Bug 489995 - reboot removes everything in /var/run/spamass-milter/.spamassassin (bayes_seen, bayes_toks, etc.)
reboot removes everything in /var/run/spamass-milter/.spamassassin (bayes_see...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: spamass-milter (Show other bugs)
10
All Linux
low Severity high
: ---
: ---
Assigned To: Paul Howarth
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-12 15:51 EDT by Eddie Lania
Modified: 2009-04-24 15:55 EDT (History)
1 user (show)

See Also:
Fixed In Version: 0.3.1-13.fc10
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-23 08:17:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Eddie Lania 2009-03-12 15:51:22 EDT
Description of problem: reboot removes everything in /var/run/spamass-milter/.spamassassin (bayes_seen, bayes_toks, etc.), all directories are removed.

the directories below /var/run/spamass-milter:

.spamassassin
.razor
.pyzor

Get automatically removed when the system is rebooted.

This also means that any of the registration information that has been done with the razor-admin tool gets lost but ALSO the gathered bayes information.

When the service are just being stopped and started this does not occur.


Version-Release number of selected component (if applicable):

spamass-milter-0.3.1-8.fc10.i386
spamassassin-3.2.5-2.fc10.i386



How reproducible: install Fedora 10 with spamassassin and spamass-milter and configure it to work


Steps to Reproduce:
1. Install and run for a while
2. reboot
3. Look in the the /var/run/spamass-milter directoy: everything is removed and files have to be re-created.
  
Actual results:


Expected results:


Additional info:
Comment 1 Paul Howarth 2009-03-13 03:12:27 EDT
How are you configuring spamassassin and spamass-milter?

What's in /etc/sysconfig/spamass-milter ?
Comment 2 Eddie Lania 2009-03-13 06:34:54 EDT
### Override for your different local config
#SOCKET=/var/run/spamass-milter/spamass-milter.sock

### Standard parameters for spamass-milter are:
### -P /var/run/spamass-milter.pid (PID file)
###
### Note that the -f parameter for running the milter in the background
### is not required because the milter runs in a wrapper script that
### backgrounds itself
###
### You may add another parameters here, see spamass-milter(1)
#EXTRA_FLAGS="-m -r 15"
EXTRA_FLAGS="-i 192.168.1.0/24,192.168.2.0/24,127.0.0.1/32 -M -b dev-null"
Comment 3 Eddie Lania 2009-03-16 03:33:01 EDT
Do I need to provide more data? If so, please mention it.
Comment 4 Paul Howarth 2009-03-16 19:10:05 EDT
(In reply to comment #3)
> Do I need to provide more data? If so, please mention it.  

I think I've got everything I need, thanks.

It's normal for everything under /var/run to be cleared at root; I hadn't realized that people ran the milter without using separate per-user config files and databases (having common ones doesn't work as well) and that these files would end up in /var/run/spamass-milter/. In fact this answers the question I raised in https://bugzilla.redhat.com/show_bug.cgi?id=483849#c5 about a change to the SELinux policy for the milter that was made in Fedora.

What I'll need to do is to move the sa-milt user's home directory to somewhere other than /var/run so that it doesn't get cleared out at boot time. I'll need to think about that a bit to see if I can figure out a change that won't need a change to the SELinux policy too.
Comment 5 Paul Howarth 2009-03-16 19:35:34 EDT
Can you try this:

# service spamass-milter stop
# mkdir /var/spool/spamassassin
# chmod 755 /var/spool/spamassassin
# usermod -m --home /var/spool/spamassassin/milter sa-milt
# mkdir /var/run/spamass-milter
# chown sa-milt:sa-milt /var/run/spamass-milter
# chmod 711 /var/run/spamass-milter
# restorecon -rv /var/run/spamass-milter /var/spool/spamassassin
# service spamass-milter start

Are you running with SELinux enabled?
Comment 6 Paul Howarth 2009-03-17 06:52:41 EDT
(In reply to comment #5)
> Can you try this:
> 
> # service spamass-milter stop
> # mkdir /var/spool/spamassassin
> # chmod 755 /var/spool/spamassassin
> # usermod -m --home /var/spool/spamassassin/milter sa-milt
> # mkdir /var/run/spamass-milter
> # chown sa-milt:sa-milt /var/run/spamass-milter
> # chmod 711 /var/run/spamass-milter
> # restorecon -rv /var/run/spamass-milter /var/spool/spamassassin
> # service spamass-milter start

Forget this, it's broken with SELinux. I'll need a different location and an SELinux policy update.
Comment 7 Paul Howarth 2009-03-17 06:55:51 EDT
(In reply to comment #5)
> Can you try this:
> 
> # service spamass-milter stop
> # mkdir /var/spool/spamassassin
> # chmod 755 /var/spool/spamassassin
> # usermod -m --home /var/spool/spamassassin/milter sa-milt
> # mkdir /var/run/spamass-milter
> # chown sa-milt:sa-milt /var/run/spamass-milter
> # chmod 711 /var/run/spamass-milter
> # restorecon -rv /var/run/spamass-milter /var/spool/spamassassin
> # service spamass-milter start

Forget this, it's broken with SELinux. I'll need a different location and an SELinux policy update.
Comment 8 Paul Howarth 2009-03-17 07:01:13 EDT
(In reply to comment #5)
> Can you try this:
> 
> # service spamass-milter stop
> # mkdir /var/spool/spamassassin
> # chmod 755 /var/spool/spamassassin
> # usermod -m --home /var/spool/spamassassin/milter sa-milt
> # mkdir /var/run/spamass-milter
> # chown sa-milt:sa-milt /var/run/spamass-milter
> # chmod 711 /var/run/spamass-milter
> # restorecon -rv /var/run/spamass-milter /var/spool/spamassassin
> # service spamass-milter start

Forget this, it's broken with SELinux. I'll need a different location and an SELinux policy update.
Comment 9 Paul Howarth 2009-03-17 07:05:43 EDT
Apologies for the multiple comments - I got error responses from bugzilla and resubmitted my comments.
Comment 10 Eddie Lania 2009-03-17 12:16:46 EDT
I am running this on a production server. The server acts as a DNS, DHCP, HTTP and MAIL gateway server. It relays the mail in- and outwards from/to an exchange server. Just recently I went over from an older fedora Core 3 version to F10. It is great having a Linux server in between internet and an intranet. It filters all spam and viruses before reaching the inside of our LAN.

Because of the troubles with SELinux, I disabled SELinux.

What would be the benefit of running SELinux? Am I more vulnerable now running without it?

Regards,

E.
Comment 11 Paul Howarth 2009-03-17 12:36:57 EDT
Well I personally wouldn't dream of running an Internet-connected box without SELinux. It's not causing me issues on my DNS/DHCP/HTTP/Mail/FTP/Samba etc. servers but then I do know how to fix problems if they crop up.

I think the key point of SELinux is that it can limit the damage an attacker can cause if they do manage to exploit a vulnerability in some service - they won't in most cases be able to anything that the compromised service should normally be able to do. Like a firewall, it's an additional layer of protection you can employ.

You might consider running SELinux in permissive mode, where it reports things that it would not allow but still allows them to happen. If you can run your servers without generating such reports, it would be safe to switch to enforcing mode and get the benefit of SELinux protection. Be warned that if you switch from disabled to permissive mode, you'll need to reboot and relabel your filesystems to add SELinux attributes to files, which may take quite some time, particularly on a large system.

I've submitted an SELinux policy patch upstream (http://oss.tresys.com/pipermail/refpolicy/2009-March/000753.html) with a view to getting this fixed before updating spamass-milter itself. Given that you're not using SELinux yourself, all you should need to do to fix things is make a new directory /var/lib/spamass-milter, make it owned by user/group sa-milt and permissions 0755, and use vipw or usermod to change the home directory of user sa-milt to /var/lib/spamass-milter. You could also copy /var/run/spamass-milter/.spamassassin to /var/lib/spamass-milter/.spamassassin. Then restart the milter.

The package update I'm planning will include the /var/lib/spamass-milter directory and will update the sa-milt user's home directory if necessary.
Comment 12 Eddie Lania 2009-03-17 12:57:13 EDT
Will /var/lib/spamass-milter be the default directory in future version of spamassassin? I'd be happy to apply the workaround but I wonder what will happen if there will be updated rpm packages installed for it.

Regards,

E.
Comment 13 Paul Howarth 2009-03-17 13:07:46 EDT
Yes - this is a spamass-milter package function, not a spamassassin package function. The spamassassin daemon just tries to look for preferences/bayes databases etc. in the home directory of the user that connects to it, which in the case of the milter is sa-milt. So whatever the home directory of sa-milt is (as set in the spamass-milter package) will be the place spamassassin uses.

As I mentioned last time, the update I'm intending to do will make the sa-milt user's home directory /var/lib/spamass-milter (if it isn't set to that already).
Comment 14 Eddie Lania 2009-03-17 15:00:54 EDT
Apologies for that - I missed that last part of your message.

I applied the changes.

One question tough: I suppose the original /var/run/spamass-milter must be kept in place for the milter socket file? The rest can be deleted?
Comment 15 Paul Howarth 2009-03-17 16:47:15 EDT
(In reply to comment #14)
> Apologies for that - I missed that last part of your message.
> 
> I applied the changes.
> 
> One question tough: I suppose the original /var/run/spamass-milter must be kept
> in place for the milter socket file? The rest can be deleted?  

Yes. You'd want to move the .spamassassin directory to /var/lib/spamass-milter to retain your preferences/bayes stuff. Is there anything else there apart from the socket?
Comment 16 Eddie Lania 2009-03-17 17:09:00 EDT
there is also a .pyzor and a .razor directory.

I copied them over to the new location as well.

It seems to me it is save to remove them from the old /var/run/spamass-milter directory too since they do not seem to change anymore (date/time stamps/size).

In the new location /var/lib/spamass-milter I can see that they do change.

As far as I can see, the only thing that remains in /var/run/spamass-milter is the milter sock file.

Regards,

Eddie.
Comment 17 Paul Howarth 2009-03-17 17:16:14 EDT
That looks good then.

The underlying problem, by the way, was that all files under /var/run are deleted at boot time in rc.sysinit.
Comment 18 Eddie Lania 2009-03-28 06:29:42 EDT
Rebooted a few times now. No problems.

SELinux however does complain a lot.

I opened a bug for it: https://bugzilla.redhat.com/show_bug.cgi?id=492550

Regards,

Eddie.
Comment 19 Fedora Update System 2009-04-03 11:43:53 EDT
spamass-milter-0.3.1-13.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/spamass-milter-0.3.1-13.fc10
Comment 20 Fedora Update System 2009-04-03 11:47:27 EDT
spamass-milter-0.3.1-13.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/spamass-milter-0.3.1-13.fc9
Comment 21 Fedora Update System 2009-04-22 16:28:25 EDT
spamass-milter-0.3.1-13.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 22 Fedora Update System 2009-04-24 15:55:09 EDT
spamass-milter-0.3.1-13.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.