail_log_max_lines_per_sec: 0
imap_client_workarounds: delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep
namespace:
  type: public
  separator: /
  prefix: #shared/be/
  location: 
maildir:/egr/mail/shared-dovecot2/be:CONTROL=%h/Maildir/dovecot/public/control/be:INDEX=%h/Maildir/dovecot/public/indexes/be
namespace:
  type: public
  separator: /
  prefix: #shared/cee/
  location: 
maildir:/egr/mail/shared-dovecot2/cee:CONTROL=%h/Maildir/dovecot/public/control/cee:INDEX=%h/Maildir/dovecot/public/indexes/cee
namespace:
  type: public
  separator: /
  prefix: #shared/chems/
  location: 
maildir:/egr/mail/shared-dovecot2/chems:CONTROL=%h/Maildir/dovecot/public/control/chems:INDEX=%h/Maildir/dovecot/public/indexes/chems
namespace:
  type: public
  separator: /
  prefix: #shared/decs/
  location: 
maildir:/egr/mail/shared-dovecot2/decs:CONTROL=%h/Maildir/dovecot/public/control/decs:INDEX=%h/Maildir/dovecot/public/indexes/decs
namespace:
  type: public
  separator: /
  prefix: #shared/egr/
  location: 
maildir:/egr/mail/shared-dovecot2/egr:CONTROL=%h/Maildir/dovecot/public/control/egr:INDEX=%h/Maildir/dovecot/public/indexes/egr
namespace:
  type: public
  separator: /
  prefix: #shared/me/
  location: 
maildir:/egr/mail/shared-dovecot2/me:CONTROL=%h/Maildir/dovecot/public/control/me:INDEX=%h/Maildir/dovecot/public/indexes/me
namespace:
  type: public
  separator: /
  prefix: #shared/org/
  location: 
maildir:/egr/mail/shared-dovecot2/org:CONTROL=%h/Maildir/dovecot/public/control/org:INDEX=%h/Maildir/dovecot/public/indexes/org
namespace:
  type: public
  separator: /
  prefix: #shared/toptest/
  location: 
maildir:/egr/mail/shared-dovecot2/toptest:CONTROL=%h/Maildir/dovecot/public/control/toptest:INDEX=%h/Maildir/dovecot/public/indexes/toptest
namespace:
  type: public
  separator: /
  prefix: #shared/ugs/
  location: 
maildir:/egr/mail/shared-dovecot2/ugs:CONTROL=%h/Maildir/dovecot/public/control/ugs:INDEX=%h/Maildir/dovecot/public/indexes/ugs
namespace:
  type: public
  separator: /
  prefix: #shared/vprgs/
  location: 
maildir:/egr/mail/shared-dovecot2/vprgs:CONTROL=%h/Maildir/dovecot/public/control/vprgs:INDEX=%h/Maildir/dovecot/public/indexes/vprgs
namespace:
  type: private
  separator: /
  prefix: mail/
  hidden: yes
namespace:
  type: private
  separator: /
  location: 
maildir:~/Maildir:CONTROL=%h/Maildir/dovecot/private/control:INDEX=%h/Maildir/dovecot/private/indexes
  inbox: yes
auth default:
  mechanisms: plain login
  passdb:
    driver: pam
  userdb:
    driver: passwd
  socket:
    type: listen
    client:
      path: /var/spool/postfix/private/auth
      user: postfix
      group: postfix
    master:
plugin:
  acl: vfile:/usr/local/etc/dovecot-acls

Thanks.