diff -ruN mailman-2.1.12-a/configure.in mailman-2.1.12-b/configure.in

--- mailman-2.1.12-a/configure.in	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/configure.in	2009-07-28 12:19:47.000000000 +0200

@@ -249,26 +249,101 @@

 fi

 # new macro for finding group names

-AC_DEFUN([MM_FIND_GROUP_NAME], [

+# returns a comma separated list of quoted group names

+# the list is returned in the same order as specified with any duplicates removed

+# the filter flag must be "yes" or "no", e.g. this is permcheck

+#         "no"  ==> none existing groups are not filtered out

+#         "yes" ==> only those groups that are in the group database are included

+#                   in the list

+AC_DEFUN(MM_FIND_GROUP_LIST, [

 # $1 == variable name

-# $2 == user id to check for

+# $2 == white space separated list of groups to check,

+#       list may contain mix of id's and names

+# $3 == filter, if == 'yes' then remove any non-existing groups

 AC_SUBST($1)

 changequote(,)

 if test -z "$$1"

 then

     cat > conftest.py <

 import grp

-gid = ''

+group_names = []

+seen = {}

+filter = "$3"

+

 for group in "$2".split():

     try:

+        gid = int(group)

+        try:

+            gname = grp.getgrgid(gid)[0]

+        except KeyError:

+            gname = ''

+    except ValueError:

         try:

-            gname = grp.getgrgid(int(group))[0]

-            break

-        except ValueError:

             gname = grp.getgrnam(group)[0]

+        except KeyError:

+            if filter == "yes":

+                gname = ''

+            else:

+                gname = group

+    if gname:

+        if gname not in seen:

+            seen[gname] = 1

+            group_names.append(gname)

+

+if group_names:

+    val = '"' + '", "'.join(group_names) + '"'

+    #val = "'"+val+"'"

+else:

+    val = ''

+

+fp = open("conftest.out", "w")

+fp.write("%s\n" % val)

+fp.close()

+EOF

+    $PYTHON conftest.py

+    $1=`cat conftest.out`

+fi

+changequote([, ])

+rm -f conftest.out conftest.py])

+

+

+# new macro for finding group names

+AC_DEFUN(MM_FIND_GROUP_NAME, [

+# Given a list of tokens, either a name or a number (gid)

+# return the first one in the list that is found in the 

+# group database. The return value is always a name, possibly

+# translated from a gid. If permcheck is "no" then the group

+# database is not checked, instead the first token in the list

+# which is a name is returned (e.g. the default value). If permcheck

+# is no and only gid's are in the list then the null string is returned.

+# $1 == variable name

+# $2 == group id to check for

+# $3 == permcheck, either "yes" or "no"

+AC_SUBST($1)

+changequote(,)

+if test -z "$$1"

+then

+    cat > conftest.py <

+import grp

+gname=''

+if "$3" == "yes":

+    for group in "$2".split():

+        try:

+            try:

+                gname = grp.getgrgid(int(group))[0]

+                break

+            except ValueError:

+                gname = grp.getgrnam(group)[0]

+                break

+        except KeyError:

+            gname = ''

+else:

+    for group in "$2".split():

+        try:

+            int(group)

+        except ValueError:

+            gname = group

             break

-    except KeyError:

-        gname = ''

 fp = open("conftest.out", "w")

 fp.write("%s\n" % gname)

 fp.close()

@@ -282,25 +357,41 @@

 # new macro for finding UIDs

 AC_DEFUN([MM_FIND_USER_NAME], [

+# Given a list of tokens, either a name or a number (uid)

+# return the first one in the list that is found in the 

+# password database. The return value is always a name, possibly

+# translated from a uid. If permcheck is "no" then the password

+# database is not checked, instead the first token in the list

+# which is a name is returned (e.g. the default value). If permcheck

+# is no and only uid's are in the list then the null string is returned.

 # $1 == variable name

 # $2 == user id to check for

+# $3 == permcheck, either "yes" or "no"

 AC_SUBST($1)

 changequote(,)

 if test -z "$$1"

 then

     cat > conftest.py <

 import pwd

-uid = ''

-for user in "$2".split():

-    try:

+uname=''

+if "$3" == "yes":

+    for user in "$2".split():

         try:

-            uname = pwd.getpwuid(int(user))[0]

-            break

+            try:

+                uname = pwd.getpwuid(int(user))[0]

+                break

+            except ValueError:

+                uname = pwd.getpwnam(user)[0]

+                break

+        except KeyError:

+            uname = ''

+else:

+    for user in "$2".split():

+        try:

+            int(user)

         except ValueError:

-            uname = pwd.getpwnam(user)[0]

+            uname = user

             break

-    except KeyError:

-        uname = ''

 fp = open("conftest.out", "w")

 fp.write("%s\n" % uname)

 fp.close()

@@ -326,7 +417,7 @@

 # User `mailman' must exist

 AC_SUBST(MAILMAN_USER)

 AC_MSG_CHECKING(for user name \"$USERNAME\")

-MM_FIND_USER_NAME(MAILMAN_USER, $USERNAME)

+MM_FIND_USER_NAME(MAILMAN_USER, $USERNAME, $with_permcheck)

 if test -z "$MAILMAN_USER"

 then

   if test "$with_permcheck" = "yes"

@@ -357,7 +448,7 @@

 # Target group must exist

 AC_SUBST(MAILMAN_GROUP)

 AC_MSG_CHECKING(for group name \"$GROUPNAME\")

-MM_FIND_GROUP_NAME(MAILMAN_GROUP, $GROUPNAME)

+MM_FIND_GROUP_NAME(MAILMAN_GROUP, $GROUPNAME, $with_permcheck)

 if test -z "$MAILMAN_GROUP"

 then

   if test "$with_permcheck" = "yes"

@@ -380,11 +471,11 @@

 prefix = "$prefixcheck"

 groupname = "$GROUPNAME"

 mailmangroup = "$MAILMAN_GROUP"

-try:

-    mailmangid = grp.getgrnam(mailmangroup)[2]

-except KeyError:

-    mailmangid = -1

 problems = []

+try: mailmangid = grp.getgrnam(mailmangroup)[2]

+except KeyError:

+    problems.append("group doesn't exist: " + mailmangroup)

+    mailmangid = 41

 try: statdata = os.stat(prefix)

 except OSError:

     problems.append("Directory doesn't exist: " + prefix)

@@ -434,7 +525,7 @@

 then

     with_mail_gid="mailman other mail daemon"

 fi

-MM_FIND_GROUP_NAME(MAIL_GROUP, $with_mail_gid)

+MM_FIND_GROUP_LIST(MAIL_GROUP, $with_mail_gid, $with_permcheck)

 if test -z "$MAIL_GROUP"

 then

   if test "$with_permcheck" = "yes"

@@ -461,7 +552,7 @@

     with_cgi_gid="www www-data nobody"

 fi

-MM_FIND_GROUP_NAME(CGI_GROUP, $with_cgi_gid)

+MM_FIND_GROUP_LIST(CGI_GROUP, $with_cgi_gid, $with_permcheck)

 if test -z "$CGI_GROUP"

 then

   if test "$with_permcheck" = "yes"

diff -ruN mailman-2.1.12-a/src/cgi-wrapper.c mailman-2.1.12-b/src/cgi-wrapper.c

--- mailman-2.1.12-a/src/cgi-wrapper.c	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/src/cgi-wrapper.c	2009-07-28 12:19:47.000000000 +0200

@@ -28,11 +28,11 @@

 /* Group name that CGI scripts run as.  See your web server's documentation

  * for details.

  */

-#define LEGAL_PARENT_GROUP CGI_GROUP

+#define LEGAL_PARENT_GROUPS CGI_GROUP

 const char* logident = LOG_IDENT;

 char* script = SCRIPTNAME;

-const char* parentgroup = LEGAL_PARENT_GROUP;

+const char* parentgroups[] = {LEGAL_PARENT_GROUPS};

 int

@@ -42,7 +42,7 @@

         char* fake_argv[3];

         running_as_cgi = 1;

-        check_caller(logident, parentgroup);

+	check_caller(logident, parentgroups, sizeof(parentgroups) / sizeof(parentgroups[0]));

         /* For these CGI programs, we can ignore argc and argv since they

          * don't contain anything useful.  `script' will always be the driver

diff -ruN mailman-2.1.12-a/src/common.c mailman-2.1.12-b/src/common.c

--- mailman-2.1.12-a/src/common.c	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/src/common.c	2009-07-28 12:19:47.000000000 +0200

@@ -117,13 +117,14 @@

 /* Is the parent process allowed to call us?

  */

 void

-check_caller(const char* ident, const char* parentgroup)

+check_caller(const char* ident, const char** parentgroups, size_t numgroups)

 {

         GID_T mygid = getgid();

         struct group *mygroup = getgrgid(mygid);

         char* option;

         char* server;

         char* wrapper;

+	int i;

         if (running_as_cgi) {

                 option = "--with-cgi-gid";

@@ -136,28 +137,46 @@

                 wrapper = "mail";

         }

-        if (!mygroup)

-                fatal(ident, GROUP_NAME_NOT_FOUND,

-                      "Failure to find group name for GID %d.  Mailman\n"

-                      "expected the %s wrapper to be executed as group\n"

-                      "\"%s\", but the system's %s server executed the\n"

-                      "wrapper as GID %d for which the name could not be\n"

-                      "found.  Try adding GID %d to your system as \"%s\",\n"

-                      "or tweak your %s server to run the wrapper as group\n"

-                      "\"%s\".",

-                      mygid, wrapper, parentgroup, server, mygid, mygid,

-                      parentgroup, server, parentgroup);

+  	if (!mygroup)

+		fatal(ident, GROUP_ID_NOT_FOUND,

+		      "Failure to lookup via getgrgid() the group info for group id %d that this Mailman %s wrapper is executing under.\n"

+		      "This is probably due to an incorrectly configured system and is not a Mailman problem",

+		      mygid, wrapper);

+

+	for (i = 0; i < numgroups; i++) {

+		if (strcmp(parentgroups[i], mygroup->gr_name) == 0) break;

+	}

+

+        if (i >= numgroups) {

+		char *groupset = NULL;

+		size_t size = 0;

+

+		for (i = 0; i < numgroups; i++) {

+			size += strlen(parentgroups[i]) + 2;

+		}

+

+		groupset = malloc(size);

+

+		if (groupset) {

+			groupset[0] = 0;

+			for (i = 0; i < numgroups; i++) {

+				strcat(groupset, parentgroups[i]);

+				if (i < numgroups-1) strcat(groupset, ", ");

+			}

+		}

-        if (strcmp(parentgroup, mygroup->gr_name))

                 fatal(ident, GROUP_MISMATCH,

-                      "Group mismatch error.  Mailman expected the %s\n"

-                      "wrapper script to be executed as group \"%s\", but\n"

-                      "the system's %s server executed the %s script as\n"

-                      "group \"%s\".  Try tweaking the %s server to run the\n"

-                      "script as group \"%s\", or re-run configure, \n"

-                      "providing the command line option `%s=%s'.",

-                      wrapper, parentgroup, server, wrapper, mygroup->gr_name,

-                      server, parentgroup, option, mygroup->gr_name);

+		      "Group mismatch error. Mailman expected the %s wrapper script to be\n"

+		      "executed as one of the following groups:\n"

+		      "[%s],\n"

+		      "but the system's %s server executed the %s script as group: \"%s\".\n"

+		      "Try tweaking the %s server to run the script as one of these groups:\n"

+		      "[%s],\n"

+		      "or re-run configure providing the command line option:\n"

+		      "'%s=%s'.",

+		      wrapper, groupset, server, wrapper, mygroup->gr_name,

+		      server, groupset, option, mygroup->gr_name);

+	}

 }

diff -ruN mailman-2.1.12-a/src/common.h mailman-2.1.12-b/src/common.h

--- mailman-2.1.12-a/src/common.h	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/src/common.h	2009-07-28 12:19:47.000000000 +0200

@@ -33,7 +33,7 @@

 #define GID_T GETGROUPS_T

 extern void fatal(const char*, int, char*, ...);

-extern void check_caller(const char*, const char*);

+extern void check_caller(const char* ident, const char**, size_t);

 extern int run_script(const char*, int, char**, char**);

 /* Global variable used as a flag. */

@@ -51,7 +51,7 @@

 #define MAIL_USAGE_ERROR 5

 #define MAIL_ILLEGAL_COMMAND 6

 #define ADDALIAS_USAGE_ERROR 7

-#define GROUP_NAME_NOT_FOUND 8

+#define GROUP_ID_NOT_FOUND 8

 /*

diff -ruN mailman-2.1.12-a/src/mail-wrapper.c mailman-2.1.12-b/src/mail-wrapper.c

--- mailman-2.1.12-a/src/mail-wrapper.c	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/src/mail-wrapper.c	2009-07-28 12:19:47.000000000 +0200

@@ -23,9 +23,9 @@

 /* Group name that your mail programs run as.  See your mail server's

  * documentation for details.

  */

-#define LEGAL_PARENT_GROUP MAIL_GROUP

+#define LEGAL_PARENT_GROUPS MAIL_GROUP

-const char* parentgroup = LEGAL_PARENT_GROUP;

+const char* parentgroups[] = {LEGAL_PARENT_GROUPS};

 const char* logident = "Mailman mail-wrapper";

@@ -74,7 +74,7 @@

                 fatal(logident, MAIL_ILLEGAL_COMMAND,

                       "Illegal command: %s", argv[1]);

-        check_caller(logident, parentgroup);

+        check_caller(logident, parentgroups, sizeof(parentgroups) / sizeof(parentgroups[0]));

         /* If we got here, everything must be OK */

         status = run_script(argv[1], argc, argv, env);

diff -ruN mailman-2.1.12-a/src/Makefile.in mailman-2.1.12-b/src/Makefile.in

--- mailman-2.1.12-a/src/Makefile.in	2009-02-23 22:23:35.000000000 +0100

+++ mailman-2.1.12-b/src/Makefile.in	2009-07-28 12:19:47.000000000 +0200

@@ -49,9 +49,9 @@

 SHELL=		/bin/sh

-MAIL_FLAGS=	-DMAIL_GROUP="\"$(MAIL_GROUP)\""

+MAIL_FLAGS=	-DMAIL_GROUP='$(MAIL_GROUP)'

-CGI_FLAGS=	-DCGI_GROUP="\"$(CGI_GROUP)\""

+CGI_FLAGS=	-DCGI_GROUP='$(CGI_GROUP)'

 HELPFUL=	-DHELPFUL