Postfix installation procedure created a system user postfix and it's primary group postfix while installation procedure for OpenDKIM created a system user opendkim and it's primary group opendkim.
To enable Postfix and OpenDKIM to work together most of the administrators do two things:
A
They append a secondary group opendkim to Postfix.
B
They set OpenDKIM configuration file /etc/opendkim.conf to create a UNIX socket using these three (two) lines:
UMask 002
PidFile /var/run/opendkim/opendkim.pid
Socket local:/var/spool/postfix/opendkim/opendkim.sock
Official OpenDKIM documentation states this for the configuration parameter UMask:
Requests a specific permissions mask to be used for file creation. This only really applies to creation of the socket when Socket specifies a UNIX domain socket, and to the PidFile (if any);
I know that UNIX sockets are convenient because they can limit user privileges. In my case I want OpenDKIM to work with Postfix as safe as possible. But with UMask set to 002 UNIX socket will be created with ownership opendkim:opendkim and privileges 664 = rw-rw-r--.
I understand that group members (Postfix) need to read and write to the UNIX socket, but I don't understand why almost all tutorials online (A, B, C...) leave read permissions for others?
Is this a general missconception? Wouldn't a reasonable value for UMask be 007? Also the PID file is created using the same privileges...
If I check any other UNIX socket on my system some also have rights for others... Why is that important to have?
┌───┐
│ # │ root > mailer > ~
└─┬─┘
└─> ss -x -l | head -n 10
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
u_dgr UNCONN 0 0 /run/systemd/notify 14848 * 0
u_str LISTEN 0 128 /var/run/dovecot/director-userdb 13957121 * 0
u_str LISTEN 0 128 /run/systemd/private 14852 * 0
u_str LISTEN 0 100 /var/run/dovecot/dict 13957125 * 0
u_str LISTEN 0 128 /var/run/dovecot/dict-async 13957129 * 0
u_str LISTEN 0 1 /var/run/irqbalance568.sock 17673 * 0
u_dgr UNCONN 0 0 /run/systemd/journal/syslog 14859 * 0
u_str LISTEN 0 128 /var/run/dovecot/config 13957133 * 0
u_str LISTEN 0 128 /var/run/dovecot/login/login 13957135 * 0
┌───┐
│ # │ root > mailer > ~
└─┬─┘
└─> ls -l /var/run/dovecot/config
srw------- 1 root root 0 Dec 31 07:35 /var/run/dovecot/config
┌───┐
│ # │ root > mailer > ~
└─┬─┘
└─> ls -l /var/run/dovecot/login/login
srw-rw-rw- 1 root root 0 Dec 31 07:35 /var/run/dovecot/login/login
0 Answers