Your message dated Sat, 29 Nov 2025 09:04:23 +0000
with message-id <[email protected]>
and subject line Bug#1108263: fixed in msmtp 1.8.32-1
has caused the Debian Bug report #1108263,
regarding msmtp can't authenticate with gssapi if apparmor is enabled
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1108263: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108263
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: msmtp
Version: 1.8.23
Debian version: 12.11
Linux kernel: 6.1.0-31-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.128-1
(2025-02-07) x86_64 GNU/Linux
Sending a mail using msmtp with gssapi authentication while apparmor is enabled
fails because the file /etc/gssapi_mech.conf is not readable in msmtp apparmor
profile.
$ cat message.txt | msmtp --read-envelope-from --read-recipients --tls=on
--auth=gssapi --host=XXX --port=25 --user=XXX
warning: unable to open /etc/gssapi_mech.conf: errno 13 (Permission denied)
msmtp: GNU SASL: GSSAPI error in client while negotiating security context in
gss_init_sec_context() in SASL library. This is most likely due to insufficient
credentials or malicious interactions.
msmtp: could not send mail
$ ls -l /etc/gssapi_mech.conf
-rw-r--r-- 1 root root 834 Aug 16 2022 /etc/gssapi_mech.conf
$ cat /etc/gssapi_mech.conf
# Example /etc/gssapi_mech.conf file
#
# GSSAPI Mechanism Definitions
[...]
Corresponding audit log:
AVC apparmor="DENIED" operation="open" profile="msmtp"
name="/etc/gssapi_mech.conf" pid=1759102 comm="msmtp" requested_mask="r"
denied_mask="r" fsuid=5022 ouid=0
The msmtp package depends on libgsasl18, which depends on libgssglue1 which
provides the /etc/gssapi_mech.conf file.
Allowing msmtp to read this file in its apparmor profiles fixes the issue.
/etc/apparmor.d/usr.bin.msmtp:
[...]
# kerberos related
/tmp/{,.}krb5cc_* rwk,
/etc/gss/mech.d/ r,
/etc/gss/mech.d/** r,
+ /etc/gssapi_mech.conf r,
[...]
Thank you,
--
Louis
--- End Message ---
--- Begin Message ---
Source: msmtp
Source-Version: 1.8.32-1
Done: Emmanuel Bouthenot <[email protected]>
We believe that the bug you reported is fixed in the latest version of
msmtp, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bouthenot <[email protected]> (supplier of updated msmtp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 29 Nov 2025 06:23:52 +0000
Source: msmtp
Architecture: source
Version: 1.8.32-1
Distribution: unstable
Urgency: medium
Maintainer: Emmanuel Bouthenot <[email protected]>
Changed-By: Emmanuel Bouthenot <[email protected]>
Closes: 1108263 1119688
Changes:
msmtp (1.8.32-1) unstable; urgency=medium
.
* New upstream release (Closes: #1119688)
* AppArmor: Fix authentication with gssapi (Closes: #1108263)
* Update debian/watch to version 5
* Remove useless 'Rules-Requires-Root: no' from debian/control
Checksums-Sha1:
7d407a57d296179cfd2b4119532c80df306cd619 2210 msmtp_1.8.32-1.dsc
2e7b9f668701ec4c91b915cada61021260d71245 456960 msmtp_1.8.32.orig.tar.xz
2055bc166f2cfd3e20fa82a2a0cc22cee9490da8 488 msmtp_1.8.32.orig.tar.xz.asc
28ff7f3ed39df8e3c636897261bb62152be31045 24708 msmtp_1.8.32-1.debian.tar.xz
f4544c7aee1879869c06633f6af41d4a5361813a 10194 msmtp_1.8.32-1_source.buildinfo
Checksums-Sha256:
b16300ddbccd87fd3278d636417b19320668a3bb1bf048e6917122493d88faee 2210
msmtp_1.8.32-1.dsc
20cd58b58dd007acf7b937fa1a1e21f3afb3e9ef5bbcfb8b4f5650deadc64db4 456960
msmtp_1.8.32.orig.tar.xz
0a04156bb8495a76e057f4e663017d864ab43c97210ae42276e6b08aeaea4dc2 488
msmtp_1.8.32.orig.tar.xz.asc
211594d410e3d3399fca42d4292d239abb0d52c317c93dd7e33788c6ced46aa0 24708
msmtp_1.8.32-1.debian.tar.xz
6eb858189fc972dbd195f64ad29549629260606db2defb484ae0cf2381ac567a 10194
msmtp_1.8.32-1_source.buildinfo
Files:
ba5494641c576d02bdf4c0327f37d6e1 2210 mail optional msmtp_1.8.32-1.dsc
b22d06d4e2f2318150b868cd84a61388 456960 mail optional msmtp_1.8.32.orig.tar.xz
30ecce1863ba03ead7f121074758fcac 488 mail optional msmtp_1.8.32.orig.tar.xz.asc
a7508596ded2cd17740343866160cf0f 24708 mail optional
msmtp_1.8.32-1.debian.tar.xz
bb70e566bc44bfeadaa8732963420ceb 10194 mail optional
msmtp_1.8.32-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQ1Tfow3vJnf8QuHSwd3I5KdQsMFAmkqsrUACgkQSwd3I5Kd
QsN30Q/+LwK85NOMgdN3WGImG/V9Jd0Jbx0i75PlZRgrML6mINsTMDybdhu8v01Z
GHuoopKXpGzEPqp+nWn0YlNq+kF3vdYT7iwDkx+jf69PUJXhGwk4ro4tvm3UvSwM
TZwXuA0VcKuD5bAIe+7sRUAr6ulcrwSaAjS8MvYt0LPNOi/EIYfpr5lj6ofB6LtC
Uy2/emv3YqQagzMz2sQmr5petUZrr8BmP39Z2CBUhKlmBpO96ENQ+eDZ7Zs8xG1s
6pxl0ITaIS8L472t+D8JYmz5oxt1yjDi5uh2EQsYBvpUjCHu/HjMqy26WOgWNPQ6
soJ1puRbkB53kixYx1CacPa63xp1ohxOHbIoFFlNp7ry9uY79rg7AUyFCztRIusQ
+lKIUTjWtp+pnA+AJyorMxwKzyFn5hg745mzYHfSnjBjRcF2NyqufWNELVLw8xTN
wISSDm9ZJ97vv17M7zUilRjohWsdbDDW/BA31A0kuVJFunUDjbJHOMp4kjL8EmKA
oKY1Jvpeu5XdSWy8atkFMrtkxKH0nvQCnY/zitZoCZ3UTeYcHSeQynXMzduI8iH/
s/XcWSJhs+R8moJEF54t6fUEii7BzUbL8d9fhP8/dXvm4Ido+IYGvNl89eQtLUm/
xITBUZOUWsA06lyYyTt0c2+bKsnSuVLgGmvrFAp3kc125DeQKTQ=
=/S7W
-----END PGP SIGNATURE-----
pgp_ovcFN39CJ.pgp
Description: PGP signature
--- End Message ---
