[Mailman-Users] Group mismatch error

[Mark Sapiro]

Barry Finkel wrote:

>I decided to build a Ubuntu/Debian package using the Mailman 2.1.9
>source.  After a few problems I built a package.
>
>I installed the package on Ubuntu, replacing the 2.1.5.  When I sent
>mail to one of my test lists, I got this message:
>
>Diagnostic-Code: X-Postfix; Command died with status 2:
>    "/var/lib/mailman/mail/mailman post vm6bsftest3". Command output:
>    Group mismatch error.  Mailman expected the mail wrapper script to
>    be executed as group "daemon", but the system's mail server executed
>    the mail script as group "nogroup".  Try tweaking the mail server
>    to run the script as group "daemon", or re-run configure,  providing
>    the command line option `--with-mail-gid=nogroup'.
>
>I then ran bin/check_perms -f, and this is the output:


This is not a permissions issue. check_perms won't fix it.


>
>I sent another test message to the same list, and I got this error
>messsage:
>
>Diagnostic-Code: X-Postfix; Command died with status 2: 
>    "/var/lib/mailman/mail/mailman post vm6bsftest3". Command output:
>    Group mismatch error.  Mailman expected the mail wrapper script to
>    be executed as group "daemon", but the system's mail server executed
>    the mail script as group "list".  Try tweaking the mail server to
>    run the script as group "daemon", or re-run configure,  providing
>    the command line option `--with-mail-gid=list'.
>
>The only differences between the first error and the second are
>
>     Mailman expected the mail wrapper script to be executed as group
>     "daemon", but the system's mail server executed the mail script as
>     group "nogroup".   ("nogroup" ==> "list")
>
>     ... or re-run configure,  providing the command line option
>     `--with-mail-gid=nogroup'.   (nogroup ==> list)
>
>When I built the Ubuntu 2.1.9 package, the configure had
>
>     --with-mail-gid=daemon
>
>and I assume that the same was true of the Ubuntu 2.1.5 package I had
>initially installed.


See below for remark on packager magic.


>My questions are these:
>
>1) Where is this group test being made?


In the wrapper /usr/lib/mailman/mail/mailman.


>2) What in the "check_perms" run caused the change in the message from
>   "nogroup" to "list"?


It changed the group of the Postfix aliases file that contains the
aliases for Mailman.


>3) My MTA is Postfix.  The 
>
>        /usr/lib/mailman/mail/mailman
>
>   executable has ownership
>
>        root:list


Correct. It is also SETGID. See
<http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq06.016.htp>.

With Postfix, the /usr/lib/mailman/data/aliases* files need to be in
mailman's group ('list' in your case) so that Mailman's Postfix
integration can update them. This causes Postfix to execute the pipe
to the wrapper as group 'list', thus the wrapper must expect to be
executed as group 'list', thus you must configure with
--with-mail-gid=list.


>   in both the Ubuntu 2.1.9 and 2.1.5 installations.
>   Is there some file whose ownership has to change to correct this
>   mismatch reported in the error message?


Postfix AFAIK is the only common MTA that uses ownership of the aliases
to determine user and group under which they run. This is the source
of the group in 'system's mail server executed the mail script as
group "list"'. In a source installation, the 'expected' group is
compiled into the wrapper as a result of configure's --with-mail-gid
option.

In a 'package' installation, the expected group is determined by what
ever magic the packager has resorted to to avoid having to recompile
the wrapper.

-- 
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan