Bug 1532139

Summary: SpamAssassin/Plugin/DCC.pm don't honor dcc_home in calling dccproc
Product: Red Hat Enterprise Linux 7 Reporter: Peter Bieringer <pb>
Component: spamassassinAssignee: Ondřej Lysoněk <olysonek>
Status: CLOSED WONTFIX QA Contact: qe-baseos-daemons
Severity: medium Docs Contact:
Priority: low    
Version: 7.4CC: giovanni, psklenar, thozza
Target Milestone: rcKeywords: Patch, Upstream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-12-06 16:09:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Peter Bieringer 2018-01-08 07:02:24 UTC
Description of problem:

Because of systemd confinguration for amavisd-new an enabled DCC plugin in spamassassin can't write to /etc/dcc anymore, see also:
https://bugzilla.redhat.com/show_bug.cgi?id=1473017

Trying to move the data directory to /var/dcc/etc shows that the plugin will not honor the "dcc_home" path while calling dccproc.

Version-Release number of selected component (if applicable):
spamassassin-3.4.0-2.el7.x86_64
amavisd-new-2.11.0-2.el7.noarch

How reproducible:
always after enabling dcc


Steps to Reproduce:
0. install DCC RPM, copy /etc/dcc contents to /var/dcc/etc
mkdir /var/dcc/etc
cp -a /etc/dcc/* /var/dcc/etc/
chgrp amavis /var/dcc/etc
chmod -R g+rw /var/dcc/etc

1. enable dcc in spamassassin with
grep dcc /etc/mail/spamassassin/local.cf 
use_dcc 1
dcc_home /var/dcc/etc
dcc_timeout 10
dcc_add_header 1

2. restart amavisd-new

Actual results:
Jan  8 07:27:56 st2 dccproc[1798]: open(/etc/dcc/map): Permission denied
Jan  8 07:27:56 st2 dccproc[1798]: lock_open(/etc/dcc/whiteclnt.dccx): Read-only file system

Expected results:
Using files in /var/dcc/etc


Additional info:

Following patch will extend dccproc's calling options with the home directory:

--- /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/DCC.pm.orig	2014-02-07 09:36:27.000000000 +0100
+++ /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/DCC.pm	2018-01-08 07:42:09.570603680 +0100
@@ -871,6 +871,10 @@
 	# learn or report spam
 	unshift(@opts, '-t', 'many');
       }
+      if ($conf->{dcc_home}) {
+	# set home directory explicitly
+	unshift(@opts, '-h', $conf->{dcc_home});
+      };
 
       defined $path  or die "no dcc_path found\n";
       dbg("$tag opening pipe to " .


Then after restart of amavisd the message is gone.

Once this is implemented next can think about fixing the DCC RPMs to change packaging structure to /var/dcc/etc

Comment 2 Giovanni Bechis 2018-03-08 10:50:52 UTC
Hi,
just fixed in SpamAssassin trunk and 3.4

Comment 3 Peter Bieringer 2018-11-05 06:50:49 UTC
Hmm, in spamassassin-3.4.0-4.el7_5.x86_64 it's not fixed, option -h is not specified and therefore issue still occurs.

Comment 4 Ondřej Lysoněk 2018-11-05 09:46:46 UTC
spamassassin-3.4.0-4.el7_5.x86_64 is an update that only includes a security bug fix. This bug was not meant to be fixed there.

Comment 5 Tomáš Hozza 2019-12-06 16:09:19 UTC
Red Hat Enterprise Linux version 7 entered the Maintenance Support 1 Phase in August 2019. In this phase only qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. Other errata advisories may be delivered as appropriate.

This bug has been reviewed by Support and Engineering representative and does not meet the inclusion criteria for Maintenance Support 1 Phase. If this issue still exists in newer major version of Red Hat Enterprise Linux, it has been cloned there and work will continue in the cloned bug.

For more information about Red Hat Enterprise Linux Lifecycle, please see https://access.redhat.com/support/policy/updates/errata/

Comment 6 RHEL Program Management 2019-12-06 16:09:24 UTC
Development Management has reviewed and declined this request. You may appeal this decision by using your Red Hat support channels, who will make certain  the issue receives the proper prioritization with product and development management.

https://www.redhat.com/support/process/production/#howto