Casper_cj2
New member
- Joined
- Oct 29, 2026
- Messages
- 1
Description:
We have identified a reproducible bug where updating or saving SpamAssassin settings (such as whitelists) via the DirectAdmin user interface causes the user's IMAP Maildir 'subscriptions' file to be overwritten, truncated, or corrupted with artifacts.
Using auditd, we traced the exact system calls during a SpamAssassin update event and confirmed that the DirectAdmin binary itself is performing a rename operation that overwrites the subscriptions file.
Server Details:
- DirectAdmin version: DirectAdmin 1.712 ec89dfdef71bf44e412fc5b28ac3cf4c70773140
- OS: AlmaLinux 8.10 (Cerulean Leopard)
Audit Log Proof:
When saving SpamAssassin settings, auditd captures the following syscall sequence targeting the Maildir subscriptions file:
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions ... nametype=CREATE
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions ... nametype=DELETE
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions.temp ... nametype=DELETE
type=SYSCALL msg=audit(...): syscall=rename ... comm=directadmin exe=/usr/local/directadmin/directadmin key=sub_corrupt
type=SYSCALL msg=audit(...): syscall=chmod ... comm=directadmin exe=/usr/local/directadmin/directadmin key=sub_corrupt
Steps to Reproduce:
1. Ensure a mailbox has a populated IMAP 'subscriptions' file.
2. Go to User Level -> SpamAssassin Setup -> Add a whitelist domain and click Save.
3. Check the mailbox Maildir 'subscriptions' file; it is either wiped or contains invalid data, causing IMAP clients and webmail to show folders as disabled/unsubscribed.
Expected Behavior:
Saving SpamAssassin settings should only modify ~/.spamassassin/user_prefs and should never touch, rewrite, or interfere with the IMAP Maildir 'subscriptions' file.
Could you please check the internal file-handling routines for SpamAssassin saves in the directadmin binary?
We have identified a reproducible bug where updating or saving SpamAssassin settings (such as whitelists) via the DirectAdmin user interface causes the user's IMAP Maildir 'subscriptions' file to be overwritten, truncated, or corrupted with artifacts.
Using auditd, we traced the exact system calls during a SpamAssassin update event and confirmed that the DirectAdmin binary itself is performing a rename operation that overwrites the subscriptions file.
Server Details:
- DirectAdmin version: DirectAdmin 1.712 ec89dfdef71bf44e412fc5b28ac3cf4c70773140
- OS: AlmaLinux 8.10 (Cerulean Leopard)
Audit Log Proof:
When saving SpamAssassin settings, auditd captures the following syscall sequence targeting the Maildir subscriptions file:
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions ... nametype=CREATE
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions ... nametype=DELETE
type=PATH msg=audit(...): name=/home/allesvoor/imap/domain.com/user/Maildir/subscriptions.temp ... nametype=DELETE
type=SYSCALL msg=audit(...): syscall=rename ... comm=directadmin exe=/usr/local/directadmin/directadmin key=sub_corrupt
type=SYSCALL msg=audit(...): syscall=chmod ... comm=directadmin exe=/usr/local/directadmin/directadmin key=sub_corrupt
Steps to Reproduce:
1. Ensure a mailbox has a populated IMAP 'subscriptions' file.
2. Go to User Level -> SpamAssassin Setup -> Add a whitelist domain and click Save.
3. Check the mailbox Maildir 'subscriptions' file; it is either wiped or contains invalid data, causing IMAP clients and webmail to show folders as disabled/unsubscribed.
Expected Behavior:
Saving SpamAssassin settings should only modify ~/.spamassassin/user_prefs and should never touch, rewrite, or interfere with the IMAP Maildir 'subscriptions' file.
Could you please check the internal file-handling routines for SpamAssassin saves in the directadmin binary?