1

Postfix is delivering mail to ~vmail/user/new directories with owner vmail:vmail but permissions masked to 700 (i.e. not group readable.) I need the mailfiles to be created group readable so that other apps in the vmail group can read the mailbox directly. How can I configure these permissions?

tribalvibes
  • 127
  • 6

3 Answers3

2

The permissions are not configurable, I'm afraid. They're hardcoded in Postfix.

Dag Høidahl
  • 133
  • 6
  • Could use ACLs to add additional allowed read permissions? – morgant May 09 '12 at 14:58
  • 1
    For reference, [here the lines](https://github.com/vdukhovni/postfix/blob/master/postfix/src/virtual/maildir.c#L209) where postfix hardcoded its permission – masegaloeh Feb 17 '15 at 09:45
  • ACLs will not help here. Postfix ensures only the owner can access newly arrived emails, even when the Default ACL for newly created files is more permissive. – sampi Jun 15 '18 at 09:38
2

Firstly, it is a good idea to restate the already existing answer. Postfix does not allow setting mailbox permissions. They are hard coded.

The correct solution is always likely do delegate the delivery to some other software. Supposedly LMTP to dovecot is one possible choice. In case you are already abusing what is possible with postfix to the degree where replacing the delivery agent is not feasible, you might still hack up a configuration which works good enough. It is not advisable, so please do not follow this route unless really, really needed and never prior to reflecting over this post.

As noted on multiple-transports-in-postfix, it is possible to perform arbitrary actions on email reception by setting always_bcc. Doing so in combination with a pipe transport not actually delivering anything but instead recursively running chmod or setfacl on the relevant mail folders might help achieving more accessible file permissions. There is no guarantee that the real transport completes delivery before the fake transport sets the permissions, so be careful.

Configuration examples deliberately not provided, because delegating delivery to some other software is always the desired choice for anyone hoping to copy'n'paste.

sampi
  • 158
  • 5
0

I was able to solve my use case simply by setting the owner of the maildirs to app:vmail rather than adding the apps to the vmail group. Thanks everyone for the workarounds.

tribalvibes
  • 127
  • 6