Re: [gentoo-server] exim + spamd: permissions errors when checking spam

[Jeroen Geilman]

fire-eyes wrote:
> On Saturday 19 August 2006 19:58, Jeroen Geilman wrote:
>
>> They're not funky errors; spamd is simply telling you that it cannot
>> create a ~/.spamassassin directory for user "nobody" - which is not
>> surprising, since nobody doesn't *have* a homedirectory.
>>
>> This is a known limitation when running spamd from within exim's acls -
>> it can only run as one user, since there is currently no way for exim to
>> pass the username to spamd.
>> There are two solutions - either run spamd as one dedicated user who
>> does have a homedirectory, say "spamd", or use the old procmail
>> forwarding method which can and does work per-user.
>>
>> The reason Exim can't do per-user spamchecking has to do with the way it
>> processes messages - when the spamd ACL is evaluated, it doesn't yet
>> know the final destination.
>>
>> I found this out after some heavy Googling and detailed perusing of the
>> Exim manual - which is very good by the way, *if* you can grasp its syntax.
>>
>> I finally opted to just run as "nobody" and forget the per-user Bayes
>> database - resulting in a significant amount of spam...
>>
>> I'm currently moving back to postfix, which has worked for me in the past.
>>
>
> Thanks for the reply, I appreciate it.
>
> Okay, this now makes sense to me. nobody on my system has / as the home
> directory (wtf?), and of course it doesn't have perms there. so ~/ becomes //
> in the logs. Okay makes sense so far.
>
> What I did was make a dedicated user for spamd to drop down to. I informed
> gentoo of this by editing the appropriate options in /etc/conf.d/spamd , and
> also changing the location of the pidfile there to the home directory of the
> new user. I then set this users shell to bash (though I don't think I should
> need one?)
>
> Starting spamd looks normal. ps auwxxx | grep spam shows three processes: One
> root spamd and two children running as the user I specified.
>
> When exim sends mail at it, I get the exact same errors; As if it is for some
> reason using the root spamd. Doesn't really make sense to me.
>
> None of it makes sense to me, as i've run exim + spamd in the past on other
> servers out of the box; No mucking of usernames etc was ever needed.
>
> Also, I am not trying to get per-user spam stuff to work, only run spamd as a
> non-priv user, and have exim talk to the daemon via localhost:873.
>
> I feel like I am missing something here, any idea what it is?
>
What user does spamd run under ?
It *should* run under root - not sure what you mean by "root spamd", 
there's just a parent and some child processes.

The relevant part of my config is:

spamd_address = 127.0.0.1 783

acl_check_content:

  accept  hosts = +relay_from_hosts

  deny  message = This message scored $spam_score points. Removed with 
pleasure.
        spam = nobody:true
        condition = ${if >{$spam_score_int}{100}{1}{0}}

  accept message = Content scanned by ClamAV and Spamassassin.
        spam = nobody:true


-- 
gentoo-server@g.o mailing list