Carlos E. R. wrote:

apparmor.

Remove dovecot profile and reinstall apparmor-profiles

That didn't make any difference. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

Check again all the logs just after you try to start it. It is known that it has a problem with apparmour, there is a bad profile (reported by several people and a bugzilla). Stop AA temporarily and try again.

Disabling apparmor allowed dovecot to run, but I couldn't connect with it. Here's what's in /var/log/messages with apparmor running: 2013-11-26T21:22:53.737490-05:00 linux systemd[1]: Started Dovecot IMAP/POP3 email server. 2013-11-26T21:22:53.754062-05:00 linux dovecot[7009]: Fatal: execv(/usr/bin/doveconf) failed: Permission denied 2013-11-26T21:22:53.756725-05:00 linux kernel: [13293.041295] type=1400 audit(1385518973.751:98): apparmor="DENIED" operation="exec" parent=1 profile="/usr/sbin/dovecot" name="/usr/bin/doveconf" pid=7009 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 2013-11-26T21:22:53.758534-05:00 linux systemd[1]: dovecot.service: main process exited, code=exited, status=84/n/a 2013-11-26T21:22:53.758982-05:00 linux systemd[1]: Unit dovecot.service entered failed state. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott wrote:

...

Check again all the logs just after you try to start it. It is known that it has a problem with apparmour, there is a bad profile (reported by several people and a bugzilla). Stop AA temporarily and try again. I installed the profile from bugzilla. While dovecot now runs, I cannot log in. It doesn't like the password that used to work. Using the same

Carlos E. R. wrote: password, I can su to that account with that password.

If I use the /etc/dovecot that comes with the upgrade, I cannot connect to the server. If I use my old version, I can connect, but not login. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott wrote:

There was a 2nd profile on that bugzilla report. Installing that has it working now.

Looks like I spoke to soon. Only my Inbox is available. None of the other folders work. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

...

James Knott wrote:

...

There was a 2nd profile on that bugzilla report. Installing that has it working now. Looks like I spoke to soon. Only my Inbox is available. None of the other folders work. Apparmour blocks are logged, so you can spot them and know there is a

On 2013-11-27 04:40, James Knott wrote: problem. But they are not logged by the application that has problems. You have to look both in the mail log, the messages log, ah! and the apparmor log if it exists. Linux has logs, use them.

You say you upgraded. Was that a real upgrade, or did you install fresh to the same partition? I say this because in the second case you have to generate a certificate.

There were a couple of issues. I had to use my previous dovecot.conf. Also, apparmor was blocking it. I have it running now by putting apparmor in complain mode for dovecot. I checked messages and nothing there regarding apparmor and there's nothing in /var/log/apparmor. The problem is described in bugzilla. https://bugzilla.novell.com/show_bug.cgi?id=851984 BTW, I don't understand how this could be so fscked up. Didn't someone test this? Years ago, I used to work on the team that developed standard desktop systems for employees at IBM Canada. I was responsible for several apps on OS/2 and Windows as well as the OS/2 operating system. I would have been fired for such incompetence. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2013-11-27 16:00, James Knott wrote:

...

BTW, I don't understand how this could be so fscked up. Didn't someone test this? Years ago, I used to work on the team that developed standard desktop systems for employees at IBM Canada. I was responsible for several apps on OS/2 and Windows as well as the OS/2 operating system. I would have been fired for such incompetence.

But testing is done by unorganized volunteers, not by a company.

I think James's point was that this wasn't tested at all, whether by unorganized volunteers, a company or a herd of cats. -- Per Jessen, Zürich (-2.3°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

jdd wrote:

AFAIR, dovecot is both a package not included in openSUSE and an application with a very good debugging documentation, two reason why openSUSE souldn't be blamed

It is included with openSUSE. I installed from the DVD

I installedd it twice in the past and have to install it on a 12.3 machine soon, so the eventual solutions are of interest for me

This problem started with 13.1. It worked fine in 12.3 and earlier. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

jdd wrote:

I want to update to 13.1 asap (because it's the next evergreen), so I keep listening, thanks

I provided a link to this issue on Bugzilla. Just watch that for details. At the moment I have it running, but it's still not done properly. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 27/11/2013 13:16, Carlos E. R. wrote:

Because 13.1 reinstated apparmor as installed and running by default. This was not the case in 12.3 and perhaps some versions earlier.

??? Didn't someone else mention documented problems in the release notes with apparmor? Are you saying the "new" default is to turn on a non-standard security mechanism on all machines??? Why would they do that? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Nov 27, 2013 at 08:43:46PM -0800, Linda Walsh wrote:

On 27/11/2013 13:16, Carlos E. R. wrote:

...

Because 13.1 reinstated apparmor as installed and running by default. This was not the case in 12.3 and perhaps some versions earlier.

---

??? Didn't someone else mention documented problems in the release notes with apparmor? Are you saying the "new" default is to turn on a non-standard security mechanism on all machines???

Why would they do that?

It is a standard security mechanism. If there are issues then we can fix them. You can run "logprof" or similar and report missing things in profiles. Ciao, Marcus -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Eddie wrote:

On Thursday 28 Nov 2013 10:01:04 Marcus Meissner wrote:

...

On Wed, Nov 27, 2013 at 08:43:46PM -0800, Linda Walsh wrote:

...

On 27/11/2013 13:16, Carlos E. R. wrote:

...

Because 13.1 reinstated apparmor as installed and running by default. This was not the case in 12.3 and perhaps some versions earlier.

----

??? Didn't someone else mention documented problems in the release notes with apparmor? Are you saying the "new" default is to turn on a non-standard security mechanism on all machines???

Why would they do that?

It is a standard security mechanism.

If there are issues then we can fix them.

You can run "logprof" or similar and report missing things in profiles.

Ciao, Marcus

I've been frustrated with this dovecot and apparmor issue which doesn't seem to be a new one. It would be nice if there was a profile that could work out of the box as I've not been able to figure out how to create or modify a profile, and email is critical for me just now.

You could just disable apparmor for now, or run dovecot in 'warning' mode. -- Per Jessen, Zürich (2.9°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 El 2013-12-06 a las 10:55 -0800, John Andersen escribió:

Unless they broke it in 13.1 YAST has a profile generator for programs that you (more or less) trust. You start the yast profile generator, and you start the application and it traps everything allowing you to approve each thing that the application requires.

It is missing in 13.1. - -- Cheers Carlos E. R. (from 11.4, with Evergreen, x86_64 "Celadon" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iF4EAREIAAYFAlKiQEgACgkQja8UbcUWM1zDNwD8COe/RUC784jFxZ0zR3G4TbUd 3ENrgcI3z1ZEV9ItZPsA/3qBgCcj3gHLk8DH87Gddy/AOMsWy0uwW/OSobLvt9xn =z3yB -----END PGP SIGNATURE-----

On 2013-12-07 09:28, Per Jessen wrote:

Carlos E. R. wrote:

...

It is missing in 13.1.

I dunno about YaST, but what about aa-genprof and aa-logprof?

As I have always used YaST, I don't know how those tools work. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

On 2013-12-07 18:51, John Andersen wrote:

On 12/7/2013 4:43 AM, Carlos E. R. wrote:

...

On 2013-12-07 09:28, Per Jessen wrote:

...

Carlos E. R. wrote:

...

...

...

It is missing in 13.1.

I dunno about YaST, but what about aa-genprof and aa-logprof?

...

As I have always used YaST, I don't know how those tools work.

Now if someone else posted that, what would your reply be? ;-)

RTFM? ;-) There are several aspects of Linux where I have never bothered to learn about them, just used YaST to do it for me. It is one of the advantages of openSUSE. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

On 2013-12-07 18:55, jdd wrote:

Le 07/12/2013 18:54, Carlos E. R. a écrit :

...

There are several aspects of Linux where I have never bothered to learn about them, just used YaST to do it for me. It is one of the advantages of openSUSE.

and one of it's defects :-((

Well, it is when the related Yast module is removed. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2013-11-27 21:03, Per Jessen wrote:

Carlos E. R. wrote:

...

On 2013-11-27 16:00, James Knott wrote:

...

BTW, I don't understand how this could be so fscked up. Didn't someone test this? Years ago, I used to work on the team that developed standard desktop systems for employees at IBM Canada. I was responsible for several apps on OS/2 and Windows as well as the OS/2 operating system. I would have been fired for such incompetence.

But testing is done by unorganized volunteers, not by a company.

I think James's point was that this wasn't tested at all, whether by unorganized volunteers, a company or a herd of cats.

IMO, it is James fault for not volunteering to test it ;-) See this thread: Date: Fri, 11 Oct 2013 11:08:34 +0200 From: Jos Poortvliet <> Subject: [opensuse-factory] testing - what help do we want? And this link:

https://news.opensuse.org/2013/10/22/help-test-the-opensuse-release-candidat...

And

this thread: Date: Fri, 11 Oct 2013 14:23:59 +0200 From: Jos Poortvliet <> Subject: [opensuse-factory] openSUSE 13.1 RC1 is out, help test! Or this: Date: Sun, 03 Nov 2013 17:04:09 +1100 From: Basil Chupin <> Subject: [opensuse-factory] Requesting people to test RC1 of RC2 or whatever Or this: Date: Thu, 07 Nov 2013 10:15:42 +0100 From: Alberto Planas Dominguez <> To: opensuse-testing at opensuse.org Cc: opensuse-factory at opensuse.org Subject: [opensuse-factory] Last call for testing (before 13.1 GM) Have a look at this link:

https://docs.google.com/spreadsheet/ccc?key=0AgNkaGiuxpjxdFJMa2lKVXQ5eGszYUlPSVdUa2JiU0E&usp=drive_web#gid=0

It

is a spreadsheet of tests. There were a lot of people working on it. If things have not been tested, it is the fault of those people that did not step forward to contribute with the testing. :-} - -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlKWZYMACgkQtTMYHG2NR9UPcQCfT0unADFAPy+nSx63sDCwI9Nn yeUAn3nbiBgSKorRN9Gt+HxRviqlrU+K =3Xjh -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David, Seems like years since I've seen a post from you. Very welcome back, Greg "David C. Rankin" wrote:

On 11/27/2013 09:00 AM, James Knott wrote:

...

BTW, I don't understand how this could be so fscked up. Didn't someone test this? Years ago, I used to work on the team that developed standard desktop systems for employees at IBM Canada. I was responsible for several apps on OS/2 and Windows as well as the OS/2 operating system. I would have been fired for such incompetence.

Done by the same team responsible for the ACA website :-)

-- Sent from my Android phone with K-9 Mail. Please excuse my brevity. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

You say you upgraded. Was that a real upgrade, or did you install fresh to the same partition? I say this because in the second case you have to generate a certificate.

It was an upgrade, not a new installation. I'm aware of certificates, having created them a few times in the past. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Linda Walsh wrote:

Getting it working involved going back to the config file I used in the previous version ... the new version had all the config options spread out into a bunch of different files.

I copied over the /etc/dovecot directory from the backup I made before updating to 13.1. It didn't make any difference. There is no indication that dovecot is failing to start. It just isn't running. A port scan shows port 993 is closed. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org