ACL group vs. owner question

[Peter Chiochetti]

A hopefully simple question regarding the use of ACLs - the spirit being 
of taking away most permissions first and then adding them back selectively:

In the global ACL declaration I have:

> * owner lr
> * group=SYS lrwstipekxa

The owner is put into the SYS group via userdb extra field in static 
passwd file ("archiv" is a system user, but pam is disabled for the server):

> archiv:::::::userdb_acl_groups=SYS

Still, the group permissions do not get applied:

> root at host:/etc/dovecot# doveadm -D acl debug -u archiv INBOX
> […]
> doveadm(archiv): Debug: Added userdb setting: plugin/acl_groups=SYS
> doveadm(archiv): Debug: Effective uid=1002, gid=1001, home=/home/archiv
> doveadm(archiv): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled
> doveadm(archiv): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir
> doveadm(archiv): Debug: maildir++: root=/home/archiv/Maildir, index=, indexpvt=, control=, inbox=/home/archiv/Maildir, alt=
> doveadm(archiv): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl
> doveadm(archiv): Debug: acl: acl username = archiv
> doveadm(archiv): Debug: acl: owner = 1
> doveadm(archiv): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl
> doveadm(archiv): Info: Mailbox 'INBOX' is in namespace ''
> doveadm(archiv): Info: Mailbox path: /home/archiv/Maildir
> doveadm(archiv): Info: All message flags are shared across users in mailbox
> doveadm(archiv): Debug: acl vfile: file /home/archiv/Maildir/dovecot-acl not found
> doveadm(archiv): Info: User archiv has rights: lookup read
> doveadm(archiv): Info: Mailbox in user's private namespace
> doveadm(archiv): Info: Mailbox INBOX is visible in LIST

My question: Shouldn't this work? (In a stock setup.)


PS: when I add "* group-override=SYS" to /etc/dovecot/dovecot-acl the 
user will not even be able to list INBOX.

PPS: As an aside, the setup also switches any sytem or /virtual/ users 
during login in local.conf:
> userdb {
>         driver = static
>         args = uid=archiv gid=archiv home=/home/archiv user=archiv
> }
but I get the above result without that switching when I make it read:
> userdb {
>    driver = static
>    args = home=/home/archiv
> }
So I suppose that it's not relevant in this case…

Thank you in advance

-- 
peter