Problem calling rspamc from dovecot sieve

[uli-a]

I have dovecot / sieve setup that rspamd learns spam/ham when the user moves email into / out of the spam folder. This worked until recently but now calling rspamc seems to timeout after 10 seconds. I see the following error message in the dovecot log:

Feb 23 09:13:29 server.tld dovecot[2556973]: imap(user@server.tld)<2600363><amThy8oupupbAHwi>: Error: program exec:/var/vmail/bin/learn_spam.sh (2600364): Forcibly terminated with signal 15
Feb 23 09:13:29 server.tld dovecot[2556973]: imap(user@server.tld)<2600363><amThy8oupupbAHwi>: Error: sieve: failed to pipe message to program 'learn_spam.sh': refer to server log for more information. [2025-02-23 09:13:29]
Feb 23 09:13:29 server.tld dovecot[2556973]: imap(user@server.tld)<2600363><amThy8oupupbAHwi>: Error: sieve: Execution of script /var/vmail/sieve/global/learn-spam.sieve failed

This is the sieve filter to learn spam:

require ["vnd.dovecot.pipe", "vnd.dovecot.environment", "copy", "imapsieve", "environment", "variables" ];

if environment :matches "imap.user" "*" {
  set "username" "${1}";
}

pipe :copy "learn_spam.sh" [ "${username}" ];

This is the script "learn_spam.sh":

#!/bin/bash
inputtext=$( /usr/bin/cat )
echo "${inputtext}" | /usr/bin/rspamc -h 127.0.0.1:11334 learn_spam >> /var/vmail/bin/rspamd.log 2>&1

I tried a couple if things to find where the problem is but it seems all rather strange:

• Switched rspamd worker controller from tcp to socket => same error
• Disabled all hardening options for dovecot in systemd service => same error

I added some debug code to "learn_spam.sh" to find out where the problem might come from:

#!/bin/bash
inputtext=$( /usr/bin/cat )
echo "curl:" >> /var/vmail/bin/rspamd.log
curl -v localhost:11334 >> /var/vmail/bin/rspamd.log 2>&1
echo "stat:" >> /var/vmail/bin/rspamd.log
/usr/bin/rspamc -h 127.0.0.1:11334 stat >> /var/vmail/bin/rspamd.log 2>&1
echo "learn:" >> /var/vmail/bin/rspamd.log 2>&1
echo "${inputtext}" | /usr/bin/rspamc -h 127.0.0.1:11334 learn_spam >> /var/vmail/bin/rspamd.log 2>&1

The curl works fine. Therefore I can call other programs from a sieve script and there is no firewall issue. The script hangs at "rspamc stat" - there are not logs entries after "echo stat:". 10 seconds later the error messages in the dovecot logs appear.

I tried other calls of rspamc:

• "rspamc --version" => should give an error message but hangs as the other rspamc calls
• Switched from the symbolic link /usr/bin/rspamc to /usr/bin/rspamc-3.11.0 => same error

I am out of ideas what the issue might be.

[m-i-k-e-y]

To me, this seems to be rather a dovecot config issue than an issue with rspamd.

Assuming rspamd is running on the same host dovecot runs on, you can use these sieve scripts without any additional shell scripts:

$ cat <path_to_sieve_cfg>/global/learn-spam.sieve
require ["vnd.dovecot.pipe", "copy", "imapsieve"];
pipe :copy "rspamc" ["learn_spam"];
$

$ cat <path_to_sieve_cfg>/global/learn-ham.sieve
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];

if environment :matches "imap.mailbox" "*" {
    set "mailbox" "${1}";
}
    
if string "${mailbox}" "Trash" {
    stop;
}

pipe :copy "rspamc" ["learn_ham"];
$

$ cat <path_to_sieve_cfg>/global/spam-global.sieve 
require "fileinto";

if header :contains "X-Spam-Flag" "YES" {
    fileinto "Spam";
}
    
if header :is "X-Spam" "Yes" {
    fileinto "Spam";
}
$

I'm using these for years now.
As a reference, I found these here: Mailserver mit Dovecot, Postfix, MySQL und Rspamd unter Debian 11 Bullseye / Ubuntu 22.04 LTS, it's in german, but I think you get the point.

I'm not affiliated with rspamd nor with the author of that site. And I can't help with any change requests to these scripts. I just use them as they are.

[uli-a]

Thanks for the answer. Unfortunately, this results in exactly the same error:

Feb 23 13:18:11 server.tld dovecot[19965]: imap(user@server.tld)<20045><XAclL84uF+ggAwDmFwfIADWNrrIWv4lo>: Error: program exec:/usr/bin/rspamc (20285): Execution timed out (> 10000 msecs)
Feb 23 13:18:11 server.tld dovecot[19965]: imap(user@server.tld)<20045><XAclL84uF+ggAwDmFwfIADWNrrIWv4lo>: Error: program exec:/usr/bin/rspamc (20285): Forcibly terminated with signal 15
Feb 23 13:18:11 server.tld dovecot[19965]: imap(user@server.tld)<20045><XAclL84uF+ggAwDmFwfIADWNrrIWv4lo>: Error: sieve: failed to pipe message to program `rspamc': refer to server log for more information. [2025-02-23 13:18:11]
Feb 23 13:18:11 server.tld dovecot[19965]: imap(user@server.tld)<20045><XAclL84uF+ggAwDmFwfIADWNrrIWv4lo>: Error: sieve: Execution of script /var/vmail/sieve/global/learn-spam.sieve failed

Since every other program in /usr/bin I call via the script (e.g. echo, curl and cat) works fine, I doubt that this is solely a dovecot issue. But as I said: I'm out of ideas here.

To me this looks like a SELinux / AppArmor issue (things don't work without any meaningful error message or apparent reason), but I have neither of them installed.

[japc]

You can try to debug the dovecot sieve script execution with:

HOME=/pathto/somemaildir sieve-test -c /etc/dovecot/dovecot.conf \
  -omail_debug=yes \
  -l dbox:~/dbox \
  -t- -Tlevel=matching 
  -D -e \
  /pathto/learn_spam.sieve /pathto/spam.msg

(your dovecot path may differ)

Maybe that will sched some light.

[uli-a]

I had to change the sieve script slightly, because require imapsieve would not work with sieve-test:

require ["vnd.dovecot.pipe", "copy", "environment", "variables" ];

pipe :copy "learn_spam.sh";

That worked without error. The same script still gives the error above when moving the email in the imap client.

[uli-a]

I changed the script "learn_spam.sh" to run rspamc in the background that it does not get terminated after 10 seconds:

#!/bin/bash
inputtxt=$( /usr/bin/cat )
#echo "${inputtxt}" >> /var/vmail/bin/rspamd.log
echo "${inputtxt}" | /usr/bin/rspamc -v -t 60 -h 127.0.0.1:11334 -P pw learn_spam >> /var/vmail/bin/rspamd.log 2>&1 &

Even with the timeout set to 60 s rspamc runs indefinitely (I killed it after 8 minutes or so) and uses 100 % CPU.

One more piece to the puzzle but still no solution.

[martinjakl]

Has anybody found the answer for this? I have completely the same issue.

[marcusweinhold]

Had a similar problem. For me the issue was, that rspamc wanted to allocate more than 256M of memory, which is the default limit set by dovecot, see https://doc.dovecot.org/main/core/summaries/settings.html#default_vsz_limit

Setting this to 512M solved the issue for me. My sieve scripts call rspamc directly like

pipe :copy "rspamc" ["learn_spam"];

[martinjakl]

Thanks for the tip, but that didn't help me.

[Glidos]

Plus 1. I've been struggling with this all day. I don't suppose anyone has found a fix they can post?