Hi all.

My /etc/postfix/main.cf contains:
mail_spool_directory = /var/spool/mail/
mail_owner = postfix

My /etc/group contains
mail::12:mail,postfix

And if I run ps aux | grep postfix , the output is:
postfix 9677 0.0 0.4 6876 1780 ? S 15:26 0:00 pickup -l -t fifo -u
root 15594 0.0 0.1 1832 496 pts/0 S+ 15:56 0:00 grep postfix
root 22208 0.0 0.4 6812 1772 ? Ss Aug07 0:00 /usr/libexec/postfix/master
postfix 22211 0.0 0.4 6936 1860 ? S Aug07 0:00 qmgr -l -t fifo -u

I try to send an email to andrea@example.com.
example.com is the domain of my mail server, andrea is a local user.

//////////////////////////////
Case 1: the email is delivered successfully

The permissions I set are:

drwxrwxrwx andrea.mail on /var/spool/mail/andrea
drwx------ andrea.andrea on /var/spool/mail/andrea/cur
drwx------ andrea.andrea on /var/spool/mail/andrea/new
drwxrwxrwx andrea.mail on /var/spool/mail/andrea/tmp

///////////////////////////////////////////////////////

Case 2: the email is NOT delivered successfully. The server's reply is:

Diagnostic-Code: X-Postfix; maildir delivery failed: create maildir file
/var/spool/mail/andrea/tmp/1249933864.P8041.server.example.com: Permission
denied


The permissions in this case are:

drw-rw---- andrea.mail on /var/spool/mail/andrea
drwx------ andrea.andrea on /var/spool/mail/andrea/cur
drwx------ andrea.andrea on /var/spool/mail/andrea/new
drwxrwxrwx andrea.mail on /var/spool/mail/andrea/tmp

///////////////////////////////////////////////////////

To recap, the only difference between the two cases is the permission on
/var/spool/mail/andrea (777 in the case 1, 660 in the case 2).
I don't want to use permission 777, I think is not necessary. I can't understand why 660 is not enough.
I mean, postfix run under the user 'postfix'. The user 'postfix' belongs to the group 'mail'.
Then the directory /var/spool/mail/andrea should be writable by postfix.
So why the case 2 doesn't work? I really can't understand that.

Can you please help me?

Thanks for you time,
Daniele

I think it's the execute permissions that are important here, so 770 or even 700 should be sufficient. Note that mail_owner is irrelevant here, as the local delivery agent delivers using the andrea uid.

execute permission is required to navigate to a directory, hence you need the permissions set so the local delivery agent has access to the directory as Berhanie has advised above (700) - else the delivery agent can't access the directories within the subtree and you get your error.

That is why 660 is not enough (usual disclaimer: I believe anyway).

For comparative purposes: the permissions on my postfix base maildir directory setup are 700 and this works fine.