Bug 1325517

Summary:	The systemd file will not work for mailboxes under /usr/local
Product:	[Fedora] Fedora	Reporter:	dag
Component:	dovecot	Assignee:	Michal Hlavinka <mhlavink>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	23	CC:	janfrode, mhlavink
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-09 08:19:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description dag 2016-04-09 13:50:56 UTC

Description of problem:
dovecot IMAP server could not access the email directories
  Log entry would be: 
Error: open() failed with file /usr/local/..../dbox-Mails/dovecot.index.log: Read-only file system

Version-Release number of selected component (if applicable):
2.2.22-1

How reproducible:
Always

Steps to Reproduce:
1.Assign maildriectory to /usr/local/...
2.Try to access your email
3.

Actual results:
Fails with read-only filesystem

Expected results:
Mails delivered through IMAP

Additional info:

Comment 1 dag 2016-04-09 14:02:12 UTC

Reason found:
/lib/systemd/system/dovecot.service contains:
ProtectSystem=full
which excludes access to everything in /usr
And in standard Pottering manners there is no note whatsoever of this
illegal access anywhere in the logs...
A small entry there would have saved me 4-5 hours of extra work...

Anyway:
Commenting out the line, reloading systemd and restarting dovecot made everything work as expected

Could be nice if changes like these had a note about the potential implications when updating.

Comment 2 Michal Hlavinka 2016-08-09 08:19:55 UTC

This is configuration detail that I'm not going to change. It would go against usual use cases, so it would negatively impact majority of users.

Anyway, I've added comment about ProtectSystem to dovecot.service file in git, will be in next package updates.