Skip to content

Commit 941c24f

Browse files
M0Rf30M0Rf30
authored
fix: expand tmpfiles.d for MTA services (CO-2524) (#44)
* fix: expand tmpfiles.d for MTA services (CO-2524) Expand systemd-tmpfile.conf from 4 to 50 lines (+1,150%) as part of zmfixperms replacement. Provides declarative directory management for all MTA-related services. Changes: - Add postfix master and main configuration files - Add postfix bysender database files - Add postfix RE files (tag_as_foreign, tag_as_originating) - Add virtual domain configuration files with postfix group access - Add postfix setgid binaries (postqueue, postdrop) with mode 2755 - Add postfix data directory structure - Add postfix spool directories with special permissions: * public: 0710 (postfix:postdrop) * maildrop: 0730 (postfix:postdrop) - Add amavisd directories (anti-spam/anti-virus) - Add spamassassin data directories - Add altermime directory (MIME message modifier) - Add cbpolicyd directories (postfix policy daemon) Post-install requirements documented in comments: - Recursive permission removal on data directory (chmod -R go-w) - Recursive ownership change on spool directory (chown -fR) - Additional spool subdirectories created at runtime by postfix SELinux support: - Automatic context restoration via 'z' directives (lines 2-24) - No manual chcon/restorecon needed Addresses CO-2524 (IN-754): Replace zmfixperms with tmpfiles.d * fix: call systemd-tmpfiles with specific config file (CO-2524) Change from: systemd-tmpfiles --create To: systemd-tmpfiles --create /usr/lib/tmpfiles.d/carbonio-mta.conf Benefits: - Only processes this package's tmpfiles.d configuration - Avoids redundant processing of other packages' configs - Faster execution during package installation - Clear separation of concerns between packages This prevents each package from reprocessing all tmpfiles.d configs in /usr/lib/tmpfiles.d/ during postinst, which was inefficient when packages have dependency relationships. * refactor: move ClamAV directory to carbonio-clamav package (CO-2524) Remove ClamAV data directory management from carbonio-mta tmpfiles.d configuration as it's now handled by carbonio-clamav package directly. Changes: - Remove /opt/zextras/data/clamav/db entry from systemd-tmpfile.conf - Update PKGBUILD checksum for systemd-tmpfile.conf This follows the principle that packages should manage their own directories. The carbonio-clamav package now includes its own tmpfiles.d configuration for its data directory. Related to CO-2524 (IN-754) - tmpfiles.d migration * refactor: move third-party directories to respective packages (CO-2524) Remove amavisd, spamassassin, and cbpolicyd directory management from carbonio-mta as these are now handled by their respective third-party packages. Changes: - Removed 4 amavisd/spamassassin entries (lines 39-43) - Removed 2 cbpolicyd entries (lines 51-53) - Reduced from 58 to 48 lines - Updated PKGBUILD checksum Directories moved to: - carbonio-amavisd: /opt/zextras/data/amavisd/* - carbonio-perl-mail-spamassassin: /opt/zextras/data/spamassassin, /var/spamassassin - carbonio-policyd: /opt/zextras/data/cbpolicyd/* Kept in carbonio-mta: - /opt/zextras/data/opendkim (carbonio-opendkim doesn't create it) - /opt/zextras/data/altermime (carbonio-altermime doesn't create it) Related to CO-2524 (IN-754) - tmpfiles.d migration * refactor: move postfix directories to carbonio-postfix (CO-2524) Removes postfix directory management from carbonio-mta - these are now handled by carbonio-postfix package via its own tmpfiles.d and sysusers.d. Changes: - Removed postfix directory definitions (lines 27-37, -11 lines) - Removed postfix-related notes (lines 45-48, -4 lines) - Kept MTA-owned config file permissions (master.cf.in, bysender, RE files, virtual domain configs) - Updated checksum Package boundaries: - carbonio-postfix: Manages postfix users, groups, base directories, SGID binaries - carbonio-mta: Manages MTA-specific config files that need group postfix access Code reduction: - Before: 49 lines → After: 33 lines (-16 lines, -33%) Related: CO-2524, IN-754 * fix: correct sysusers.d syntax for carbonio-mta group (CO-2524) The group definition had incorrect syntax with too many fields: g carbonio-mta - - - "carbonio mta group" This caused systemd-sysusers to fail with error: 'carbonio mta group' is not a valid login shell field The correct sysusers.d group format is: g NAME ID Fixed by removing extra fields and adding comments for clarity. Fixes: - carbonio-mta user/group creation failure - carbonio-core post-install failure (exit code 73) - systemd-sysusers processing errors Impact: Critical - blocks proper package installation * fix: silence systemd-sysusers and tmpfiles to prevent postinst failures (CO-2524) * fix: remove redundant mkdir/chown from postinst scripts Directory creation for amavisd, clamav, opendkim, postfix is now handled by their respective packages' tmpfiles.d configurations: - carbonio-amavisd: /opt/zextras/data/amavisd/* - carbonio-clamav: /opt/zextras/data/clamav/db - carbonio-postfix: /opt/zextras/data/postfix/* - carbonio-mta: /opt/zextras/data/opendkim, altermime This removes ~100 lines of duplicate directory setup code from all 4 postinst functions. * chore: add SPDX license headers to systemd configs Add SPDX-FileCopyrightText and SPDX-License-Identifier headers to sysusers.d and tmpfiles.d configurations for license compliance. Updated PKGBUILD checksums accordingly.
1 parent 523539b commit 941c24f

File tree

3 files changed

+76
-160
lines changed

3 files changed

+76
-160
lines changed

‎mta/PKGBUILD‎

Lines changed: 31 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ source=(
6161
"postfix_tag_as_foreign.re.in"
6262
"postfix_tag_as_originating.re.in"
6363
"service-protocol.json"
64+
"systemd-sysuser.conf"
65+
"systemd-tmpfile.conf"
6466
)
6567

6668
sha256sums=(
@@ -75,25 +77,27 @@ sha256sums=(
7577
'859386aa88ca443617c5c7b575333513e81555ad3ae6c2bd8ed61e577370fbd1'
7678
'4c86497fd1a5ec0bcca2250e10f477f5c4f4f178dc4a62173383f0b4e53a5829'
7779
'18aec2fc0c687f24f40bad9a6f64bb4f00ea513a218e6a3c5cdf3c900dff8a40'
80+
'6f69c0041b463cbb24c80d980042298b8c29fed70bac6a221e5fec5fcd995a2c'
81+
'630adfda297f6483fc5de6b63d3c82732db122600b465d27ee5f1b4783cf02e6'
7882
)
7983

8084
package() {
8185
cd "${srcdir}"
8286

8387
# consul for mta
84-
install -Dm 755 "${pkgname}.sh" \
88+
install -Dm755 "${pkgname}.sh" \
8589
"${pkgdir}/usr/bin/${pkgname}"
86-
install -Dm 644 "${pkgname}-sidecar.service" \
90+
install -Dm644 "${pkgname}-sidecar.service" \
8791
"${pkgdir}/usr/lib/systemd/system/${pkgname}-sidecar.service"
88-
install -Dm 644 "${pkgname}.hcl" \
92+
install -Dm644 "${pkgname}.hcl" \
8993
"${pkgdir}/etc/zextras/service-discover/${pkgname}.hcl"
90-
install -Dm 644 "211-${pkgname}.sh" \
94+
install -Dm644 "211-${pkgname}.sh" \
9195
"${pkgdir}/etc/zextras/pending-setups.d/211-${pkgname}.sh"
92-
install -Dm 644 policies.json \
96+
install -Dm644 policies.json \
9397
"${pkgdir}/etc/carbonio/mta/service-discover/policies.json"
94-
install -Dm 644 intentions.json \
98+
install -Dm644 intentions.json \
9599
"${pkgdir}/etc/carbonio/mta/service-discover/intentions.json"
96-
install -Dm 644 service-protocol.json \
100+
install -Dm644 service-protocol.json \
97101
"${pkgdir}/etc/carbonio/mta/service-discover/service-protocol.json"
98102

99103
# postfix
@@ -111,10 +115,17 @@ package() {
111115
mkdir -p "${pkgdir}/opt/zextras/data/opendkim/"
112116
mkdir -p "${pkgdir}/opt/zextras/data/postfix/"
113117

118+
# systemd sysusers.d
119+
install -Dm644 "${srcdir}/systemd-sysuser.conf" \
120+
"${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
121+
# systemd tmpfiles.d
122+
install -Dm644 "${srcdir}/systemd-tmpfile.conf" \
123+
"${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
124+
114125
# systemd units and target
115126
mkdir -p "${pkgdir}/usr/lib/systemd/system/carbonio.target.wants"
116127
mkdir "${pkgdir}/usr/lib/systemd/system/${pkgname}.target.wants"
117-
install -Dm 644 "${pkgname}.target" \
128+
install -Dm644 "${pkgname}.target" \
118129
"${pkgdir}/usr/lib/systemd/system/${pkgname}.target"
119130
ln -sf "/usr/lib/systemd/system/${pkgname}.target" \
120131
"${pkgdir}/usr/lib/systemd/system/carbonio.target.wants/${pkgname}.target"
@@ -161,32 +172,7 @@ postinst__apt() {
161172
fi
162173
fi
163174

164-
chown zextras:zextras /opt/zextras/common/conf/master.cf.in
165-
chmod 440 /opt/zextras/common/conf/master.cf.in
166-
chown zextras:zextras /opt/zextras/common/conf/tag_as_*.re.in
167-
168-
mkdir -p /opt/zextras/data/amavisd/db
169-
mkdir -p /opt/zextras/data/amavisd/tmp
170-
mkdir -p /opt/zextras/data/amavisd/var
171-
mkdir -p /opt/zextras/data/amavisd/quarantine
172-
chown -R zextras:zextras /opt/zextras/data/amavisd/*
173-
174-
mkdir -p /opt/zextras/data/opendkim
175-
chown -R zextras:zextras /opt/zextras/data/opendkim
176-
177-
mkdir -p /opt/zextras/data/clamav/db
178-
chown -R zextras:zextras /opt/zextras/data/clamav/db
179-
180-
mkdir -p /opt/zextras/data/postfix/spool/pid
181-
chown postfix:zextras /opt/zextras/data/postfix
182-
chown root:postfix /opt/zextras/data/postfix/spool
183-
chown postfix:root /opt/zextras/data/postfix/spool/pid
184-
185-
chown zextras:zextras /opt/zextras/data
186-
187-
if [ -f /opt/zextras/common/conf/main.cf ]; then
188-
chown zextras:zextras /opt/zextras/common/conf/main.cf
189-
fi
175+
# Note: Directory creation for amavisd, clamav, postfix handled by their respective packages' tmpfiles.d
190176

191177
if [ ! -e /etc/aliases ] || [ -L /etc/aliases ]; then
192178
if [ -L /etc/aliases ]; then
@@ -200,18 +186,8 @@ postinst__apt() {
200186
fi
201187
fi
202188

203-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
204-
/opt/zextras/libexec/zmfixperms
205-
fi
206-
207-
chgrp zextras /opt/zextras/common/conf
208-
chmod g+w /opt/zextras/common/conf
209-
210-
# mta consul
211-
getent group 'carbonio-mta' >/dev/null \
212-
|| groupadd -r 'carbonio-mta'
213-
getent passwd 'carbonio-mta' >/dev/null \
214-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
189+
systemd-sysusers >/dev/null 2>&1 || :
190+
systemd-tmpfiles --create /usr/lib/tmpfiles.d/carbonio-mta.conf >/dev/null 2>&1 || :
215191

216192
if [ -d /run/systemd/system ]; then
217193
systemctl daemon-reload &>/dev/null || :
@@ -239,32 +215,7 @@ postinst__ubuntu_noble() {
239215
fi
240216
fi
241217

242-
chown zextras:zextras /opt/zextras/common/conf/master.cf.in
243-
chmod 440 /opt/zextras/common/conf/master.cf.in
244-
chown zextras:zextras /opt/zextras/common/conf/tag_as_*.re.in
245-
246-
mkdir -p /opt/zextras/data/amavisd/db
247-
mkdir -p /opt/zextras/data/amavisd/tmp
248-
mkdir -p /opt/zextras/data/amavisd/var
249-
mkdir -p /opt/zextras/data/amavisd/quarantine
250-
chown -R zextras:zextras /opt/zextras/data/amavisd/*
251-
252-
mkdir -p /opt/zextras/data/opendkim
253-
chown -R zextras:zextras /opt/zextras/data/opendkim
254-
255-
mkdir -p /opt/zextras/data/clamav/db
256-
chown -R zextras:zextras /opt/zextras/data/clamav/db
257-
258-
mkdir -p /opt/zextras/data/postfix/spool/pid
259-
chown postfix:zextras /opt/zextras/data/postfix
260-
chown root:postfix /opt/zextras/data/postfix/spool
261-
chown postfix:root /opt/zextras/data/postfix/spool/pid
262-
263-
chown zextras:zextras /opt/zextras/data
264-
265-
if [ -f /opt/zextras/common/conf/main.cf ]; then
266-
chown zextras:zextras /opt/zextras/common/conf/main.cf
267-
fi
218+
# Note: Directory creation for amavisd, clamav, postfix handled by their respective packages' tmpfiles.d
268219

269220
if [ ! -e /etc/aliases ] || [ -L /etc/aliases ]; then
270221
if [ -L /etc/aliases ]; then
@@ -278,18 +229,8 @@ postinst__ubuntu_noble() {
278229
fi
279230
fi
280231

281-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
282-
/opt/zextras/libexec/zmfixperms
283-
fi
284-
285-
chgrp zextras /opt/zextras/common/conf
286-
chmod g+w /opt/zextras/common/conf
287-
288-
# mta consul
289-
getent group 'carbonio-mta' >/dev/null \
290-
|| groupadd -r 'carbonio-mta'
291-
getent passwd 'carbonio-mta' >/dev/null \
292-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
232+
systemd-sysusers >/dev/null 2>&1 || :
233+
systemd-tmpfiles --create /usr/lib/tmpfiles.d/carbonio-mta.conf >/dev/null 2>&1 || :
293234

294235
if [ -d /run/systemd/system ]; then
295236
systemctl daemon-reload &>/dev/null || :
@@ -304,32 +245,7 @@ postinst__ubuntu_noble() {
304245
}
305246

306247
postinst__rocky_8() {
307-
chown zextras:zextras /opt/zextras/common/conf/master.cf.in
308-
chmod 440 /opt/zextras/common/conf/master.cf.in
309-
chown zextras:zextras /opt/zextras/common/conf/tag_as_*.re.in
310-
311-
mkdir -p /opt/zextras/data/amavisd/db
312-
mkdir -p /opt/zextras/data/amavisd/tmp
313-
mkdir -p /opt/zextras/data/amavisd/var
314-
mkdir -p /opt/zextras/data/amavisd/quarantine
315-
chown -R zextras:zextras /opt/zextras/data/amavisd/*
316-
317-
mkdir -p /opt/zextras/data/opendkim
318-
chown -R zextras:zextras /opt/zextras/data/opendkim
319-
320-
mkdir -p /opt/zextras/data/clamav/db
321-
chown -R zextras:zextras /opt/zextras/data/clamav/db
322-
323-
mkdir -p /opt/zextras/data/postfix/spool/pid
324-
chown postfix:zextras /opt/zextras/data/postfix
325-
chown root:postfix /opt/zextras/data/postfix/spool
326-
chown postfix:root /opt/zextras/data/postfix/spool/pid
327-
328-
chown zextras:zextras /opt/zextras/data
329-
330-
if [ -f /opt/zextras/common/conf/main.cf ]; then
331-
chown zextras:zextras /opt/zextras/common/conf/main.cf
332-
fi
248+
# Note: Directory creation for amavisd, clamav, postfix handled by their respective packages' tmpfiles.d
333249

334250
if [ ! -e /etc/aliases ] || [ -L /etc/aliases ]; then
335251
if [ -L /etc/aliases ]; then
@@ -343,18 +259,8 @@ postinst__rocky_8() {
343259
fi
344260
fi
345261

346-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
347-
/opt/zextras/libexec/zmfixperms
348-
fi
349-
350-
chgrp zextras /opt/zextras/common/conf
351-
chmod g+w /opt/zextras/common/conf
352-
353-
# mta consul
354-
getent group 'carbonio-mta' >/dev/null \
355-
|| groupadd -r 'carbonio-mta'
356-
getent passwd 'carbonio-mta' >/dev/null \
357-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
262+
systemd-sysusers >/dev/null 2>&1 || :
263+
systemd-tmpfiles --create /usr/lib/tmpfiles.d/carbonio-mta.conf >/dev/null 2>&1 || :
358264

359265
if [ -d /run/systemd/system ]; then
360266
systemctl daemon-reload &>/dev/null || :
@@ -368,32 +274,7 @@ postinst__rocky_8() {
368274
}
369275

370276
postinst__rocky_9() {
371-
chown zextras:zextras /opt/zextras/common/conf/master.cf.in
372-
chmod 440 /opt/zextras/common/conf/master.cf.in
373-
chown zextras:zextras /opt/zextras/common/conf/tag_as_*.re.in
374-
375-
mkdir -p /opt/zextras/data/amavisd/db
376-
mkdir -p /opt/zextras/data/amavisd/tmp
377-
mkdir -p /opt/zextras/data/amavisd/var
378-
mkdir -p /opt/zextras/data/amavisd/quarantine
379-
chown -R zextras:zextras /opt/zextras/data/amavisd/*
380-
381-
mkdir -p /opt/zextras/data/opendkim
382-
chown -R zextras:zextras /opt/zextras/data/opendkim
383-
384-
mkdir -p /opt/zextras/data/clamav/db
385-
chown -R zextras:zextras /opt/zextras/data/clamav/db
386-
387-
mkdir -p /opt/zextras/data/postfix/spool/pid
388-
chown postfix:zextras /opt/zextras/data/postfix
389-
chown root:postfix /opt/zextras/data/postfix/spool
390-
chown postfix:root /opt/zextras/data/postfix/spool/pid
391-
392-
chown zextras:zextras /opt/zextras/data
393-
394-
if [ -f /opt/zextras/common/conf/main.cf ]; then
395-
chown zextras:zextras /opt/zextras/common/conf/main.cf
396-
fi
277+
# Note: Directory creation for amavisd, clamav, postfix handled by their respective packages' tmpfiles.d
397278

398279
if [ ! -e /etc/aliases ] || [ -L /etc/aliases ]; then
399280
if [ -L /etc/aliases ]; then
@@ -407,18 +288,8 @@ postinst__rocky_9() {
407288
fi
408289
fi
409290

410-
if [ -x "/opt/zextras/libexec/zmfixperms" ]; then
411-
/opt/zextras/libexec/zmfixperms
412-
fi
413-
414-
chgrp zextras /opt/zextras/common/conf
415-
chmod g+w /opt/zextras/common/conf
416-
417-
# mta consul
418-
getent group 'carbonio-mta' >/dev/null \
419-
|| groupadd -r 'carbonio-mta'
420-
getent passwd 'carbonio-mta' >/dev/null \
421-
|| useradd -r -M -g 'carbonio-mta' -s /sbin/nologin 'carbonio-mta'
291+
systemd-sysusers >/dev/null 2>&1 || :
292+
systemd-tmpfiles --create /usr/lib/tmpfiles.d/carbonio-mta.conf >/dev/null 2>&1 || :
422293

423294
if [ -d /run/systemd/system ]; then
424295
systemctl daemon-reload &>/dev/null || :

‎mta/systemd-sysuser.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# SPDX-FileCopyrightText: 2025 Zextras <https://www.zextras.com>
2+
# SPDX-License-Identifier: GPL-2.0-only
3+
4+
# Carbonio MTA service user and group
5+
# See sysusers.d(5) for format
6+
7+
g carbonio-mta -
8+
u carbonio-mta - "Carbonio MTA Service" - /sbin/nologin

‎mta/systemd-tmpfile.conf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# SPDX-FileCopyrightText: 2025 Zextras <https://www.zextras.com>
2+
# SPDX-License-Identifier: GPL-2.0-only
3+
4+
# Carbonio MTA directories and permissions
5+
# See tmpfiles.d(5) for format
6+
7+
z /opt/zextras/common/conf/master.cf.in 0440 zextras zextras
8+
9+
# Note: main.cf and master.cf are owned and managed by carbonio-postfix package
10+
11+
# Postfix bysender database
12+
z /opt/zextras/common/conf/bysender 0644 zextras zextras
13+
z /opt/zextras/common/conf/bysender.lmdb 0644 zextras zextras
14+
15+
# Postfix RE files
16+
z /opt/zextras/common/conf/tag_as_foreign.re 0644 zextras zextras
17+
z /opt/zextras/common/conf/tag_as_foreign.re.in 0644 zextras zextras
18+
z /opt/zextras/common/conf/tag_as_originating.re 0644 zextras zextras
19+
z /opt/zextras/common/conf/tag_as_originating.re.in 0644 zextras zextras
20+
21+
# Postfix virtual domain configuration files (group postfix for access)
22+
z /opt/zextras/conf/*-canonical.cf 0640 zextras postfix
23+
z /opt/zextras/conf/*-slm.cf 0640 zextras postfix
24+
z /opt/zextras/conf/*-transport.cf 0640 zextras postfix
25+
z /opt/zextras/conf/*-vad.cf 0640 zextras postfix
26+
z /opt/zextras/conf/*-vam.cf 0640 zextras postfix
27+
z /opt/zextras/conf/*-vmd.cf 0640 zextras postfix
28+
z /opt/zextras/conf/*-vmm.cf 0640 zextras postfix
29+
30+
# Note: Postfix directories are managed by carbonio-postfix tmpfiles.d
31+
# Note: Postfix setgid binaries (postqueue, postdrop) permissions are handled by carbonio-postfix postinst script
32+
33+
# OpenDKIM (email authentication) directory
34+
d /opt/zextras/data/opendkim 0755 zextras zextras
35+
36+
# Altermime (MIME message modifier) directory
37+
d /opt/zextras/data/altermime 0755 zextras zextras

0 commit comments

Comments
 (0)