Hi, postfix-3.3.0 installs /usr/sbin/post{drop,queue} *without* proper setgid flag. Therefore sendmail can only be used by root. The man pages confirm the necessity of the flags (each in section SECURITY): http://www.postfix.org/postdrop.1.html http://www.postfix.org/postqueue.1.html I did not test previous versions of postfix. Another user on the German IRC channel confirmed it installs fine on a non-hardened profile. Reproducible: Always Steps to Reproduce: 1. select hardened profile 2. emerge postfix 3. ls -l /usr/sbin/post{drop,queue}
emerge info and use flags on postfix?
I’ll post the emerge --info of my server. My main Desktop with the same profile has the identical issue though. The retpoline CFLAGS don't matter, as I have these only on my server set (-mindirect-branch=thunk -mfunction-return=thunk -mindirect-branch-register). emerg'ing with USE="-hardened" (which sets -Os instead of -O2 from CFLAGS) doesn't influence the outcome neither. emerge --info postfix: Portage 2.3.24 (python 3.5.4-final-0, default/linux/amd64/17.0/hardened, gcc-7.3.0, glibc-2.25-r10, 4.15.9-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-4.15.9-gentoo-x86_64-Intel_Xeon_E312xx_-Sandy_Bridge-with-gentoo-2.4.1 KiB Mem: X total, X free KiB Swap: X total, X free Timestamp of repository gentoo: Fri, 23 Mar 2018 04:00:01 +0000 Head commit of repository gentoo: a5f198a2cef6002cb8f8400153dc3b73977aff92 sh bash 4.4_p19 ld GNU ld (Gentoo 2.30 p1) 2.30.0 app-shells/bash: 4.4_p19::gentoo dev-lang/perl: 5.26.1-r2::gentoo dev-lang/python: 2.7.14-r1::gentoo, 3.5.4-r1::gentoo dev-util/cmake: 3.10.2::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.4.1-r2::gentoo sys-apps/openrc: 0.35.2::gentoo sys-apps/sandbox: 2.13::gentoo sys-devel/autoconf: 2.69-r4::gentoo sys-devel/automake: 1.16-r1::gentoo sys-devel/binutils: 2.30::gentoo sys-devel/gcc: 7.3.0::gentoo sys-devel/gcc-config: 1.9.1::gentoo sys-devel/libtool: 2.4.6-r4::gentoo sys-devel/make: 4.2.1-r2::gentoo sys-kernel/linux-headers: 4.15::gentoo (virtual/os-headers) sys-libs/glibc: 2.25-r10::gentoo Repositories: gentoo location: /var/portage/tree sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage sync-user: portage:portage priority: -1000 sync-rsync-verify-metamanifest: no sync-rsync-extra-opts: crossdev location: /usr/local/portage masters: gentoo mrueg priority: 0 holgersson-overlay location: /var/lib/layman/holgersson-overlay sync-type: laymansync sync-uri: https://git.holgersson.xyz/holgersson-overlay masters: gentoo priority: 50 mrueg location: /var/lib/layman/mrueg sync-type: laymansync sync-uri: git://anongit.gentoo.org/dev/mrueg.git masters: gentoo priority: 50 ABI="amd64" ABI_X86="64" ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA" ACCEPT_PROPERTIES="*" ACCEPT_RESTRICT="*" ALSA_CARDS="" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ARCH="amd64" AUTOCLEAN="yes" BOOTSTRAP_USE="cxx unicode internal-glib python_targets_python3_5 python_targets_python2_7 multilib hardened pic xtpax -jit -orc" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe -mindirect-branch=thunk -mfunction-return=thunk -mindirect-branch-register" CFLAGS_amd64="-m64" CFLAGS_x32="-mx32" CFLAGS_x86="-m32" CHOST="x86_64-pc-linux-gnu" CHOST_amd64="x86_64-pc-linux-gnu" CHOST_x32="x86_64-pc-linux-gnux32" CHOST_x86="i686-pc-linux-gnu" CLEAN_DELAY="5" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" COLLISION_IGNORE="/lib/modules/* *.py[co] *$py.class */dropin.cache" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.1/ext-active/ /etc/php/apache2-php7.2/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cgi-php7.2/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/php/cli-php7.2/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CPU_FLAGS_X86="mmx mmxext sse sse2" CPU_FLAGS_x86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" CXXFLAGS="-march=native -O2 -pipe -mindirect-branch=thunk -mfunction-return=thunk -mindirect-branch-register -std=c++11" DEFAULT_ABI="amd64" DISTDIR="/var/portage/distfiles" EDITOR="/usr/bin/vim" ELIBC="glibc" EMERGE_DEFAULT_OPTS="--verbose --quiet-build --with-bdeps=y" EMERGE_WARNING_DELAY="10" EPREFIX="" EROOT="/" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news nodoc parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FETCHCOMMAND="wget -t 3 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}"" FETCHCOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}"" FETCHCOMMAND_SFTP="bash -c "x=\${2#sftp://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port= ; eval \"declare -a ssh_opts=(\${3})\" ; exec sftp \${port:+-P \${port}} \"\${ssh_opts[@]}\" \"\${host}:/\${x#*/}\" \"\$1\"" sftp "${DISTDIR}/${FILE}" "${URI}" "${PORTAGE_SSH_OPTS}"" FETCHCOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port= ; exec rsync --rsh=\"ssh \${port:+-p\${port}} \${3}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}" "${PORTAGE_SSH_OPTS}"" FFLAGS="-O2 -pipe" GCC_SPECS="" GENTOO_MIRRORS="http://ftp.halifax.rwth-aachen.de/gentoo/ http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/ http://mirror.netcologne.de/gentoo/" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" HOME="/root" INFOPATH="/usr/share/gcc-data/x86_64-pc-linux-gnu/7.3.0/info:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.30/info:/usr/share/info" INPUT_DEVICES="" IUSE_IMPLICIT="abi_x86_64 prefix prefix-chain prefix-guest" KERNEL="linux" L10N="de de_DE en" LANG="de_DE.utf8" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LC_COLLATE="C" LC_MEASUREMENT="de_DE.UTF-8" LC_MESSAGES="C" LC_MONETARY="de_DE.UTF-8" LC_NUMERIC="de_DE.UTF-8" LC_TIME="de_DE.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LDFLAGS_amd64="-m elf_x86_64" LDFLAGS_x32="-m elf32_x86_64" LDFLAGS_x86="-m elf_i386" LESS="-R -M --shift 5" LESSOPEN="|lesspipe %s" LIBDIR_amd64="lib64" LIBDIR_x32="libx32" LIBDIR_x86="lib32" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="de de_DE en" LOGNAME="root" MAIL="/var/mail/root" MAKEOPTS="-j2 -l5" MANPAGER="manpager" MANPATH="/usr/share/gcc-data/x86_64-pc-linux-gnu/7.3.0/man:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.30/man:/usr/lib64/php7.1/man/:/usr/lib64/php7.2/man/:/usr/local/share/man:/usr/share/man" MULTILIB_ABIS="amd64 x86" MULTILIB_STRICT_DENY="64-bit.*shared object" MULTILIB_STRICT_DIRS="/lib32 /lib /usr/lib32 /usr/lib /usr/kde/*/lib32 /usr/kde/*/lib /usr/qt/*/lib32 /usr/qt/*/lib /usr/X11R6/lib32 /usr/X11R6/lib" MULTILIB_STRICT_EXEMPT="(perl5|gcc|gcc-lib|binutils|eclipse-3|debug|portage|udev|systemd|clang|python-exec|llvm)" NETBEANS="apisupport cnd groovy gsf harness ide identity j2ee java mobility nb php profiler soa visualweb webcommon websvccommon xml" NOCOLOR="true" OFFICE_IMPLEMENTATION="libreoffice" PATH="/usr/bin:/bin:/usr/sbin:/sbin" PAX_MARKINGS="XT" PHP_TARGETS="php7-1" PKGDIR="/var/portage/packages" PORTAGE_ARCHLIST="alpha amd64 amd64-fbsd amd64-linux arm arm-linux arm64 arm64-linux hppa ia64 m68k m68k-mint mips ppc ppc-aix ppc-macos ppc64 ppc64-linux s390 sh sparc sparc-solaris sparc64-solaris x64-cygwin x64-macos x64-solaris x86 x86-cygwin x86-fbsd x86-linux x86-macos x86-solaris x86-winnt" PORTAGE_BIN_PATH="/usr/lib/portage/python3.5" PORTAGE_COMPRESS="xz" PORTAGE_COMPRESS_EXCLUDE_SUFFIXES="css gif htm[l]? jp[e]?g js pdf png" PORTAGE_COMPRESS_FLAGS="-6 -T1" PORTAGE_CONFIGROOT="/" PORTAGE_DEBUG="0" PORTAGE_DEPCACHEDIR="/var/cache/edb/dep" PORTAGE_ELOG_CLASSES="log warn error" PORTAGE_ELOG_MAILFROM="portage@localhost" PORTAGE_ELOG_MAILSUBJECT="[portage] ebuild log for ${PACKAGE} on ${HOST}" PORTAGE_ELOG_MAILURI="root" PORTAGE_ELOG_SYSTEM="save_summary:log,warn,error,qa echo" PORTAGE_FETCH_CHECKSUM_TRY_MIRRORS="5" PORTAGE_FETCH_RESUME_MIN_SIZE="350K" PORTAGE_GID="250" PORTAGE_GPG_DIR="/etc/portage/gpg" PORTAGE_GPG_SIGNING_COMMAND="gpg --sign --digest-algo SHA256 --clearsign --yes --default-key "${PORTAGE_GPG_KEY}" --homedir "${PORTAGE_GPG_DIR}" "${FILE}"" PORTAGE_INST_GID="0" PORTAGE_INST_UID="0" PORTAGE_INTERNAL_CALLER="1" PORTAGE_OVERRIDE_EPREFIX="" PORTAGE_PYM_PATH="/usr/lib64/python3.5/site-packages" PORTAGE_PYTHONPATH="/usr/lib64/python3.5/site-packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_RSYNC_RETRIES="-1" PORTAGE_SYNC_STALE="30" PORTAGE_TMPDIR="/var/tmp" PORTAGE_VERBOSE="1" PORTAGE_WORKDIR_MODE="0700" PORTAGE_XATTR_EXCLUDE="btrfs.* security.evm security.ima security.selinux system.nfs4_acl user.apache_handler user.Beagle.* user.dublincore.* user.mime_encoding user.xdg.*" PORT_LOGDIR_CLEAN="find "${PORT_LOGDIR}" -type f ! -name "summary.log*" -mtime +7 -delete" POSTGRES_TARGETS="postgres9_5" PROFILE_IS_HARDENED="1" PROFILE_ONLY_VARIABLES="ARCH ELIBC IUSE_IMPLICIT KERNEL USERLAND USE_EXPAND_IMPLICIT USE_EXPAND_UNPREFIXED USE_EXPAND_VALUES_ARCH USE_EXPAND_VALUES_ELIBC USE_EXPAND_VALUES_KERNEL USE_EXPAND_VALUES_USERLAND" PROSODY_MODULES="admin_message log_auth sslv3_warn" PWD="/root" PYTHONDONTWRITEBYTECODE="1" PYTHON_SINGLE_TARGET="python3_5" PYTHON_TARGETS="python2_7 python3_5" RESUMECOMMAND="wget -c -t 3 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}"" RESUMECOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}"" RESUMECOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port= ; exec rsync --rsh=\"ssh \${port:+-p\${port}} \${3}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}" "${PORTAGE_SSH_OPTS}"" ROOT="/" ROOTPATH="/usr/x86_64-pc-linux-gnu/gcc-bin/7.3.0:/usr/x86_64-pc-linux-gnu/armv6j-hardfloat-linux-gnueabi/gcc-bin/7.3.0:/usr/x86_64-pc-linux-gnu/x86_64-linux-gnu/gcc-bin/7.3.0:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin" RPMDIR="/usr/portage/rpm" RUBY_TARGETS="ruby22 ruby23" SHELL="/bin/bash" SHLVL="1" SSH_CLIENT="" SSH_CONNECTION="" SYMLINK_LIB="yes" TWISTED_DISABLE_WRITING_OF_PLUGIN_CACHE="1" UNINSTALL_IGNORE="/lib/modules/* /var/run /var/lock" USE="acl amd64 audit bash-completion bzip2 caps crypt cxx fpm git gpg hardened iconv ipv6 multilib ncurses nftables nptl openmp pam pcre pie postgres readline seccomp ssl ssp unicode vhosts vim-syntax xattr xtpax zlib zsh zsh-completion" ABI_X86="64" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" KERNEL="linux" L10N="de de_DE en" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-1" POSTGRES_TARGETS="postgres9_5" PYTHON_SINGLE_TARGET="python3_5" PYTHON_TARGETS="python2_7 python3_5" RUBY_TARGETS="ruby22 ruby23" USERLAND="GNU" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" USER="root" USERLAND="GNU" USE_EXPAND="ABI_MIPS ABI_PPC ABI_S390 ABI_X86 ALSA_CARDS APACHE2_MODULES APACHE2_MPMS CALLIGRA_EXPERIMENTAL_FEATURES CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CPU_FLAGS_ARM CPU_FLAGS_X86 CURL_SSL ELIBC ENLIGHTENMENT_MODULES FFTOOLS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL L10N LCD_DEVICES LIBREOFFICE_EXTENSIONS LIRC_DEVICES LLVM_TARGETS MONKEYD_PLUGINS NETBEANS_MODULES NGINX_MODULES_HTTP NGINX_MODULES_MAIL NGINX_MODULES_STREAM OFED_DRIVERS OFFICE_IMPLEMENTATION OPENMPI_FABRICS OPENMPI_OFED_FEATURES OPENMPI_RM PHP_TARGETS POSTGRES_TARGETS PYTHON_SINGLE_TARGET PYTHON_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS ROS_MESSAGES RUBY_TARGETS SANE_BACKENDS USERLAND UWSGI_PLUGINS VIDEO_CARDS VOICEMAIL_STORAGE XFCE_PLUGINS XTABLES_ADDONS" USE_EXPAND_HIDDEN="ABI_MIPS ABI_PPC ABI_S390 CPU_FLAGS_ARM ELIBC KERNEL USERLAND" USE_EXPAND_IMPLICIT="ARCH ELIBC KERNEL USERLAND" USE_EXPAND_UNPREFIXED="ARCH" USE_EXPAND_VALUES_ARCH="alpha amd64 amd64-fbsd amd64-linux arm arm-linux arm64 hppa ia64 m68k m68k-mint mips ppc ppc64 ppc64-linux ppc-aix ppc-macos s390 sh sparc sparc64-solaris sparc-solaris x64-cygwin x64-macos x64-solaris x86 x86-cygwin x86-fbsd x86-linux x86-macos x86-solaris x86-winnt" USE_EXPAND_VALUES_ELIBC="AIX bionic Cygwin Darwin DragonFly FreeBSD glibc HPUX Interix mingw mintlib musl NetBSD OpenBSD SunOS uclibc Winnt" USE_EXPAND_VALUES_KERNEL="AIX Darwin FreeBSD freemint HPUX linux NetBSD OpenBSD SunOS Winnt" USE_EXPAND_VALUES_USERLAND="BSD GNU" USE_ORDER="env:pkg:conf:defaults:pkginternal:repo:env.d" VIDEO_CARDS="" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" ================================================================= Package Settings ================================================================= mail-mta/postfix-3.3.0::gentoo was built with the following: USE="cdb hardened pam postgres ssl -berkdb -doc -dovecot-sasl -eai -ldap -ldap-bind -libressl -lmdb -mbox -memcached -mysql -nis -sasl (-selinux) -sqlite" ABI_X86="(64)" CFLAGS="-march=native -O2 -pipe -mindirect-branch=thunk -mfunction-return=thunk -mindirect-branch-register -Wno-comment" CXXFLAGS="-march=native -O2 -pipe -mindirect-branch=thunk -mfunction-return=thunk -mindirect-branch-register -std=c++11 -Wno-comment"
Please post the build log as well. What is the output if you run postfix set-permissions by hand?
I hit this today too. I have 2 systems: One with hardened profile that worked OK, but the other normal system was missing the needed setgid flags. But it does not seem to relate to "hardened", as changing that useflag did not help. But turning USE=doc off did help. The output from "postfix set-permissions" also pointed to that direction: chown: cannot access '/usr/share/doc/postfix-3.0.0/readme': No such file or directory It seems the script now aborts on some errors. For me there were two issues: I had modified /etc/postfix/main.cf and as dispatch-conf wanted to revert these changes, I always 'zapped' the new versions. So the html and readme dirs in main.cf were seriously outdated. But after fixing these dirs it still did not work, because now the error complained about a man page. As the ebuild does "2>/dev/null" for the set-permission call, no errors can be seen during emerge. I will try to recreate the problem on my home system and will try to post the man page error too..
[ebuild U ] mail-mta/postfix-3.3.1-r1::gentoo [3.2.4::gentoo] USE="berkdb doc eai ldap mbox mysql pam sasl sqlite ssl -cdb -dovecot-sasl -hardened -ldap-bind -libressl -lmdb -memcached -nis -postgres (-selinux)" 0 KiB After this update setgid flags are missing. Manual run "postfix set-permissions": postfix: Postfix is running with backwards-compatible default settings postfix: See http://www.postfix.org/COMPATIBILITY_README.html for details postfix: To disable backwards compatibility use "postconf compatibility_level=2" and "postfix reload" chown: cannot access '/usr/share/doc/postfix-3.0.0/readme': No such file or directory After fixing html_directory + readme_directory: postfix: Postfix is running with backwards-compatible default settings postfix: See http://www.postfix.org/COMPATIBILITY_README.html for details postfix: To disable backwards compatibility use "postconf compatibility_level=2" and "postfix reload" chown: cannot access '/usr/share/man/man1/postalias.1': No such file or directory ariolc ~ # ls /usr/share/man/man1/post* /usr/share/man/man1/postalias.1.bz2 /usr/share/man/man1/postfix-tls.1.bz2 /usr/share/man/man1/postmulti.1.bz2 /usr/share/man/man1/postcat.1.bz2 /usr/share/man/man1/postkick.1.bz2 /usr/share/man/man1/postqueue.1.bz2 /usr/share/man/man1/postconf.1.bz2 /usr/share/man/man1/postlock.1.bz2 /usr/share/man/man1/postsuper.1.bz2 /usr/share/man/man1/postdrop.1.bz2 /usr/share/man/man1/postlog.1.bz2 /usr/share/man/man1/posttls-finger.1.bz2 /usr/share/man/man1/postfix.1.bz2 /usr/share/man/man1/postmap.1.bz2 postalias.1 only exists as a bz2 version but this time the script did not seem to bail out and not the setgid flags were set sucessfully. Remerging 3.3.1-r1 a second time did also work, as the main.cf now points to the current docs. Looking at /usr/libexec/postfix/post-install it seems that lines 470 to 488 check that all directorys exists and if the old main.cf points to a wrong html_directory it will abort before even trying to set the setgid flags. But that script seems unchanged from 3.2.4.
I also got burnt by this today. I went back to the masked mail-mta/postfix-3.3.1-r1 to go back to the previous version and still had postdrop screaming about errors, so removed the local mask on mail-mta/postfix-3.3.1-r1. So re-emerging doesn't necessarily fix the issue. My use flags: USE="berkdb doc eai hardened pam sasl ssl -cdb -dovecot-sasl -ldap -ldap-bind -libressl -lmdb -mbox -memcached -mysql -nis -postgres (-selinux) -sqlite" Post manually fixing permissions, running "sudo /usr/sbin/postfix set-permissions" outputs the following and exits with a return code of 1: chown: cannot access '/etc/postfix/postfix-files.d': No such file or directory Not sure if that's normal or an early exit on error.
Got burned by this again, even now that postfix-3.3.1-r1 flat out removed the "doc" use flag. (It doesn't help that this command is called before the config is updated, and thus (even when "doc" was still available) the config is outdated.) Now I get the following from "sudo postfix set-permissions", presumably because man pages are stored as .bz2 files, so postfix is looking for the wrong filename. ============================================================================= chown: cannot access '/usr/share/man/man1/postalias.1': No such file or directory ============================================================================= I've lost mail on both occasions because of this bug. I would suggest that we set the group and g+s on these files manually to make sure they're set right and/or die when this call fails with user notification.
Same for me since the update to 3.3.1-r1 Used this as a workaround: - removed old/invalid readme_directory from main.cf - emerged again with PORTAGE_COMPRESS disabled: # cat /etc/portage/env/no-compress.conf PORTAGE_COMPRESS="" # cat /etc/portage/package.env mail-mta/postfix no-compress.conf # emerge -pv postfix [ebuild R ] mail-mta/postfix-3.3.1-r1::gentoo USE="berkdb dovecot-sasl eai pam ssl -cdb -doc -hardened -ldap -ldap-bind -libressl -lmdb -mbox -memcached -mysql -nis -postgres -sasl (-selinux) -sqlite" 0 KiB # emerge --info Portage 2.3.40 (python 2.7.14-final-0, default/linux/amd64/17.0, gcc-6.4.0, glibc-2.26-r7, 4.14.65-gentoo x86_64) ================================================================= System uname: Linux-4.14.65-gentoo-x86_64-Intel_Core_Processor_-Haswell-with-gentoo-2.4.1 KiB Mem: 4036560 total, 879780 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Sun, 02 Sep 2018 12:00:01 +0000 Head commit of repository gentoo: 599a1b010fa1ff7f0f88763840dfaa3d92a08273 sh bash 4.4_p12 ld GNU ld (Gentoo 2.29.1 p3) 2.29.1 app-shells/bash: 4.4_p12::gentoo dev-java/java-config: 2.2.0-r4::gentoo dev-lang/perl: 5.24.3-r1::gentoo dev-lang/python: 2.7.14-r1::gentoo, 3.4.8::gentoo, 3.6.5::gentoo dev-util/cmake: 3.9.6::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.4.1-r2::gentoo sys-apps/openrc: 0.34.11::gentoo sys-apps/sandbox: 2.13::gentoo sys-devel/autoconf: 2.69-r4::gentoo sys-devel/automake: 1.15.1-r2::gentoo sys-devel/binutils: 2.29.1-r1::gentoo, 2.30-r2::gentoo sys-devel/gcc: 6.4.0-r1::gentoo, 7.3.0-r3::gentoo sys-devel/gcc-config: 1.8-r1::gentoo sys-devel/libtool: 2.4.6-r3::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 4.13::gentoo (virtual/os-headers) sys-libs/glibc: 2.26-r7::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-jobs: 1 sync-rsync-verify-metamanifest: yes sync-rsync-extra-opts: sync-rsync-verify-max-age: 24 hoffie-local location: /usr/local/portage/overlay masters: gentoo priority: 0 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/spool/munin-async/.ssh" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/apache2-php7.1/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="" DISTDIR="/usr/portage/distfiles" ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LC_ALL="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j1" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="acl amd64 bzip2 cli crypt cxx dovecot-sasl dri fortran iconv idn ipv6 libav libtirpc mmx modules multilib ncurses nls nptl openmp pam pcre readline seccomp sieve sse sse2 ssl ssse3 unicode vim-syntax xattr zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon plan sheets stage words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 fma3 mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" NGINX_MODULES_HTTP="addition cache_purge dav dav_ext echo fancyindex flv gunzip gzip_static headers_more mp4 naxsi push push_stream random_index realip secure_link slowfs_cache spdy stub_status sub upload_progress access auth_basic autoindex browser charset empty_gif fastcgi gzip limit_conn limit_req map metrics proxy referer rewrite scgi split_clients ssi upstream_ip_hash userid uwsgi xslt" NGINX_MODULES_STREAM="access limit_conn upstream" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6" POSTGRES_TARGETS="postgres9_5 postgres10" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_6" RUBY_TARGETS="ruby23" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Hello everyone, Related to bug 665280. It seems to be fix with this commit[1], which actually fix the issue of missing /etc/postfix/postfix-files.d directory (and the rebuild fixed the gid of binaries /usr/sbin/postdrop /usr/sbin/postqueue) # ls -l /usr/sbin/postdrop /usr/sbin/postqueue -rwxr-sr-x 1 root postdrop 14240 Sep 15 08:41 /usr/sbin/postdrop -rwxr-sr-x 1 root postdrop 22384 Sep 15 08:41 /usr/sbin/postqueue Now, I would like to address a very bad issue: why DID NOT the commiter of this fix create a new release instead of using the same ebuild file? Since now 1 year or 2, IIRC, Portage doesn't check if the ebuild changes, and therefor, for most people, the package is not rebuild with its new modifications. This kind of issues is very upsetting, Gentoo's devs please need to learn to change ebuild's release version when modifying an ebuild, SPECIALLY when the ebuild is in stable arch. Many thanks. I guess this issue can be closed. 1: https://gitweb.gentoo.org/repo/gentoo.git/commit/mail-mta/postfix?id=b46832183b5c6adb2b6820d418d6370256115d8b
