Hi list,

I am having trouble getting global ACLs to work correctly. This is, I assume, an issue separate from the one I reported a few days ago [1], where the imap process crashes when creating subfolders of folders with an ACL set.

As you can see from my 'dovecot -n' output below I have three namespaces; two private ("Backup" and the default, empty one) and one public ("Public"). I also use the autocreate plugin to create a few standard folders. Those folders, along with some others, should have some special permissions and restrictions in place. I.e. messages must not be deletable, the mailbox itself may not be deleted, etc.

I want to use global ACLs so that I don't have to put a dovecot-acl file in every folder that I want to have an ACL set. Thus, according to the wiki, if have set

acl:vfile:/etc/dovecot/acls

I can create files named "Sent", "Trash", "Drafts", "INBOX.Spam" and "Backup.sent", "Backup.received", "Public.Spam", "Public.Ham" in the directory /etc/dovecot/acls. These files contain the ACL, such as "owner lrp", "owner lrwsipk" and "authenticated lrwstipk". Any and all "dovecot-acl-list" files have been deleted before testing and reproducing that problem again just now.

Is there anything more to it? I ask, because I can't seem to get it to work correctly using this approach with global ACLs. Problems include:

• Can't get the mailboxes "Spam" and "Ham" under the "Public" namespace to show up in the mail client (Thunderbird, KMail, Horde/IMP) at all. These have the ACL "authenticated lrwstipk" set so the should be visible to authenticated clients, shouldn't they? All I see is the namespace with no mailboxes beneath it.
• Deleting messages from the "Backup.sent" or "Backup.received" mailboxes is possible from Thunderbird, KMail and Horde/IMP, despite having the ACL "owner rlp" set, which, if I understand correctly, should only allow users to lookup, read and post to the mailing list via LDA/Sieve.

What am I doing wrong? It seems to me that the global ACL files for namespaces other than the empty one are not at all considered? Do I have to use another notation for the ACL file names?

Any help is much appreciated.

Thanks in advance!

Configuration information follows.

Contents of /etc/dovecot/acl

Backup.received owner rlp Backup.sent owner rlp Drafts owner lrwstipk INBOX.Spam owner lrwstipk Public.Ham authenticated lrwstipk Public.Spam authenticated lrwstipk Sent owner lrwstipk Trash owner lrwstipk

'dovecot -n'

# 1.2.4: /usr/local/etc/dovecot.conf # OS: Linux 2.6.26-2-686 i686 Debian 5.0.2 log_timestamp: %Y-%m-%d %H:%M:%S protocols: managesieve imap imaps pop3 pop3s login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_executable(managesieve): /usr/local/libexec/dovecot/managesieve-login mail_access_groups: mail mail_privileged_group: mail mail_location: maildir:~/Maildir mail_drop_priv_before_exec: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_executable(managesieve): /usr/local/libexec/dovecot/managesieve mail_plugins(default): autocreate acl mail_plugins(imap): autocreate acl mail_plugins(pop3): mail_plugins(managesieve): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/local/lib/dovecot/managesieve namespace: type: public separator: . prefix: Public. location: maildir:/var/mail/public:CONTROL=~/Maildir/control/public:INDEX=~/Maildir/index/public list: yes namespace: type: private separator: . prefix: Backup. location: maildir:~/Maildir-backup hidden: yes list: no namespace: type: private separator: . inbox: yes list: yes subscriptions: yes lda: log_path: info_log_path: auth_socket_path: /var/run/dovecot/auth-master postmaster_address: postmaster@mailtest0.rise-s.com mail_plugins: sieve acl auth default: mechanisms: plain login passdb: driver: pam passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: passwd userdb: driver: static args: uid=vmail gid=vmail home=/var/vmail/%Ld/%Ln allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: sieve: ~/.dovecot.sieve sieve_dir: ~/sieve sieve_global_path: /etc/dovecot/sieve/default.sieve sieve_global_dir: /etc/dovecot/sieve/global/ sieve_before: /etc/dovecot/sieve/before/ autocreate: Trash autocreate2: Drafts autocreate3: Sent autocreate4: INBOX.Spam autosubscribe: Trash autosubscribe2: Drafts autosubscribe3: Sent autosubscribe4: INBOX.Spam acl: vfile:/etc/dovecot/acl

[1] http://dovecot.org/list/dovecot/2009-August/042467.html

Andreas Ntaflos Vienna, Austria

GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4