Sending mail from a website using mail gives an error

Zmann · 2026-07-04 21:57:54

Hi,

sometimes I debug (own) websites sending mail via php mail function on my local system. This worked flawlessly in the past, but now I no longer receive the sent messages locally and the syslog says
postfix/postdrop[36896]: warning: mail_queue_enter: create file maildrop/593583.36896: Permission denied

Here the permissions of the mentioned folder:
# ls -ld /var/spool/postfix/maildrop
drwx-ws--- 2 postfix postdrop 4096 Jul 4 23:28 /var/spool/postfix/maildrop/

I searched for a solution but the proposals in the internet like `chmod 3730 /var/spool/postfix/maildrop` didn't help. Just to make sure I was not looking at the wrong place I tested
# chmod 2733 /var/spool/postfix/maildrop

After that, mail sending succeeded again, but of course this is no solution.

Can anyone shed some light on this? What are the correct permissions on this folder?

Cheers, Zmann

seth · 2026-07-04 22:29:21

If 2733 works by 2730 doesn't the postdrop process isn't run by the postdrop gid (or as root)
https://man.archlinux.org/man/postdrop.1#SECURITY

 echo foo | strace -f -o /tmp/postdrop.strace postdrop

Zmann · Yesterday 21:40:12

Thanks for your reply, seth!
I understand the problem and yes: an echo piped to postdrop causes the same error.
If I echo something to postdrop it is run as my user account and from the website it is run as user http. So far no surprise.

But `ls -l /usr/bin/postdrop` yields
-rwxr-sr-x 1 root postdrop 18648 Jun 18 11:10 /usr/bin/postdrop

I thought these permissions would cause the effective gid of the process to be set to the postdrop group, which obviously is not the case.
How am I expected to fix this?

Confused, Zmann

seth · Today 06:02:52

postdrop group, which obviously is not the case.

Sorry, I should have pointed that out: /tmp/postdrop.strace is gonna be rather interesting about what's going on that prevents that from happening

Zmann · Today 21:53:31

Hi seth, sorry, I was not sure, what to do with the log. I took a quick look, but I find interpreting traces quite difficult.

Is it good style to post the whole log (879 lines) or should I filter out certain lines? What I noticed so far is: there were several
lines in the log, where getgid() and getegid() were called and they always returned the same value (id of my primary group),
which is a little surprising for me.

Cheers, Zmann

Arch Linux

#1 2026-07-04 21:57:54

Sending mail from a website using mail gives an error

#2 2026-07-04 22:29:21

Re: Sending mail from a website using mail gives an error

#3 Yesterday 21:40:12

Re: Sending mail from a website using mail gives an error

#4 Today 06:02:52

Re: Sending mail from a website using mail gives an error

#5 Today 21:53:31

Re: Sending mail from a website using mail gives an error

Board footer