audit 5: the supervisor socket the panel's alone, OpenDKIM logs and oversigns From

M17: the supervisord control socket is root:supervisor 0770, a group whose
one member is the panel; OpenDKIM and Postfix keep `selfpost` for the files
under /data and no longer reach the socket.

L30, read in OpenDKIM 2.11.0~beta2's source first: it logs through
syslog(3) only and has no Logfile option, and nothing in the container
served /dev/log. internal/syslogrelay (the panel binary with
-syslog-relay=/run/syslog/log, program syslog-relay before OpenDKIM,
/dev/log a link to its socket) passes the datagrams to stdout, error and
worse marked. opendkim.conf: Syslog yes, Canonicalization relaxed/simple,
OversignHeaders From (RFC 6376 § 3.4, § 8.15). e2e: OpenDKIM's start line
reaches the container log; every program RUNNING; DKIM verifies.

Tested on the test server: go vet + go test of 26 packages, make e2e (all
pass, 626 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/process_check.go

@@ -14,7 +14,7 @@ import (
 // excluded: autostart=false, so it rests STOPPED until its first run and
 // EXITED after it (supervisor 4.2.5, supervisor/process.py,
 // Subprocess.finish(); assumptions C-V10).
-var wantRunning = []string{"opendkim", "panel", "postfix", "cert-reload", "logrotate"}
+var wantRunning = []string{"syslog-relay", "opendkim", "panel", "postfix", "cert-reload", "logrotate"}
 
 // checkSupervisorProcesses shells into the container directly (not through the
 // panel's /overview page) so it works before an administrator account even
@@ -129,3 +129,15 @@ func checkCitedPackageVersions(s *stack) error {
 	}
 	return nil
 }
+
+// checkOpenDKIMLogs waits for OpenDKIM's start line in the container's log:
+// OpenDKIM logs through syslog(3) only, and /dev/log is the syslog-relay
+// program's (audit 2026-10-12, L30). OpenDKIM 2.11.0~beta2,
+// opendkim/opendkim.c: syslog(LOG_INFO, "%s v%s starting%s%s%s",
+// DKIMF_PRODUCT, ...), DKIMF_PRODUCT "OpenDKIM Filter" (opendkim.h).
+func checkOpenDKIMLogs(s *stack) error {
+	return waitFor("OpenDKIM's start line in the container log", 20*time.Second, 500*time.Millisecond, func() (bool, error) {
+		out := s.logs("selfpost")
+		return strings.Contains(out, "opendkim[") && strings.Contains(out, "OpenDKIM Filter v"), fmt.Errorf("no OpenDKIM line in the log")
+	})
+}