[Mailman-Users] command listinfo not in docroot (10005)

[Stephen J. Turnbull]

Mark Sapiro writes:
 > On 11/28/2015 08:30 AM, Dave Arndt wrote:

 > > My questions are:
 > > 
 > > 1) Am I taking the right approach in solving this problem?  That is, by
 > > installing under docroot, will it address the Apache suexec problem we're
 > > seeing?

Which docroot?  suEXEC has its own docroot configured, which may be
different from Apache's (or maybe not, the docs are unclear on this).

 > Maybe. See <http://wiki.list.org/DOC/Apache%2BSuexec>
 > 
 > 
 > > 2) If docroot is /var/www/html, do i create the mailman directory
 > > *directly* beneath the /var/www.html folder?  i.e. -
 > > /var/www.html/mailman (that just doesn't seem right...?)

As you say, that just doesn't feel right; usual security models say
keep your executables out of the document tree.  Whoever configured
your suEXEC may have felt the same way.  Also, according to the docs
referenced below, --suexec-docroot defaults to $(DATADIR)/htdocs.  I
suspect your $(DATADIR) is indeed /var/www, and you evidently have the
"root" for Apache itself set to /var/www/html, but if that value was
defaulted for suEXEC, suEXEC may think --suexec-docroot=/var/www/htdocs.

You may also be running into one of the other restrictions, such as
uidmin or gidmin.  Eg, on my Debian system Mailman's uid = gid = 38,
but in suEXEC's default, uidmin = gidmin = 100, so I'd lose.  (In that
case suEXEC's error log is confusing, but that kind of thing happens.)

 > Also, have you looked at all 20 steps under "suEXEC Security Model" at
 > <http://httpd.apache.org/docs/2.4/suexec.html>?

You're right, suEXEC is very difficult software to work with.  You
can't blame that on Mailman, though, and if you got suEXEC from your
distro, you should file a bug with them (probably on the Mailman
package).  If it's locally built by your Information Thuggery
department, they should get the "glory".

BTW, I disagree with Mark's wording on "different security models".  I
would say that the two security models are the same, except for who
keeps the keys to the bus.  Apache expects that suEXEC will be
driving, while Mailman is designed as the designated driver.  (Cue
"Three Stooges" schtick with Larry, Curly, and Moe all trying to get
into the driver's seat simultaneously.)