mail/spamassassin config option AS_ROOT is confusing
adamw at adamw.org
Wed Dec 21 00:16:38 UTC 2016
> On 20 Dec, 2016, at 16:51, RW <rwmaillists at googlemail.com> wrote:
> On Tue, 20 Dec 2016 11:53:43 -0700
> Mike Brown wrote:
>> The AS_ROOT option in the mail/spamassassin port is really confusing
>> to me. Given that its description is "Run spamd as root
>> (recommended)", what actually happens is somewhat bonkers:
>> The main spamd process always runs as root. If AS_ROOT is enabled,
>> then the child processes who do all the work will not run as root,
>> but rather as unprivileged user spamd. If AS_ROOT is disabled, then
>> the children *will* run as root, but as needed they will setuid to
>> the user calling spamc.
>> Which setting you want depends on where user prefs and Bayes data is
>> stored. If it's in user-owned ~/.spamassassin directories, then you
>> want AS_ROOT disabled or you'll get a plethora of error messages and
>> lock file warnings relating to permissions, since user spamd can't
>> write where it needs to.
> That shouldn't happen as the default (without virtual users) is to
> use /var/spool/spamd, the spamd user's home directory.
>> It took me a while to figure this out on a fresh installation. I
>> enabled the option, thinking "yes, of course I want it to run as
>> root, so that it can write to the users' home directories"... then I
>> was confused when it ended up not running as root but rather as user
>> spamd, and the behavior I wanted was only possible if I configured
>> the port to *not* run spamd as root.
>> I guess I am just griping, but I would like to think there is a
>> better way to describe and name the configuration option. Maybe
>> AS_SPAMD_USER with description "Run spamd as unprivileged user
> I never noticed this because (probably like a lot of people) the first
> thing I did was set my own spamd_flags in rc.conf and that overrides
> the effect of AS_ROOT.
> I do agree it's confusing. I've CC'ed the maintainer.
Thanks for the Cc, RW. Mike, I completely agree that the wording is terrible.
I think your suggested text ("Run spamd as unprivileged user (recommended)") is great.
The ports system also has the ability to put more detail into a pkg-help file that shows up as something like "Press ^E for more info." It sounds like this would be useful here. It's been a while since I messed around with that option so would you be interested in writing a slightly more detailed explanation of the difference?
adamw at adamw.org
More information about the freebsd-ports