🚀 go-pugleaf

I have authored a Perl/CGI script that runs setuid (not as root --
so please let's not have the setuid security discussion).  The
script shows varying behaviour from command input (` ... `).  I am
able to create a "test" directory in the working directory with the
correct owner and group, but the cvs checkout performed in the same
fashion creates directories and files owned (user -- group ownership
is controlled by setgid bit) by apache.  The issue is that the cvs
checkout is failing because apache is not a member of the required
group to access the cvs repository.  Because I am not sure if the
behaviour is perl or cvs, I have included both groups in the mail.

Any help or guidance would be greatly appreciated!

Details:

script:
-rwsr-xr-x    1 tux      frasca      11777 Mar 21 14:05 /var/www/cgi- 
                                            bin/update_doxdocs.cgi

working directory:
.:
total 32
drwxrwsrwx    4 tux      frasca       1024 Mar 21 14:06 cvsroot
-rw-r--r--    1 apache   apache        372 Mar 21 14:06 cvs_stderr
-rw-r--r--    1 tux      apache        371 Mar 21 14:06 doxlog
drwxrwsrwx    2 tux      frasca       1024 Mar 20 09:13
                                                otherRepositories
-rw-r--r--    1 tux      frasca      27233 Mar  7 16:30 template.dox

./cvsroot:
total 30
-rw-rw-r--    1 tux      frasca      27188 Mar 21 14:06 config.dox
drwxr-sr-x    3 apache   frasca       1024 Mar 21 14:06 NetCom
drwxr-sr-x    2 tux      frasca       1024 Mar 21 14:06 test

./cvsroot/NetCom:
total 1
drwxr-sr-x    2 apache   frasca       1024 Mar 21 14:06 CVS

./cvsroot/NetCom/CVS:
total 3
-rw-r--r--    1 apache   frasca          0 Mar 21 14:06 Entries
-rw-r--r--    1 apache   frasca          0 Mar 21 14:06 Entries.Log
-rw-r--r--    1 apache   frasca         29 Mar 21 14:06 Repository
-rw-r--r--    1 apache   frasca         19 Mar 21 14:06 Root
-rw-r--r--    1 apache   frasca          9 Mar 21 14:06 Tag

./cvsroot/test:
total 0

./otherRepositories:
total 0
-rw-rw-r--    1 tux      frasca          0 Mar 20 09:13 config.dox


Code snippets:

# this creates cvsroot/test shown above
`mkdir test`;

# this creates cvsroot/NetCom/* and cvs_stderr
`cvs -d /usr/local/$repository checkout -r $status module
                                2> /tmp/doxupdate/cvs_stderr`;


Please include my email, pvoegel@frasca.com, as CC in any response
as I am restricted from joining newsgroups here at my employer.  I
will attempt to check the groups from home, but am in need of the
answer at work.

Thanks!