Le 30 juil. 2013 à 12:28, Timo Sirainen a écrit :

On 14.7.2013, at 19.54, Axel Luttgens wrote:

...

[...]

Going on with our telnet session:

recipient=john.doe@example.com size=10000

action=OK

Hmmm... OK, this may be a config problem of mine which may require further investigation.

Did you solve this?

Hello Timo,

Nice to read from you.

Unfortunately, no; I'm still stuck with that problem, as described in: http://www.dovecot.org/list/dovecot/2013-July/091462.html

...

[...]

Is this the expected behavior, to have quota-status switch to another user?

Either one of these fixes would be sufficient:

http://hg.dovecot.org/dovecot-2.2/rev/2470bb9106b0 http://hg.dovecot.org/dovecot-2.2/rev/51b8020b29f6

Thanks! Do you really mean "either", not "both"? I ask, because those patches seem to intervene at quite different levels (but I guess I'll have, one day or another, to get more acquainted with Dovecot's coding, so as not to come with such silly questions...).

Yet another possibility would be to use service { service_count=1 } to recreate the process every time.

Yes, but I fear some inefficiencies with such an extreme setting; in fact, I hoped to rely on Postfix for managing the service's life cycle.

Best Regards, Axel

On 1.8.2013, at 13.11, Axel Luttgens AxelLuttgens@swing.be wrote:

Le 30 juil. 2013 à 20:36, Axel Luttgens a écrit :

...

[...] Do you really mean "either", not "both"? I ask, because those patches seem to intervene at quite different levels (but I guess I'll have, one day or another, to get more acquainted with Dovecot's coding, so as not to come with such silly questions...). […]

I meant "either".

So, even if I could only test a unique mail uid/gid (i.e. dovemailer/dovemailer) kind of setup, I've applied both patches so as to verify they don't enter in conflict. On the other hand, trying to run the service as another user:

service quota-status { client_limit = 1 executable = quota-status -p postfix user = dovemailer group = dovemailer unix_listener /var/spool/postfix/private/quota-policyd { user = postfix } }

unfortunately still requires to relax the permissions on the config unix socket:

service config { unix_listener config { group = dovemailer mode = 0660 } }

so as to avoid such immediate failures:

quota-status: Fatal: Error reading configuration: net_connect_unix(/_ROOT/var/run/dovecot/config) failed: Permission denied master: Error: service(quota-status): command startup failed, throttling for 2 secs

Yeah. Hmm. I guess this is a good idea to fix too: http://hg.dovecot.org/dovecot-2.2/rev/eb63eca74471

Although now if the config process crashes, this error comes back and Dovecot can't fix it automatically. That's in my TODO as well. Config process never crashes though :)

But now a failure, very likely related to patch 2470bb9106b0, occurs at the first query:

quota-status: Fatal: seteuid(0) failed: Operation not permitted

Fixed: http://hg.dovecot.org/dovecot-2.2/rev/43488e1044c9

On Thu, Aug 01, 2013 at 02:31:31PM +0200, Axel Luttgens wrote:

http://hg.dovecot.org/dovecot-2.2/rev/2470bb9106b0 http://hg.dovecot.org/dovecot-2.2/rev/51b8020b29f6 http://hg.dovecot.org/dovecot-2.2/rev/eb63eca74471 http://hg.dovecot.org/dovecot-2.2/rev/43488e1044c9

Is there any chance to get these backported to 2.1 as well? After all, it has the same issues without these patches.

The individual patches seem to apply just fine to current 2.1 tip without any code changes:

$ patch -p1 < p/2470bb9106b0 patching file src/lib-storage/mail-storage-service.c Hunk #1 succeeded at 946 (offset -21 lines). Hunk #2 succeeded at 966 (offset -21 lines). $ patch -p1 < p/51b8020b29f6 patching file src/plugins/quota/quota-status.c Hunk #1 succeeded at 218 (offset 3 lines). $ patch -p1 < p/eb63eca74471 patching file src/lib-master/master-service-settings.c Hunk #1 succeeded at 323 (offset -13 lines). patching file src/lib-master/master-service-settings.h Hunk #1 succeeded at 53 (offset -3 lines). patching file src/lib-master/master-service.c Hunk #1 succeeded at 229 (offset -7 lines). patching file src/lib-master/master-service.h Hunk #1 succeeded at 12 (offset -3 lines). $ patch -p1 < p/43488e1044c9 patching file src/lib-storage/mail-storage-service.c Hunk #1 succeeded at 728 with fuzz 2 (offset -20 lines).

After that, everything works just fine and as expected, as Axel described for 2.2:

• Running under non-root user is possible
• Querying for more than one user under the same connection is possible

$ printf "recipient=m.mustermann@example.net\nsize=1234\n\nrecipient=m.mustermann@example.net\nsize=12340000\n\nrecipient=test@example.net\nsize=12340000\n\n" | nc 127.0.0.1 12340 action=OK

action=REJECT Over quota

action=REJECT Over quota

So it seems to me that I can apply them well enough on my own. I'd just like them to come with the default source, so I cannot forget them when upgrading. :-)

Ulrich