Skip to content

fix: Ensure state persisted to /var/mail-state retains correct group #3011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
polarathene merged 14 commits into from
Jan 24, 2023
Merged

fix: Ensure state persisted to /var/mail-state retains correct group #3011

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
bd997e8
fix: RSPAM ENV should only add to array if ENV enabled
polarathene Jan 18, 2023
28bb6c3
fix: Correctly match ownership for Postfix content
polarathene Jan 18, 2023
cd19b7f
fix: Ensure correct `chown -R` user and groups applied
polarathene Jan 18, 2023
f5a72df
refactor: `misc-stack.sh` conditional handling
polarathene Jan 18, 2023
7061324
chore: Move amavis `chown -R` fix into `misc-stack.sh`
polarathene Jan 18, 2023
69e452e
fix: Dockerfile should preserve `clamav` ownership with `COPY --link`
polarathene Jan 18, 2023
0da5632
chore: Workaround `buildx` bug with separate `chown -R`
polarathene Jan 18, 2023
819b9e3
chore: `COPY --link` from a separate stage instead of relying on scratch
polarathene Jan 18, 2023
6cccd75
lint: Appease the linting gods
polarathene Jan 18, 2023
37a5ac1
chore: Align `misc-stack.sh` paths for `chown -R` operations
polarathene Jan 19, 2023
cb226c8
fix: Reduce one extra cache layer copy
polarathene Jan 20, 2023
3d16a83
fix: Remove separate ClamAV stage by adding `clamav` user explicitly
polarathene Jan 21, 2023
5d0b4b8
chore: Add reference link regarding users to `misc-stack.sh`
polarathene Jan 21, 2023
5b0393f
Merge branch 'master' into fix/chown-services
polarathene Jan 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,10 @@ SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
# -----------------------------------------------

COPY target/bin/sedfile /usr/local/bin/sedfile
RUN chmod +x /usr/local/bin/sedfile
RUN <<EOF
chmod +x /usr/local/bin/sedfile
adduser --quiet --system --group --disabled-password --home /var/lib/clamav --no-create-home --uid 200 clamav
EOF

COPY target/scripts/build/* /build/
COPY target/scripts/helpers/log.sh /usr/local/bin/helpers/log.sh
Expand All @@ -31,6 +34,12 @@ RUN /bin/bash /build/packages.sh
# --- ClamAV & FeshClam -------------------------
# -----------------------------------------------

# Copy over latest DB updates from official ClamAV image. This is better than running `freshclam`,
# which would require an extra memory of 500MB+ during an image build.
# When using `COPY --link`, the `--chown` option is only compatible with numeric ID values.
# hadolint ignore=DL3021
COPY --link --chown=200 --from=docker.io/clamav/clamav:latest /var/lib/clamav /var/lib/clamav

RUN <<EOF
echo '0 */6 * * * clamav /usr/bin/freshclam --quiet' >/etc/cron.d/clamav-freshclam
chmod 644 /etc/clamav/freshclam.conf
Expand All @@ -40,10 +49,6 @@ RUN <<EOF
rm -rf /var/log/clamav/
EOF

# Copy over latest DB updates from official ClamAV image. Better than running `freshclam` (which requires extra RAM during build)
# hadolint ignore=DL3021
COPY --link --from=docker.io/clamav/clamav:latest /var/lib/clamav /var/lib/clamav

# -----------------------------------------------
# --- Dovecot -----------------------------------
# -----------------------------------------------
Expand Down
1 change: 0 additions & 1 deletion target/scripts/start-mailserver.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,6 @@ function _register_functions
# ? >> Fixes

_register_fix_function '_fix_var_mail_permissions'
[[ ${ENABLE_AMAVIS} -eq 1 ]] && _register_fix_function '_fix_var_amavis_permissions'

[[ ${ENABLE_CLAMAV} -eq 0 ]] && _register_fix_function '_fix_cleanup_clamav'
[[ ${ENABLE_SPAMASSASSIN} -eq 0 ]] && _register_fix_function '_fix_cleanup_spamassassin'
Expand Down
10 changes: 0 additions & 10 deletions target/scripts/startup/fixes-stack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,16 +21,6 @@ function _fix_var_mail_permissions
_log 'trace' 'Permissions in /var/mail look OK'
}

function _fix_var_amavis_permissions
{
local AMAVIS_STATE_DIR='/var/mail-state/lib-amavis'
[[ ${ONE_DIR} -eq 0 ]] && AMAVIS_STATE_DIR="/var/lib/amavis"
[[ ! -e ${AMAVIS_STATE_DIR} ]] && return 0

_log 'trace' 'Fixing Amavis permissions'
chown -hR amavis:amavis "${AMAVIS_STATE_DIR}" || _shutdown 'Failed to fix Amavis permissions'
}

function _fix_cleanup_clamav
{
_log 'trace' 'Cleaning up disabled ClamAV'
Expand Down
37 changes: 25 additions & 12 deletions target/scripts/startup/misc-stack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ function _misc_save_states
then
_log 'debug' "Consolidating all state onto ${STATEDIR}"

# Always enabled features:
FILES=(
spool/postfix
lib/postfix
Expand All @@ -33,8 +34,8 @@ function _misc_save_states
[[ ${ENABLE_FAIL2BAN} -eq 1 ]] && FILES+=('lib/fail2ban')
[[ ${ENABLE_FETCHMAIL} -eq 1 ]] && FILES+=('lib/fetchmail')
[[ ${ENABLE_POSTGREY} -eq 1 ]] && FILES+=('lib/postgrey')
[[ ${ENABLE_RSPAMD} -ne 1 ]] && FILES+=('lib/rspamd')
# [[ ${ENABLE_RSPAMD} -ne 1 ]] && FILES+=('lib/redis')
[[ ${ENABLE_RSPAMD} -eq 1 ]] && FILES+=('lib/rspamd')
# [[ ${ENABLE_RSPAMD} -eq 1 ]] && FILES+=('lib/redis')
[[ ${ENABLE_SPAMASSASSIN} -eq 1 ]] && FILES+=('lib/spamassassin')
[[ ${SMTP_ONLY} -ne 1 ]] && FILES+=('lib/dovecot')

Expand All @@ -43,36 +44,48 @@ function _misc_save_states
DEST="${STATEDIR}/${FILE//\//-}"
FILE="/var/${FILE}"

# If relevant content is found in /var/mail-state (presumably a volume mount),
# use it instead. Otherwise copy over any missing directories checked.
if [[ -d ${DEST} ]]
then
_log 'trace' "Destination ${DEST} exists, linking ${FILE} to it"
# Original content from image no longer relevant, remove it:
rm -rf "${FILE}"
ln -s "${DEST}" "${FILE}"
elif [[ -d ${FILE} ]]
then
_log 'trace' "Moving contents of ${FILE} to ${DEST}"
# Empty volume was mounted, or new content from enabling a feature ENV:
mv "${FILE}" "${DEST}"
ln -s "${DEST}" "${FILE}"
else
_log 'trace' "Linking ${FILE} to ${DEST}"
mkdir -p "${DEST}"
ln -s "${DEST}" "${FILE}"
fi

# Symlink the original path in the container ($FILE) to be
# sourced from assocaiated path in /var/mail-state/ ($DEST):
ln -s "${DEST}" "${FILE}"
done

# This ensures the user and group of the files from the external mount have their
# numeric ID values in sync. New releases where the installed packages order changes
# can change the values in the Docker image, causing an ownership mismatch.
# NOTE: More details about users and groups added during image builds are documented here:
# https://github.com/docker-mailserver/docker-mailserver/pull/3011#issuecomment-1399120252
_log 'trace' 'Fixing /var/mail-state/* permissions'
[[ ${ENABLE_CLAMAV} -eq 1 ]] && chown -R clamav /var/mail-state/lib-clamav
[[ ${ENABLE_SPAMASSASSIN} -eq 1 ]] && chown -R debian-spamd /var/mail-state/lib-spamassassin
[[ ${ENABLE_POSTGREY} -eq 1 ]] && chown -R postgrey /var/mail-state/lib-postgrey
[[ ${ENABLE_AMAVIS} -eq 1 ]] && chown -R amavis:amavis /var/mail-state/lib-amavis
[[ ${ENABLE_CLAMAV} -eq 1 ]] && chown -R clamav:clamav /var/mail-state/lib-clamav
[[ ${ENABLE_FETCHMAIL} -eq 1 ]] && chown -R fetchmail:nogroup /var/mail-state/lib-fetchmail
[[ ${ENABLE_POSTGREY} -eq 1 ]] && chown -R postgrey:postgrey /var/mail-state/lib-postgrey
[[ ${ENABLE_SPAMASSASSIN} -eq 1 ]] && chown -R debian-spamd:debian-spamd /var/mail-state/lib-spamassassin

chown -R postfix /var/mail-state/lib-postfix
chown -R postfix:postfix /var/mail-state/lib-postfix

# NOTE: The Postfix spool location has mixed owner/groups to take into account:
# UID = postfix(101): active, bounce, corrupt, defer, deferred, flush, hold, incoming, maildrop, private, public, saved, trace
# UID = root(0): dev, etc, lib, pid, usr
# GID = postdrop(103): maildrop, public
# GID for all other directories is root(0)
# NOTE: `spool-postfix/private/` will be set to `postfix:postfix` when Postfix starts / restarts
# Set most common ownership:
chown -R postfix:root /var/mail-state/spool-postfix
chown root:root /var/mail-state/spool-postfix
# These two require the postdrop(103) group:
chgrp -R postdrop /var/mail-state/spool-postfix/maildrop
chgrp -R postdrop /var/mail-state/spool-postfix/public
Expand Down