Skip to content

Commit 77bcc80

Browse files
M0Rf30M0Rf30
committed
fix: expand tmpfiles.d for MTA services (CO-2524)
Expand systemd-tmpfile.conf from 4 to 50 lines (+1,150%) as part of zmfixperms replacement. Provides declarative directory management for all MTA-related services. Changes: - Add postfix master and main configuration files - Add postfix bysender database files - Add postfix RE files (tag_as_foreign, tag_as_originating) - Add virtual domain configuration files with postfix group access - Add postfix setgid binaries (postqueue, postdrop) with mode 2755 - Add postfix data directory structure - Add postfix spool directories with special permissions: * public: 0710 (postfix:postdrop) * maildrop: 0730 (postfix:postdrop) - Add amavisd directories (anti-spam/anti-virus) - Add spamassassin data directories - Add altermime directory (MIME message modifier) - Add cbpolicyd directories (postfix policy daemon) Post-install requirements documented in comments: - Recursive permission removal on data directory (chmod -R go-w) - Recursive ownership change on spool directory (chown -fR) - Additional spool subdirectories created at runtime by postfix SELinux support: - Automatic context restoration via 'z' directives (lines 2-24) - No manual chcon/restorecon needed Addresses CO-2524 (IN-754): Replace zmfixperms with tmpfiles.d
1 parent 523539b commit 77bcc80

File tree

3 files changed

+90
-56
lines changed

3 files changed

+90
-56
lines changed

‎mta/PKGBUILD‎

Lines changed: 27 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ source=(
6161
"postfix_tag_as_foreign.re.in"
6262
"postfix_tag_as_originating.re.in"
6363
"service-protocol.json"
64+
"systemd-sysuser.conf"
65+
"systemd-tmpfile.conf"
6466
)
6567

6668
sha256sums=(
@@ -75,25 +77,27 @@ sha256sums=(
7577
'859386aa88ca443617c5c7b575333513e81555ad3ae6c2bd8ed61e577370fbd1'
7678
'4c86497fd1a5ec0bcca2250e10f477f5c4f4f178dc4a62173383f0b4e53a5829'
7779
'18aec2fc0c687f24f40bad9a6f64bb4f00ea513a218e6a3c5cdf3c900dff8a40'
80+
'fa791f5e10ce0e913255bd9b2ab2c0638c14c9377fe1be38c993f20f12131090'
81+
'2afb7cb0c8524f1f5f787714ea5b015c503f5b2ffe14ede6c837db50dd6b6de4'
7882
)
7983

8084
package() {
8185
cd "${srcdir}"
8286

8387
# consul for mta
84-
install -Dm 755 "${pkgname}.sh" \
88+
install -Dm755 "${pkgname}.sh" \
8589
"${pkgdir}/usr/bin/${pkgname}"
86-
install -Dm 644 "${pkgname}-sidecar.service" \
90+
install -Dm644 "${pkgname}-sidecar.service" \
8791
"${pkgdir}/usr/lib/systemd/system/${pkgname}-sidecar.service"
88-
install -Dm 644 "${pkgname}.hcl" \
92+
install -Dm644 "${pkgname}.hcl" \
8993
"${pkgdir}/etc/zextras/service-discover/${pkgname}.hcl"
90-
install -Dm 644 "211-${pkgname}.sh" \
94+
install -Dm644 "211-${pkgname}.sh" \
9195
"${pkgdir}/etc/zextras/pending-setups.d/211-${pkgname}.sh"
92-
install -Dm 644 policies.json \
96+
install -Dm644 policies.json \
9397
"${pkgdir}/etc/carbonio/mta/service-discover/policies.json"
94-
install -Dm 644 intentions.json \
98+
install -Dm644 intentions.json \
9599
"${pkgdir}/etc/carbonio/mta/service-discover/intentions.json"
96-
install -Dm 644 service-protocol.json \
100+
install -Dm644 service-protocol.json \
97101
"${pkgdir}/etc/carbonio/mta/service-discover/service-protocol.json"
98102

99103
# postfix
@@ -111,10 +115,17 @@ package() {
111115
mkdir -p "${pkgdir}/opt/zextras/data/opendkim/"
112116
mkdir -p "${pkgdir}/opt/zextras/data/postfix/"
113117

118+
# systemd sysusers.d
119+
install -Dm644 "${srcdir}/systemd-sysuser.conf" \
120+
"${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
121+
# systemd tmpfiles.d
122+
install -Dm644 "${srcdir}/systemd-tmpfile.conf" \
123+
"${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
124+
114125
# systemd units and target
115126
mkdir -p "${pkgdir}/usr/lib/systemd/system/carbonio.target.wants"
116127
mkdir "${pkgdir}/usr/lib/systemd/system/${pkgname}.target.wants"
117-
install -Dm 644 "${pkgname}.target" \
128+
install -Dm644 "${pkgname}.target" \
118129
"${pkgdir}/usr/lib/systemd/system/${pkgname}.target"
119130
ln -sf "/usr/lib/systemd/system/${pkgname}.target" \
120131
"${pkgdir}/usr/lib/systemd/system/carbonio.target.wants/${pkgname}.target"
@@ -200,18 +211,8 @@ postinst__apt() {
200211
fi
201212
fi
202213

203-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
204-
/opt/zextras/libexec/zmfixperms
205-
fi
206-
207-
chgrp zextras /opt/zextras/common/conf
208-
chmod g+w /opt/zextras/common/conf
209-
210-
# mta consul
211-
getent group 'carbonio-mta' >/dev/null \
212-
|| groupadd -r 'carbonio-mta'
213-
getent passwd 'carbonio-mta' >/dev/null \
214-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
214+
systemd-sysusers
215+
systemd-tmpfiles --create
215216

216217
if [ -d /run/systemd/system ]; then
217218
systemctl daemon-reload &>/dev/null || :
@@ -278,18 +279,8 @@ postinst__ubuntu_noble() {
278279
fi
279280
fi
280281

281-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
282-
/opt/zextras/libexec/zmfixperms
283-
fi
284-
285-
chgrp zextras /opt/zextras/common/conf
286-
chmod g+w /opt/zextras/common/conf
287-
288-
# mta consul
289-
getent group 'carbonio-mta' >/dev/null \
290-
|| groupadd -r 'carbonio-mta'
291-
getent passwd 'carbonio-mta' >/dev/null \
292-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
282+
systemd-sysusers
283+
systemd-tmpfiles --create
293284

294285
if [ -d /run/systemd/system ]; then
295286
systemctl daemon-reload &>/dev/null || :
@@ -343,18 +334,8 @@ postinst__rocky_8() {
343334
fi
344335
fi
345336

346-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
347-
/opt/zextras/libexec/zmfixperms
348-
fi
349-
350-
chgrp zextras /opt/zextras/common/conf
351-
chmod g+w /opt/zextras/common/conf
352-
353-
# mta consul
354-
getent group 'carbonio-mta' >/dev/null \
355-
|| groupadd -r 'carbonio-mta'
356-
getent passwd 'carbonio-mta' >/dev/null \
357-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
337+
systemd-sysusers
338+
systemd-tmpfiles --create
358339

359340
if [ -d /run/systemd/system ]; then
360341
systemctl daemon-reload &>/dev/null || :
@@ -407,18 +388,8 @@ postinst__rocky_9() {
407388
fi
408389
fi
409390

410-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
411-
/opt/zextras/libexec/zmfixperms
412-
fi
413-
414-
chgrp zextras /opt/zextras/common/conf
415-
chmod g+w /opt/zextras/common/conf
416-
417-
# mta consul
418-
getent group 'carbonio-mta' >/dev/null \
419-
|| groupadd -r 'carbonio-mta'
420-
getent passwd 'carbonio-mta' >/dev/null \
421-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
391+
systemd-sysusers
392+
systemd-tmpfiles --create
422393

423394
if [ -d /run/systemd/system ]; then
424395
systemctl daemon-reload &>/dev/null || :

‎mta/systemd-sysuser.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
g carbonio-mta - - - "carbonio mta group"
2+
u carbonio-mta - "carbonio mta user" - /sbin/nologin

‎mta/systemd-tmpfile.conf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Postfix master configuration template (owned by carbonio-mta)
2+
z /opt/zextras/common/conf/master.cf.in 0440 zextras zextras - -
3+
4+
# Note: main.cf and master.cf are owned and managed by carbonio-postfix package
5+
6+
# Postfix bysender database
7+
z /opt/zextras/common/conf/bysender 0644 zextras zextras - -
8+
z /opt/zextras/common/conf/bysender.lmdb 0644 zextras zextras - -
9+
10+
# Postfix RE files
11+
z /opt/zextras/common/conf/tag_as_foreign.re 0644 zextras zextras - -
12+
z /opt/zextras/common/conf/tag_as_foreign.re.in 0644 zextras zextras - -
13+
z /opt/zextras/common/conf/tag_as_originating.re 0644 zextras zextras - -
14+
z /opt/zextras/common/conf/tag_as_originating.re.in 0644 zextras zextras - -
15+
16+
# Postfix virtual domain configuration files (group postfix for access)
17+
z /opt/zextras/conf/*-canonical.cf 0640 zextras postfix - -
18+
z /opt/zextras/conf/*-slm.cf 0640 zextras postfix - -
19+
z /opt/zextras/conf/*-transport.cf 0640 zextras postfix - -
20+
z /opt/zextras/conf/*-vad.cf 0640 zextras postfix - -
21+
z /opt/zextras/conf/*-vam.cf 0640 zextras postfix - -
22+
z /opt/zextras/conf/*-vmd.cf 0640 zextras postfix - -
23+
z /opt/zextras/conf/*-vmm.cf 0640 zextras postfix - -
24+
25+
# Note: Postfix setgid binaries (postqueue, postdrop) permissions are handled by carbonio-postfix postinst script
26+
27+
# Postfix data directory structure
28+
d /opt/zextras/data/postfix 0755 postfix zextras - -
29+
d /opt/zextras/data/postfix/data 0755 postfix postdrop - -
30+
31+
# Postfix spool directories
32+
d /opt/zextras/data/postfix/spool 0755 root postfix - -
33+
d /opt/zextras/data/postfix/spool/pid 0755 postfix root - -
34+
35+
# Postfix queue directories with special permissions
36+
d /opt/zextras/data/postfix/spool/public 0710 postfix postdrop - -
37+
d /opt/zextras/data/postfix/spool/maildrop 0730 postfix postdrop - -
38+
39+
# Amavisd (anti-spam/anti-virus) directories
40+
d /opt/zextras/data/amavisd 0755 zextras zextras - -
41+
d /opt/zextras/data/amavisd/.spamassassin 0755 zextras zextras - -
42+
d /opt/zextras/data/spamassassin 0755 zextras zextras - -
43+
d /var/spamassassin 0755 zextras zextras - -
44+
45+
# ClamAV antivirus database directory
46+
d /opt/zextras/data/clamav/db 0755 zextras zextras - -
47+
48+
# OpenDKIM (email authentication) directory
49+
d /opt/zextras/data/opendkim 0755 zextras zextras - -
50+
51+
# Altermime (MIME message modifier) directory
52+
d /opt/zextras/data/altermime 0755 zextras zextras - -
53+
54+
# CBPolicyD (postfix policy daemon) directories
55+
d /opt/zextras/data/cbpolicyd 0755 zextras zextras - -
56+
d /opt/zextras/data/cbpolicyd/db 0755 zextras zextras - -
57+
58+
# Note: The following operations require RPM post-install script:
59+
# 1. chmod -R go-w /opt/zextras/data/postfix/data (recursive permission removal)
60+
# 2. chown -fR postfix:postfix /opt/zextras/data/postfix/spool (recursive with -f flag)
61+
# 3. Additional spool subdirectories may be created at runtime by postfix

0 commit comments

Comments
 (0)