email: Make rspamd learn spam/ham when the user marks mails as junk or not junk.

Add two sieve scripts for spam/ham learning. When the user moves a mail
from anywhere to junk, or from junk to anywhere (except for trash) the
mail is piped into the respective rspamc learn_spam/learn_ham command.
The rspamc command is run as the mail user and the command requires that
the user can connect to localhost:11334. Because of that, add the mail
user to the allowed users that can access protected services.

The sievec compilation of the new scripts requre the dovecot-antispam
package, so install it and increment the email version number.

Closes: #2487
Imroves: #56

Tests done:
1. Apply the patches on an existing install
2. Confirm the firewall and the email app get updated
3. Move a mail from inbox to junk and confirm that rspamd statistics for
   "Learned" mails increment by one.
4. Move back the mail from junk to inbox and confirm the number
   increments again.
5. Move the mail to trash and confirm the script doesn't execute.
6. Repeat steps 3-5 with mail_debug = yes in /etc/dovecot/dovecot.conf
   and confirm the script esxecution further by reading the debug logs.

[Sunil]

- Split the configuration file 90-freedombox-sieve.conf into
90-freedombox-imap.conf and merge the remaining with 95-freedombox-sieve.conf.

- These changes do not need dovecot-anitspam package. Remove it from packages
list for the app.

Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>

plinth/modules/email/__init__.py

@@ -52,7 +52,7 @@ class EmailApp(plinth.app.App):
 
     app_id = 'email'
 
-    _version = 5
+    _version = 6
 
     def __init__(self) -> None:
         """Initialize the email app."""
@@ -104,6 +104,7 @@ class EmailApp(plinth.app.App):
             '/etc/dovecot/conf.d/05-freedombox-userdb.conf',
             '/etc/dovecot/conf.d/15-freedombox-auth.conf',
             '/etc/dovecot/conf.d/15-freedombox-mail.conf',
+            '/etc/dovecot/conf.d/90-freedombox-imap.conf',
             '/etc/dovecot/conf.d/90-freedombox-lmtp.conf',
             '/etc/dovecot/conf.d/90-freedombox-mailboxes.conf',
             '/etc/dovecot/conf.d/90-freedombox-master.conf',
@@ -118,9 +119,11 @@ class EmailApp(plinth.app.App):
             '/etc/rspamd/local.d/freedombox-dkim-signing.conf'
         ])
         self.add(dropin_configs)
-        dropin_configs_sieve = DropinConfigs(
-            'dropin-configs-email-sieve',
-            ['/etc/dovecot/freedombox-sieve-after/sort-spam.sieve'])
+        dropin_configs_sieve = DropinConfigs('dropin-configs-email-sieve', [
+            '/etc/dovecot/freedombox-sieve/learn-ham.sieve',
+            '/etc/dovecot/freedombox-sieve/learn-spam.sieve',
+            '/etc/dovecot/freedombox-sieve-after/sort-spam.sieve',
+        ])
         self.add(dropin_configs_sieve)
 
         listen_ports = [(25, 'tcp4'), (25, 'tcp6'), (465, 'tcp4'),

plinth/modules/email/data/usr/share/freedombox/etc/dovecot/conf.d/90-freedombox-imap.conf

@@ -0,0 +1,8 @@
+# Do not edit this file. Manage your settings on FreedomBox.
+
+# Make rspamd learn spam/ham when the user marks mails as junk or not junk.
+# https://doc.dovecot.org/2.3/configuration_manual/howto/antispam_with_sieve/
+
+protocol imap {
+  mail_plugins = $mail_plugins imap_sieve
+}

plinth/modules/email/data/usr/share/freedombox/etc/dovecot/conf.d/95-freedombox-sieve.conf

@@ -6,4 +6,21 @@
 
 plugin {
   sieve_after = /etc/dovecot/freedombox-sieve-after
+
+  # Make rspamd learn spam/ham when the user marks mails as junk or not junk.
+  # https://doc.dovecot.org/2.3/configuration_manual/howto/antispam_with_sieve/
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+  sieve_pipe_bin_dir = /usr/bin
+  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
+
+  # From elsewhere to Junk folder
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY
+  imapsieve_mailbox1_before = file:/etc/dovecot/freedombox-sieve/learn-spam.sieve
+
+  # From Junk folder to elsewhere
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Junk
+  imapsieve_mailbox2_causes = COPY
+  imapsieve_mailbox2_before = file:/etc/dovecot/freedombox-sieve/learn-ham.sieve
 }

plinth/modules/email/data/usr/share/freedombox/etc/dovecot/freedombox-sieve/learn-ham.sieve

@@ -0,0 +1,6 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment"];
+if environment "imap.mailbox" "Trash" {
+   # Putting spam in Trash mailbox is not significant
+   stop;
+}
+pipe :copy "rspamc" ["learn_ham"];

plinth/modules/email/data/usr/share/freedombox/etc/dovecot/freedombox-sieve/learn-spam.sieve

@@ -0,0 +1,2 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve"];
+pipe :copy "rspamc" ["learn_spam"];

plinth/modules/email/privileged/spam.py

@@ -31,8 +31,10 @@ def setup_spam():
 
 def _compile_sieve():
     """Compile all .sieve script to binary format for performance."""
-    sieve_dir = '/etc/dovecot/freedombox-sieve-after/'
-    subprocess.run(['sievec', sieve_dir], check=True)
+    sieve_dirs = ['/etc/dovecot/freedombox-sieve-after/',
+                  '/etc/dovecot/freedombox-sieve']
+    for sieve_dir in sieve_dirs:
+        subprocess.run(['sievec', sieve_dir], check=True)
 
 
 def _setup_rspamd():

plinth/modules/firewall/__init__.py

@@ -49,7 +49,7 @@ class FirewallApp(app_module.App):
 
     app_id = 'firewall'
 
-    _version = 4
+    _version = 5
 
     can_be_disabled = False
 

plinth/modules/firewall/privileged.py

@@ -111,7 +111,7 @@ def _setup_local_service_protection():
     for permanent in [[], ['--permanent']]:
         for ip_type in ['ipv4', 'ipv6']:
             for owner_type in ['--uid-owner', '--gid-owner']:
-                for user_group in ['root', 'www-data']:
+                for user_group in ['root', 'www-data', 'mail']:
                     _add_rule(permanent, ip_type, '-A', 'OUTPUT', '-m',
                               'owner', owner_type, user_group, '-j', 'MARK',
                               '--or-mark', '0x800000')