Re: Upgrade spamassassin from 4.0.1 to 4.0.2 breaks amavis

[Jared Hall via users]

Yikes.  Running anything daemon as root on BSD doesn't seem right.  It 
is entirely likely that some directories have 640 permissions.  From the 
Amavisd-new docs/Security Considerations:

 * Never run/amavisd-new/as root or with other elevated privileges. Use
   a dedicated username (UID) and group (GID) for the purpose (for
   example: don't use usernames/mail/or/nobody/).
   Start/amavisd-new/daemon with/su/(1) (best), or use command line
   options -u (and -g) to specify username/group when starting amavisd,
   or at least specify $daemon_user and $daemon_group in amavisd.conf .
   Later versions of/amavisd-new/perform certain checks on its
   environment and fail to start up if some obvious security flaw is
   found in current UID of the process or in ownership and protections
   of the most critical files and directories.
 * The directories /var/amavis/tmp, /var/virusmail, /var/amavis/db,
   /var/amavis/.spamassassin, /var/amavis/.razor ($TEMPBASE,
   $QUARANTINEDIR, $db_home) must be writable for/amavisd-new/process,
   and are commonly owned by user and group under which/amavisd-new/is
   running. These directories should not be writable by other
   non-privileged users. It is advised to keep $TEMPBASE in a separate
   subdirectory (e.g. /var/amavis/tmp) and not letting temporary files
   be created in the top-level /var/amavis directory.

FAIK, amavisd-new is supposed to run as user vscan and group vscan on 
FreeBSD.  On my O/S, amavis runs as user amavis.  Package from FreeBSD 
is 4.0.1_2 therefore it is likely you installed SA 4.0.2 from tarball as 
root.  Hopefully, you've got backups of the /usr/local/lib/perl5 folders 
and the binaries that SpamAssassin installs (spamassassin, spamc, spamd, 
sa-compile, sa-learn, sa-update, sa-awl...) that you can compare 
permissions with.

You *might* have better success asking for amavisd help from the FreeBSD 
group.

-- Jared Hall
ja...@jaredsec.com
Available for hire.


On 10/17/2025 7:27 AM, Xavier Humbert wrote:
Hi Harald,

I do use packages (/usr/local is the base dir for packages in FreeBSD)

And, while I run amavisd as root, I should not been hit by permission 
issues.

Regards,

Xavier

Le 17/10/2025 13:24, Reindl Harald a écrit :
what do you not understand in "Permission denied"

when you are manually dancing around in /usr/local instead using 
packages learn about chown / chgrp / chmod

Am 17.10.25 um 11:03 schrieb Xavier Humbert:
Hi

I just upgraded from 4.0.1 to 4.0.2 on FreebSD 14.3-STABLE, then 
amavis won't start anymore :

root@numenor ~]# amavisd
fetch_modules: error loading optional module Razor2/Client/Agent.pm:
   Can't locate Getopt/Long.pm:   lib/Getopt/Long.pm: Permission 
denied at 
/usr/local/lib/perl5/site_perl/mach/5.40/Razor2/Client/Agent.pm line 
15.
   BEGIN failed--compilation aborted at 
/usr/local/lib/perl5/site_perl/ mach/5.40/Razor2/Client/Agent.pm 
line 15.
   Compilation failed in require at /usr/local/lib/perl5/site_perl/ 
Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/DKIM.pm:
   Can't locate Mail/DKIM.pm:   lib/Mail/DKIM.pm: Permission denied 
at / usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Image/Info.pm:
   Can't locate Image/Info.pm:   lib/Image/Info.pm: Permission 
denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Image/Info/GIF.pm:
   Can't locate Image/Info/GIF.pm:   lib/Image/Info/GIF.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Image/Info/JPEG.pm:
   Can't locate Image/Info/JPEG.pm:   lib/Image/Info/JPEG.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Image/Info/PNG.pm:
   Can't locate Image/Info/PNG.pm:   lib/Image/Info/PNG.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Image/Info/BMP.pm:
   Can't locate Image/Info/BMP.pm:   lib/Image/Info/BMP.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Image/Info/TIFF.pm:
   Can't locate Image/Info/TIFF.pm:   lib/Image/Info/TIFF.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF.pm:
   Can't locate Mail/SPF.pm:   lib/Mail/SPF.pm: Permission denied at 
/ usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/Server.pm:
   Can't locate Mail/SPF/Server.pm:   lib/Mail/SPF/Server.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Request.pm:
   Can't locate Mail/SPF/Request.pm:  lib/Mail/SPF/Request.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech.pm:
   Can't locate Mail/SPF/Mech.pm:   lib/Mail/SPF/Mech.pm: Permission 
denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/A.pm:
   Can't locate Mail/SPF/Mech/A.pm:   lib/Mail/SPF/Mech/A.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/PTR.pm:
   Can't locate Mail/SPF/Mech/PTR.pm:  lib/Mail/SPF/Mech/PTR.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/All.pm:
   Can't locate Mail/SPF/Mech/All.pm:  lib/Mail/SPF/Mech/All.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/Exists.pm:
   Can't locate Mail/SPF/Mech/Exists.pm: 
 lib/Mail/SPF/Mech/Exists.pm: Permission denied at 
/usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/IP4.pm:
   Can't locate Mail/SPF/Mech/IP4.pm:  lib/Mail/SPF/Mech/IP4.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/IP6.pm:
   Can't locate Mail/SPF/Mech/IP6.pm:  lib/Mail/SPF/Mech/IP6.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/Include.pm:
   Can't locate Mail/SPF/Mech/Include.pm: 
 lib/Mail/SPF/Mech/Include.pm: Permission denied at 
/usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/Mech/MX.pm:
   Can't locate Mail/SPF/Mech/MX.pm:  lib/Mail/SPF/Mech/MX.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mod.pm:
   Can't locate Mail/SPF/Mod.pm:   lib/Mail/SPF/Mod.pm: Permission 
denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/Mod/Exp.pm:
   Can't locate Mail/SPF/Mod/Exp.pm:  lib/Mail/SPF/Mod/Exp.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/Mod/Redirect.pm:
   Can't locate Mail/SPF/Mod/Redirect.pm: 
 lib/Mail/SPF/Mod/Redirect.pm: Permission denied at 
/usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
Mail/SPF/SenderIPAddrMech.pm:
   Can't locate Mail/SPF/SenderIPAddrMech.pm:  lib/Mail/SPF/ 
SenderIPAddrMech.pm: Permission denied at /usr/local/lib/perl5/ 
site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Mail/SPF/v1/Record.pm:
   Can't locate Mail/SPF/v1/Record.pm:  lib/Mail/SPF/v1/Record.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module Mail/SPF/v2/Record.pm:
   Can't locate Mail/SPF/v2/Record.pm:  lib/Mail/SPF/v2/Record.pm: 
Permission denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm 
line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/_compV6.al:
   Can't locate auto/NetAddr/IP/_compV6.al:  lib/auto/NetAddr/IP/ 
_compV6.al: Permission denied at 
/usr/local/lib/perl5/site_perl/Amavis/ Boot.pm line 77.
fetch_modules: error loading optional module auto/NetAddr/IP/short.al:
   Can't locate auto/NetAddr/IP/short.al: 
 lib/auto/NetAddr/IP/short.al: Permission denied at 
/usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ inet_any2n.al:
   Can't locate auto/NetAddr/IP/InetBase/inet_any2n.al:  lib/auto/ 
NetAddr/IP/InetBase/inet_any2n.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ inet_n2ad.al:
   Can't locate auto/NetAddr/IP/InetBase/inet_n2ad.al:  lib/auto/ 
NetAddr/IP/InetBase/inet_n2ad.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ inet_n2dx.al:
   Can't locate auto/NetAddr/IP/InetBase/inet_n2dx.al:  lib/auto/ 
NetAddr/IP/InetBase/inet_n2dx.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ inet_ntoa.al:
   Can't locate auto/NetAddr/IP/InetBase/inet_ntoa.al:  lib/auto/ 
NetAddr/IP/InetBase/inet_ntoa.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ ipv6_aton.al:
   Can't locate auto/NetAddr/IP/InetBase/ipv6_aton.al:  lib/auto/ 
NetAddr/IP/InetBase/ipv6_aton.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module 
auto/NetAddr/IP/InetBase/ ipv6_ntoa.al:
   Can't locate auto/NetAddr/IP/InetBase/ipv6_ntoa.al:  lib/auto/ 
NetAddr/IP/InetBase/ipv6_ntoa.al: Permission denied at 
/usr/local/lib/ perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/ 
new_public_key.al:
   Can't locate auto/Crypt/OpenSSL/RSA/new_public_key.al:  lib/auto/ 
Crypt/OpenSSL/RSA/new_public_key.al: Permission denied at 
/usr/local/ lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/ 
new_key_from_parameters.al:
   Can't locate auto/Crypt/OpenSSL/RSA/new_key_from_parameters.al: 
 lib/ auto/Crypt/OpenSSL/RSA/new_key_from_parameters.al: Permission 
denied at /usr/local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/ 
get_key_parameters.al:
   Can't locate auto/Crypt/OpenSSL/RSA/get_key_parameters.al: 
 lib/auto/ Crypt/OpenSSL/RSA/get_key_parameters.al: Permission 
denied at /usr/ local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module auto/Crypt/OpenSSL/RSA/ 
import_random_seed.al:
   Can't locate auto/Crypt/OpenSSL/RSA/import_random_seed.al: 
 lib/auto/ Crypt/OpenSSL/RSA/import_random_seed.al: Permission 
denied at /usr/ local/lib/perl5/site_perl/Amavis/Boot.pm line 77.
fetch_modules: error loading optional module Error.pm:
   Can't locate Error.pm:   lib/Error.pm: Permission denied at /usr/ 
local/lib/perl5/site_perl/Amavis/Boot.pm line 77.

All modules are installed, eg :

[root@numenor ~]# locate Agent.pm
/usr/local/lib/perl5/site_perl/mach/5.40/Razor2/Client/Agent.pm