Received Wed, 02 Jul 2008 03:46:15 PHT
Spamassassin: Permission denied at ... SpamAssassin.pm line 1536 - running spamassassin as root: Learn How to fix your spamassassin permission error
Permission denied ... SpamAssassin.pm line 1536
Setup creating error messages:
openSuSE 10.2 with spamassassin, postfix, evolution. I found that most likely, after intense Googliing, all other Linux distributions and setups have the same problem in an environment run as root. This error messages are mainly or entirely occurring if you - like I do since 10 years - run your Linux machine strictly as user root - i.e. my Desktop, mailbox, Firefox, ... ALL. I love power, hence I only work as root. The result is that spamassassin dislikes that nanda many other users out there appear to have the same problem. I found little or no real help Googliing, but small steps leading to the working end-result. The point is that this problem is rather easy to fix. Have a look at the error messages below, if you have any or several of them, then follow the instructions in the bottom section of the page and all should be perfectly fine afterwards.
Depending on how you work on your SA ( SpamAssassin ) configuration, above might be the first error you find in your error log - it was the first error in my case, all other errors occurred when attempting a partial or wrong other solution. All errors disappeared after all SA configuration properly adjusted.
If you have tweaked and twisted your configuration already, then any or all of below listed errors might occur at one time. I had the pleasure to meet them all during my endeavor to solve the SA problem and thus I also had the pleasure of solving all. As by now there are NO further SpamAssassin related error messages in my /var/log/warn.
tail -f /var/log/warn
Jul 2 02:44:12 gott spamd[13735]: mkdir /root/.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin.pm line 1536
Jul 2 02:44:12 gott spamd[13735]: locker: safe_lock: cannot create tmp lockfile /root/.spamassassin/auto-whitelist.lock.gott.liebe.13735 for /root/.spamassassin/auto-whitelist.lock: Permission denied
Jul 2 02:44:12 gott spamd[13735]: auto-whitelist: open of auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile /root/.spamassassin/auto-whitelist.lock.gott.liebe.13735 for /root/.spamassassin/auto-whitelist.lock: Permission denied
Jul 2 02:44:12 gott spamd[13735]: bayes: locker: safe_lock: cannot create tmp lockfile /root/.spamassassin/bayes.lock.gott.liebe.13735 for /root/.spamassassin/bayes.lock: Permission denied
Jul 2 02:44:12 gott spamd[13735]: mkdir /root/.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin.pm line 1536
Above and a all 8 errors as listed below - all related to the same problem in spamassasin configuration - will be treated and most likely solved in this article.
- mkdir /root/.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin.pm line 1536
- locker: safe_lock: cannot create tmp lockfile /root/.spamassassin/auto-whitelist.lock.gott.liebe.4910 for /root/.spamassassin/auto-whitelist.lock: Permission denied
- Jul 2 17:42:33 gott spamd[9982]: bayes: locker: safe_lock: cannot create tmp lockfile /root/.spamassassin/bayes.lock.gott.liebe.9982 for /root/.spamassassin/bayes.lock: Permission denied
Jul 2 17:42:33 gott spamd[9982]: spamd: still running as root: user not specified with -u, not found, or set to root, falling back to nobody at /usr/sbin/spamd line 1147, <GEN29> line 4.
Jul 2 17:42:34 gott spamd[9982]: mkdir /root/.spamassassin: Permission denied at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin.pm line 1536 - auto-whitelist: cannot open auto_whitelist_path /path_to/auto-whitelist: Permission denied
- bayes: cannot write to /root/.spamassassin/bayes_journal, bayes db update ignored: Permission denied
- spamd: cannot run as nonexistent user or root with -u option
- connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#3 of 3): Connection refused
- spamd -u nobody [10112] info: config: SpamAssassin failed to parse line, "/gott/CyberspaceAshram/spamd/bayes/" is not valid for "bayes_path", skipping: bayes_path /gott/CyberspaceAshram/spamd/bayes/
Our love for working as user root is the cause - the point is that SA does NOT run as user root and defaults to user nobody. If you have the installed default SpamAssassin configuration, then all SA folders are created in each user space. For user root that is in: /root/.spamassassin. User nobody has no permission to access /root folder. To change permissions to allow nobody would be unwise and most complex. I have wasted much time attempting it to now avail. Changing default paths for SA is simple, secure and far more convenient.
Howto fix your spamassassin Permission denied error
First I give you the small changes step by step, then you receive the permission setup that works on my setup.
In SA system-wide config we add the path info to get all our SpamAssassin for user root into a NON-root folder. In my precise case I have since years a production-partition with all files from my web site project and related tools and data. To keep SpamAssassin files there as well is convenient as this partition survives all updates and re-installs, hence also all SA rules and data are preserved over time!
Modify your SpamAssassin system configuration local.cf to add path info
Our system wide SA configuration is in /etc/mail/spamassassin/local.cf
ADD the below lines:
bayes_path /gott/CyberspaceAshram/spamd/bayes/bayes
auto_whitelist_path /gott/CyberspaceAshram/spamd/bayes/auto-whitelist
bayes_file_mode 777
auto_whitelist_file_mode 777
I explain above 2 paths - please pay attention to avoid errors:
- /gott/CyberspaceAshram/spamd/bayes/ is the path to my bayes-FOLDER, the second bayes after the slash / is the FILE prefix !! NO file, NO folder. only file prefix in the configuration file. Of course you create your own path/folder - but do NOT create the file prefix - just configure/define it in the local.cf !!! You create the folder containing the bayes files - the prefix is defined in your local.cf and SA does create all bayes files as needed. SA then will create files all starting with bayes_ - such as:
bayes_journal
bayes_seen
bayes_toks - /gott/CyberspaceAshram/spamd/bayes/auto-whitelist - that however is a FILE. If your install is new, then you create that file:
touch /gott/CyberspaceAshram/spamd/bayes/auto-whitelist
Now change ownership:
chown nobody:nobody /gott/CyberspaceAshram/spamd/bayes/auto-whitelist
and
chmod 666 /gott/CyberspaceAshram/spamd/bayes/auto-whitelist
If you have already bayes_ files in your /root/.spamassassin folder, then I recommend you copy these existing files into your new location. Else you may loose months of manual spam teaching data resulting in a much higher spam volume bypassing the first weeks your spam filter until all "SPAM learning" has caught up again.
File and folder permissions
There might be other options, I have tried a number and none worked except my current permission setup below. Keep in mind that SA runs as user nobody - we do that part later. Here the permissions of my new folders:
drwxr-xr-x 3 root root
-rw-rw-rw- 1 root root auto-whitelist
-rw-rw-rw- 1 nobody nobody bayes_journal
-rw-rw-rw- 1 root root bayes_seen
-rw-rw-rw- 1 root root bayes_toks
Folders chmod 755 - files chmod 666
All bayes_ ... files are auto created by SA and grow constantly over time. The file bayes_journal is created upon boot and gets lost after reboot. Nothing to worry about bayes_journal. SA takes care of that. SA takes care of ALL !! ... when properly configured.
ALL lock files are autocreated as needed and deleted as soon as file-access terminated. Hence all the lock files having created the error messages in /var/log/warn rarely appear in a file listing as they live just for seconds or less.
As user root - single user on one machine, there is no one else using SA but me and all SA files now are thus system wide. As a result there is NO need for any files to be in my /root/.spamassassin.
The file /root/.spamassassin/user_prefs NO longer is in use - all lines out-commented. Probably it is save to delete that file as all configuration is done in our system wide /etc/mail/spamassassin/local.cf
Run spamd as user nobody !!
Of course you may chose another system user to run spamd - in openSuSE nobody is a good choice to make life simple and SA running!
Hence for testing you first make sure you have all configuration files saved after changes made, all permissions set as above, then stop existing spamd
rcspamd stopthen start as user nobody for testing we enter in shell
spamd -u nobody
and we watch our error log
tail -f /var/log/warn
The command rcspamd start -u nobody does NOT work to pass -u nobody !!! rcspamd gets the additional arguments from the file /etc/sysconfig/spamd. To permanently start spamd each time as user nobody, we ADD the argument -u nobody in file: /etc/sysconfig/spamd - change / ADD argument to run spamd as user "nobody":
# Default is "-d -c -L"
SPAMD_ARGS="-d -x -u nobody"
For details of above - please see man spamd, I have removed the -L because I do want to make remote tests ( DNS ) since I work on a fast Internet connection. I may replace the -L argument when working via mobile 3G Internet connection however. In addition the meaning of arguments currently in use on my system is:
-x Disable user config files - since i use one single system wide configuration for spamd
-d Daemonize
- u nobody Run as user nobody
To test spamassassin you need to RECEIVE email !! Of course you also need to receive SPAM mail and mark mail in your inbox as SPAM. There should be no more error messages. Now it might be time to proceed with all other configuration as needed if you wish to add rules to SA. For me a basic setup is sufficient. My daily mail is some 1000 - 1500 eMails with approx 99% SPAM. SpamAssassin does all work for me! Just take your time to check your spam folder and UN-SPAM any good mail until SA has learned all rules for your purpose.
Remember: bayes_path and bayes prefix
bayes_path in your /etc/mail/spamassassin/local.cf end with a file prefix - not a directory !!!
Note that any change in /etc/mail/spamassassin/local.cf only become effective AFTER you restart spamd. In case of any doubt or persistig problem after ALL above path and permissions are set correctly - reboot your machine!
Adapt all my paths to your own system needs !!
spamc skipped message, greater than max message size (256000 bytes)
One last point is the now and then appearing error message spamc skipped message, greater than max message size (256000 bytes). The meaning is that any eMail greater than 256000 bytes will be processed without SPAM check for sole reason of resource conservation. I have NOT found where the 256000 bytes are configured - NOT in my postfix configurations NOR anywhere in SA. A good point might be that typically spam is small else spammers never could get the masses mailed. Hence the risk of getting a really large mail greater than 256000 bytes as SPAM certainly is small, thus the need to change that limit is small as well.
The following manual may help you for additional clarifications if needed:
man Mail::SpamAssassin::Conf
God bless
hans




![[Love]](img/topics/7.gif)


