Here we go, however I prefer to start with a command that doesn't shoot the imap process in the foot:
$ gdb --args doveadm acl debug -u someuser shared/someotheruser
...
(gdb) where #0 0x00007ffff781df10 in rmdir () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007ffff7d6ccef in mailbox_list_delete_until_root (list=0x55555568ce58, path=0x55555568be58 "/var/mail/someotheruser", type=<optimized out>) at list/mailbox-list-delete.c:311 #2 0x00007ffff7d6d605 in mailbox_list_delete_mailbox_until_root (list=0x55555568ce58, storage_name=storage_name@entry=0x55555569a660 "INBOX") at list/mailbox-list-delete.c:342 #3 0x00007ffff7d6f542 in mailbox_list_iter_try_delete_noselect (info=0x555555699cd8, ctx=0x555555699c48, storage_name=0x55555569a660 "INBOX") at list/mailbox-list-iter-private.h:40 #4 fs_list_entry (ctx=0x555555699c48, entry=<optimized out>) at list/mailbox-list-fs-iter.c:755 #5 fs_list_next (ctx=<optimized out>) at list/mailbox-list-fs-iter.c:781 #6 fs_list_iter_next (_ctx=0x555555699c48) at list/mailbox-list-fs-iter.c:899 #7 0x00007ffff7d7733b in mailbox_list_index_sync_list (sync_ctx=0x555555699ba0) at list/mailbox-list-index-sync.c:322 #8 mailbox_list_index_sync (list=list@entry=0x55555568ce58, refresh=<optimized out>) at list/mailbox-list-index-sync.c:480 #9 0x00007ffff7d774eb in mailbox_list_index_refresh_force (list=list@entry=0x55555568ce58) at list/mailbox-list-index.c:649 #10 0x00007ffff7d795a0 in mailbox_list_index_refresh_if_found (list=0x55555568ce58, name=0x5555556953b0 "", selectable=true) at list/mailbox-list-index.c:910 #11 mailbox_list_index_refresh_if_found (list=0x55555568ce58, name=0x5555556953b0 "", selectable=<optimized out>) at list/mailbox-list-index.c:900 #12 0x00007ffff7d79660 in mailbox_list_index_update_mailbox (update=<optimized out>, box=0x555555694fe8) at list/mailbox-list-index.c:975 #13 mailbox_list_index_open_mailbox (box=0x555555694fe8) at list/mailbox-list-index.c:968 #14 0x00007ffff7d1502c in mailbox_open_full (box=box@entry=0x555555694fe8, input=input@entry=0x0) at ./src/lib-storage/mail-storage.c:1772 #15 0x00007ffff7d15229 in mailbox_open (box=0x555555694fe8) at ./src/lib-storage/mail-storage.c:1821 #16 0x00007ffff6cb970c in cmd_acl_debug_mailbox_open (ctx=0x555555649818, user=<optimized out>, mailbox=0x555555649378 "shared/someotheruser", box_r=0x7fffffffe640) at ./src/plugins/acl/doveadm-acl.c:370 #17 cmd_acl_debug_run (_ctx=0x555555649818, user=<optimized out>) at ./src/plugins/acl/doveadm-acl.c:514 #18 0x000055555558d5bb in doveadm_mail_next_user (ctx=0x555555649818, error_r=<optimized out>) at ./src/doveadm/doveadm-mail.c:506 #19 0x000055555558f2bf in doveadm_mail_cmd_exec (ctx=0x555555649818, wildcard_user=0x0) at ./src/doveadm/doveadm-mail.c:710 #20 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at ./src/doveadm/doveadm-mail.c:1039 #21 0x00005555555a36a9 in doveadm_cmdline_run (argc=<optimized out>, argv=0x55555561b7d0, cctx=cctx@entry=0x555555642218) at ./src/doveadm/doveadm-cmd-parse.c:451 #22 0x00005555555a3832 in doveadm_cmdline_try_run (cmd_name=cmd_name@entry=0x55555561b809 "acl", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x555555642218) at ./src/doveadm/doveadm-cmd.c:160 #23 0x000055555557cf3e in main (argc=<optimized out>, argv=<optimized out>) at ./src/doveadm/doveadm.c:386
Am 27.08.25 um 22:29 schrieb Timo Sirainen:
On 27. Aug 2025, at 12.30, pelzi--- via dovecot <dovecot@dovecot.org> wrote:
Found out what triggers the crashes: it is *not* the lexicographically lowest someotheruser, it is a someotheruser with a group acl active on its INBOX. If you manually remove the group acl from the affected mailbox's acl file, access is possible as granted to users in the remaining acl lines.
This can be tested just by dovecot acl debug - it crashes the same way as the imap process and is much easier to debug. To provoke crashing, just issue something like:
$ doveadm acl add -u someuser shared/someotheruser/INBOX group=somegroup lookup
This command will try to rmdir someotheruser's inbox file, then crash, plus any subsequent calls like I can reproduce the crash, but not the rmdir() error. Not really sure where it's coming from. Can you get a gdb backtrace to it as well? Maybe:
gdb --args doveadm acl add -u someuser shared/someotheruser/INBOX group=somegroup lookup b rmdir run
Or if that doesn't work for some reason, you should be able to get a core dump from all errors with:
log_core_filter = category=error