Sending mail from a website using mail gives an error

Zmann · 2026-07-04 21:57:54

Hi,

sometimes I debug (own) websites sending mail via php mail function on my local system. This worked flawlessly in the past, but now I no longer receive the sent messages locally and the syslog says
postfix/postdrop[36896]: warning: mail_queue_enter: create file maildrop/593583.36896: Permission denied

Here the permissions of the mentioned folder:
# ls -ld /var/spool/postfix/maildrop
drwx-ws--- 2 postfix postdrop 4096 Jul 4 23:28 /var/spool/postfix/maildrop/

I searched for a solution but the proposals in the internet like `chmod 3730 /var/spool/postfix/maildrop` didn't help. Just to make sure I was not looking at the wrong place I tested
# chmod 2733 /var/spool/postfix/maildrop

After that, mail sending succeeded again, but of course this is no solution.

Can anyone shed some light on this? What are the correct permissions on this folder?

Cheers, Zmann

seth · 2026-07-04 22:29:21

If 2733 works by 2730 doesn't the postdrop process isn't run by the postdrop gid (or as root)
https://man.archlinux.org/man/postdrop.1#SECURITY

 echo foo | strace -f -o /tmp/postdrop.strace postdrop

Zmann · 2026-07-05 21:40:12

Thanks for your reply, seth!
I understand the problem and yes: an echo piped to postdrop causes the same error.
If I echo something to postdrop it is run as my user account and from the website it is run as user http. So far no surprise.

But `ls -l /usr/bin/postdrop` yields
-rwxr-sr-x 1 root postdrop 18648 Jun 18 11:10 /usr/bin/postdrop

I thought these permissions would cause the effective gid of the process to be set to the postdrop group, which obviously is not the case.
How am I expected to fix this?

Confused, Zmann

seth · 2026-07-06 06:02:52

postdrop group, which obviously is not the case.

Sorry, I should have pointed that out: /tmp/postdrop.strace is gonna be rather interesting about what's going on that prevents that from happening

Zmann · 2026-07-06 21:53:31

Hi seth, sorry, I was not sure, what to do with the log. I took a quick look, but I find interpreting traces quite difficult.

Is it good style to post the whole log (879 lines) or should I filter out certain lines? What I noticed so far is: there were several
lines in the log, where getgid() and getegid() were called and they always returned the same value (id of my primary group),
which is a little surprising for me.

Cheers, Zmann

seth · Yesterday 06:02:16

Is it good style to post the whole log (879 lines)

You can also

cat /tmp/postdrop.strace | curl -s -H "Accept: application/json, */*" --upload-file - 'https://paste.c-net.org/'

Zmann · Yesterday 18:13:31

Hi seth,

nice trick for avoiding huge posts!
You can find the log via https://paste.c-net.org/SpoutingSquat
My user id is 6666, id of my primary group is 985, id of group postdrop is 75.

Cheers, Zmann

seth · Yesterday 20:30:10

Ah, fook.

echo foo | sudo -g postdrop strace -f -o /tmp/postdrop.strace postdrop

(You cannot setgid under strace, so we just pretend that that has happened)

Zmann · Yesterday 22:01:40

Hi seth,

if a member of group postdrop executes the postdrop command, the file in /var/spool/postfix/maildrop can obviously be created but then postdrop fails with

...
16545 fstat(4, {st_mode=S_IFREG|0644, st_size=60, ...}) = 0
16545 read(4, "# dict-type\tso-name (pathname)\td"..., 4096) = 60
16545 read(4, "", 4096) = 0
16545 close(4) = 0
16545 access("/etc/postfix/dynamicmaps.cf.d", R_OK|X_OK) = 0
16545 openat(AT_FDCWD, "/etc/postfix/dynamicmaps.cf.d", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
16545 fstat(4, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
16545 getdents64(4, 0x56265f8afe90 /* 3 entries */, 32768) = 88
16545 openat(AT_FDCWD, "/etc/postfix/dynamicmaps.cf.d/postfix-lmdb.cf", O_RDONLY) = 5
16545 fstat(5, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0
16545 read(5, "lmdb\tpostfix-lmdb.so\tdict_lmdb_o"..., 4096) = 52
16545 read(5, "", 4096) = 0
16545 close(5) = 0
16545 getdents64(4, 0x56265f8afe90 /* 0 entries */, 32768) = 0
16545 close(4) = 0
16545 getpid() = 16545
16545 openat(AT_FDCWD, "maildrop/22309.16545", O_RDWR|O_CREAT|O_EXCL, 0644) = 4
16545 fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
16545 rename("maildrop/22309.16545", "maildrop/057793A00E9") = 0
16545 write(1, "protocol\0postdrop_protocol\0queue"..., 49) = 49
16545 read(0, "foo\n", 4096) = 4
16545 read(0, "", 4096) = 0
16545 write(2, "postdrop: warning: stdin: unexpe"..., 77) = 77
16545 getpid() = 16545
16545 sendto(3, "<20>Jul 7 23:52:00 postfix/post"..., 111, MSG_NOSIGNAL, NULL, 0) = 111
16545 write(2, "postdrop: fatal: uid=6666: malfo"..., 43) = 43
16545 getpid() = 16545
16545 sendto(3, "<18>Jul 7 23:52:00 postfix/post"..., 77, MSG_NOSIGNAL, NULL, 0) = 77
16545 rt_sigaction(SIGINT, {sa_handler=SIG_IGN, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=[QUIT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[QUIT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGTERM, {sa_handler=SIG_IGN, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 rt_sigaction(SIGHUP, {sa_handler=SIG_IGN, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, {sa_handler=0x5626349b4d20, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f6334e3e270}, 8) = 0
16545 unlink("maildrop/057793A00E9") = 0
16545 clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=1, tv_nsec=0}, 0x7ffce6b80d10) = 0
16545 exit_group(1) = ?
16545 +++ exited with 1 +++

The last words on commandline are:
protocolpostdrop_protocolqueue_id057793A00E9postdrop: warning: stdin: unexpected EOF in data, record type 102 length 111
postdrop: fatal: uid=6666: malformed input

I assume it complains about the lousy input :-)

Cheers, Zmann

seth · Today 06:54:31

if a member of group postdrop executes the postdrop command, the file in /var/spool/postfix/maildrop can obviously be created but then postdrop fails with

If

echo foo | sudo -g postdrop postdrop

"works" but

echo foo | postdrop

runs into a permission error the sgid isn't applied.

type -a postdrop
findmnt -T "$(type -p postdrop)"

Zmann · Today 18:31:08

Hi seth,

> type -a postdrop
postdrop is /usr/bin/postdrop

> findmnt -T "$(type -p postdrop)"
TARGET SOURCE         FSTYPE OPTIONS
/      /dev/nvme0n1p2 ext4   rw,relatime

Looks more or less as expected, I think.

Do you have any other ideas?

Cheers, Zmann

seth · Today 19:24:59

Meh, I had hoped for some script, function or nosuid mound

What happens if you re-own it to postdrop and set the SUID bit?

Zmann · Today 20:39:07

Mmmh, on my system there is no user postdrop, it's just a group...

seth · Today 21:21:00

It should™ not matter whether you're SUID'ing postdrop (or actually rather postfix) or root - the question is whether SUID works and SGID doesn't.
Maybe also try to re-group postdrop to root:root :\

Are you mayhaps using the linux-hardened kernel?

Edi: sudo works and uses SUID - maybe apparmor?

Last edited by seth (Today 21:26:27)

Arch Linux

#1 2026-07-04 21:57:54

Sending mail from a website using mail gives an error

#2 2026-07-04 22:29:21

Re: Sending mail from a website using mail gives an error

#3 2026-07-05 21:40:12

Re: Sending mail from a website using mail gives an error

#4 2026-07-06 06:02:52

Re: Sending mail from a website using mail gives an error

#5 2026-07-06 21:53:31

Re: Sending mail from a website using mail gives an error

#6 Yesterday 06:02:16

Re: Sending mail from a website using mail gives an error

#7 Yesterday 18:13:31

Re: Sending mail from a website using mail gives an error

#8 Yesterday 20:30:10

Re: Sending mail from a website using mail gives an error

#9 Yesterday 22:01:40

Re: Sending mail from a website using mail gives an error

#10 Today 06:54:31

Re: Sending mail from a website using mail gives an error

#11 Today 18:31:08

Re: Sending mail from a website using mail gives an error

#12 Today 19:24:59

Re: Sending mail from a website using mail gives an error

#13 Today 20:39:07

Re: Sending mail from a website using mail gives an error

#14 Today 21:21:00

Re: Sending mail from a website using mail gives an error

Board footer