Description

This is similar to a recent fix for the DMS state volume, where a non-root user needs access but the host directory mounted has mistakenly been too aggressive with permissions for the directory (one known example is AWS ECS (EC2) using EBS volumes).

It appears that Rspamd support with DKIM at least expects this due to running operations as the _rspamd user to read content from the DMS config volume. In future this concern shouldn't be the case, as the root user during setup could make internal copies that anything running as _rspamd should instead interact with.

However since this is not always an obvious failure (various unresolved reports in the past were tripped up by this for the state volume), the fix is probably worth adding? (makes me wonder if similar is prone to our other volumes too then 🤔)

NOTE: While we only need chmod o+x, we can use chmod +x here as unlike other permissions like +w it appears to apply +x to ugo by default.

Fixes: #4485

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have commented my code, particularly in hard-to-understand areas
• New and existing unit tests pass locally with my changes
• I have added information about changes made in this PR to CHANGELOG.md