On 3.1.2011, at 19.15, Michal Hlavinka wrote:

I'm facing problem with mail group privileges (again), because I've heard a few complains. I was looking at old emails and list archives, but still does not know the answer. In default (fedora/rhel) setup mail group and 0660 privileges are used.

I still think this is the main problem. Mailboxes should be 0600. There's no reason why they should be 0660. There is very close to zero (if not zero) installations where 0660 makes any sense. It's just an extra potential security problem.

Shouldn't mkdir and chown make together a transaction? When it fails just for first time, it confuses some admins (this is the reason why I'm getting complains (bug reports) just because missing/wrong configuration). I think it a) should work even for first connection (ignore chown failure) or b)it should not work for following connection, so the behavior should be more consistent.

Sounds reasonable, yes. (Not such which one, a or b.) I should probably do something about it, but it's still about how to handle an error condition, so not a hugely important thing.

Also it seems unclear what configuration option is required for making this work in new dovecot versions where configuration is split to mail_privileged_group and mail_access_groups. I see that after reading documentation in 10-mail.conf, some admins expects mail_privileged_group to be enough while mail_access_group is required to prevent fchown failure. Would it be possible to explicitly mention in the config file what option is required? I can add patch with this to our rpm, but we always prefer to be as close to the upstream as possible. Thanks

mail_privileged_group affects only the .lock file creation, so only mail_access_groups can help here. But I don't think that should be necessary either.