Sending mail from a website using mail gives an error

Zmann · 2026-07-04 21:57:54

Hi,

sometimes I debug (own) websites sending mail via php mail function on my local system. This worked flawlessly in the past, but now I no longer receive the sent messages locally and the syslog says
postfix/postdrop[36896]: warning: mail_queue_enter: create file maildrop/593583.36896: Permission denied

Here the permissions of the mentioned folder:
# ls -ld /var/spool/postfix/maildrop
drwx-ws--- 2 postfix postdrop 4096 Jul 4 23:28 /var/spool/postfix/maildrop/

I searched for a solution but the proposals in the internet like `chmod 3730 /var/spool/postfix/maildrop` didn't help. Just to make sure I was not looking at the wrong place I tested
# chmod 2733 /var/spool/postfix/maildrop

After that, mail sending succeeded again, but of course this is no solution.

Can anyone shed some light on this? What are the correct permissions on this folder?

Cheers, Zmann

seth · 2026-07-04 22:29:21

If 2733 works by 2730 doesn't the postdrop process isn't run by the postdrop gid (or as root)
https://man.archlinux.org/man/postdrop.1#SECURITY

 echo foo | strace -f -o /tmp/postdrop.strace postdrop

Zmann · 2026-07-05 21:40:12

Thanks for your reply, seth!
I understand the problem and yes: an echo piped to postdrop causes the same error.
If I echo something to postdrop it is run as my user account and from the website it is run as user http. So far no surprise.

But `ls -l /usr/bin/postdrop` yields
-rwxr-sr-x 1 root postdrop 18648 Jun 18 11:10 /usr/bin/postdrop

I thought these permissions would cause the effective gid of the process to be set to the postdrop group, which obviously is not the case.
How am I expected to fix this?

Confused, Zmann

seth · Yesterday 06:02:52

postdrop group, which obviously is not the case.

Sorry, I should have pointed that out: /tmp/postdrop.strace is gonna be rather interesting about what's going on that prevents that from happening

Zmann · Yesterday 21:53:31

Hi seth, sorry, I was not sure, what to do with the log. I took a quick look, but I find interpreting traces quite difficult.

Is it good style to post the whole log (879 lines) or should I filter out certain lines? What I noticed so far is: there were several
lines in the log, where getgid() and getegid() were called and they always returned the same value (id of my primary group),
which is a little surprising for me.

Cheers, Zmann

seth · Today 06:02:16

Is it good style to post the whole log (879 lines)

You can also

cat /tmp/postdrop.strace | curl -s -H "Accept: application/json, */*" --upload-file - 'https://paste.c-net.org/'

Zmann · Today 18:13:31

Hi seth,

nice trick for avoiding huge posts!
You can find the log via https://paste.c-net.org/SpoutingSquat
My user id is 6666, id of my primary group is 985, id of group postdrop is 75.

Cheers, Zmann

seth · Today 20:30:10

Ah, fook.

echo foo | sudo -g postdrop strace -f -o /tmp/postdrop.strace postdrop

(You cannot setgid under strace, so we just pretend that that has happened)

Zmann · Today 22:01:40

Hi seth,

if a member of group postdrop executes the postdrop command, the file in /var/spool/postfix/maildrop can obviously be created but then postdrop fails with

...
16545 fstat(4, {st_mode=S_IFREG|0644, st_size=60, ...}) = 0
16545 read(4, "# dict-type\tso-name (pathname)\td"..., 4096) = 60
16545 read(4, "", 4096) = 0
16545 close(4) = 0
16545 access("/etc/postfix/dynamicmaps.cf.d", R_OK|X_OK) = 0
16545 openat(AT_FDCWD, "/etc/postfix/dynamicmaps.cf.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
16545 fstat(4, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
16545 getdents64(4, 0x56265f8afe90 /* 3 entries */, 32768) = 88
16545 openat(AT_FDCWD, "/etc/postfix/dynamicmaps.cf.d/postfix-lmdb.cf", O_RDONLY) = 5
16545 fstat(5, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0
16545 read(5, "lmdb\tpostfix-lmdb.so\tdict_lmdb_o"..., 4096) = 52
16545 read(5, "", 4096) = 0
16545 close(5) = 0
16545 getdents64(4, 0x56265f8afe90 /* 0 entries */, 32768) = 0
16545 close(4) = 0
16545 getpid() = 16545
16545 openat(AT_FDCWD, "maildrop/22309.16545", O_RDWR|O_CREAT|O_EXCL, 0644) = 4
16545 fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
16545 rename("maildrop/22309.16545", "maildrop/057793A00E9") = 0
16545 write(1, "protocol\0postdrop_protocol\0queue"..., 49) = 49
16545 read(0, "foo\n", 4096) = 4
16545 read(0, "", 4096) = 0
16545 write(2, "postdrop: warning: stdin: unexpe"..., 77) = 77
16545 getpid() = 16545
16545 sendto(3, "<20>Jul 7 23:52:00 postfix/post"..., 111, MSG_NOSIGNAL, NULL, 0) = 111
16545 write(2, "postdrop: fatal: uid=6666: malfo"..., 43) = 43
16545 getpid() = 16545
16545 sendto(3, "<18>Jul 7 23:52:00 postfix/post"..., 77, MSG_NOSIGNAL, NULL, 0) = 77
16545 rt_sigaction(SIGINT, {sa_handler=SIG_IGN, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=[QUIT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[QUIT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGTERM, {sa_handler=SIG_IGN, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGHUP, {sa_handler=SIG_IGN, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 unlink("maildrop/057793A00E9") = 0
16545 clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=1, tv_nsec=0}, 0x7ffce6b80d10) = 0
16545 exit_group(1) = ?
16545 +++ exited with 1 +++

The last words on commandline are:
protocolpostdrop_protocolqueue_id057793A00E9postdrop: warning: stdin: unexpected EOF in data, record type 102 length 111
postdrop: fatal: uid=6666: malformed input

I assume it complains about the lousy input :-)

Cheers, Zmann

Arch Linux

#1 2026-07-04 21:57:54

Sending mail from a website using mail gives an error

#2 2026-07-04 22:29:21

Re: Sending mail from a website using mail gives an error

#3 2026-07-05 21:40:12

Re: Sending mail from a website using mail gives an error

#4 Yesterday 06:02:52

Re: Sending mail from a website using mail gives an error

#5 Yesterday 21:53:31

Re: Sending mail from a website using mail gives an error

#6 Today 06:02:16

Re: Sending mail from a website using mail gives an error

#7 Today 18:13:31

Re: Sending mail from a website using mail gives an error

#8 Today 20:30:10

Re: Sending mail from a website using mail gives an error

#9 Today 22:01:40

Re: Sending mail from a website using mail gives an error

Board footer