[SNIP]
Is there some special way the permissions have to be set? I made sure
anybody could read it and the .spamassassin directory it's in just in case.
It sounds like you want to remove calling SA from the MTA, and instead call it
from the MDA (such as procmail) which allows per-user configs and databases.
I looked into procmail. Setting mailbox_command in postfix's main.cf
makes it work fine for local deliveries. However, most of my users on
one box are aliases that forward to another address, and those don't get
filtered through procmail.
You may ask: if they're just aliases, do they even have a home directory
to put the user_prefs in? Well, one does for testing. Once I get that
part working, I'm going to move on to putting the preferences in MySQL.
Anyway, I found a solution that worked just fine -- skip procmail and
have master.cf invoke spamc with "-u ${user}". The documentation for
spamc says the -u option is obsolete, but it does what I need.