spamd cannot use bayes_path

[Michael Monnerie <m....@zmi.at>]

Hi there, I use "spamc -u zmi -L spam" to learn spam. In my personal 
config, I have:
bayes_path              ~/.spamassassin/bayes

and in the site-wide local.cf I tried with
a) nothing set
b) bayes_path     /my_site_path

Both way, I get these lines:

Sep 30 10:14:27 power2u spamd[25154]: config: not parsing, administrator 
setting: bayes_path              ~/.spamassassin/bayes
Sep 30 10:14:27 power2u spamd[25154]: config: failed to parse line, 
skipping: bayes_path              ~/.spamassassin/bayes

Is it true I cannot set the bayes_path per user when using spamc/spamd?
When using "spamassassin -D -r" I can see that the user bayes is used 
correctly.

mfg zmi
-- 
// Michael Monnerie, Ing.BSc  ---   it-management Michael Monnerie
// http://zmi.at           Tel: 0660/4156531          Linux 2.6.11
// PGP Key:   "lynx -source http://zmi.at/zmi2.asc | gpg --import"
// Fingerprint: EB93 ED8A 1DCD BB6C F952  F7F4 3911 B933 7054 5879
// Keyserver: www.keyserver.net                 Key-ID: 0x70545879

Re: spamd cannot use bayes_path

[Michael Monnerie <m....@zmi.at>]

On Freitag, 30. September 2005 17:48 Matt Kettler wrote:
> > When using "spamassassin -D -r" I can see that the user bayes is
> > used correctly.
>
> Yes, the spamassassin script doesn't enforce any security rules, and
> will accept any parameter in user_prefs, even admin settings. This is
> because spamassassin always runs as the current user, it never starts
> as one user then setuid's to another. No mixed-privilege security
> problems possible.

So in order to learn SPAM/HAM for specific users who (want to) use their 
own bayes, I have to drop spamc and use spamassassin instead. That's 
not a big deal for that one time "learn 1500 spams", but I call that 
script every 10 minutes for a lot of users - meaning a much bigger load 
on the server, as spamc is much quicker loaded than spamassassin. Is 
there no way around this limitation?

mfg zmi
-- 
// Michael Monnerie, Ing.BSc  ---   it-management Michael Monnerie
// http://zmi.at           Tel: 0660/4156531          Linux 2.6.11
// PGP Key:   "lynx -source http://zmi.at/zmi2.asc | gpg --import"
// Fingerprint: EB93 ED8A 1DCD BB6C F952  F7F4 3911 B933 7054 5879
// Keyserver: www.keyserver.net                 Key-ID: 0x70545879

Re: spamd cannot use bayes_path

[Matt Kettler <mk...@evi-inc.com>]

Michael Monnerie wrote:
> 
> Is it true I cannot set the bayes_path per user when using spamc/spamd?

No, you cannot, other than by using ~/ to direct it into their home directory at
a site-wide level. The same goes for any path setting.

This has to do with security concerns. Spamd is a mixed privilege application
(started as root, setuid'ed later), and giving the user power to dictate
directories could cause a security hole if something went awry in spamd's setuid
process.

By default user's also can't create any rule statements which might have regular
expressions in them, for the same reasons.


> When using "spamassassin -D -r" I can see that the user bayes is used 
> correctly.

Yes, the spamassassin script doesn't enforce any security rules, and will accept
any parameter in user_prefs, even admin settings. This is because spamassassin
always runs as the current user, it never starts as one user then setuid's to
another. No mixed-privilege security problems possible.