[Mailman-Users] add_members from another script?

[Richard Barrett]

On Friday, August 15, 2003, at 07:51  pm, Bill Goffe wrote:

> I'm running Mailman 2.1.2 on a Debian system, and I'd like to call
> add_members from another script. In my application, users can only get
> to this point via a password, so I'm reasonably sure that they don't
> need address verification that the normal subscription mechanism
> provides. But, when I call add_members from another CGI script, I get
>
> Traceback (most recent call last):
>   File "/usr/local/mailman/bin/remove_members", line 186, in ?
>     main()
>   File "/usr/local/mailman/bin/remove_members", line 161, in main
>     mlist = MailList.MailList(listname)
>   File "/usr/local/mailman/Mailman/MailList.py", line 122, in __init__
>     self.Lock()
>   File "/usr/local/mailman/Mailman/MailList.py", line 155, in Lock
>     self.__lock.lock(timeout)
>   File "/usr/local/mailman/Mailman/LockFile.py", line 243, in lock
>     self.__write()
>   File "/usr/local/mailman/Mailman/LockFile.py", line 422, in __write
>     fp = open(self.__tmpfname, 'w')
> IOError: [Errno 13] Permission denied:
>   '/usr/local/mailman/locks/a.lock.cook.20710.0'
>
> As Mailman and Apache run under different userids, I tried adding
> Mailman's group to Apache's, but I still get similar errors (I tried  
> the
> reverse in case I got it reversed).  Interestingly, if I run Apache
> *itself* as mailman, it works fine, but that seems like an awfully  
> blunt
> mechanism.
>
> I read the FAQ, but didn't see anything. I also spent a lot of time in
> archives, and while this is talked about, it is never really answered.
>

Mailman's own CGI scripts are run via compiled C wrappers that have set  
gid to the mailman group permission and which then execute the  
associated MM CGI script from $prefix/Mailman/Cgi/ directory. These  
wrappers do some security checking before running the script. The  
source of the wrapper is in $build/src/cgi-wrapper.c

You do not necessarily have to copy this approach in all its detail,  
although, if your alternative CGI script is written in Python, it is  
not that difficult to do. But the general principle of doing it this  
way is good. Take a look at the permissions on the wrappers in  
$exec-prefix/cgi-bin/ and the C wrapper source code.

Certainly this is preferable to opening up the permissions of your  
Apache server too far, especially if it is accessible from the internet.

Another approach is to have your script drop stuff to a file where a  
cron script run by the mailman user picks the data up and does the real  
thing. But this puts a lag in response and lacks immediacy. But it can  
be made a bit more hacker proof.

> Thus, I'm most curious if anybody has any suggestions.
>
>          - Bill
>
> --          *------------------------------------------------------*
>          | Bill Goffe                 goffe at oswego.edu          |
>          | Department of Economics    voice: (315) 312-3444     |
>          | SUNY Oswego                fax:   (315) 312-5444     |
>          | 443 Mahar Hall             <wuecon.wustl.edu/~goffe> |
>          | Oswego, NY  13126                                    |
> *--------*------------------------------------------------------ 
> *-----------*
> | "Our products just aren't engineered for security."                   
>      |
> |   -- Brian Valentine, Microsoft Senior VP for Windows Development,    
>      |
> |      "Lead Windows Developer Bugged by Security," Matt Berger,  
> InfoWorld  |
> |      www.infoworld.com/articles/hn/xml/02/09/05/020905hnmssecure.xml  
>      |
> *---------------------------------------------------------------------- 
> -----*
-----------------------------------------------------------------------
Richard Barrett                               http://www.openinfo.co.uk