Re: Upgrade spamassassin from 4.0.1 to 4.0.2 breaks amavis
"Jared Hall via users" <[email protected]>
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
Yikes. Running anything daemon as root on BSD doesn't seem right. It
is entirely likely that some directories have 640 permissions. From the
Amavisd-new docs/Security Considerations:
* Never run/amavisd-new/as root or with other elevated privileges. Use
a dedicated username (UID) and group (GID) for the purpose (for
example: don't use usernames/mail/or/nobody/).
Start/amavisd-new/daemon with/su/(1) (best), or use command line
options -u (and -g) to specify username/group when starting amavisd,
or at least specify $daemon_user and $daemon_group in amavisd.conf .
Later versions of/amavisd-new/perform certain checks on its
environment and fail to start up if some obvious security flaw is
found in current UID of the process or in ownership and protections
of the most critical files and directories.
* The directories /var/amavis/tmp, /var/virusmail, /var/amavis/db,
/var/amavis/.spamassassin, /var/amavis/.razor ($TEMPBASE,
$QUARANTINEDIR, $db_home) must be writable for/amavisd-new/process,
and are commonly owned by user and group under which/amavisd-new/is
running. These directories should not be writable by other
non-privileged users. It is advised to keep $TEMPBASE in a separate
subdirectory (e.g. /var/amavis/tmp) and not letting temporary files
be created in the top-level /var/amavis directory.
FAIK, amavisd-new is supposed to run as user vscan and group vscan on
FreeBSD. On my O/S, amavis runs as user amavis. Package from FreeBSD
is 4.0.1_2 therefore it is likely you installed SA 4.0.2 from tarball as
root. Hopefully, you've got backups of the /usr/local/lib/perl5 folders
and the binaries that SpamAssassin installs (spamassassin, spamc, spamd,
sa-compile, sa-learn, sa-update, sa-awl...) that you can compare
permissions with.
You *might* have better success asking for amavisd help from the FreeBSD
group.
-- Jared Hall
[email protected]
Available for hire.
On 10/17/2025 7:27 AM, Xavier Humbert wrote:
> Hi Harald,
>
> I do use packages (/usr/local is the base dir for packages in FreeBSD)
>
> And, while I run amavisd as root, I should not been hit by permission
> issues.
>
> Regards,
>
> Xavier
>
> Le 17/10/2025 13:24, Reindl Harald a écrit :
>> what do you not understand in "Permission denied"
>>
>> when you are manually dancing around in /usr/local instead using
>> packages learn about chown / chgrp / chmod
>>
>> Am 17.10.25 um 11:03 schrieb Xavier Humbert:
>>> Hi
>>>
>>> I just upgraded from 4.0.1 to 4.0.2 on FreebSD 14.3-STABLE, then
>>> amavis won't start anymore :
>>>
>>> root@numenor ~]# amavisd
>>> fetch_modules: error loading optional module Razor2/Client/Agent.pm:
>>> Can't locate Getopt/Long.pm: lib/Getopt/Long.pm: Permission
>>> denied at
>>> /usr/local/lib/perl5/site_perl/mach/5.40/Razor2/Client/Agent.pm line
>>> 15.
>>> BEGIN failed--compilation aborted at
>>> /usr/local/lib/perl5/site_perl/ mach/5.40/Razor2/Client/Agent.pm
>>> line 15.
>>> Compilation failed in require at /usr/local/lib/perl5/site_perl/
>>> Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/DKIM.pm:
>>> Can't locate Mail/DKIM.pm: lib/Mail/DKIM.pm: Permission denied
>>> at / usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Image/Info.pm:
>>> Can't locate Image/Info.pm: lib/Image/Info.pm: Permission
>>> denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Image/Info/GIF.pm:
>>> Can't locate Image/Info/GIF.pm: lib/Image/Info/GIF.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Image/Info/JPEG.pm:
>>> Can't locate Image/Info/JPEG.pm: lib/Image/Info/JPEG.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Image/Info/PNG.pm:
>>> Can't locate Image/Info/PNG.pm: lib/Image/Info/PNG.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Image/Info/BMP.pm:
>>> Can't locate Image/Info/BMP.pm: lib/Image/Info/BMP.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Image/Info/TIFF.pm:
>>> Can't locate Image/Info/TIFF.pm: lib/Image/Info/TIFF.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF.pm:
>>> Can't locate Mail/SPF.pm: lib/Mail/SPF.pm: Permission denied at
>>> / usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Server.pm:
>>> Can't locate Mail/SPF/Server.pm: lib/Mail/SPF/Server.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Request.pm:
>>> Can't locate Mail/SPF/Request.pm: lib/Mail/SPF/Request.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech.pm:
>>> Can't locate Mail/SPF/Mech.pm: lib/Mail/SPF/Mech.pm: Permission
>>> denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/A.pm:
>>> Can't locate Mail/SPF/Mech/A.pm: lib/Mail/SPF/Mech/A.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/PTR.pm:
>>> Can't locate Mail/SPF/Mech/PTR.pm: lib/Mail/SPF/Mech/PTR.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/All.pm:
>>> Can't locate Mail/SPF/Mech/All.pm: lib/Mail/SPF/Mech/All.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/Exists.pm:
>>> Can't locate Mail/SPF/Mech/Exists.pm:
>>> lib/Mail/SPF/Mech/Exists.pm: Permission denied at
>>> /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/IP4.pm:
>>> Can't locate Mail/SPF/Mech/IP4.pm: lib/Mail/SPF/Mech/IP4.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/IP6.pm:
>>> Can't locate Mail/SPF/Mech/IP6.pm: lib/Mail/SPF/Mech/IP6.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/Include.pm:
>>> Can't locate Mail/SPF/Mech/Include.pm:
>>> lib/Mail/SPF/Mech/Include.pm: Permission denied at
>>> /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mech/MX.pm:
>>> Can't locate Mail/SPF/Mech/MX.pm: lib/Mail/SPF/Mech/MX.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mod.pm:
>>> Can't locate Mail/SPF/Mod.pm: lib/Mail/SPF/Mod.pm: Permission
>>> denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mod/Exp.pm:
>>> Can't locate Mail/SPF/Mod/Exp.pm: lib/Mail/SPF/Mod/Exp.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/Mod/Redirect.pm:
>>> Can't locate Mail/SPF/Mod/Redirect.pm:
>>> lib/Mail/SPF/Mod/Redirect.pm: Permission denied at
>>> /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> Mail/SPF/SenderIPAddrMech.pm:
>>> Can't locate Mail/SPF/SenderIPAddrMech.pm: lib/Mail/SPF/
>>> SenderIPAddrMech.pm: Permission denied at /usr/local/lib/perl5/
>>> site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Mail/SPF/v1/Record.pm:
>>> Can't locate Mail/SPF/v1/Record.pm: lib/Mail/SPF/v1/Record.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module Mail/SPF/v2/Record.pm:
>>> Can't locate Mail/SPF/v2/Record.pm: lib/Mail/SPF/v2/Record.pm:
>>> Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm
>>> line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/_compV6.al:
>>> Can't locate auto/NetAddr/IP/_compV6.al: lib/auto/NetAddr/IP/
>>> _compV6.al: Permission denied at
>>> /usr/local/lib/perl5/site_perl/Amavis/ Boot.pm line 77.
>>> fetch_modules: error loading optional module auto/NetAddr/IP/short.al:
>>> Can't locate auto/NetAddr/IP/short.al:
>>> lib/auto/NetAddr/IP/short.al: Permission denied at
>>> /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ inet_any2n.al:
>>> Can't locate auto/NetAddr/IP/InetBase/inet_any2n.al: lib/auto/
>>> NetAddr/IP/InetBase/inet_any2n.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ inet_n2ad.al:
>>> Can't locate auto/NetAddr/IP/InetBase/inet_n2ad.al: lib/auto/
>>> NetAddr/IP/InetBase/inet_n2ad.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ inet_n2dx.al:
>>> Can't locate auto/NetAddr/IP/InetBase/inet_n2dx.al: lib/auto/
>>> NetAddr/IP/InetBase/inet_n2dx.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ inet_ntoa.al:
>>> Can't locate auto/NetAddr/IP/InetBase/inet_ntoa.al: lib/auto/
>>> NetAddr/IP/InetBase/inet_ntoa.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ ipv6_aton.al:
>>> Can't locate auto/NetAddr/IP/InetBase/ipv6_aton.al: lib/auto/
>>> NetAddr/IP/InetBase/ipv6_aton.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module
>>> auto/NetAddr/IP/InetBase/ ipv6_ntoa.al:
>>> Can't locate auto/NetAddr/IP/InetBase/ipv6_ntoa.al: lib/auto/
>>> NetAddr/IP/InetBase/ipv6_ntoa.al: Permission denied at
>>> /usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/
>>> new_public_key.al:
>>> Can't locate auto/Crypt/OpenSSL/RSA/new_public_key.al: lib/auto/
>>> Crypt/OpenSSL/RSA/new_public_key.al: Permission denied at
>>> /usr/local/ lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/
>>> new_key_from_parameters.al:
>>> Can't locate auto/Crypt/OpenSSL/RSA/new_key_from_parameters.al:
>>> lib/ auto/Crypt/OpenSSL/RSA/new_key_from_parameters.al: Permission
>>> denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/
>>> get_key_parameters.al:
>>> Can't locate auto/Crypt/OpenSSL/RSA/get_key_parameters.al:
>>> lib/auto/ Crypt/OpenSSL/RSA/get_key_parameters.al: Permission
>>> denied at /usr/ local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/
>>> import_random_seed.al:
>>> Can't locate auto/Crypt/OpenSSL/RSA/import_random_seed.al:
>>> lib/auto/ Crypt/OpenSSL/RSA/import_random_seed.al: Permission
>>> denied at /usr/ local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>> fetch_modules: error loading optional module Error.pm:
>>> Can't locate Error.pm: lib/Error.pm: Permission denied at /usr/
>>> local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
>>>
>>> All modules are installed, eg :
>>>
>>> [root@numenor ~]# locate Agent.pm
>>> /usr/local/lib/perl5/site_perl/mach/5.40/Razor2/Client/Agent.pm
>