Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#44032 - [postfix] postdrop and postqueue binary are missing setgid to group postdrop

Attached to Project: Arch Linux
Opened by So Wieso (sowieso) - Tuesday, 03 March 2015, 12:04 GMT
Last edited by Gaetan Bisson (vesath) - Friday, 06 March 2015, 17:15 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Gaetan Bisson (vesath)
Architecture x86_64
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:

postfix packages (3.0.0-2 and more) ship with wrong permissions:
tar -tvf /var/cache/pacman/pkg/postfix-3.0.0-2-x86_64.pkg.tar.xz lists:
-rwxr-xr-x root/root 14880 2015-02-12 04:48 usr/bin/postdrop
-rwxr-xr-x root/root 14840 2015-02-12 04:48 usr/bin/postqueue

but should be:
-rwxr-sr-x 1 root postdrop 14880 12. Feb 04:48 /usr/bin/postdrop
-rwxr-sr-x 1 root postdrop 14840 12. Feb 04:48 /usr/bin/postqueue

With missing setgid postfix is not able to deliver local mails.
This is a continuation of https://bugs.archlinux.org/task/35627 , as requested.

According to the linked bug report this should be solved, but it is not for me. I guess post-install in .INSTALL does this for most of the users, as no one is complaining, but fails for me somehow. Anyway I'd like to have permissions set correctly in the first place.
I had the problem also at two previous postfix updates.

Additional info:
postfix/postfix-script[23794]: warning: not owned by group postdrop: /usr/bin/postqueue
postfix/postfix-script[23795]: warning: not owned by group postdrop: /usr/bin/postdrop
postfix/postfix-script[23797]: warning: not set-gid or not owner+group+world executable: /usr/bin/postqueue
postfix/postfix-script[23798]: warning: not set-gid or not owner+group+world executable: /usr/bin/postdrop

Steps to reproduce:
Updating the package and starting postfix (at least for me).
This task depends upon

Closed by  Gaetan Bisson (vesath)
Friday, 06 March 2015, 17:15 GMT
Reason for closing:  Works for me
Comment by Gaetan Bisson (vesath) - Tuesday, 03 March 2015, 19:10 GMT
We rely on an upstream script, /usr/lib/postfix/post-install, called in both post_install and post_upgrade, to set permissions correctly. Pacman warnings are unfortunate but harmless: this is because permissions check happen before the install script is executed.

If you find script did not run correctly at post_install or post_upgrade, please report the error messages. You may also wish to run it manually as root:

/usr/lib/postfix/post-install meta_directory=/etc/postfix daemon_directory=/usr/lib/postfix command_directory=/usr/bin upgrade-package

And see if there is any issue.
Comment by So Wieso (sowieso) - Wednesday, 04 March 2015, 17:34 GMT
Thanks for your help, now I found the error message post-install produces:
chown: cannot access '/usr/share/doc/packages/postfix-doc/README_FILES': No such file or directory
which was a configuration error in main.cf. So post-install never came to the important part.

Luckily I found this hint inside post-install:
# If a parameter is not set via the command line or environment,
# try to use settings from installed configuration files.


Nevertheless, I have a suggestion for the package, in case this is possible.
post-install states:
upgrade-package
Short-hand for: set-permissions upgrade-configuration.

Could we maybe run the set-permissions part inside the pkgbuild and leave the upgrade-configuration part for the install script? Then pacman would not need to complain about wrong permissions.
Comment by Gaetan Bisson (vesath) - Friday, 06 March 2015, 17:14 GMT
I have not had the time to look at this yet, but it is not so straightforward to run post-install inside pkgdir, which lacks much of a real system root. Please let me know if you have a working patch to our current PKGBUILD for that.

Loading...