Plugin for learning SA, can't read IMAP folders

patrik

Verified User
Joined
Sep 6, 2006
Messages
126
I decided to write a plugin for DA with which users can learn spamassassin using mail in any of their mailboxes. I have done the GUI and now it struck me, the IMAP folders are only readable by root. The inbox (in /home/[USER]/mail/[DOMAIN]/) is readable by the user but not any IMAP folder. And because the plugin script is running as the particular user we're unable to learn spamassasin by reading mails from any IMAP folder.

Any ideas of how to walk around the problem?
 
Off the top of my head how about creating a php program to run SUID that you'd call from your plugin?

Jeff
 
I'm not really sure what you mean (I'm not too experienced with SUID as it seems).
 
Last edited:
That can be fixed by googling :) .

I mean have a separate program running as root.

I don't know if you can install that from the plugin system or not.

Jeff
 
If you run as root then SA will learn the spam for root not particular user. Am i not right?
 
I was thinking about using SA to learn for the entire server.

Is it possible?

I don't know.

Jeff
 
Hello,

Firstly, we'll be moving to dovecot as default for our next project.. so the old imap folder may eventually be obsolete... but that's just for new systems, old ones don't have to convert.

As for suid.. what you can do, is create a very simple program.c file.. which will be a wrapper to upgrade the plugins privileges to root. Note that a script can't be +s because the shebang line is the program run, not the script, so you lose the sticky effectivenes.. you need a self running binary.

My recommendation would be a simple program.c.. with the sticky bit. It will be a wrapper which would then go about doing other tasks as root however you'd like.

To do this, you have to get your code to first run "seteuid(0)" and "setegid(0)" to set the effective uid/gid to root. Then, follow with "setuid(0)", "setgid(0)".. and you'd be totally root (assuming my memory serves me correctly). From there, you can call out to any php scripts you'd like, and they'd have root access.

The only catch with this... is the security concern. You have to be very very careful and extremely thorough with your input parseing/filter becaue anyone can run that suid script to get root.. it would be up to you to make sure it plays safely.


A more sane approache would be to add a root cronjob to run every minute. It would check for files created by the user, similar to our task.queue system for DA. They'd write it to somewhere like /home/username/sa-learn.queue. The root cron will check everyones directory for that file... it would contain the things it needs to do, then go about doing it. Again, be thorough in your parsing, but this approach is much more secure because users never actually run a root +s program, the program reads from them.

John
 
How about every hour or so John; it's not critical that things be learned every minute.

Jeff
 
marvin said:
If you run as root then SA will learn the spam for root not particular user. Am i not right?
I use the dbpath paramater in order to write to correct bayes database.
 
Back
Top