We have a set of old Linux boxes (Redhat 9), running sendmail 8.12.11
to store inbound email (for later access by IMAP clients).

We are transparently replacing these with Fedora Core 5, sendmail 8.13.7.

But the new machines are having trouble with the "|..." aspect of
'.forward' files. Forwarding to email addresses works. Storing a copy in
the normal inbox with the "\..." syntax works. But the "|..." stuff is
failing: log file entries:
[...] dsn=5.0.0, stat=Can't create output

Running a delivery in "-v" mode gives:

--- snip ---
Running /var/spool/mqueue/k8SBSXA9000519 (sequence 1 of 1)
/var/tdltest/amd/.forward: line 1: forwarding to "|/usr/local/bin/procmail"
"|/usr/local/bin/procmail"... Connecting to prog...
"|/usr/local/bin/procmail"... Can't create output
--- snip ---

The "Mlocal" remains as:
Mlocal, P=/usr/sbin/tmail, F=lsDFMAw5:/|@qShn9u, [...]

("tmail" is the UW imap delivery program).

I'm probably overlooking something really obvious (perhaps change between
8.12.11 and 8.13 7). Hints as to what that might be (or how I might
further investigate) would be welcome.




--

: David Lee I.T. Service :
: Senior Systems Programmer Computer Centre :
: Durham University :
: http://www.dur.ac.uk/t.d.lee/ South Road :
: Durham DH1 3LE :
: Phone: +44 191 334 2752 U.K. :

David Lee <t.d.lee@durham.ac.uk> writes:

> We are transparently replacing these with Fedora Core 5, sendmail 8.13.7.
>
> But the new machines are having trouble with the "|..." aspect of
> '.forward' files. Forwarding to email addresses works. Storing a copy in
> the normal inbox with the "\..." syntax works. But the "|..." stuff is
> failing: log file entries:
> [...] dsn=5.0.0, stat=Can't create output
>
> Running a delivery in "-v" mode gives:
>
> --- snip ---
> Running /var/spool/mqueue/k8SBSXA9000519 (sequence 1 of 1)
> /var/tdltest/amd/.forward: line 1: forwarding to "|/usr/local/bin/procmail"
> "|/usr/local/bin/procmail"... Connecting to prog...
==== that is prog mailer
> "|/usr/local/bin/procmail"... Can't create output
> --- snip ---
>
> The "Mlocal" remains as:
> Mlocal, P=/usr/sbin/tmail, F=lsDFMAw5:/|@qShn9u, [...]

What is on "Mprog" ?


> ("tmail" is the UW imap delivery program).
>
> I'm probably overlooking something really obvious (perhaps change between
> 8.12.11 and 8.13 7). Hints as to what that might be (or how I might
> further investigate) would be welcome.

/ Kari Hurtta

On Thu, 28 Sep 2006, Kari Hurtta wrote:

> David Lee <t.d.lee@durham.ac.uk> writes:
>
> > We are transparently replacing these with Fedora Core 5, sendmail 8.13.7.
> >
> > But the new machines are having trouble with the "|..." aspect of
> > '.forward' files. Forwarding to email addresses works. Storing a copy in
> > the normal inbox with the "\..." syntax works. But the "|..." stuff is
> > failing: log file entries:
> > [...] dsn=5.0.0, stat=Can't create output
> >
> > Running a delivery in "-v" mode gives:
> >
> > --- snip ---
> > Running /var/spool/mqueue/k8SBSXA9000519 (sequence 1 of 1)
> > /var/tdltest/amd/.forward: line 1: forwarding to "|/usr/local/bin/procmail"
> > "|/usr/local/bin/procmail"... Connecting to prog...
> ==== that is prog mailer
> > "|/usr/local/bin/procmail"... Can't create output
> > --- snip ---
> >
> > The "Mlocal" remains as:
> > Mlocal, P=/usr/sbin/tmail, F=lsDFMAw5:/|@qShn9u, [...]
>
> What is on "Mprog" ?

Sorry, I included the wrong thing. It is:
Mprog, P=/bin/sh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
T=X-Unix/X-Unix/X-Unix,
A=sh -c $u

Also the one in "sendmail.cf.rpmnew", presumably FC5's own, is:
Mprog, P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
T=X-Unix/X-Unix/X-Unix,
A=smrsh -c $u

Which presumably means that the possible "F=|" wouldn't be necessary.
Even if I add that (becoming "F=lsDFMoqeu9|"), it still fails:
"|/usr/bin/procmail"... Connecting to prog...
"|/usr/bin/procmail"... Can't create output

I'm perplexed, despite several years of "sendmail" maintenance behind me.

This problem might be subtle. But it might be very obvious and I've
simply missed it (e.g. something changing between 8.12.11 to 8.13.7 that
I've missed in the release notes etc.).

--

: David Lee I.T. Service :
: Senior Systems Programmer Computer Centre :
: Durham University :
: http://www.dur.ac.uk/t.d.lee/ South Road :
: Durham DH1 3LE :
: Phone: +44 191 334 2752 U.K. :

On Thu, 28 Sep 2006, David Lee wrote:

> On Thu, 28 Sep 2006, Kari Hurtta wrote:
>
> > David Lee <t.d.lee@durham.ac.uk> writes:
> >
> > > We are transparently replacing these with Fedora Core 5, sendmail 8.13.7.
> > >
> > > But the new machines are having trouble with the "|..." aspect of
> > > '.forward' files. Forwarding to email addresses works. Storing a copy in
> > > the normal inbox with the "\..." syntax works. But the "|..." stuff is
> > > failing: log file entries:
> > > [...] dsn=5.0.0, stat=Can't create output
> > >
> > > Running a delivery in "-v" mode gives:
> > >
> > > --- snip ---
> > > Running /var/spool/mqueue/k8SBSXA9000519 (sequence 1 of 1)
> > > /var/tdltest/amd/.forward: line 1: forwarding to "|/usr/local/bin/procmail"
> > > "|/usr/local/bin/procmail"... Connecting to prog...
> > ==== that is prog mailer
> > > "|/usr/local/bin/procmail"... Can't create output
> > > --- snip ---
> > >
> > > The "Mlocal" remains as:
> > > Mlocal, P=/usr/sbin/tmail, F=lsDFMAw5:/|@qShn9u, [...]
> >
> > What is on "Mprog" ?
>
> Sorry, I included the wrong thing. It is:
> Mprog, P=/bin/sh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
> T=X-Unix/X-Unix/X-Unix,
> A=sh -c $u
> [...]
> I'm perplexed, despite several years of "sendmail" maintenance behind me.

It is still failing. I have added some "sm_syslog(LOG_INFO, ...)" lines
through the "deliver.c" code. It successfully reaches the "execve()" call
(near line 2740 in "deliver.c"). And "excve()" seems not to return
(usually a good sign). But it still fails: "Can't create output".

Hints welcome!

--

: David Lee I.T. Service :
: Senior Systems Programmer Computer Centre :
: Durham University :
: http://www.dur.ac.uk/t.d.lee/ South Road :
: Durham DH1 3LE :
: Phone: +44 191 334 2752 U.K. :

In article <Pine.GSO.4.58.0610021957390.20751@arachne.dur.ac. uk> David
Lee <t.d.lee@durham.ac.uk> writes:
>On Thu, 28 Sep 2006, David Lee wrote:
>
>> On Thu, 28 Sep 2006, Kari Hurtta wrote:
>>
>> > David Lee <t.d.lee@durham.ac.uk> writes:
>> >
>> > > We are transparently replacing these with Fedora Core 5, sendmail 8.13.7.
>> > >
>> > > But the new machines are having trouble with the "|..." aspect of
>> > > '.forward' files. Forwarding to email addresses works. Storing a copy in
>> > > the normal inbox with the "\..." syntax works. But the "|..." stuff is
>> > > failing: log file entries:
>> > > [...] dsn=5.0.0, stat=Can't create output
>> > >
>> > > Running a delivery in "-v" mode gives:
>> > >
>> > > --- snip ---
>> > > Running /var/spool/mqueue/k8SBSXA9000519 (sequence 1 of 1)
>> > > /var/tdltest/amd/.forward: line 1: forwarding to
>"|/usr/local/bin/procmail"
>> > > "|/usr/local/bin/procmail"... Connecting to prog...
>> > ==== that is prog mailer
>> > > "|/usr/local/bin/procmail"... Can't create output
>> > > --- snip ---
>> > >
>> > > The "Mlocal" remains as:
>> > > Mlocal, P=/usr/sbin/tmail, F=lsDFMAw5:/|@qShn9u, [...]
>> >
>> > What is on "Mprog" ?
>>
>> Sorry, I included the wrong thing. It is:
>> Mprog, P=/bin/sh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL,
>R=EnvToL/HdrToL, D=$z:/,
>> T=X-Unix/X-Unix/X-Unix,
>> A=sh -c $u
>> [...]
>> I'm perplexed, despite several years of "sendmail" maintenance behind me.
>
>It is still failing. I have added some "sm_syslog(LOG_INFO, ...)" lines
>through the "deliver.c" code. It successfully reaches the "execve()" call
>(near line 2740 in "deliver.c"). And "excve()" seems not to return
>(usually a good sign). But it still fails: "Can't create output".

This comes from the parent sendmail noting that the child exited with
code 73 (see /usr/include/sysexits.h). It's not likely that /bin/sh
generated that exit code itself, rather it succeeded in running procmail
and just propagated the exit code from *procmail* (who is very much
aware of sysexits.h, of course).

So, probable cause is that procmail wasn't able to write where the
procmailrc file told it to write (whether $DEFAULT or something else).
I.e. this is basically a procmail problem, not a sendmail one, but I'll
note that the location of the .forward file above isn't a typical home
directory - you'll want to check which uid/gid procmail is actually run
as, as well as where it is attempting to write - most easily done by
tweaking the procmailrc file.

--Per Hedeland
per@hedeland.org

On Mon, 2 Oct 2006, Per Hedeland wrote:

> In article <Pine.GSO.4.58.0610021957390.20751@arachne.dur.ac. uk> David Lee <t.d.lee@durham.ac.uk> writes:
>
> > [...]
> >It is still failing. I have added some "sm_syslog(LOG_INFO, ...)" lines
> >through the "deliver.c" code. It successfully reaches the "execve()" call
> >(near line 2740 in "deliver.c"). And "excve()" seems not to return
> >(usually a good sign). But it still fails: "Can't create output".
>
> This comes from the parent sendmail noting that the child exited with
> code 73 (see /usr/include/sysexits.h). It's not likely that /bin/sh
> generated that exit code itself, rather it succeeded in running procmail
> and just propagated the exit code from *procmail* (who is very much
> aware of sysexits.h, of course).
>
> So, probable cause is that procmail wasn't able to write where the
> procmailrc file told it to write (whether $DEFAULT or something else).
> I.e. this is basically a procmail problem, not a sendmail one, but I'll
> note that the location of the .forward file above isn't a typical home
> directory - you'll want to check which uid/gid procmail is actually run
> as, as well as where it is attempting to write - most easily done by
> tweaking the procmailrc file.

Thanks, Per. Your reply is appreciated.

Despite many years of sendmail experience, this particular issue was
baffling me.

In fact, we've just resolved it. Sendmail is innocent. (Innocent too, as
it turns out, is procmail.)

Our new machines are FC5. They are joining a farm of older Redhat
servers. These are all intended to be equivalent. There _ought_ to be no
functional difference.

The failures on the new machines was hard to pin down. sendmail was
working. "sendmail.cf" was identical. Forwarding to addresses was
working. A manually run "procmail" was working. But forwarding to "|..."
was failing. "maillog" contained no hint of any what was behind the
"Can't create output" problem.


The crucial difference turned out to be (perhaps obviously in retrospect)
the "SELinux" feature of FC5. A quick "proof of concept" experiment of
turning off SELinux fixed our problem.

(So now we're working out a way to keep, but manage, the use of SELinux on
such machines in our environment.)

So many thanks for your .



Might "SELinux" deserve a mention somewhere in the FAQ? Something like:

Q. Why does delivery to a program fail, when both sendmail and that
program independently work?

A. [For example] Check not only the mail log file, but also the general
system log file ("/.../messages"). If your system is Linux-based, with
SELinux turned on, you may see errors in there about SELinux. [Then
describe, or reference off to, something about working through SELinux
problems.]




--

: David Lee I.T. Service :
: Senior Systems Programmer Computer Centre :
: Durham University :
: http://www.dur.ac.uk/t.d.lee/ South Road :
: Durham DH1 3LE :
: Phone: +44 191 334 2752 U.K. :