Question

I find a few ci: %FILENAME%,v: Permission denied in apaches error.log from time to time.

Test case

The error is not always reproducible, but it occours when the same user edits the same page with short intervals. I was investigating why the revision-numbers didn't increase....

Environment

-- ChristianFrier - 21 Jun 2002

Follow up

I have a similar problem. Can someone look at this, please? I tried the final tip in RcsNonStrictLocking by ColasNahaboo, but didn't work.

Perhaps has something to do with the suid executable?

The error message is:

/usr/bin/ci -l -q -mnone -t-none -d'2002/11/05 14:00:00' -w'guest' /var/lib/twiki/data/Test/TestTopic3.txt 2>&1 1>/dev/null
ci: /var/lib/twiki/data/Test/_1GzZ04D: Permission denied
ci: /var/lib/twiki/data/Test/TestTopic3.txt: can't build working file

I tried to change the permissions of /var/lib/twiki/data/Test, but didn't work (only the first time).

I've also seen this error:

/usr/bin/ci -q -l -m'none' -t-none -w'guest' /var/lib/twiki/data/Test/TestTopic2.txt 2>&1 1>/dev/null
ci: /var/lib/twiki/data/Test/TestTopic2.txt: setuid initial checkin prohibited

Any ideas?

The only thing I've come with is removing the setuid bit from the save CGI and give permissions to the www-data user (in Debian). I wonder if there is a better solution.

By the way, doesn't this belong to the Support web?

-- EstebanManchado - 05 Nov 2002

Moved this topic from the Codev web to the Support web.

-- PeterThoeny - 06 Nov 2002

It sounds like you have the setuid bit on some or all scripts in the bin directory - please do an ls -l to check this. I have not tried this setup, and it would be much easier to just set the TWiki directories and files to be updatable by the www-data user (which is presumably the Apache userid in TWikiOnDebian - see that page for links to known bugs with the .deb package by the way).

If you don't want to use that approach, try taking off the setuid bits and instead using something like cgiwrap or suexec - there are topics on TWiki.org that mention both, though the setup is mainly independent of TWiki. I use suexec on my webhost with TWiki (see DreamhostSetupNotes) and it works fine, with no need for setuid Perl (which is probably a big security hole in any case.

By the way, it would help in future if you created a new support question and just referenced any similar ones - it is very easy for such 'new question in old page' updates to be missed, as mentioned in the SupportGuidelines. I've renamed the page to reflect the latest question.

-- RichardDonkin - 08 Nov 2002

Answer