I forgot to CC you on this question...
Strange, I didn't see this message on info-cyrus, anyway:
Also, the reason I discovered this is that Mandrake's "msec" security-auditing process automatically chowns /usr/sieve to root.root several times a day. Luca, do you think this is something that the RPMs should override in /etc/security/perm.local to cyrus.mail, either automatically or (if such a thing is possible) after prompting? I'm of
The RPM uses /var/lib/imap/sieve by default, and that isn't affected by msec, at least it isn't on my two systems, one 8.2 and the other 9.0, both with security level 3 (implying CHECK_PERMS=yes).
I've checked the perm configuration files for all levels and none of them touches anything under /var/lib.
Bye -- Luca Olivetti