Public folders for users to identify spam

Question

It looks like it should work, but ...
I have SL server providing IMAP mailboxes for users, and that all works fine.  As it is now, for a user to notify SpamAssassin that it didn't classify a message properly, they have to actively redirect the message to the junkmail or notjunkmail account.  This is a PITA and a) they can't be bothered and b) the email address to which they're to redirect or forward the improperly classified message is subject to errors.
What I'd like is a pair of public mailboxes that they can just drag misclassified messages to, so I set up a public namespace containing two mailboxes, JunkMail and NotJunkMail.  They're visible to all the users I want them to be and the permissions seem right.  The plan is to whip up a launchd job to digest the contents of these mailboxes in the middle of the night, much like the stock sa-learn job.
The problem is that when I try to drag a sample email message from my inbox to the JunkMail foler, I get an error that says <bold>Blah blah blah</bold> The IMAP command "UID COPY" (to Public.JunkMail) failed for the mailbox "wherever I drag from" with server error: Character not allowed in mailbox name '.'.
I've tried changing the 'separator' in the namespaces to bot '/' and '.', with no discernible difference in behavior or message.  I've set all of the mail logging levels to DEBUG to no avail.  I've made the public mail boxes world-writable.  Nothing seems to help, or even change the client-side behavior.
If someone more knowledgeable about dovecot and its IMAP configuration can point me in the right direction, I'd appreciate it greatly.
Thanks,
  - Ted

Answer 1

This is a followup to let people know how I got it to work.
My supposition is that when dovecot evaluates whether a user can write into a folder it does not do a full group membership expansion to determine the user's rights, so making the folders in question writable by the shared 'mailusers' group (that all human mail users are members of) was not adequate.
Instead, I had to add ACLs to the target folders granting explicit rights to each individual user.  My nightly spam-training script uses the approach of stopping the mail server, moving any folders that might contain trainable messages aside, replacing those folders with empty versions of themselves, then restarting the mail server.
I had been using a more elaborate approach that evaluated whether there was anything to process before stopping the mail server, but with the ACL approach that also meant comparing the current group membership with what users had been set on the folders' ACLs.  After I had written the script to do that, I decided the slight increase in efficiency wasn't worth the added complexity - bouncing my mail server in the middle of the night isn't even marginally problematic for my users, but YMMV.  Instead, by just replacing the folders each night with their ACLs generated from the current group membership, membership changes are incorporated within 24 hours, which is good enough for me.
Anyway, this Bash snippet shows the crux of what I'm doing now:
readonly    SP='[:space:]'
readonly    UserList="$(dscl  '/LDAPv3/127.0.0.1' \
    '-read' "/Groups/$UserGroup" 'Member' | sed -En \
    "s!^[$SP]*Member[$SP]*:[$SP]*(.+)[$SP]*\$!\\1!p")"
readonly    ServerStatus="$(serveradmin status mail \
    | sed -En 's!^[^"]*"([^"]+)".*$!\1!p' \
    | tr '[:upper:]' '[:lower:]')"
[[ "$ServerStatus" != 'running' ]] \
    || serveradmin stop mail > /dev/null
for d in "$PublicSpamPath" "$PublicHamPath"
do
    [[ ! -d "$d" ]] || mv "$d" "$d.$ScanSuffix"
    mkdir -m 2755 "$d"
    chgrp "$UserGroup" "$d"
    for n in $UserList
    do
        chmod +ai "$n allow $UserAcls" "$d"
    done
    mkdir -m 2755 "$d/cur" "$d/new" "$d/tmp"
    chgrp "$UserGroup" "$d/cur" "$d/new" "$d/tmp"
done
[[ "$ServerStatus" != 'running' ]] \
    || serveradmin start mail > /dev/null
If this helps, you're welcome.