OSError: [Errno 30] Read-only file system problem

[mvl22]

Thank you for your work on getting this working on Python3.

I have been attempting to install it on a new Ubuntu 26.04 server. I have put the install script below, and as you can see I am using the stock Python3 distribution and not doing anything involving virtualenv (as that's rather beyond my knowledge). I am not running a chroot jail.

I am seeing the following error in the Apache log when loading /mailman/admin:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
[----- Mailman Version: 2.2.0 -----]
[----- Traceback ------]
Traceback (most recent call last):
  File "/usr/local/mailman/scripts/driver", line 82, in run_main
    logger = StampedLogger('error',
                           label='admin',
                           manual_reprime=1,
                           nofail=0,
                           immediate=1)
  File "/usr/local/mailman/Mailman/Logging/StampedLogger.py", line 52, in __init__
    Logger.__init__(self, category, nofail, immediate)
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/mailman/Mailman/Logging/Logger.py", line 55, in __init__
    self.__get_f()
    ~~~~~~~~~~~~^^
  File "/usr/local/mailman/Mailman/Logging/Logger.py", line 71, in __get_f
    f = codecs.open(
        self.__filename, 'a+', self.__encoding, 'replace')
  File "<frozen codecs>", line 923, in open
OSError: [Errno 30] Read-only file system: '/usr/local/mailman/logs/error'
[----- Python Information -----]
sys.version     = 3.14.4 (main, Apr  8 2026, 04:02:31) [GCC 15.2.0]
sys.executable  = /usr/bin/python3
sys.prefix      = /usr
sys.exec_prefix = /usr
sys.path        = ['/usr/local/mailman/pythonlib', '/usr/local/mailman', '/usr/local/mailman/scripts', '/usr/local/mailman', '/usr/lib/python314.zip', '/usr/lib/python3.14', '/usr/lib/python3.14/lib-dynload', '/usr/lib/python3.1/site-packages', '/usr/lib/python3.1/dist-packages', '/usr/local/lib/python3.14/dist-packages', '/usr/lib/python3/dist-packages', '/usr/lib/python3.14/dist-packages', '/usr/local/mailman/Mailman']
sys.platform    = linux
[----- Environment Variables -----]
\tHTTPS: on
\tHTTP_HOST: myserver.example.com
\tSERVER_NAME: myserver.example.com
\tSERVER_PORT: 443
\tREMOTE_ADDR: 86.16.53.147
\tDOCUMENT_ROOT: /var/www/html/
\tREQUEST_SCHEME: https
\tREMOTE_PORT: 64846
\tSERVER_PROTOCOL: HTTP/1.1
\tREQUEST_METHOD: GET
\tQUERY_STRING: 
\tREQUEST_URI: /mailman/admin
\tSCRIPT_NAME: /mailman/admin
\tPYTHONPATH: /usr/local/mailman
\tLC_CTYPE: C.UTF-8

I get the same problem on the CPanel fork at HEAD.

The relevant parts of my install script in bash that I have written are as follows - this is as run immediately after a fresh OS install.

# 1 Installation Requirements
apt-get install -y build-essential
gcc --version
apt-get install python3

# 2.1 Add the group and user
groupadd mailman  
useradd -c"GNU Mailman" -s /usr/sbin/nologin --no-create-home -g mailman mailman

# Mailserver
apt-get install -y exim4
usermod -a -G Debian-exim mailman  

# 2.2 Create the directory where the installation will be created
prefix=/usr/local/mailman
mkdir -p $prefix
cd $prefix
chgrp -R mailman .
chmod -R a+rx,g+ws .

# Obtain distribution and unpack to folder
# See: https://github.com/cpanel/mailman2-python3/
apt-get install -y wget
wget -O /tmp/mailman2-python3.tgz https://github.com/jaredmauch/mailman2-python3/archive/refs/heads/main.tar.gz
apt-get install -y tar
cd /tmp/
tar -xvzf /tmp/mailman2-python3.tgz
cd mailman2-python3-main/

# 3 Build and install Mailman
# 3.1 Run configure
# Build, first adding prerequisites
apt-get install -y python3-dnspython python3-pip
chown -R mailman /tmp/mailman2-python3-main/
sudo -H -u mailman bash -c "./configure --with-mail-gid=Debian-exim --with-cgi-gid=www-data --with-mailhost=$hostname --with-urlhost=$hostname"

# 3.2 Make and install
apt-get install -y python3-legacy-cgi
sudo -H -u mailman bash -c 'make'
sudo -H -u mailman bash -c 'make install'

# 4 Check your installation
cd $prefix
sudo -H -u mailman bash -c "bin/check_perms -f"

The bin/check_perms script is showing correct basically permissions:

# sudo -H -u mailman bash -c "bin/check_perms -f"
Warning: Private archive directory is other-executable (o+x).
         This could allow other users on your system to read private archives.
         If you're on a shared multiuser system, you should consult the
         installation manual on how to fix this.
No problems found

Permissions on that logs directory directory are:

# ls -lAF /usr/local/mailman/ | grep logs
drwxrwsr-x  2 mailman mailman 4096 May 10 15:57 logs/

And attempting to write a file succeeds:

sudo -H -u mailman bash -c "touch /usr/local/mailman/logs/error"

Possibly the reference to /usr/local/mailman/logs/ is where the error is thrown rather than the directory the failure is happening in? If I set that directory to 777 permissions, the error continues.

Are you kindly able to provide any pointers?

PS I would be happy to contribute my finalised bash install script to the project once I can get things working and have got it sufficiently generalised.

[thegushi]

This definitely feels like an apparmor thing to me. If you su -m to the mailman user, are you able to touch a file in that directory?

[thegushi]

Can you paste the output of systemctl cat apache2 | grep -E 'ProtectSystem|ReadOnly|PrivateTmp'

[mvl22]

@thegushi Thanks for your thinking on this.

This definitely feels like an apparmor thing to me. If you su -m to the mailman user, are you able to touch a file in that directory?

Yes, that worked:

# su -m mailman bash -c "touch /usr/local/mailman/logs/foo"
# ls -lAF /usr/local/mailman/logs/
total 0
-rw-rw-r-- 1 mailman mailman 0 May 11 10:35 foo

Can you paste the output of systemctl cat apache2 | grep -E 'ProtectSystem|ReadOnly|PrivateTmp'

# systemctl cat apache2 | grep -E 'ProtectSystem|ReadOnly|PrivateTmp'
PrivateTmp=true
ProtectSystem=full

Ah, so this looks like ProtectSystem will be the problem...

full | mount /usr, /boot, /efi, /etc as read-only for invoked processes

Presumably the best thing will be to symlink out the data, which is in fact the original Mailman 2 packaging in earlier Ubuntu. I'll give this a try and report back.

Thanks for realising this may be AppArmor.

[mvl22]

The following has indeed fixed this:

# Move logs to avoid AppArmor restrictions causing "OSError: [Errno 30] Read-only file system: '/usr/local/mailman/logs/error'"
# See also: https://linux-audit.com/systemd/settings/units/protectsystem/
mv /usr/local/mailman/logs /var/log/mailman
ln -s /var/log/mailman /usr/local/mailman/logs

I expect there may be other directories that similarly need moving.

I aim to post a full install script here once things are working.

[thegushi]

But the apache config is outside the scope of this project. Ok to close for the moment?

[thegushi]

I'm closing this, if you have an install script, feel free to push it in in a separate pr.

[mvl22]

I'm closing this, if you have an install script, feel free to push it in in a separate pr.

Yes, I will shortly have a fully-reproducible bash script. If this is considered in scope, could you suggest what file name/path you would prefer?

[jaredmauch]

Anything reasonable except perhaps jaredmauch-stinks.sh

[mvl22]

Yes, I will shortly have a fully-reproducible bash script. If this is considered in scope, could you suggest what file name/path you would prefer?

I have now proposed this as PR #38 in the doc/ directory, alongside the other installer-related items there.