4

I'm attempting to pipe an email to PHP with my Postfix mail server, using the technique mentioned here and have encountered the following error...

Mar 16 22:52:52 s15438530 postfix/pipe[9259]: AD1632E84C63: to=<php@[myserver].com>, relay=plesk_virtual, delay=0.61, delays=0.59/0/0/0.02, dsn=4.3.0, status=deferred (temporary failure. Command output: /bin/sh: /var/www/vhosts/[myserver].com/httpdocs/clients/emailpipe/email2php.php: Permission denied 4.2.1 Message can not be delivered at this time )

I'd really appreciate if anyone could shed some light on this issue for me. I've tried 777'ing the emailpipe directory, to no avail. Where am I going wrong?

Many thanks.

stevenmc
  • 1,659
  • 4
  • 18
  • 27
  • Have you looked at the permissions of the parent of the emailpipe directory (and all directories farther up in the directory structure)? By the way, don't chmod it 777; setting it to 755 is perfectly adequate. – amcnabb Mar 21 '12 at 22:44

4 Answers4

10

From the postfix docs...

For security reasons, deliveries to command and file destinations are performed with the rights of the alias database owner. A default userid, default_privs, is used for deliveries to commands/files in root-owned aliases.

So you have two options, either set the default_privs in main.cf to match the ownership of the email2php file.

Alternatively, there should be a way to create an alias database that is owned by the user instead of postfix/nobody. I haven't tried this before though so can't advise.

outeredge
  • 295
  • 1
  • 8
  • +1. This is likely to be the _actual_ issue causing the perm problem in the first place. – MrGomez Mar 28 '12 at 16:50
  • The down side of the first option is that we can specify only one user to the *default_privs*. So, I tried your alternative solution and got a positive result. See http://serverfault.com/a/517805/145024. – Tsutomu Jun 22 '13 at 17:33
3

I have fixed this issue by disabling the SELINUX.

tomrozb
  • 25,773
  • 31
  • 101
  • 122
Saurabh Singla
  • 31
  • 3
  • I was able to use the [audit2allow](https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow.html) command to generate a policy that allowed SELinux to remain running but permit my script to handle incoming email piped to it from Postfix. – PaulR Feb 21 '14 at 18:53
2

Make sure that you have

#!/usr/bin/php
<?php

(or whatever your path to php is - do "which php" on the server) at the top of each of your php scripts and that each of the php script files is executable

chmod +x /var/.../email2php.php

Also, make sure that you can test the script from the command line:

cat some_rfc822_email.txt | /var/.../email2php.php

and get the result that you want

Eli Rosencruft
  • 7,232
  • 1
  • 19
  • 17
0

To fix this issue, you'll want to chown or chmod /var/www/vhosts/[myserver].com/httpdocs/clients/emailpipe/email2php.php to executable by your postfix user. Alternately, you'll want to redefine this user to execute the file successfully.

Simply changing the permissions of your directory (unless you used -R) won't be sufficient.

To illustrate why this works, consider the following toy example: 

<me>@harley:~$ touch test
<me>@harley:~$ ls -al test
-rw-r--r-- 1 <me> <me> 0 2012-03-26 23:44 test
<me>@harley:~$ sh test
<me>@harley:~$
<me>@harley:~$ ./test
bash: ./test: Permission denied
<me>@harley:~$ chmod 755 test
<me>@harley:~$ ./test
<me>@harley:~$

In order to execute a file directly through the running shell, it needs to be set as executable. Other invocations (for example, sh email2php.php or php email2php.php) only require read access, because they're chaining execution off a different file entirely.

For what's likely to be causing the issue in the first place, see here.

Community
  • 1
  • 1
MrGomez
  • 23,788
  • 45
  • 72
  • I had used the -R flag, the answer provided by amcnabb allowed me to make progress, however, I'm still encountering issues saving off attachments. Thanks for your suggestion though. – stevenmc Mar 28 '12 at 13:11