mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

deploy: add CAP_KILL so opendkim reload on domain add/remove works

Browse Source 
supervisord runs as root inside the container but cap_drop: ALL still
blocked it from signaling opendkim (a different uid) — cross-uid
kill() checks CAP_KILL regardless of the caller's uid. Domain add was
failing in prod with "unknown problem sending sig opendkim ...
PermissionError: Operation not permitted".
This commit is contained in:
Микс
2026-07-15 22:30:20 +03:00
parent 88f9d33e8d
commit 1b21f001eb
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/docker-compose.yml
+7
View File
@@ -75,6 +75,12 @@ services:
# - SETUID/SETGID — supervisord drops the panel to the unprivileged # - SETUID/SETGID — supervisord drops the panel to the unprivileged
# `panel` user; Postfix switches to its own users; # `panel` user; Postfix switches to its own users;
# - DAC_OVERRIDE — cross-user file access within the `selfpost` group. # - DAC_OVERRIDE — cross-user file access within the `selfpost` group.
# - KILL — supervisord (root) sends SIGUSR1 to opendkim (a
# different uid) on domain add/remove to reload its
# KeyTable/SigningTable; without it os.kill() fails
# with EPERM even though the caller is root, because
# the kernel's signal permission check for
# cross-uid kill() still consults CAP_KILL.
# FOWNER/FSETID are required by build/entrypoint.sh's permission # FOWNER/FSETID are required by build/entrypoint.sh's permission
# self-healing; without them chmod fails with EPERM and the container # self-healing; without them chmod fails with EPERM and the container
# crash-loops on start. # crash-loops on start.
@@ -90,3 +96,4 @@ services:
- SETUID - SETUID
- SETGID - SETGID
- DAC_OVERRIDE - DAC_OVERRIDE
- KILL