1 /* Copyright 1988,1990,1993,1994 by Paul Vixie
2 * All rights reserved
3 *
4 * Distribute freely, except: don't remove my name from the source or
5 * documentation (don't take credit for my work), mark your changes (don't
6 * get me blamed for your possible bugs), don't alter or remove this
7 * notice. May be sold if buildable source is provided to buyer. No
8 * warrantee of any kind, express or implied, is included with this
9 * software; use at your own risk, responsibility for damages (if any) to
10 * anyone resulting from the use of this software rests entirely with the
11 * user.
12 *
13 * Send bug reports, bug fixes, enhancements, requests, flames, etc., and
14 * I'll try to keep a version up to date. I can be reached as follows:
15 * Paul Vixie <[email protected]> uunet!decwrl!vixie!paul
16 */
17
18 #if !defined(lint) && !defined(LINT)
19 static const char rcsid[] =
20 "$FreeBSD$";
21 #endif
22
23
24 #include "cron.h"
25 #include <sys/signal.h>
26 #if defined(sequent)
27 # include <sys/universe.h>
28 #endif
29 #if defined(SYSLOG)
30 # include <syslog.h>
31 #endif
32 #if defined(LOGIN_CAP)
33 # include <login_cap.h>
34 #endif
35 #ifdef PAM
36 # include <security/pam_appl.h>
37 # include <security/openpam.h>
38 #endif
39
40
41 static void child_process(entry *, user *),
42 do_univ(user *);
43
44
45 void
do_command(e,u)46 do_command(e, u)
47 entry *e;
48 user *u;
49 {
50 pid_t pid;
51
52 Debug(DPROC, ("[%d] do_command(%s, (%s,%d,%d))\n",
53 getpid(), e->cmd, u->name, e->uid, e->gid))
54
55 /* fork to become asynchronous -- parent process is done immediately,
56 * and continues to run the normal cron code, which means return to
57 * tick(). the child and grandchild don't leave this function, alive.
58 *
59 * vfork() is unsuitable, since we have much to do, and the parent
60 * needs to be able to run off and fork other processes.
61 */
62 switch ((pid = fork())) {
63 case -1:
64 log_it("CRON",getpid(),"error","can't fork");
65 if (e->flags & INTERVAL)
66 e->lastexit = time(NULL);
67 break;
68 case 0:
69 /* child process */
70 pidfile_close(pfh);
71 child_process(e, u);
72 Debug(DPROC, ("[%d] child process done, exiting\n", getpid()))
73 _exit(OK_EXIT);
74 break;
75 default:
76 /* parent process */
77 Debug(DPROC, ("[%d] main process forked child #%d, "
78 "returning to work\n", getpid(), pid))
79 if (e->flags & INTERVAL) {
80 e->lastexit = 0;
81 e->child = pid;
82 }
83 break;
84 }
85 Debug(DPROC, ("[%d] main process returning to work\n", getpid()))
86 }
87
88
89 static void
child_process(e,u)90 child_process(e, u)
91 entry *e;
92 user *u;
93 {
94 int stdin_pipe[2], stdout_pipe[2];
95 register char *input_data;
96 char *usernm, *mailto, *mailfrom;
97 int children = 0;
98 # if defined(LOGIN_CAP)
99 struct passwd *pwd;
100 login_cap_t *lc;
101 # endif
102
103 Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd))
104
105 /* mark ourselves as different to PS command watchers by upshifting
106 * our program name. This has no effect on some kernels.
107 */
108 setproctitle("running job");
109
110 /* discover some useful and important environment settings
111 */
112 usernm = env_get("LOGNAME", e->envp);
113 mailto = env_get("MAILTO", e->envp);
114 mailfrom = env_get("MAILFROM", e->envp);
115
116 #ifdef PAM
117 /* use PAM to see if the user's account is available,
118 * i.e., not locked or expired or whatever. skip this
119 * for system tasks from /etc/crontab -- they can run
120 * as any user.
121 */
122 if (strcmp(u->name, SYS_NAME)) { /* not equal */
123 pam_handle_t *pamh = NULL;
124 int pam_err;
125 struct pam_conv pamc = {
126 .conv = openpam_nullconv,
127 .appdata_ptr = NULL
128 };
129
130 Debug(DPROC, ("[%d] checking account with PAM\n", getpid()))
131
132 /* u->name keeps crontab owner name while LOGNAME is the name
133 * of user to run command on behalf of. they should be the
134 * same for a task from a per-user crontab.
135 */
136 if (strcmp(u->name, usernm)) {
137 log_it(usernm, getpid(), "username ambiguity", u->name);
138 exit(ERROR_EXIT);
139 }
140
141 pam_err = pam_start("cron", usernm, &pamc, &pamh);
142 if (pam_err != PAM_SUCCESS) {
143 log_it("CRON", getpid(), "error", "can't start PAM");
144 exit(ERROR_EXIT);
145 }
146
147 pam_err = pam_acct_mgmt(pamh, PAM_SILENT);
148 /* Expired password shouldn't prevent the job from running. */
149 if (pam_err != PAM_SUCCESS && pam_err != PAM_NEW_AUTHTOK_REQD) {
150 log_it(usernm, getpid(), "USER", "account unavailable");
151 exit(ERROR_EXIT);
152 }
153
154 pam_end(pamh, pam_err);
155 }
156 #endif
157
158 #ifdef USE_SIGCHLD
159 /* our parent is watching for our death by catching SIGCHLD. we
160 * do not care to watch for our children's deaths this way -- we
161 * use wait() explicitly. so we have to disable the signal (which
162 * was inherited from the parent).
163 */
164 (void) signal(SIGCHLD, SIG_DFL);
165 #else
166 /* on system-V systems, we are ignoring SIGCLD. we have to stop
167 * ignoring it now or the wait() in cron_pclose() won't work.
168 * because of this, we have to wait() for our children here, as well.
169 */
170 (void) signal(SIGCLD, SIG_DFL);
171 #endif /*BSD*/
172
173 /* create some pipes to talk to our future child
174 */
175 if (pipe(stdin_pipe) != 0 || pipe(stdout_pipe) != 0) {
176 log_it("CRON", getpid(), "error", "can't pipe");
177 exit(ERROR_EXIT);
178 }
179
180 /* since we are a forked process, we can diddle the command string
181 * we were passed -- nobody else is going to use it again, right?
182 *
183 * if a % is present in the command, previous characters are the
184 * command, and subsequent characters are the additional input to
185 * the command. Subsequent %'s will be transformed into newlines,
186 * but that happens later.
187 *
188 * If there are escaped %'s, remove the escape character.
189 */
190 /*local*/{
191 register int escaped = FALSE;
192 register int ch;
193 register char *p;
194
195 for (input_data = p = e->cmd; (ch = *input_data);
196 input_data++, p++) {
197 if (p != input_data)
198 *p = ch;
199 if (escaped) {
200 if (ch == '%' || ch == '\\')
201 *--p = ch;
202 escaped = FALSE;
203 continue;
204 }
205 if (ch == '\\') {
206 escaped = TRUE;
207 continue;
208 }
209 if (ch == '%') {
210 *input_data++ = '\0';
211 break;
212 }
213 }
214 *p = '\0';
215 }
216
217 /* fork again, this time so we can exec the user's command.
218 */
219 switch (vfork()) {
220 case -1:
221 log_it("CRON",getpid(),"error","can't vfork");
222 exit(ERROR_EXIT);
223 /*NOTREACHED*/
224 case 0:
225 Debug(DPROC, ("[%d] grandchild process Vfork()'ed\n",
226 getpid()))
227
228 if (e->uid == ROOT_UID)
229 Jitter = RootJitter;
230 if (Jitter != 0) {
231 srandom(getpid());
232 sleep(random() % Jitter);
233 }
234
235 /* write a log message. we've waited this long to do it
236 * because it was not until now that we knew the PID that
237 * the actual user command shell was going to get and the
238 * PID is part of the log message.
239 */
240 /*local*/{
241 char *x = mkprints((u_char *)e->cmd, strlen(e->cmd));
242
243 log_it(usernm, getpid(), "CMD", x);
244 free(x);
245 }
246
247 /* that's the last thing we'll log. close the log files.
248 */
249 #ifdef SYSLOG
250 closelog();
251 #endif
252
253 /* get new pgrp, void tty, etc.
254 */
255 (void) setsid();
256
257 /* close the pipe ends that we won't use. this doesn't affect
258 * the parent, who has to read and write them; it keeps the
259 * kernel from recording us as a potential client TWICE --
260 * which would keep it from sending SIGPIPE in otherwise
261 * appropriate circumstances.
262 */
263 close(stdin_pipe[WRITE_PIPE]);
264 close(stdout_pipe[READ_PIPE]);
265
266 /* grandchild process. make std{in,out} be the ends of
267 * pipes opened by our daddy; make stderr go to stdout.
268 */
269 close(STDIN); dup2(stdin_pipe[READ_PIPE], STDIN);
270 close(STDOUT); dup2(stdout_pipe[WRITE_PIPE], STDOUT);
271 close(STDERR); dup2(STDOUT, STDERR);
272
273 /* close the pipes we just dup'ed. The resources will remain.
274 */
275 close(stdin_pipe[READ_PIPE]);
276 close(stdout_pipe[WRITE_PIPE]);
277
278 /* set our login universe. Do this in the grandchild
279 * so that the child can invoke /usr/lib/sendmail
280 * without surprises.
281 */
282 do_univ(u);
283
284 # if defined(LOGIN_CAP)
285 /* Set user's entire context, but skip the environment
286 * as cron provides a separate interface for this
287 */
288 if ((pwd = getpwnam(usernm)) == NULL)
289 pwd = getpwuid(e->uid);
290 lc = NULL;
291 if (pwd != NULL) {
292 pwd->pw_gid = e->gid;
293 if (e->class != NULL)
294 lc = login_getclass(e->class);
295 }
296 if (pwd &&
297 setusercontext(lc, pwd, e->uid,
298 LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETENV)) == 0)
299 (void) endpwent();
300 else {
301 /* fall back to the old method */
302 (void) endpwent();
303 # endif
304 /* set our directory, uid and gid. Set gid first,
305 * since once we set uid, we've lost root privileges.
306 */
307 if (setgid(e->gid) != 0) {
308 log_it(usernm, getpid(),
309 "error", "setgid failed");
310 exit(ERROR_EXIT);
311 }
312 # if defined(BSD)
313 if (initgroups(usernm, e->gid) != 0) {
314 log_it(usernm, getpid(),
315 "error", "initgroups failed");
316 exit(ERROR_EXIT);
317 }
318 # endif
319 if (setlogin(usernm) != 0) {
320 log_it(usernm, getpid(),
321 "error", "setlogin failed");
322 exit(ERROR_EXIT);
323 }
324 if (setuid(e->uid) != 0) {
325 log_it(usernm, getpid(),
326 "error", "setuid failed");
327 exit(ERROR_EXIT);
328 }
329 /* we aren't root after this..*/
330 #if defined(LOGIN_CAP)
331 }
332 if (lc != NULL)
333 login_close(lc);
334 #endif
335 chdir(env_get("HOME", e->envp));
336
337 /* exec the command.
338 */
339 {
340 char *shell = env_get("SHELL", e->envp);
341
342 # if DEBUGGING
343 if (DebugFlags & DTEST) {
344 fprintf(stderr,
345 "debug DTEST is on, not exec'ing command.\n");
346 fprintf(stderr,
347 "\tcmd='%s' shell='%s'\n", e->cmd, shell);
348 _exit(OK_EXIT);
349 }
350 # endif /*DEBUGGING*/
351 execle(shell, shell, "-c", e->cmd, (char *)NULL,
352 e->envp);
353 warn("execle: couldn't exec `%s'", shell);
354 _exit(ERROR_EXIT);
355 }
356 break;
357 default:
358 /* parent process */
359 break;
360 }
361
362 children++;
363
364 /* middle process, child of original cron, parent of process running
365 * the user's command.
366 */
367
368 Debug(DPROC, ("[%d] child continues, closing pipes\n", getpid()))
369
370 /* close the ends of the pipe that will only be referenced in the
371 * grandchild process...
372 */
373 close(stdin_pipe[READ_PIPE]);
374 close(stdout_pipe[WRITE_PIPE]);
375
376 /*
377 * write, to the pipe connected to child's stdin, any input specified
378 * after a % in the crontab entry. while we copy, convert any
379 * additional %'s to newlines. when done, if some characters were
380 * written and the last one wasn't a newline, write a newline.
381 *
382 * Note that if the input data won't fit into one pipe buffer (2K
383 * or 4K on most BSD systems), and the child doesn't read its stdin,
384 * we would block here. thus we must fork again.
385 */
386
387 if (*input_data && fork() == 0) {
388 register FILE *out = fdopen(stdin_pipe[WRITE_PIPE], "w");
389 register int need_newline = FALSE;
390 register int escaped = FALSE;
391 register int ch;
392
393 if (out == NULL) {
394 warn("fdopen failed in child2");
395 _exit(ERROR_EXIT);
396 }
397
398 Debug(DPROC, ("[%d] child2 sending data to grandchild\n", getpid()))
399
400 /* close the pipe we don't use, since we inherited it and
401 * are part of its reference count now.
402 */
403 close(stdout_pipe[READ_PIPE]);
404
405 /* translation:
406 * \% -> %
407 * % -> \n
408 * \x -> \x for all x != %
409 */
410 while ((ch = *input_data++)) {
411 if (escaped) {
412 if (ch != '%')
413 putc('\\', out);
414 } else {
415 if (ch == '%')
416 ch = '\n';
417 }
418
419 if (!(escaped = (ch == '\\'))) {
420 putc(ch, out);
421 need_newline = (ch != '\n');
422 }
423 }
424 if (escaped)
425 putc('\\', out);
426 if (need_newline)
427 putc('\n', out);
428
429 /* close the pipe, causing an EOF condition. fclose causes
430 * stdin_pipe[WRITE_PIPE] to be closed, too.
431 */
432 fclose(out);
433
434 Debug(DPROC, ("[%d] child2 done sending to grandchild\n", getpid()))
435 exit(0);
436 }
437
438 /* close the pipe to the grandkiddie's stdin, since its wicked uncle
439 * ernie back there has it open and will close it when he's done.
440 */
441 close(stdin_pipe[WRITE_PIPE]);
442
443 children++;
444
445 /*
446 * read output from the grandchild. it's stderr has been redirected to
447 * it's stdout, which has been redirected to our pipe. if there is any
448 * output, we'll be mailing it to the user whose crontab this is...
449 * when the grandchild exits, we'll get EOF.
450 */
451
452 Debug(DPROC, ("[%d] child reading output from grandchild\n", getpid()))
453
454 /*local*/{
455 register FILE *in = fdopen(stdout_pipe[READ_PIPE], "r");
456 register int ch;
457
458 if (in == NULL) {
459 warn("fdopen failed in child");
460 _exit(ERROR_EXIT);
461 }
462
463 ch = getc(in);
464 if (ch != EOF) {
465 register FILE *mail;
466 register int bytes = 1;
467 int status = 0;
468
469 Debug(DPROC|DEXT,
470 ("[%d] got data (%x:%c) from grandchild\n",
471 getpid(), ch, ch))
472
473 /* get name of recipient. this is MAILTO if set to a
474 * valid local username; USER otherwise.
475 */
476 if (mailto == NULL) {
477 /* MAILTO not present, set to USER,
478 * unless globally overriden.
479 */
480 if (defmailto)
481 mailto = defmailto;
482 else
483 mailto = usernm;
484 }
485 if (mailto && *mailto == '\0')
486 mailto = NULL;
487
488 /* if we are supposed to be mailing, MAILTO will
489 * be non-NULL. only in this case should we set
490 * up the mail command and subjects and stuff...
491 */
492
493 if (mailto) {
494 register char **env;
495 auto char mailcmd[MAX_COMMAND];
496 auto char hostname[MAXHOSTNAMELEN];
497
498 if (gethostname(hostname, MAXHOSTNAMELEN) == -1)
499 hostname[0] = '\0';
500 hostname[sizeof(hostname) - 1] = '\0';
501 (void) snprintf(mailcmd, sizeof(mailcmd),
502 MAILARGS, MAILCMD);
503 if (!(mail = cron_popen(mailcmd, "w", e))) {
504 warn("%s", MAILCMD);
505 (void) _exit(ERROR_EXIT);
506 }
507 if (mailfrom == NULL || *mailfrom == '\0')
508 fprintf(mail, "From: Cron Daemon <%s@%s>\n",
509 usernm, hostname);
510 else
511 fprintf(mail, "From: Cron Daemon <%s>\n",
512 mailfrom);
513 fprintf(mail, "To: %s\n", mailto);
514 fprintf(mail, "Subject: Cron <%s@%s> %s\n",
515 usernm, first_word(hostname, "."),
516 e->cmd);
517 # if defined(MAIL_DATE)
518 fprintf(mail, "Date: %s\n",
519 arpadate(&TargetTime));
520 # endif /* MAIL_DATE */
521 for (env = e->envp; *env; env++)
522 fprintf(mail, "X-Cron-Env: <%s>\n",
523 *env);
524 fprintf(mail, "\n");
525
526 /* this was the first char from the pipe
527 */
528 putc(ch, mail);
529 }
530
531 /* we have to read the input pipe no matter whether
532 * we mail or not, but obviously we only write to
533 * mail pipe if we ARE mailing.
534 */
535
536 while (EOF != (ch = getc(in))) {
537 bytes++;
538 if (mailto)
539 putc(ch, mail);
540 }
541
542 /* only close pipe if we opened it -- i.e., we're
543 * mailing...
544 */
545
546 if (mailto) {
547 Debug(DPROC, ("[%d] closing pipe to mail\n",
548 getpid()))
549 /* Note: the pclose will probably see
550 * the termination of the grandchild
551 * in addition to the mail process, since
552 * it (the grandchild) is likely to exit
553 * after closing its stdout.
554 */
555 status = cron_pclose(mail);
556 }
557
558 /* if there was output and we could not mail it,
559 * log the facts so the poor user can figure out
560 * what's going on.
561 */
562 if (mailto && status) {
563 char buf[MAX_TEMPSTR];
564
565 snprintf(buf, sizeof(buf),
566 "mailed %d byte%s of output but got status 0x%04x\n",
567 bytes, (bytes==1)?"":"s",
568 status);
569 log_it(usernm, getpid(), "MAIL", buf);
570 }
571
572 } /*if data from grandchild*/
573
574 Debug(DPROC, ("[%d] got EOF from grandchild\n", getpid()))
575
576 fclose(in); /* also closes stdout_pipe[READ_PIPE] */
577 }
578
579 /* wait for children to die.
580 */
581 for (; children > 0; children--)
582 {
583 WAIT_T waiter;
584 PID_T pid;
585
586 Debug(DPROC, ("[%d] waiting for grandchild #%d to finish\n",
587 getpid(), children))
588 pid = wait(&waiter);
589 if (pid < OK) {
590 Debug(DPROC, ("[%d] no more grandchildren--mail written?\n",
591 getpid()))
592 break;
593 }
594 Debug(DPROC, ("[%d] grandchild #%d finished, status=%04x",
595 getpid(), pid, WEXITSTATUS(waiter)))
596 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter))
597 Debug(DPROC, (", dumped core"))
598 Debug(DPROC, ("\n"))
599 }
600 }
601
602
603 static void
do_univ(u)604 do_univ(u)
605 user *u;
606 {
607 #if defined(sequent)
608 /* Dynix (Sequent) hack to put the user associated with
609 * the passed user structure into the ATT universe if
610 * necessary. We have to dig the gecos info out of
611 * the user's password entry to see if the magic
612 * "universe(att)" string is present.
613 */
614
615 struct passwd *p;
616 char *s;
617 int i;
618
619 p = getpwuid(u->uid);
620 (void) endpwent();
621
622 if (p == NULL)
623 return;
624
625 s = p->pw_gecos;
626
627 for (i = 0; i < 4; i++)
628 {
629 if ((s = strchr(s, ',')) == NULL)
630 return;
631 s++;
632 }
633 if (strcmp(s, "universe(att)"))
634 return;
635
636 (void) universe(U_ATT);
637 #endif
638 }
639