Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / tips / dot_cgi.mdwn

diff --git a/doc/tips/dot_cgi.mdwn b/doc/tips/dot_cgi.mdwn
index a33c8f385a91377804aaa087a56b00cfabd00d8a..8667fed41f76de8242d3d90ead89f88ba4fdd14c 100644 (file)
--- a/doc/tips/dot_cgi.mdwn
+++ b/doc/tips/dot_cgi.mdwn
@@ -45,6 +45,8 @@ configuration changes should work anywhere.
 
        ErrorDocument 404 /cgi-bin/ikiwiki.cgi
 
+* On Fedora (and RHEL, CentOS, and derivatives) you may need to change CGI mode from `06755` to `755` as suid/sgid bit is prohibited by `suexec`. ([Bug 1341568](https://bugzilla.redhat.com/show_bug.cgi?id=1341658))
+
 ## lighttpd
 
 Here is how to enable cgi on [lighttpd](http://www.lighttpd.net/) and
@@ -82,6 +84,32 @@ made into a startup script in `init.d`. You may also need to make this file writ
 
     chmod a+w /tmp/fcgi.socket
 
+If you have [systemd](https://en.wikipedia.org/wiki/Systemd), you may use a service file like so:
+
+Edit/create a service file (in Debian it would be: `sudo vim /lib/systemd/system/ikiwiki.service`
+
+Content of `ikiwiki.service`:
+
+    [Unit]
+    Description=Ikiwiki fcgi socket wrap
+    After=network.target
+    
+    [Service]
+    Type=simple
+    User=www-data
+    Group=www-data
+    ExecStart=/usr/bin/spawn-fcgi -s /tmp/fcgi.socket -n -- /usr/sbin/fcgiwrap
+    
+    [Install]
+    WantedBy=multi-user.target
+
+Then run:
+
+    # This enables the service at startup
+    sudo systemctl enable ikiwiki.service
+    # This attempts to start the service
+    sudo systemctl start ikiwiki.service
+
 Then you need an nginx config plugged in that wrapper. Here's an
 example virtual host configuration: