http://bugzilla.opensuse.org/show_bug.cgi?id=967528 http://bugzilla.opensuse.org/show_bug.cgi?id=967528#c1 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #1 from Christian Boltz --- Looks like you use a maildir the profile doesn't expect ;-) - which doesn't surprise me much because everybody seems to use a different one. Please edit /etc/apparmor.d/tunables/dovecot and change @{DOVECOT_MAILSTORE} to the directory you use. You can remove all the other directories listed there if you don't need them. After editing the file, run rcapparmor reload to reload the profiles. If you disabled AppArmor before to get dovecot working, you'll also need to restart dovecot and maybe other services to apply the profiles on them - see the output of aa-status ("processes are unconfined but have a profile defined"). BTW: Just curious - what do you use as maildir? (closing as worksforme - if the above doesn't help, please reopen) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=967528 http://bugzilla.opensuse.org/show_bug.cgi?id=967528#c3 --- Comment #3 from Christian Boltz --- AppArmor *does* follow symlinks - but in a different way than you think ;-) AppArmor will always look at the symlink targets, so if you have a symlink /home/freek/Maildir/ -> /hbasic/freek/Maildir/, you need permissions for /hbasic/freek/Maildir/. Possible ways to handle this: - if it's only about the Maildir, then add /hbasic/*/Maildir in /etc/apparmor.d/tunables/dovecot - if your whole home directory is a symlink, - set an AppArmor alias in /etc/apparmor.d/tunables/alias - or - - change @{HOME} or @{HOMEDIRS} in /etc/apparmor.d/tunables/home (both are honored by all profiles that have #include ) - or avoid the problem by using mount --bind instead of symlinks -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=967528 http://bugzilla.opensuse.org/show_bug.cgi?id=967528#c5 Freek de Kruijf changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|WORKSFORME |FEATURE --- Comment #5 from Freek de Kruijf --- (In reply to Christian Boltz from comment #4)

Since you didn't complain about what I wrote, I'll assume my comment #3 helped ;-)

It certainly did. Thanks. Apologies for not answering. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=967528 http://bugzilla.opensuse.org/show_bug.cgi?id=967528#c7 C. Andrews Lavarre changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High Status|RESOLVED |REOPENED URL| |mail.privustech.com Hardware|Other |64bit Resolution|FEATURE |--- OS|Other |UNIX Other --- Comment #7 from C. Andrews Lavarre --- Thank you for this thread. I have the same problem, but these comments have not fixed the problem. When I try to start dovecot I get: doveconf: Fatal: execvp(/usr/lib64/dovecot) failed: Permission denied So dovecot does not run, and the log file is empty. dmesg DID report: apparmor="DENIED" operation="open" profile="/usr/sbin/dovecot" name="/etc/apache2/ssl.crt/mail.privustech.com_start.crt" So I followed your instructions to change change @{DOVECOT_MAILSTORE} to the directory you use. @{DOVECOT_MAILSTORE}=/home/andy/Maildir/ This is a pure path (no symbolic links) and that problem went away. But I still get this error. -- You are receiving this mail because: You are on the CC list for the bug.