Greetings,

I run a small mailman site inside my company and had swish-e indexing 
correctly and searchable using swish.cgi for a while, but I believe a 
CentOS upgrade changed something (I believe).  I've been fighting to get 
it working again but without success.  Before I go entirely bald, I'm 
hoping someone here can point me at the obvious (and probably silly) 
thing I'm doing.

I've spent quite a while with My Friend Google and in the archives but 
not found any solution.

The first thing that I get in httpd's error.log is (oursite is really 
the FQDN of the site):

[Tue Jan 10 14:31:33 2012] [error] [client 150.132.88.182] 
/usr/lib/mailman/cgi-bin/swish.cgi aborted: Insecure $ENV{PATH} while 
running setgid at /usr/lib/mailman/cgi-bin/swish.cgi line 2133., 
referer: 
http://oursite/mailman/swish.cgi?query=cgi&submit=Search%21&metaname=swishdefault&sort=swishrank&dr_o=12&dr_s_mon=1&dr_s_day=10&dr_s_year=2012&dr_e_mon=1&dr_e_day=10&dr_e_year=2012

I then went in and added the following in swish.cgi:

$ENV{PATH} = "/usr/local/bin:/bin:/usr/bin";
delete (at)not-real.ENV{ 'IFS', 'CDPATH', 'ENV', 'BASH_ENV' };

which changed the error to:

[Tue Jan 10 14:35:08 2012] [error] [client 150.132.88.182] 
/usr/lib/mailman/cgi-bin/swish.cgi aborted: Insecure dependency in exec 
while running setgid at /usr/lib/mailman/cgi-bin/swish.cgi line 2135., 
referer: 
http://oursite/mailman/swish.cgi?query=cgi&submit=Search%21&metaname=swishdefault&sort=swishrank&dr_o=12&dr_s_mon=1&dr_s_day=10&dr_s_year=2012&dr_e_mon=1&dr_e_day=10&dr_e_year=2012

This is a bit beyond my perl skills, I'm afraid.  The line in question is:

         unless ( exec $self->{prog},  $self->swish_command_array ) {

in this chunk:

     if ( !$pid ) {  # in child
         unless ( exec $self->{prog},  $self->swish_command_array ) {
             warn "Child process Failed to exec '$self->{prog}' Error: $!";
             print "Failed to exec Swish";  # send this message to parent.
             exit;
         }
     } else {
         $self->{pid} = $pid;
     }


The permissions in the appropriate directory are:
# pwd
/usr/lib/mailman/cgi-bin
# ls -l
total 756
-rwxr-sr-x 1 root mailman  12280 Mar 30  2011 admin
-rwxr-sr-x 1 root mailman  12288 Mar 30  2011 admindb
(etc)
-rwxr-sr-x 1 root mailman  12288 Mar 30  2011 subscribe
-rwxr-sr-x 1 root mailman 108564 Jan 10 14:34 swish.cgi

and the mailman cgi scripts are working just fine.

I checked out the latest SVN version of swish.cgi.in and there's no 
change in this code from the latest stable version.

If I run the script as:

SWISH_DEBUG=basic ./swish.cgi >/tmp/outfile

the /tmp/output file looks good.  It points to the correct results.

I'd be grateful if someone can point me in the right direction so I can 
get this working correctly.

Cheers,

David
_______________________________________________
Users mailing list
Users(at)not-real.lists.swish-e.org
http://lists.swish-e.org/listinfo/users