puppet-postfix

sendmail(1) reads parts of it's configuration from the main.cf file.
When the file is not readable, the command invocation will fail with the
following error:

fatal: open /etc/postfix/main.cf: Permission denied

The parameters read from main.cf are documented here:
http://www.postfix.org/sendmail.1.html