[Dovecot] 1.07 to 1.0.13 mail_extra_groups

[Mark Sapiro]

I have just upgraded from 1.0.7 to 1.0.13. I read the comments in the
example .conf file and it seemed what I needed to enable dotlock
access to mailboxes in /var/spool/mail (writable by 'mail' group) was
"mail_privileged_group = mail" so I removed the "mail_extra_groups =
mail" that I had in 1.0.7 and added "mail_privileged_group = mail",
but I got errors like the following:

May  6 12:48:54 sbh16 dovecot: POP3(xxx): file_lock_dotlock() failed
with mbox file /var/spool/mail/xxx: Permission denied
May  6 12:48:54 sbh16 dovecot: POP3(xxx): Couldn't open INBOX: Internal
error occurred. Refer to server log for more information. [2008-05-06
12:48:54]
May  6 12:48:54 sbh16 dovecot: POP3(xxx): Couldn't open INBOX top=0/0,
retr=0/0, del=0/0, size=0
May  6 12:48:54 sbh16 dovecot: pop3-login: Login: user=<xxx>,
method=PLAIN, rip=72.52.113.36, lip=72.52.113.36, secured

I then put "mail_extra_groups = mail" back in the configuration. This
seems to have the effect of setting both "mail_privileged_group =
mail" and "mail_access_groups = mail" as well as issuing "Warning:
mail_extra_groups setting was often used insecurely so it is now
deprecated, use mail_access_groups or mail_privileged_group instead"
when dovecot is started.

So my question is what do I need. I thought it would be just
"mail_privileged_group = mail", but that doesn't work. Do I need both
"mail_privileged_group = mail" and "mail_access_groups = mail" or just
"mail_access_groups = mail".

Also, are the comments describing these in the example .conf file
correct, or are they reversed.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan