CODEWITHSUNDEEP
linuxbashpermissionscentosqmail
Penguinsushi
Penguinsushi

Reputation: 1

Qmail/popuser Environment Permissions (Linux/CentOS)

I am trying to get a mail-receiving script working, but I am getting a permissions error when it tries to copy files to where I need them.

We're running a Linux/CentOS/Plesk webserver. I have qmail set to pipe messages that a certain address receives to a shell script. That script is supposed to write the messages to a file and copy them to one of the server's vhost subscriptions so that they can be accessed by code running via the webserver.

I can get the messages passed to the shell script no problem, and it can successfully write the received message to a file in the local directory (the recipient's folder in /var/qmail/mailnames/). When the script tries to copy the message file to the correct vhost directory, however, I get a 'permission denied' error.

--

.qmail (file piping mail to parse_mail.sh - included for clarity, this part is working as intended):

| true
| /bin/bash parse_mail.sh &> parse_mail_sh.log

--

parse_mail.sh:

echo "Start parse_mail $(date)";
u=$(/bin/id -u -n);
echo "running as ${u}";
umask 000;
# random tag name
templ='message';
rand=$(awk -vmin=100000000 -vmax=999999999 'BEGIN{srand(); print 
int(min+rand()*(max-min+1))}');
tag=$templ$rand;
echo "Create dir ${tag}/";
/bin/mkdir $tag;
echo "Write message into ${tag}/";
/bin/cp /dev/stdin ${tag}/message.txt;
echo "Copy message to message_files/";
/bin/cp ${tag}/message.txt /var/www/vhosts/subscription/httpdocs/subfolder/message_files/${tag}_content.txt
echo "Remove ${tag}/";
/bin/rm -R ${tag};
echo "End parse_mail";

--

parse_mail_sh.log log shows:

Start parse_mail Thu Jul 18 11:07:06 EDT 2019
running as popuser
Create dir message494556566/
Write message into message494556566/
Copy message to message_files/
/bin/cp: failed to access '/var/www/vhosts/subscription/httpdocs/subfolder/message_files/message494556566_content.txt': Permission denied
Remove message494556566/
End parse_mail

--

Pretty straight-forward, right? 'popuser' just doesn't have permission to write to this other directory.

Except, here's the odd thing:

I'm not an expert, but I generally understand how unix/linux permissions work. I believe popuser DOES have the requisite permissions to access and write to the directory - the intervening directory structure is traversable, and I've added popuser to the groups necessary to write to that specific subscription folder.

I can su to popuser in the terminal and cd up and down the directory structure, and copy/create files in the correct places. I can even run the mail-receiving script from the terminal AS popuser, and it works perfectly. It only throws the error when triggered on receiving mail.

I assume this means that there is some difference in the environment popuser is operating in via qmail as opposed to the terminal - I just haven't been able to track down exactly what that might be (or find articles online about it).

Or perhaps I misunderstanding how something works? Like I said, not an expert...

So my question is:

Why can't the parse_mail.sh script successfully copy the created file to the indicated message_files/ directory when a message is received by qmail, given that that same script CAN do so when executed by the same system user (popuser) when run via the terminal?

Upvotes: -1

Views: 406

Answers (1)

Penguinsushi
Penguinsushi

Reputation: 1

After several days of fighting with this, I discovered the problem.

I had made all of the correct changes, but the system hadn't caught up.

I had restarted various services in PLESK - including the "POP/mail server"- but apparently postfix is not something you can control from there.

When I stopped and then restarted Postfix, my script suddenly worked.

My only theory is that perhaps 'popuser' was operating through postfix on an old session that didn't have my user group changes - which might explain why I could perform the operations via a popuser terminal, but the mail processor could not.

Upvotes: 0

Related Questions