[Dovecot] misconception in uid and gid

[Steffen Kaiser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 1 Aug 2013, Felix Rubio Dalmau wrote:

> 	I'm using a SQL database to store the usernames and passwords of my users. However, I have found that I must explicitly return the uid and gid with every query, even though all virtual users use the same uid and gid. The query, that works, is:
>
> 	user_query = SELECT mail, 'vmail' AS uid, 'vmail' AS gid, home, CONCAT('*:storage=', quota_MB*1024) AS quota_rule \
>             FROM virtual_users AS V LEFT JOIN virtual_domains AS D ON V.domain_id=D.id WHERE V.user='%n' AND D.name='%d'
>
> Nevertheless, if I remove the segments "'vmail' AS uid, 'vmail' AS gid" and modify the file conf.d/10-mail.conf to show
>
> 	mail_uid = vmail
> 	mail_gid = vmail
>
> I get this error:
>
> 	dovecot: auth: Error: userdb(<mail>): client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (change userdb socket permissions)
>
> Does anybody know what is wrong in my set-up?

Did you posted your setup (aka configuration, dovecot -n) somewhere to 
look at?

You seem to use an elder Dovecot, because newer versions use a more 
descriptive error message, see: 
http://www.dovecot.org/list/dovecot/2012-November/069651.html

Because, first you need to know which socket makes the problem, then you 
can see, if changing the owner helps. This error has nothing to do with 
Unix permission per se, but you can disable Dovecot's access checks when 
you chmod a+x that particular socket.

IMHO, the check itself tests if the querying Unix uid is either the owner 
or group member of the socket or owner of the retrieved record. In a 
single uid-system this check has no meaning - on a dedicated mail system 
at least. Because the global mail_uid has no meaning in the auth code (as 
this is no "default" value), you are left with:

a) return uid with the query _and_ have all users use the same uid,or
b) disable the Dovecot check by changing the socket's Unix permission to 
something different that 0666, e.g. set x-Unix-permission,or
c) change the owner of the socket to vmail (then root cannot access the 
entries, if necessary),or
d) put all Unix users, that access the socket, into one group and have the 
socket owned by that group.

This is the code ./src/auth/auth-master-connection.c:

st contains the data of the socket, cred the data of the accessing user, 
when conn->userdb_restricted_uid is set, later in the code the entries 
owner uid must match that number.


/*!!! at this point variant b) would apply */
         /* figure out what permissions we want to give to this client */
         if ((st->st_mode & 0777) != 0666) {
                 /* permissions were already restricted by the socket
                    permissions. also +x bit indicates that we shouldn't do
                    any permission checks. */
                 return 0;
         }

[snip]

/*!!! at this point variants c) and d) would apply */
         if (cred.uid == st->st_uid || cred.gid == st->st_gid) {
                 /* full permissions */
                 return 0;
         } else {
                 /* restrict permissions: return only lookups whose 
returned
                    uid matches the peer's uid */
                 conn->userdb_restricted_uid = cred.uid;
                 return 0;
         }


- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUftX5l3r2wJMiz2NAQLPBgf+M8jdWIjLttu+dl/aIKAmuAGnt8qreBa1
dxfeinqNdzd14ZaJUnF+hjSUeyVdydeuRwhMXXtPoAFdT+S4Uf5AG4yAT6iMqZPX
nalaTMxCCymUuEBxX3K8LvD6iT5cmAdFP0ejTivSiDuOw2i76t0qsfyIi+2e26jd
i46jvEmQxYu6WMtZrUnmjb+5d46BPNL/8hWjNo7yT4sqdMI+GEZO5Osfv+VsqUNd
zoQPDrcoDT+CtMqi4pdEFJbR5QTNppu56Gs0ibNMhSO3NvHleKAy2+jtmx5FyLjk
uvnxjsh9wjGi24UiAXD1knJqiZqrx5J3FTZMDdPQejHmSjGsYPdPCw==
=RHpW
-----END PGP SIGNATURE-----