Debian Bug report logs - #832576
postfix: Messages postfix-script: warning: group or other writable: in the logs

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Francois Mescam <francois@mescam.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: postfix: Messages postfix-script: warning: group or other writable: in the logs

Date: Wed, 27 Jul 2016 09:36:54 +0200

Package: postfix
Version: 3.1.0-4
Severity: normal

Dear Maintainer,

When I do "systemctl restart postfix" in the logs I have :
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9559]: stopping the Postfix mail system
Jul 27 09:27:08 eiffel6 postfix/master[9515]: terminating on signal 15
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9706]: warning: group or other writable: /usr/lib/postfix/./libpostfix-tls.so.1
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9707]: warning: group or other writable: /usr/lib/postfix/./sbin/lmtp
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9708]: warning: group or other writable: /usr/lib/postfix/./libpostfix-dns.so.1
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9709]: warning: group or other writable: /usr/lib/postfix/./libpostfix-util.so.1
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9710]: warning: group or other writable: /usr/lib/postfix/./libpostfix-master.so.1
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9711]: warning: group or other writable: /usr/lib/postfix/./libpostfix-global.so.1
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9712]: warning: group or other writable: /usr/lib/postfix/sbin/./lmtp
Jul 27 09:27:08 eiffel6 postfix/postfix-script[9762]: starting the Postfix mail system
Jul 27 09:27:08 eiffel6 postfix/master[9764]: daemon started -- version 3.1.0, configuration /etc/postfix

I see nothing bad in the files mentionned, for example :
# ls -l /usr/lib/postfix/./sbin/lmtp
lrwxrwxrwx 1 root root 4 juil. 20 23:42 /usr/lib/postfix/./sbin/lmtp -> smtp
# ls -l /usr/lib/postfix/./sbin/smtp
-rwxr-xr-x 1 root root 123464 juil. 20 23:42 /usr/lib/postfix/./sbin/smtp

I have these warnings since I installed postfix (3.1.0-3.1).

With my best regards.

François

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (900, 'testing'), (800, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages postfix depends on:
ii  adduser                3.115
ii  cpio                   2.11+dfsg-5
ii  debconf [debconf-2.0]  1.5.59
ii  dpkg                   1.18.9
ii  init-system-helpers    1.36
ii  libc6                  2.23-2
ii  libdb5.3               5.3.28-12
ii  libicu55               55.1-7
ii  libsasl2-2             2.1.26.dfsg1-15
ii  libsqlite3-0           3.13.0-1
ii  libssl1.0.2            1.0.2h-1
ii  lsb-base               9.20160629
ii  netbase                5.3
ii  ssl-cert               1.0.38

Versions of packages postfix recommends:
ii  python3  3.5.1-4

Versions of packages postfix suggests:
ii  bsd-mailx [mail-reader]        8.1.2-0.20160123cvs-3
ii  dovecot-core [dovecot-common]  1:2.2.25-1
ii  icedove [mail-reader]          1:45.1.0-1
ii  libsasl2-modules               2.1.26.dfsg1-15
ii  mutt [mail-reader]             1.6.0-1
pn  postfix-cdb                    <none>
ii  postfix-doc                    3.1.0-4
pn  postfix-ldap                   <none>
pn  postfix-mysql                  <none>
pn  postfix-pcre                   <none>
pn  postfix-pgsql                  <none>
ii  procmail                       3.22-25
pn  resolvconf                     <none>
pn  sasl2-bin                      <none>
pn  ufw                            <none>

-- debconf information:
  postfix/relay_restrictions_warning:
* postfix/main_mailer_type: Internet Site
  postfix/chattr: false
* postfix/mailname: eiffel6.mcfm
  postfix/destinations: eiffel6, localhost, eiffel6.mcfm
  postfix/recipient_delim: +
  postfix/protocols: all
  postfix/compat_conversion_warning: true
  postfix/sqlite_warning:
  postfix/not_configured:
  postfix/main_cf_conversion_warning: true
  postfix/kernel_version_warning:
  postfix/retry_upgrade_warning:
  postfix/mydomain_warning:
  postfix/root_address:
  postfix/rfc1035_violation: false
  postfix/mynetworks: 127.0.0.1/32 192.168.1.18/32 172.17.0.1/32 [::1]/128 [fe80::6257:18ff:fe03:28d9]/128
  postfix/bad_recipient_delimiter:
  postfix/tlsmgr_upgrade_warning:
  postfix/relayhost:
  postfix/procmail: true
  postfix/dynamicmaps_conversion_warning:
  postfix/mailbox_limit: 0

Message #10 received at 832576@bugs.debian.org (full text, mbox, reply):

From: Sven Joachim <svenjoac@gmx.de>

To: Francois Mescam <francois@mescam.org>

Cc: 832576@bugs.debian.org

Subject: Re: Bug#832576: postfix: Messages postfix-script: warning: group or other writable: in the logs

Date: Fri, 29 Jul 2016 12:07:02 +0200

Control: forwarded -1 http://marc.info/?l=postfix-users&m=145686783109440&w=2

On 2016-07-27 09:36 +0200, Francois Mescam wrote:

> When I do "systemctl restart postfix" in the logs I have :
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9559]: stopping the Postfix mail system
> Jul 27 09:27:08 eiffel6 postfix/master[9515]: terminating on signal 15
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9706]: warning: group
> or other writable: /usr/lib/postfix/./libpostfix-tls.so.1
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9707]: warning: group or other writable: /usr/lib/postfix/./sbin/lmtp
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9708]: warning: group
> or other writable: /usr/lib/postfix/./libpostfix-dns.so.1
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9709]: warning: group
> or other writable: /usr/lib/postfix/./libpostfix-util.so.1
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9710]: warning: group
> or other writable: /usr/lib/postfix/./libpostfix-master.so.1
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9711]: warning: group
> or other writable: /usr/lib/postfix/./libpostfix-global.so.1
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9712]: warning: group or other writable: /usr/lib/postfix/sbin/./lmtp
> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9762]: starting the Postfix mail system
> Jul 27 09:27:08 eiffel6 postfix/master[9764]: daemon started -- version 3.1.0, configuration /etc/postfix
>
> I see nothing bad in the files mentionned, for example :
> # ls -l /usr/lib/postfix/./sbin/lmtp
> lrwxrwxrwx 1 root root 4 juil. 20 23:42 /usr/lib/postfix/./sbin/lmtp -> smtp
> # ls -l /usr/lib/postfix/./sbin/smtp
> -rwxr-xr-x 1 root root 123464 juil. 20 23:42 /usr/lib/postfix/./sbin/smtp

Yeah, all these warnings are about symlinks.  The solution is to use
"find -L", although Wietse seems to have reservations about that (see
his replies in the thread on postfix-users).

Cheers,
       Sven

Message #17 received at 832576@bugs.debian.org (full text, mbox, reply):

From: Francois Mescam <francois@mescam.org>

To: Sven Joachim <svenjoac@gmx.de>

Cc: 832576@bugs.debian.org

Subject: Re: Bug#832576: postfix: Messages postfix-script: warning: group or other writable: in the logs

Date: Fri, 29 Jul 2016 21:07:26 +0200

[Message part 1 (text/plain, inline)]

On 29/07/2016 12:07, Sven Joachim wrote:
> Control: forwarded -1 http://marc.info/?l=postfix-users&m=145686783109440&w=2
>
> On 2016-07-27 09:36 +0200, Francois Mescam wrote:
>
>> When I do "systemctl restart postfix" in the logs I have :
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9559]: stopping the Postfix mail system
>> Jul 27 09:27:08 eiffel6 postfix/master[9515]: terminating on signal 15
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9706]: warning: group
>> or other writable: /usr/lib/postfix/./libpostfix-tls.so.1
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9707]: warning: group or other writable: /usr/lib/postfix/./sbin/lmtp
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9708]: warning: group
>> or other writable: /usr/lib/postfix/./libpostfix-dns.so.1
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9709]: warning: group
>> or other writable: /usr/lib/postfix/./libpostfix-util.so.1
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9710]: warning: group
>> or other writable: /usr/lib/postfix/./libpostfix-master.so.1
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9711]: warning: group
>> or other writable: /usr/lib/postfix/./libpostfix-global.so.1
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9712]: warning: group or other writable: /usr/lib/postfix/sbin/./lmtp
>> Jul 27 09:27:08 eiffel6 postfix/postfix-script[9762]: starting the Postfix mail system
>> Jul 27 09:27:08 eiffel6 postfix/master[9764]: daemon started -- version 3.1.0, configuration /etc/postfix
>>
>> I see nothing bad in the files mentionned, for example :
>> # ls -l /usr/lib/postfix/./sbin/lmtp
>> lrwxrwxrwx 1 root root 4 juil. 20 23:42 /usr/lib/postfix/./sbin/lmtp -> smtp
>> # ls -l /usr/lib/postfix/./sbin/smtp
>> -rwxr-xr-x 1 root root 123464 juil. 20 23:42 /usr/lib/postfix/./sbin/smtp
> Yeah, all these warnings are about symlinks.  The solution is to use
> "find -L", although Wietse seems to have reservations about that (see
> his replies in the thread on postfix-users).
Thanks for these explanations. I'll continue to live with theses 
massages, perhaps I'll filter them with logcheck.
>
> Cheers,
>         Sven


-- 
 Francois Mescam

[Message part 2 (text/html, inline)]

Message #22 received at 832576@bugs.debian.org (full text, mbox, reply):

From: Scott Mcdermott <scott@smemsh.net>

To: 832576@bugs.debian.org

Subject: Re: Bug#832576: postfix: Messages postfix-script: warning: group or other writable: in the logs

Date: Thu, 4 Aug 2016 23:21:40 -0700

> The solution is to use "find -L", although Wietse seems to
> have reservations about that (see his replies in the thread on
> postfix-users).

reference is
http://marc.info/?l=postfix-users&m=145687936712995&q=raw
msgid 3qFGk11psPzJrQ6@spike.porcupine.org

that patch should be ok right? if symlink, it must have been put
there by root anyways so there is no additional danger by
following it...

here is his patch with debian line numbers, seems to work.

everyone on debian has these warnings emitted since these .so
file will always have symlinks in /usr/lib/postfix placed there
for the different sonames


--- a/conf/postfix-script
+++ b/conf/postfix-script
@@ -299,10 +304,17 @@
 	}
 	todo=`echo "$todo" | tr ' ' '\12' | sort -u`
 
-	find $todo ! -user root \
+	if find -L $config_directory/main.cf >/dev/null 2>&1
+	then
+	    FIND="find -L"
+	else
+	    FIND=find
+	fi
+
+	$FIND $todo ! -user root \
 	    -exec $WARN not owned by root: {} \;
 
-	find $todo \( -perm -020 -o -perm -002 \) \
+	$FIND $todo \( -perm -020 -o -perm -002 \) \
 	    -exec $WARN group or other writable: {} \;
 
 	# Check Postfix mail_owner-owned directory tree owner/permissions.

Message #27 received at 832576-submitter@bugs.debian.org (full text, mbox, reply):

From: Scott Kitterman <debian@kitterman.com>

To: 832576-submitter@bugs.debian.org

Subject: Re: Bug#832576: postfix: Messages postfix-script: warning: group or other writable: in the logs

Date: Wed, 28 Dec 2016 11:36:19 -0500

On Thu, 4 Aug 2016 23:21:40 -0700 Scott Mcdermott <scott@smemsh.net> wrote:
> > The solution is to use "find -L", although Wietse seems to
> > have reservations about that (see his replies in the thread on
> > postfix-users).
> 
> reference is
> http://marc.info/?l=postfix-users&m=145687936712995&q=raw
> msgid 3qFGk11psPzJrQ6@spike.porcupine.org
> 
> that patch should be ok right? if symlink, it must have been put
> there by root anyways so there is no additional danger by
> following it...
> 
> here is his patch with debian line numbers, seems to work.
> 
> everyone on debian has these warnings emitted since these .so
> file will always have symlinks in /usr/lib/postfix placed there
> for the different sonames
> 
> 
> --- a/conf/postfix-script
> +++ b/conf/postfix-script
> @@ -299,10 +304,17 @@
>  	}
>  	todo=`echo "$todo" | tr ' ' '\12' | sort -u`
>  
> -	find $todo ! -user root \
> +	if find -L $config_directory/main.cf >/dev/null 2>&1
> +	then
> +	    FIND="find -L"
> +	else
> +	    FIND=find
> +	fi
> +
> +	$FIND $todo ! -user root \
>  	    -exec $WARN not owned by root: {} \;
>  
> -	find $todo \( -perm -020 -o -perm -002 \) \
> +	$FIND $todo \( -perm -020 -o -perm -002 \) \
>  	    -exec $WARN group or other writable: {} \;
>  
>  	# Check Postfix mail_owner-owned directory tree owner/permissions.

A better solution is to get rid of the symlinks, which will be done in the 
next upload.  The sonames aren't actually useful for postfix since they aren't 
meant to represent any public ABI (and aren't present except in Debian).

Scott K

Message #38 received at 832576-close@bugs.debian.org (full text, mbox, reply):

From: LaMont Jones <lamont@debian.org>

To: 832576-close@bugs.debian.org

Subject: Bug#832576: fixed in postfix 3.1.4-1

Date: Thu, 05 Jan 2017 16:19:28 +0000

Source: postfix
Source-Version: 3.1.4-1

We believe that the bug you reported is fixed in the latest version of
postfix, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 832576@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
LaMont Jones <lamont@debian.org> (supplier of updated postfix package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 04 Jan 2017 17:55:06 -0700
Source: postfix
Binary: postfix postfix-ldap postfix-lmdb postfix-cdb postfix-pcre postfix-mysql postfix-pgsql postfix-sqlite postfix-doc
Architecture: source
Version: 3.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: LaMont Jones <lamont@debian.org>
Changed-By: LaMont Jones <lamont@debian.org>
Description:
 postfix    - High-performance mail transport agent
 postfix-cdb - CDB map support for Postfix
 postfix-doc - Documentation for Postfix
 postfix-ldap - LDAP map support for Postfix
 postfix-lmdb - LMDB map support for Postfix
 postfix-mysql - MySQL map support for Postfix
 postfix-pcre - PCRE map support for Postfix
 postfix-pgsql - PostgreSQL map support for Postfix
 postfix-sqlite - SQLite map support for Postfix
Closes: 589188 794038 822291 832576 836306 844277 849584 849778 849919 849920 849964 850049 850086
Changes:
 postfix (3.1.4-1) unstable; urgency=medium
 .
   [Wietse Venema]
 .
   * New Upstream 3.1.4
 .
   [Scott Kitterman]
 .
   * For systems using systemd (and only systems using systemd) and not
     configured for local only use, add service override file to start after
     network-online.target and systemd-resolved.service to ensure the network
     is fully up and name services are available.  Closes: #822291, #836306,
     #844277  LP: #1649453
   * Remove postfix-dev: The postfix headers are not public interfaces and not
     suitable for third-party development
   * Stop setting artificial soname for postfix share libs - upstream does not
     promise any ABI stability and in Debian exact version depends keep needed
     packages in sync - Resolves most symlink related issues with postfix check
   * Do not choke on dangling symlinks in ca-certificates.  LP: #1305232
   * Stop shipping lmtp symlink and have master.cf/master.cf.proto lmtp
     services us smtp - they are the same since postfix 2.1.  Closes: #832576
   * Remove debian/*.files - no longer needed
   * Split postfix-files into postfix-files.d snippets for each postfix-*
     binary to enable postfix set-permissions to have the potential to work
     (additional file naming issues still to be resolved)
   * Install /etc/postfix/makedefs.out so users can see how the package was
     built
   * Add /etc/postfix/dynamicmaps.cf.d and postfix-files.d to directories
     shipped by postfix
   * Exclude Postfix license files from postfix-files - not needed in Debian
     since we ship the licenses in debian/copyright
   * Update debian/patches/05_debian_defaults.diff to comment out files in
     postfix-files that Debian does not ship in /etc/postfix
   * Add debian/patches/05_debian_manpage_differences.diff to align
     postfix-files to Debian man page naming/compression
   * Add debian/patches/05_debian_readme_differences.diff to align
     postfix-files to Debian README file naming/compression.  Closes: #589188
     LP: #274108
   * Add OVERVIEW to README files shipped in postfix-doc
   * Moved install of map type so files inside the loop used to create their
     postfix-files.d snippets to simplify debian/rules
   * Added postfix.NEWS entry to describe the demise of the smtp -> lmtp symlink
   * Move man 5 *_tables man pages to their respective binary packages and add
     appropriate breaks/replaces
   * Remove ancient check for kernels before 2.6.  Closes: #794038
   * Remove service file override on purge
   * Do not attempt to use postmulti is /etc/postfix/main.cf does not exist -
     it will fail
   * Add NEWS item and documentation about how to us postfix service files.
     Closes: #849584
 .
   [LaMont Jones]
 .
   * Make lmtp warning be a debconf question, instead of a NEWS item.
   * Allow libmysqlclient-dev to satisfy build-deps, to make backporting easier.
   * Better permissions for /etc/postfix/postfix-files.d, et al.
   * Default to compatibility_level=2 on fresh installs.
   * Various lint cleanup in templates.
   * re-refresh po files for neatness.
   * Various message cleanup in postinst, for consistency.
 .
   [localization folks]
 .
   * l10n: Updated Japanese debconf translations.  Closes: #849919 (Kenshi Muto)
   * l10n: Updated Slovak debconf translations.  Closes: #849778 (helix84)
   * l10n: Updated Basque debconf translation.  Closes: #850049 (Dooteo)
   * l10n: Updated Swedish debconf translations.  Closes: #849920 (Martin Bagge)
   * l10n: Updated Danish debconf translations.  Closes: #849964 (Joe Dalton)
   * l10n: Updated Indonesian debconf translations. (Surya Fajri)
   * l10n: Updated Brazilian Portuguese debconf translations. (Uesli)
   * l10n: Updated Brazilian Portuguese debconf translations.  Closes: #850086
     (Marcelo Santana)
   * l10n: Updated German debconf translations. (Markus Hiereth)
   * l10n: Updated Brazilian Portuguese debconf translations.  Closes: #850086
     (Marcelo Santana)
   * l10n: Updated German debconf translations. (Markus Hiereth)
Checksums-Sha1:
 f7f672c75ca1749170c0a131e48318131004d75f 2642 postfix_3.1.4-1.dsc
 2889744044d85209563dc0b5388eb32c8b1f93f0 4340102 postfix_3.1.4.orig.tar.gz
 1fceea2f6b69ed3f370df8c64b75db790ef77da0 188440 postfix_3.1.4-1.debian.tar.xz
Checksums-Sha256:
 1484839c2cfaf589910940b25c8f4bca27054a0d6e013d17c053c3afafe44984 2642 postfix_3.1.4-1.dsc
 f33b470c47ae8b4ff199ab55dc42e86031ff0c535ccbc83069c8cff69b5bd027 4340102 postfix_3.1.4.orig.tar.gz
 fb076ac1ea93ca06e897b48275240a2ace98b50285ddaec8698a16e6f459d997 188440 postfix_3.1.4-1.debian.tar.xz
Files:
 eb8a4b6e98b0993ab8cda7fe300b7ec2 2642 mail extra postfix_3.1.4-1.dsc
 878a059d92ee3b093d7d3e97248c915d 4340102 mail extra postfix_3.1.4.orig.tar.gz
 bacd420e49cef25a0416aec78e1fb1d4 188440 mail extra postfix_3.1.4-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBWG5iqNVHlGMnADo/AQjYmg//U3+aErjLpmN5lx2v/LHJ5sLDIOYLBmJM
uM260ikXzYs26adO9xS28+h9eOeJT8Ql6wRT6+nejyVFWI/u+M2mva825BfevIrF
LnIqww6vijJqM7G2S/2U2+irZc5bqmvsclD2uBoBMBV1j+pBEcVnEzDxwgC5JKaI
1RB9AiNHWoXAHMmwwLUUssCey7lHIos+W2p5RecgRvTN9K4wJCfB5KUXLhVuXENv
m+02NrpPW/50uHBkQRhzoqOgG7l0W+1HThiRHsWJ0LjS/s4SoczYpFGuwjlWmq4G
0fOUHgfXct8MxJOwzR+b2nT/WD9EiYkfhaN6HdHOz25QkMu8yE0nelBhrfXe6SRP
szF2PbNSkwybBMr/kdNrte6hWpq65aVkjNJsZLZWbCW56pz5fr0SULnQeI4ztJmG
vYGELt4uYZdDzKfrVodx5Z53z9c6B6cRaRJQvIpdf+8JbPpg1CKAI9i/kjokqOWx
1BUzK1pi2bq/NA3DDjtYlWL8S5U+X2Qtg/WfQ5RXL9JXqmCnh0pO03OhHsXPxP2+
PjQqVQt2PbxQ8LwK1HV1bj5/OoasJE4lSdUR7z8t16CvzUTU6bKsKC+rQc08EjRB
1DeJj1odpbXzB+WVkkeAsOZaVDnPVLlDp7k6z7P7yS1hw53pSBMBCqv4Tv6qtoxs
k2UN3lA/1Tg=
=mMwH
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.