We too were bit by this bug today.  Fixed with the following commands: 

chown -R debian-spamd:debian-spamd /etc/spamassassin /var/lib/spamassassin
su debian-spamd -c sa-update

However, I'm confused because running the cronjob as the debian-spamd 
pseudo-user seems to have accomplished two things, neither of which 
are good: 

1) Greatly increased the privileges of the debian-spamd pseudo-user, 
   by giving it carte-blanche write access to /etc/spamassassin and 
   /var/lib/spamassassin 

2) Silently breaks every system out there where someone runs sa-update 
   as root, to make sure the rules are updating properly.  

#2 is particularly insidious because the result is that spamassassin 
increasingly loses it's effectiveness over time, until it's no longer 
doing it's job at all. 

I'm honestly curious - what precisely is the rationale behind the decision 
to make the spamassassin cronjob run as the debian-spamd pseudo-user?  
There must be some benefit I am not seeing? 

Best -

-- 
Mark






Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

Reply via email to