audit 5: the supervisor socket the panel's alone, OpenDKIM logs and oversigns From

M17: the supervisord control socket is root:supervisor 0770, a group whose
one member is the panel; OpenDKIM and Postfix keep `selfpost` for the files
under /data and no longer reach the socket.

L30, read in OpenDKIM 2.11.0~beta2's source first: it logs through
syslog(3) only and has no Logfile option, and nothing in the container
served /dev/log. internal/syslogrelay (the panel binary with
-syslog-relay=/run/syslog/log, program syslog-relay before OpenDKIM,
/dev/log a link to its socket) passes the datagrams to stdout, error and
worse marked. opendkim.conf: Syslog yes, Canonicalization relaxed/simple,
OversignHeaders From (RFC 6376 § 3.4, § 8.15). e2e: OpenDKIM's start line
reaches the container log; every program RUNNING; DKIM verifies.

Tested on the test server: go vet + go test of 26 packages, make e2e (all
pass, 626 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/Dockerfile

@@ -70,8 +70,8 @@ RUN useradd --system --no-create-home --shell /usr/sbin/nologin panel
 # sender map, while OpenDKIM and Postfix (different users) must read them.
 # Membership in this group — plus setgid dirs under /data (set up in
 # entrypoint.sh) — lets OpenDKIM read the panel-owned keys and lets Postfix read
-# the sasldb2/sender map, and lets the panel reach the supervisor control socket
-# to signal OpenDKIM/Postfix reloads without any process running as root.
+# the sasldb2/sender map. (The supervisor control socket has a group of its
+# own, `supervisor`, below.)
 # The id is fixed, and it is the one the group has always had: an operator
 # gives the TLS private key on the host to this group by number, so that the
 # panel can put it into a full backup (guide § Taking a full backup).
@@ -97,6 +97,11 @@ RUN groupadd --system --gid 998 selfpost \
 # root:$setgid_group 2755. Linux, Documentation/userspace-api/no_new_privs.rst:
 # with no_new_privs, execve() no longer changes the gid for a setgid file.)
 RUN usermod -aG postdrop panel
+# The supervisord control socket's group (supervisord.conf, [unix_http_server]):
+# the panel alone - not OpenDKIM's or Postfix's users, which share `selfpost`
+# for the files under /data.
+RUN groupadd --system supervisor \
+ && usermod -aG supervisor panel
 
 # Runtime directories: milter sockets and the consolidated persistent root.
 RUN mkdir -p /run/opendkim /run/selfpost /data \

build/entrypoint.sh

@@ -180,6 +180,17 @@ chmod 2750 /run/opendkim /run/selfpost
 # (test(1), -S: true for any socket file, whether or not anything listens.)
 rm -f /run/opendkim/*.sock /run/selfpost/*.sock /run/selfpost/*.alive
 
+# The container's /dev/log: a link to the socket the syslog-relay program (the
+# panel's binary, as `panel`) listens on, so what OpenDKIM logs through
+# syslog(3) reaches the container's log (build/supervisord.conf; audit
+# 2026-10-12, L30). The directory is the relay's and reachable by all: the
+# socket is the container's local log, as /dev/log is on a host.
+mkdir -p /run/syslog
+chown panel:panel /run/syslog
+chmod 0755 /run/syslog
+rm -f /run/syslog/log
+ln -sfn /run/syslog/log /dev/log
+
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
 # optional 587 service are all driven by env at run time, and re-derived on every

build/opendkim.conf

@@ -14,10 +14,25 @@
 # dkimf_db_open(): a file or refile table is read line by line; an empty file
 # is an empty table, not an error.)
 
-Syslog                  no
+# Logged through syslog(3) to /dev/log, which the syslog-relay program passes
+# to the container's log (build/supervisord.conf; audit 2026-10-12, L30). The
+# errors are what is wanted - a key that cannot be read, a table that cannot
+# be opened; a line per signed message (SyslogSuccess) is not.
+Syslog                  yes
 UMask                   007
 Mode                    s
 
+# relaxed/simple: the header fields relaxed, so a relay that refolds or
+# respaces one does not break the signature; the body simple, as signed
+# (opendkim.conf.5.in, Canonicalization: header/body, the default
+# simple/simple; RFC 6376 § 3.4). OversignHeaders From lists From: in h= once
+# more than it is present, so a From: added on the way fails the signature
+# instead of being shown above the signed one (opendkim.conf.5.in,
+# OversignHeaders; RFC 6376 § 8.15) - the replay 2.4.0's sender check is
+# about.
+Canonicalization        relaxed/simple
+OversignHeaders         From
+
 # SigningTable uses refile: so the "*@example.com" left-hand patterns match any
 # local-part for a domain; KeyTable maps each domain to its key and selector.
 # (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are

build/supervisord.conf

@@ -26,17 +26,20 @@ logfile_maxbytes=0
 pidfile=/run/supervisord.pid
 loglevel=info
 
-; The control socket is reachable by the shared `selfpost` group so the panel
-; (running as the unprivileged `panel` user) can ask supervisord to send
-; OpenDKIM a reload signal after it rewrites the DKIM tables. It is still
-; unreachable by world; only root and the two SelfPost services are in the
-; group. No HTTP auth is configured because access is gated by socket
-; permissions, not the network. (supervisor 4.2.5, docs/configuration.rst,
-; [unix_http_server]: chmod and chown set the socket's mode and owner; without
-; username and password no authentication is asked.)
+; The control socket is reachable by the `supervisor` group, whose one member
+; is the panel (the unprivileged `panel` user): it asks supervisord to signal
+; OpenDKIM after it rewrites the DKIM tables, to run the Postfix reload, and
+; for the processes' state. Whoever reaches the socket can stop, start or
+; restart any program, so it is not the shared `selfpost` group's: OpenDKIM
+; and Postfix are in that one for the files under /data, and a fault in either
+; must not reach every other program (audit 2026-10-12, stage 5). Not
+; reachable by world. No HTTP auth is configured because access is gated by
+; socket permissions, not the network. (supervisor 4.2.5,
+; docs/configuration.rst, [unix_http_server]: chmod and chown set the socket's
+; mode and owner; without username and password no authentication is asked.)
 [unix_http_server]
 file=/run/supervisor.sock
-chown=root:selfpost
+chown=root:supervisor
 chmod=0770
 
 [rpcinterface:supervisor]
@@ -45,6 +48,23 @@ supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
 [supervisorctl]
 serverurl=unix:///run/supervisor.sock
 
+; The container's /dev/log (a link to the socket below, build/entrypoint.sh):
+; what OpenDKIM - which logs through syslog(3) and nothing else - sends there
+; comes out on stdout, into the container's log (internal/syslogrelay; audit
+; 2026-10-12, L30). Before OpenDKIM, so its first lines are not lost; a
+; message sent while nothing listens is dropped by syslog(3), not queued.
+[program:syslog-relay]
+command=/usr/local/bin/panel -syslog-relay=/run/syslog/log
+user=panel
+priority=50
+autostart=true
+autorestart=true
+startretries=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
 [program:opendkim]
 command=/usr/sbin/opendkim -f -x /etc/opendkim.conf
 priority=100