Updated Dovecot 2.3.0 now getting 2 strange log errors

[tony]

On 2018-01-02 16:37, tony wrote:
> On 2018-01-01 17:26, Peter wrote:
>> On 02/01/18 14:07, Stephan Bosch wrote:
>>>> I can see 21:21:38 is when the below errors showed up with the above
>>>> 21:21:38 timestamps:
>>>> 
>>>> Dec 29 21:21:38
>>>> lmtp(recipient at domain.net)<17187><UA2fMEQiR1ojQwAAUXb6+w>: Error:
>>>> program `/usr/sbin/sendmail' was forcibly terminated with signal 15
>>>> Dec 29 21:21:38
>>>> lmtp(recipient at domain.net)<17187><UA2fMEQiR1ojQwAAUXb6+w>: Error:
>>>> sieve: msgid=<470c210f-bd19-f63f-45ed-bfef59322be9 at domain.email>:
>>>> failed to send vacation response to sender at domain.email: <Failed to
>>>> execute sendmail> (temporary error)
>>>> Dec 29 21:21:38 lmtp: Error: postdrop: warning: mail_queue_enter:
>>>> create file maildrop/868503.17337: Permission denied
>>>> 
>>>> It still isn't really clear to me why this is going on.
>>> 
>>> I am wondering what that sendmail process is doing.
>>> 
>>> As you can see, Dovecot waits for it to finish for 30 seconds 
>>> (override
>>> with submission_timeout setting).
>>> 
>>> Can you try invoking sendmail manually from command line? Does it 
>>> work?
>>> Is it hanging for more than 30s?
>> 
>> I think the real error here is the postdrop one (sendmail is a wrapper
>> around postdrop).  It's a permission denied error which leads me to
>> believe it may be an selinux (or similar) issue.  I wouldn't be
>> surprised if sendmail works from the command line but fails when
>> executed from sieve because selinux has it blocked for sieve.
>> 
>> If you're running selinux or apparmour or similar, check your logs for
>> that (audit log for selinux) and look for denials.  You cna also try
>> setting selinux to permissive and trying the operation (setenforce 0).
>> 
>> 
>> Peter
> 
>> I am wondering what that sendmail process is doing.
>> 
>> As you can see, Dovecot waits for it to finish for 30 seconds 
>> (override
>> with submission_timeout setting).
>> 
>> Can you try invoking sendmail manually from command line? Does it 
>> work?
>> Is it hanging for more than 30s?
>> 
>> Regards,
>> 
>> Stephan.
> 
> Thanks for the responses. Running sendmail from the command line is
> successful, which strikes me as odd. So it is only failing when
> sendmail is invoked from sieve, but I don't yet understand why. I
> haven't made any recent significant changes to the mail environment. I
> haven't updated from postfix 3.2.4-2 since 12-16-17 when my
> distribution released the packaged updated, but I didn't notice the
> issue at that time until around 12-27 when I started getting emails
> about the reported permission denied error and sendmail timeout.

Apologies for sending too early. I meant to hit save and not sent. I 
wanted to point out that I am not using SELinux or AppArmor. The hosts 
just use some iptables rules, but traffic is permitted to and from these 
hosts, so I don't think that is the issue. There are several places that 
talk about correcting permissions, but when I verify the permissions on 
/var/lib/postfix everything is as it should be.

postfix set-permissions
postfix check

The above results in no output reporting any problems. I enabled sieve 
tracing but did not see anything that stood out apart from the usual 
reported errors. If I invoke sendmail from the vmail user I am able to 
send no problem. It doesn't make sense why sieve in general not related 
to Vacation auto-replies works fine, but auto-replies do not.

-
TC