7

The problem

I would like postfix to pipe emails to a script that operates on files owned by the www-data group located under /var/www/. However, I receive error messages that indicate insufficient privileges. By letting the script run whoami, I can confirm it's run by the correct user scriptuser (as set in my /etc/postfix/transport file). I can also confirm that the user has sufficient access rights, as no errors occur when executing the script using sudo -u scriptuser /path/to/script.

Therefore, I am quite confused and a bit lost. How is it possible that the user has access right to the files, the script is run by Postfix as this specific user, but I still get the permission denied message?

I have also tried adding default_privs = www-data to /etc/postfix/main.cf, as suggested in here with no success. Enabling access via chmod o+rx does the job, but I would consider this potentially dangerous as anyone with shell access to the server could read those files.

The config files

# in file /etc/postfix/main.cf
transport_maps = hash:/etc/postfix/transport
virtual_maps  = hash:/etc/postfix/virtual/addresses

# in file /etc/postfix/master.cf
mailreply   unix    -   n   n   -   -   pipe
  flags=FR user=scriptuser argv=/usr/lib/postfix/sbin/pipemailreply

# in file /etc/postfix/transport
mailreplyuser@localhost mailreply

# in file /etc/postfix/virtual/addresses
mydomain.com                     DOMAIN
@mydomain.com                    mailreplyuser@localhost

The file rights in /var/www/hmtl/ (via ls -la):

drwxrws--- 4 www-data www-data  4096 Mar 13 00:41 .
drwxr-xr-x 3 root     root      4096 Mar 13 01:02 ..
-rw-r--r-- 1 root     www-data     8 Mar 13 00:15 test.txt

The error message

Mar 13 10:13:21 myservername postfix/pipe[3545]: 774F3FEB3B: to=<mailreplyuser@localhost>, orig_to=<test@mydomain.com>, relay=mailreply, delay=0.13, delays=0.07/0/0/0.06, dsn=5.3.0, status=bounced (Command died with status 1: "/usr/lib/postfix/sbin/pipemailreply". Command output: cat: /var/www/html/test.txt: Permission denied )
2
  • 1
    It seems that scriptuser doesn't have sufficient permissions to folder /var/www/hmtl/. You can check with su -l scriptuser -s /bin/bash -c 'cd /var/www/hmtl/ && cat test.txt'
    – ALex_hha
    Mar 13, 2018 at 11:52
  • This works absolutely fine, and doesn't give me any errors. The user does have the permission to access the folder / the file when I run it directly via su -l or sudo -u. It's only when postfix runs the script that the user seemingly stops having the correct access rights. Mar 13, 2018 at 17:00

1 Answer 1

1

I changed "user=scriptuser" to "user=scriptuser:scriptgroup" and I was able to make it work.

http://www.postfix.org/pipe.8.html

1
  • How does that relate to the question?
    – RalfFriedl
    Jan 20, 2020 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.