R. Portier wrote:
> Hello,
>
> Context
> =======
> I use SpamAssassin 3.2.3 on Debian 4.0 i386
>
> spamd is invoked with options : -u spamassassin -m 5 -H /etc/spamassassin
> (-D -u spamassassin -m 5 -H /etc/spamassassin when in debug mode)
>
> The home for user spamassassin is /none (this directory does not exist).
>
>
>   
<snip>
>
> Issue
> =====
> The user_prefs files for my users are not taken into account by SpamAssassin.
>   

Well, you've forced spamd to always run as the user "spamassassin" so
that user's environment will ALWAYS be used, no matter who calls
spamassassin.

In order for individual user prefs to occur, spamd must be running as
root, so that it has sufficient rights to setuid itself to the user
calling spamc.

> So SpamAssassin seems to be looking for the user_prefs file in
> /none/.spamassassin/ !
>
> When spamd is running as root (options : -m 5 -H /etc/spamassassin), it
> works properly (ie the user_prefs file is looked for in
> /home/<user>/.spamassassin/, is found, and is properly processed).
>
>
> Is it a SpamAssassin bug, or am I doing something improperly ?
>   
Not a bug. That's by design, and by security requirements of the OS itself.

The normal user "spamassassin" doesn't have rights to setuid itself to
arbitrary users without a password, only root has those rights. Once
spamd setuid's itself to "spamassassin" it can't go back and re-setuid
itself run as someone else, as the OS would simply deny it.


Reply via email to