#712564 spamassassin: Add feature to run spamassassin as debian-spamd user

Package:
spamassassin
Source:
spamassassin
Submitter:
Oliver
Date:
2018-12-14 14:54:02 UTC
Severity:
wishlist
#712564#5
Date:
2013-06-17 09:09:00 UTC
From:
To:
Dear Maintainer,

please add the feature to run spamassassin as debian-spamd user.
#712564#10
Date:
2014-05-12 16:33:07 UTC
From:
To:
Yes or another solution that permits for spampd (as spamd) to read global
autowhitelist file. This last file become root owned by spamassassin I think
after a while without group permissions. It should be 0660.
So spampd cannot read this.

This bug (yes I think it is a bug) exists since height year I think.

Regards.
#712564#15
Date:
2016-06-08 19:41:24 UTC
From:
To:
Package: spamassassin
Followup-For: Bug #712564
Why so? When spamassassin is running in daemon mode (spamd) as root,
the default behaviour is to setuid to the user running spamc. This lets
spamd to load and examine the per-user configuration files as the user. So
by default, the effective UID is sent to spamd from spamc.

Certainly there is a point in what you are suggesting. You are welcome
to send a patch for each configuration file where this change could be
introduced as an added feature. The alternative username could be passed
on to 'spamd' after the '-u' switch.

Regards,
#712564#20
Date:
2018-12-14 12:35:13 UTC
From:
To:
Hi,

This is only necessary when you have a 1:1 mapping between email
recipients and users on the system, and not at all useful when there is
a virtual user setup via database or MySQL.

Even if you are in a non-virtual setup, the question is if users really
use their own configuration files for spamassassin, or if they rather
rely on the admin to configure SA correctly.

If the main usage scenario of spamassassin on debian installations is
virtual user databases, then the default could be changed to let spamd
run the children as debian-spamd.

----

I adjusted /etc/default/spamassassin and ajusted OPTIONS:

OPTIONS="--username=debian-spamd --group debian-spamd ..."
#712564#25
Date:
2018-12-14 14:12:38 UTC
From:
To:
This. exim connects to spamd at SMTP time, when there might be several local
recipients, so there is no single local user to run spamd as. And I don't
expect each of my users to set up their own spamassassin configuration.

I have always added "-u debian-spamd" to all my spamassassin installations,
and now I'm wondering if I need to add --group too, but it appears to be
unnecessary.

Regards,

Roger