Dovecot's apparmor profile breaks dovecot-antispam

Status changed to 'Confirmed' because the bug affects multiple users.

This is also affecting Lucid.

As a temporary workaround, I've added this to /etc/apparmor.d/usr.lib.dovecot.imap

  # dovecot-antispam plugin
  owner /tmp/** rwkl,
  owner /tmp/antispam-mail-*/* klrw,

  # dovecot-antispam pipes to sendmail
  /usr/sbin/sendmail PUx,

In fact the following is enough :

  # dovecot-antispam plugin
  owner /tmp/** rwkl,

  # dovecot-antispam pipes to sendmail
  /usr/sbin/sendmail PUx,

Long dormant, I just came by accidentally and realized it was missed on the last merge since it is a change in dovecot that is needed.
Adding the right bug task to hopefully be picked up next time.

While working on the minor merge for Dovecot I realized that this profile is in fact part of apparmor profiles :-/
So I flagged wrong last November - adding apparmor now.

Would be profiles/apparmor.d/usr.lib.dovecot.imap in the apparmor package.
But after all the time we might need a check if things still apply.

Also might in a different setup the same entries might be needed in usr.lib.dovecot.pop3 or such.
And in that case maybe rather abstractions/dovecot-common?

And finally I don't know if
  owner /tmp/** rwkl,
Is too open?
Looking at the logs maybe rather:
  owner /tmp/antispam-mail** rwkl,

I'd even recommend to restrict it a bit more:

  owner /tmp/antispam-mail*/ rw,
  owner /tmp/antispam-mail*/* rwkl,

sendmail might be a candidate for a child profile. Such a (maybe too generous) profile already exists in the dovecot-lda profile, so cleaning it up and removing permissions that are not needed for "just" sending a mail might be a good idea.

I won't object if you provide a generic sendmail profile that we can Px into (feel free to use the child profile in dovecot-lda as a base), but that needs much more testing before shipping and enforcing it in the default setup.