[Dovecot] "list" ACL privilege ignored for LSUB command?
wgillespie+dovecot at es2eng.com
Mon Nov 22 21:22:25 EET 2010
Hello, I am new to this list, so feel free to correct me if I do
something wrong. I don't have a problem, just a question.
The RFC which covers IMAP ACLs  states that one of the standard
l - lookup (mailbox is visible to LIST/LSUB commands, SUBSCRIBE
If I have a shared or public namespace and have a mailbox for which I do
not have lookup rights, Dovecot seems to do great with the LIST commands
at not showing it to me.
Two things I noticed though:
SUBSCRIBE-ing to the mailbox is still successful
LSUB will list mailboxes which I do not have lookup rights to
I imagine the first issue is easy enough to correct since it's just
another check before actually subscribing. The second issue seems a
little more difficult in my mind since Dovecot seems to just dump the
subscription files to the client without checking whether the mailbox is
allowed or not. I imagine a similar issue popped up with the LIST
command and that's why the dovecot-acl-list files exist.
Anyway, am I right in my observations, or am I completely overlooking
Dovecot's wiki also indicates support for this in
I'm using version 1.2.9 with the acl and imap_acl mail_plugins in case
More information about the dovecot