Hi, After upgrading opendkim from 2.11.0~alpha-10 to 2.11.0~alpha-10+deb9u1 I'm no longer able to run opendkim in a chroot environment. I've moved the configuration in /etc/default/opendkim, containing the RUNDIR environment variable, to /etc/opendkim.conf. Otherwise this works, but specifying ChangeRootDirectory to /var/run/opendkim.conf makes opendkim failing to start. The only error message I'm getting is rather uninformative: Oct 8 14:43:28 hillosipuli opendkim[367]: opendkim: smfi_opensocket() failed I'm using INET socket inet6:12301@ip6-localhost so that shouldn't be the problem either. If I remove ChangeRootDirectory setting, opendkim works just fine, but is not chrooted as expected. The UserID is specified in opendkim.conf: --------------------------------- Syslog yes LogWhy yes UMask 002 Socket inet6:12301@ip6-localhost Canonicalization relaxed/simple Mode sv SignatureAlgorithm rsa-sha256 ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable OversignHeaders From PidFile /var/run/opendkim/opendkim.pid UserID opendkim:opendkim ChangeRootDirectory /var/run/opendkim --------------------------------- Btw. /usr/share/doc/opendkim/README.Debian.gz still contains:--------------------------------- Users may also need to move the socket into a directory accessible by the Postfix chroot; this can be accomplished by setting the SOCKET variable in /etc/default/opendkim. --------------------------------- I'd be good to update this as well.
severity 878007 wishlist tags 878007 help thanks Running opendkim in a chroot is possible, but it is an advanced setup. One cannot simply create a directory and configure it as ChangeRootDirectory. opendkim expects all kinds of services to be available in there such as syslog socket, random devices, name services, trust anchors, etc. And they need to have the right permissions too. In your case, it is likely that looking up hostname ‘ip6-localhost’ inside the chroot failed (that’s what I’m seeing on my machine). Once that is out of the way, opendkim can start. So how to set up a chroot for opendkim? I used strace to identify the obstacles. Log messages could be better. Documentation could be better: upstream provides a text file ‘chroot’, which we distribute at /usr/share/doc/opendkim/chroot, unfortunately it is incomplete. I don’t use a chroot myself, but doc contributions by others are certainly welcome.