authdaemon socket directory has wrong ownership

[dusanv]

lsb_release -rd:
Description: Ubuntu 10.04.2 LTS
Release: 10.04

courier-authdaemon version: 0.62.4-1
courier-base version: 0.63.0-2.1ubuntu1

After installation, /var/run/courier/authdaemon is owned by root:root making it impossible to accept mail. After changing ownership to daemon:daemon, everything works.

[dusanv (dusanv)]

It seems this directory gets reset to root:root during boot.

[Clint Byrum (clint-fewbar)]

Hell dusanv, thank you for file this bug report and helping to make Ubuntu better.

This is caused by this snippet in /etc/init.d/courier-mta:

if [ ! -d ${run_dir} ]; then
        mkdir -p ${run_dir}
        chown daemon:daemon ${run_dir}
fi

Which was I believe added to fix this bug:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349830

Which is similar.

It falsely assumes that $run_dir will be persistent across reboots. In fact, FHS section 5.13.1 shows that this is incorrect:

http://www.pathname.com/fhs/pub/fhs-2.3.pdf

"This directory contains system information data describing the system since it was booted. Files under this
directory must be cleared (removed or truncated as appropriate) at the beginning of the boot process."

The chown snippet should be done in the startup regardless of whether the mkdir needs to happen. I also think it should probably just chgrp on the dir, and authdaemon may need to be fixed as well to create its sub-dir with group ownership defaulting to 'daemon' r-x.

I'm reopening that bug to have the maintainer take another look.

Marking this bug as Triaged, importance Medium.

A workaround is to modify the init.d scripts for authdaemon and mta to modify the perms enough so it works every time.

[Clint Byrum (clint-fewbar)]

FYI, I do also see this

    # ensure proper permissions on /var/run/courier
    chgrp daemon /var/run/courier
    chmod g+rwx /var/run/courier

This doesn't help with accessing /var/run/courier/authdaemon , which is still going to be inaccessible to daemon.

[Clint Byrum (clint-fewbar)]

Ok, this is actually bug #483170 in courier-authlib.

Marking as duplicate. Note that the bug is fixed in 10.10 and natty, and is nominated for SRU to lucid.