Control: tags -1 + moreinfo On Sun, Oct 18, 2026 at 10:15:16PM +0200, H.-Dirk Schmitt wrote: > Package: dovecot-sieve > Version: 1:2.4.5+dfsg1-4 > Severity: important > > There is still a serious bug in dovecot 2.4.4 with the ssl_key_file. > If e.g. sievec is invoked. > > → doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf > line 76: key_file: open(/etc/ssl/private/XXXXXX.key.pem) failed: Permission > denied > > The same occurs in for every mail deliverd to any user account using mailsieve > and a lot of error mails are produced degrading the mail-service for the > users. > > The problem is upstream discussed in > https://dovecot.org/mailman3/archives/list/[email protected]/thread/KT7LWWQWEMLKKLKXICBGPG7OGOQIJWEV/ > There is also a weird configuration hack mentioned to mitigate the dovecot > bug. > The bug is that the key_file isn't read before the privileges are dropped e.g. > for the sieve processing. > > This bug was solved in dovecot 2.4.5.
I'm a bit confused. You reported this bug against version 2.4.5, but also claim that it's fixed in 2.4.5. Do you happen to know exactly where/what the fix is? The mailing list thread doesn't seem to identify it a specific commit as containing the fix. > I mitigated the problem here with a no-change forky backport for the moment. > > Please upgrade the trixie version from 2.4.4 to 2.4.5 to solve the problem for > other users. Trixie contains 2.4.1 (with a bunch of backported bugfixes, not 2.4.4). Unfortunately dovecot minor versions contain incompatible changes, so we cannot simply upgrade between them with trixie point releases. We will need to identify the specific commit so we can introduce a targeted fix into trixie's version. noah
