Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: DBMail: users

dbmail_acl

 

 

DBMail users RSS feed   Index | Next | Previous | View Threaded


jon at host-it

Jan 13, 2009, 6:50 AM

Post #1 of 6 (422 views)
Permalink
dbmail_acl

Hi Guys,

I'm looking into restricting deletes by users on a specific mailbox owned by
them.

Looking at RFC 4314 section 2.1 this looks like the x command (DELETE
mailbox, old mailbox name in RENAME) ?

I've been playing around with dbmail_acl and it doesn't seem to have any
effect on my clients (tbird) abilities on the mailbox.

I've created a test mailbox, then inserted my user_idnr and the mailbox
idnr, with all other values set to 0.. I'm still able to mark as read,
delete, insert etc etc.

Am I missing an obvious setting somewhere?

There doesn't appear much documention on this table.

J Duggan.



_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


Jon at host-it

Jan 13, 2009, 7:15 AM

Post #2 of 6 (394 views)
Permalink
RE: dbmail_acl [In reply to]

>
> I've been playing around with dbmail_acl and it doesn't seem to have
> any
> effect on my clients (tbird) abilities on the mailbox.
>
> I've created a test mailbox, then inserted my user_idnr and the mailbox
> idnr, with all other values set to 0.. I'm still able to mark as read,
> delete, insert etc etc.
>
> Am I missing an obvious setting somewhere?
>
> There doesn't appear much documention on this table.

Checking through the source tarball, the only use of dbmail_acl is in migration and create table scripts... Is this table now redundant?

J Duggan.
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


paul at nfg

Jan 13, 2009, 7:40 AM

Post #3 of 6 (390 views)
Permalink
Re: dbmail_acl [In reply to]

Jon Duggan wrote:
>> I've been playing around with dbmail_acl and it doesn't seem to have
>> any
>> effect on my clients (tbird) abilities on the mailbox.
>>
>> I've created a test mailbox, then inserted my user_idnr and the mailbox
>> idnr, with all other values set to 0.. I'm still able to mark as read,
>> delete, insert etc etc.
>>
>> Am I missing an obvious setting somewhere?
>>
>> There doesn't appear much documention on this table.
>
> Checking through the source tarball, the only use of dbmail_acl is in migration and create table scripts... Is this table now redundant?

You're not looking right.

dbmail-2.2> grep -iE '(SELECT|UPDATE|INSERT).*acl' db.c
"SELECT * FROM %sacl "
"SELECT user_id, mailbox_id FROM %sacl "
"INSERT INTO %sacl (user_id, mailbox_id) "
"UPDATE %sacl SET %s = %i "
TRACE(TRACE_DEBUG, "Updated ACL for user [%llu], "
"SELECT %susers.userid FROM %susers, %sacl "

dbmail-2.3> grep -iE '(SELECT|UPDATE|INSERT).*acl' src/dm_db.c
r = db_query(c, "SELECT user_id, mailbox_id FROM %sacl WHERE user_id =
%llu AND mailbox_id = %llu",DBPFX, userid, mboxid);
return db_update("INSERT INTO %sacl (user_id, mailbox_id) VALUES (%llu,
%llu)",DBPFX, userid, mboxid);
return db_update("UPDATE %sacl SET %s = %i WHERE user_id = %llu AND
mailbox_id = %llu",DBPFX, right_flag, set, userid, mboxid);
return db_update("DELETE FROM %sacl WHERE user_id = %llu AND mailbox_id
= %llu",DBPFX, userid, mboxid);
r = db_query(c, "SELECT %susers.userid FROM %susers, %sacl "




--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


Jon at host-it

Jan 13, 2009, 7:46 AM

Post #4 of 6 (391 views)
Permalink
RE: dbmail_acl [In reply to]

Paul,

>
> You're not looking right.
>
> dbmail-2.2> grep -iE '(SELECT|UPDATE|INSERT).*acl' db.c
> "SELECT * FROM %sacl "
> "SELECT user_id, mailbox_id FROM %sacl "
> "INSERT INTO %sacl (user_id, mailbox_id) "
> "UPDATE %sacl SET %s = %i "
> TRACE(TRACE_DEBUG, "Updated ACL for user [%llu], "
> "SELECT %susers.userid FROM %susers, %sacl "
>

Thanks - i'd already worked that out after I'd sent to the list (table_prefix makes the dbname_acl name dynamic.. Duh!)

Point still stands with all fields set to 0, it shouldn't have such behaviour as allowing deletes etc?

I'll get a full trace log once business hours are out and I can restart the daemon, hopefully it will point me in the right direction

If you have any ideas, on where I might be going wrong, though, do point me in the right direction.

Regards

J Duggan.
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


paul at nfg

Jan 13, 2009, 8:08 AM

Post #5 of 6 (392 views)
Permalink
Re: dbmail_acl [In reply to]

Jon Duggan wrote:
> Hi Guys,
>
> I'm looking into restricting deletes by users on a specific mailbox owned by
> them.

Owners always have full rights on a mailbox. You can make mailboxes
read-only by setting dbmail_mailboxes.permission to 1 rather than 2
(default). But I'm not sure that won't prevent users from deleting
mailboxes...


>
> Looking at RFC 4314 section 2.1 this looks like the x command (DELETE
> mailbox, old mailbox name in RENAME) ?

DBMail's acl implementation is based on RFC2086, not RFC4314. Also, the
acl code is not very much exercised by the unit-test code. Fixing both
would require a significant effort.

--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail


jon at host-it

Jan 13, 2009, 8:27 AM

Post #6 of 6 (391 views)
Permalink
RE: dbmail_acl [In reply to]

> Owners always have full rights on a mailbox. You can make mailboxes
> read-only by setting dbmail_mailboxes.permission to 1 rather than 2
> (default). But I'm not sure that won't prevent users from deleting
> mailboxes...
>

Have tested this, 1 does indeed prevent the mailbox being deleted also.

> DBMail's acl implementation is based on RFC2086, not RFC4314. Also, the
> acl code is not very much exercised by the unit-test code. Fixing both
> would require a significant effort.
>

Noted.

Thanks for assistance.

J Duggan.

_______________________________________________
DBmail mailing list
DBmail[at]dbmail.org
https://mailman.fastxs.nl/mailman/listinfo/dbmail

DBMail users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.