[Dovecot] Occasional fchown errors?

[David Ford]

Use this patch, it fixes dovecot's ownership inheritance assumptions.

Colt ~ # cat
/usr/local/portage/net-mail/dovecot/files/dovecot-2.0.5-bad-permissions-inheritance.patch

--- src/lib-storage/mailbox-list.c.orig 2010-09-14 11:03:18.000000000 -0400
+++ src/lib-storage/mailbox-list.c      2010-10-14 15:20:15.000000000 -0400
@@ -25,6 +25,9 @@
 #include <unistd.h>
 #include <dirent.h>
 #include <sys/stat.h>
+#include <stdlib.h>
+#include <grp.h>
+#include <pwd.h>
 
 /* 20 * (200+1) < 4096 which is the standard PATH_MAX. Having these
settings
    prevents malicious user from creating eg. "a/a/a/.../a" mailbox name and
@@ -450,7 +453,7 @@
                }
 
                if (S_ISDIR(st.st_mode) && (st.st_mode & S_ISGID) != 0) {
-                       /* directory's GID is used automatically for new
+                       /* directory is sgid, so GID is used
automatically for new
                           files */
                        *gid_r = (gid_t)-1;
                } else if ((st.st_mode & 0070) >> 3 == (st.st_mode &
0007)) {
@@ -460,8 +463,39 @@
                } else if (getegid() == st.st_gid) {
                        /* using our own gid, no need to change it */
                        *gid_r = (gid_t)-1;
-               } else {
-                       *gid_r = st.st_gid;
+               }
+
+               else {
+                       /* test for unusable inheritance. logic sets
fgid_me to st.gid
+                          for unlikely case of lookup failure and we
just fall through */
+                       int j, ngroups = 999;
+                       gid_t *groups;
+                       gid_t fgid_me = st.st_gid;
+
+                       groups = malloc(ngroups * sizeof (gid_t));
+                       if (groups != NULL) {
+                               uid_t egid = getegid();
+                               struct passwd *pw = getpwuid(geteuid());
+                               if (pw != NULL) {
+                                       /* get pw entry for test using
my current effective uid */
+                                       if (getgrouplist(pw->pw_name,
egid, groups, &ngroups) != -1) {
+                                               /* get list of group IDs
my euid belongs to, ngroups
+                                                  will be set to the
number of groups I belong to */
+                                               fgid_me = egid;
+                                               for (j = 0; j < ngroups;
j++) {
+                                                       /* enumerate
list, test to see if i belong
+                                                          to gid of
parent directory */
+                                                       if (st.st_gid ==
groups[j]) {
+                                                               /* if
so, switch to parent gid */
+                                                               fgid_me
= st.st_gid;
+                                                       }
+                                               }
+                                       }
+                               }
+                               free(groups);
+                       }
+
+                       *gid_r = fgid_me;
                }
        }



On 11/10/2010 01:34 PM, Knute Johnson wrote:
> Hi:
>
> I get the occasional error below.  Is there something I don't have
> configured correctly?  Or should I just ignore this?  It is not always
> this file, sometimes it is the cache.lock file or the log.newlock
> file.  I have a mail client running on my computer and my phone at the
> same time, could that have something to do with it?
>
> Nov 10 08:32:59 rabbitbrush dovecot: IMAP(bob):
> fchown(/home/bob/mail/.imap/INBOX/dovecot.index.tmp, -1, 8(mail))
> failed: Operation not permitted (egid=1000(bob), group based on
> /var/mail/bob)
>
> From dovecot -n
>
> # 1.2.9: /etc/dovecot/dovecot.conf
> # OS: Linux 2.6.32-25-generic i686 Ubuntu 10.04.1 LTS
> log_timestamp: %Y-%m-%d %H:%M:%S
> protocols: imaps
> ssl_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem
> ssl_key_file: /etc/ssl/private/ssl-cert-snakeoil.key
> login_dir: /var/run/dovecot/login
> login_executable: /usr/lib/dovecot/imap-login
> mail_privileged_group: mail
> mail_location: mbox:~/mail:INBOX=/var/mail/%u
> mbox_write_locks: fcntl dotlock
> auth default:
>   passdb:
>     driver: pam
>   userdb:
>     driver: passwd
>
> Thanks very much,
>