From 1b21f001ebb91d4687d8d59b2b8cb0c2f858efce Mon Sep 17 00:00:00 2001 From: Mikhail Yenuchenko Date: Wed, 15 Jul 2026 22:30:20 +0300 Subject: [PATCH] deploy: add CAP_KILL so opendkim reload on domain add/remove works MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit supervisord runs as root inside the container but cap_drop: ALL still blocked it from signaling opendkim (a different uid) — cross-uid kill() checks CAP_KILL regardless of the caller's uid. Domain add was failing in prod with "unknown problem sending sig opendkim ... PermissionError: Operation not permitted". --- deploy/docker-compose.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index edea6e1..40ea213 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -75,6 +75,12 @@ services: # - SETUID/SETGID — supervisord drops the panel to the unprivileged # `panel` user; Postfix switches to its own users; # - DAC_OVERRIDE — cross-user file access within the `selfpost` group. + # - KILL — supervisord (root) sends SIGUSR1 to opendkim (a + # different uid) on domain add/remove to reload its + # KeyTable/SigningTable; without it os.kill() fails + # with EPERM even though the caller is root, because + # the kernel's signal permission check for + # cross-uid kill() still consults CAP_KILL. # FOWNER/FSETID are required by build/entrypoint.sh's permission # self-healing; without them chmod fails with EPERM and the container # crash-loops on start. @@ -90,3 +96,4 @@ services: - SETUID - SETGID - DAC_OVERRIDE + - KILL