1 /* Copyright 1988,1990,1993,1994 by Paul Vixie 2 * All rights reserved 3 * 4 * Distribute freely, except: don't remove my name from the source or 5 * documentation (don't take credit for my work), mark your changes (don't 6 * get me blamed for your possible bugs), don't alter or remove this 7 * notice. May be sold if buildable source is provided to buyer. No 8 * warrantee of any kind, express or implied, is included with this 9 * software; use at your own risk, responsibility for damages (if any) to 10 * anyone resulting from the use of this software rests entirely with the 11 * user. 12 * 13 * Send bug reports, bug fixes, enhancements, requests, flames, etc., and 14 * I'll try to keep a version up to date. I can be reached as follows: 15 * Paul Vixie <paul@vix.com> uunet!decwrl!vixie!paul 16 */ 17 18 #if !defined(lint) && !defined(LINT) 19 static const char rcsid[] = 20 "$FreeBSD$"; 21 #endif 22 23 24 #include "cron.h" 25 #include <sys/signal.h> 26 #if defined(sequent) 27 # include <sys/universe.h> 28 #endif 29 #if defined(SYSLOG) 30 # include <syslog.h> 31 #endif 32 #if defined(LOGIN_CAP) 33 # include <login_cap.h> 34 #endif 35 #ifdef PAM 36 # include <security/pam_appl.h> 37 # include <security/openpam.h> 38 #endif 39 40 41 static void child_process(entry *, user *); 42 43 static WAIT_T wait_on_child(PID_T, const char *); 44 45 extern char *environ; 46 47 void 48 do_command(e, u) 49 entry *e; 50 user *u; 51 { 52 pid_t pid; 53 54 Debug(DPROC, ("[%d] do_command(%s, (%s,%d,%d))\n", 55 getpid(), e->cmd, u->name, e->uid, e->gid)) 56 57 /* fork to become asynchronous -- parent process is done immediately, 58 * and continues to run the normal cron code, which means return to 59 * tick(). the child and grandchild don't leave this function, alive. 60 */ 61 switch ((pid = fork())) { 62 case -1: 63 log_it("CRON",getpid(),"error","can't fork"); 64 if (e->flags & INTERVAL) 65 e->lastexit = time(NULL); 66 break; 67 case 0: 68 /* child process */ 69 pidfile_close(pfh); 70 child_process(e, u); 71 Debug(DPROC, ("[%d] child process done, exiting\n", getpid())) 72 _exit(OK_EXIT); 73 break; 74 default: 75 /* parent process */ 76 Debug(DPROC, ("[%d] main process forked child #%d, " 77 "returning to work\n", getpid(), pid)) 78 if (e->flags & INTERVAL) { 79 e->lastexit = 0; 80 e->child = pid; 81 } 82 break; 83 } 84 Debug(DPROC, ("[%d] main process returning to work\n", getpid())) 85 } 86 87 88 static void 89 child_process(e, u) 90 entry *e; 91 user *u; 92 { 93 int stdin_pipe[2], stdout_pipe[2]; 94 register char *input_data; 95 char *usernm, *mailto, *mailfrom; 96 PID_T jobpid, stdinjob, mailpid; 97 register FILE *mail; 98 register int bytes = 1; 99 int status = 0; 100 const char *homedir = NULL; 101 # if defined(LOGIN_CAP) 102 struct passwd *pwd; 103 login_cap_t *lc; 104 # endif 105 106 Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd)) 107 108 /* mark ourselves as different to PS command watchers by upshifting 109 * our program name. This has no effect on some kernels. 110 */ 111 setproctitle("running job"); 112 113 /* discover some useful and important environment settings 114 */ 115 usernm = env_get("LOGNAME", e->envp); 116 mailto = env_get("MAILTO", e->envp); 117 mailfrom = env_get("MAILFROM", e->envp); 118 119 #ifdef PAM 120 /* use PAM to see if the user's account is available, 121 * i.e., not locked or expired or whatever. skip this 122 * for system tasks from /etc/crontab -- they can run 123 * as any user. 124 */ 125 if (strcmp(u->name, SYS_NAME)) { /* not equal */ 126 pam_handle_t *pamh = NULL; 127 int pam_err; 128 struct pam_conv pamc = { 129 .conv = openpam_nullconv, 130 .appdata_ptr = NULL 131 }; 132 133 Debug(DPROC, ("[%d] checking account with PAM\n", getpid())) 134 135 /* u->name keeps crontab owner name while LOGNAME is the name 136 * of user to run command on behalf of. they should be the 137 * same for a task from a per-user crontab. 138 */ 139 if (strcmp(u->name, usernm)) { 140 log_it(usernm, getpid(), "username ambiguity", u->name); 141 exit(ERROR_EXIT); 142 } 143 144 pam_err = pam_start("cron", usernm, &pamc, &pamh); 145 if (pam_err != PAM_SUCCESS) { 146 log_it("CRON", getpid(), "error", "can't start PAM"); 147 exit(ERROR_EXIT); 148 } 149 150 pam_err = pam_acct_mgmt(pamh, PAM_SILENT); 151 /* Expired password shouldn't prevent the job from running. */ 152 if (pam_err != PAM_SUCCESS && pam_err != PAM_NEW_AUTHTOK_REQD) { 153 log_it(usernm, getpid(), "USER", "account unavailable"); 154 exit(ERROR_EXIT); 155 } 156 157 pam_end(pamh, pam_err); 158 } 159 #endif 160 161 #ifdef USE_SIGCHLD 162 /* our parent is watching for our death by catching SIGCHLD. we 163 * do not care to watch for our children's deaths this way -- we 164 * use wait() explicitly. so we have to disable the signal (which 165 * was inherited from the parent). 166 */ 167 (void) signal(SIGCHLD, SIG_DFL); 168 #else 169 /* on system-V systems, we are ignoring SIGCLD. we have to stop 170 * ignoring it now or the wait() in cron_pclose() won't work. 171 * because of this, we have to wait() for our children here, as well. 172 */ 173 (void) signal(SIGCLD, SIG_DFL); 174 #endif /*BSD*/ 175 176 /* create some pipes to talk to our future child 177 */ 178 if (pipe(stdin_pipe) != 0 || pipe(stdout_pipe) != 0) { 179 log_it("CRON", getpid(), "error", "can't pipe"); 180 exit(ERROR_EXIT); 181 } 182 183 /* since we are a forked process, we can diddle the command string 184 * we were passed -- nobody else is going to use it again, right? 185 * 186 * if a % is present in the command, previous characters are the 187 * command, and subsequent characters are the additional input to 188 * the command. Subsequent %'s will be transformed into newlines, 189 * but that happens later. 190 * 191 * If there are escaped %'s, remove the escape character. 192 */ 193 /*local*/{ 194 register int escaped = FALSE; 195 register int ch; 196 register char *p; 197 198 for (input_data = p = e->cmd; (ch = *input_data); 199 input_data++, p++) { 200 if (p != input_data) 201 *p = ch; 202 if (escaped) { 203 if (ch == '%' || ch == '\\') 204 *--p = ch; 205 escaped = FALSE; 206 continue; 207 } 208 if (ch == '\\') { 209 escaped = TRUE; 210 continue; 211 } 212 if (ch == '%') { 213 *input_data++ = '\0'; 214 break; 215 } 216 } 217 *p = '\0'; 218 } 219 220 /* fork again, this time so we can exec the user's command. 221 */ 222 switch (jobpid = fork()) { 223 case -1: 224 log_it("CRON",getpid(),"error","can't fork"); 225 exit(ERROR_EXIT); 226 /*NOTREACHED*/ 227 case 0: 228 Debug(DPROC, ("[%d] grandchild process fork()'ed\n", 229 getpid())) 230 231 if (e->uid == ROOT_UID) 232 Jitter = RootJitter; 233 if (Jitter != 0) { 234 srandom(getpid()); 235 sleep(random() % Jitter); 236 } 237 238 /* write a log message. we've waited this long to do it 239 * because it was not until now that we knew the PID that 240 * the actual user command shell was going to get and the 241 * PID is part of the log message. 242 */ 243 if ((e->flags & DONT_LOG) == 0) { 244 char *x = mkprints((u_char *)e->cmd, strlen(e->cmd)); 245 246 log_it(usernm, getpid(), "CMD", x); 247 free(x); 248 } 249 250 /* that's the last thing we'll log. close the log files. 251 */ 252 #ifdef SYSLOG 253 closelog(); 254 #endif 255 256 /* get new pgrp, void tty, etc. 257 */ 258 (void) setsid(); 259 260 /* close the pipe ends that we won't use. this doesn't affect 261 * the parent, who has to read and write them; it keeps the 262 * kernel from recording us as a potential client TWICE -- 263 * which would keep it from sending SIGPIPE in otherwise 264 * appropriate circumstances. 265 */ 266 close(stdin_pipe[WRITE_PIPE]); 267 close(stdout_pipe[READ_PIPE]); 268 269 /* grandchild process. make std{in,out} be the ends of 270 * pipes opened by our daddy; make stderr go to stdout. 271 */ 272 close(STDIN); dup2(stdin_pipe[READ_PIPE], STDIN); 273 close(STDOUT); dup2(stdout_pipe[WRITE_PIPE], STDOUT); 274 close(STDERR); dup2(STDOUT, STDERR); 275 276 /* close the pipes we just dup'ed. The resources will remain. 277 */ 278 close(stdin_pipe[READ_PIPE]); 279 close(stdout_pipe[WRITE_PIPE]); 280 281 environ = NULL; 282 283 # if defined(LOGIN_CAP) 284 /* Set user's entire context, but note that PATH will 285 * be overridden later 286 */ 287 if ((pwd = getpwnam(usernm)) == NULL) 288 pwd = getpwuid(e->uid); 289 lc = NULL; 290 if (pwd != NULL) { 291 if (pwd->pw_dir != NULL 292 && pwd->pw_dir[0] != '\0') { 293 homedir = strdup(pwd->pw_dir); 294 if (homedir == NULL) { 295 warn("strdup"); 296 _exit(ERROR_EXIT); 297 } 298 } 299 pwd->pw_gid = e->gid; 300 if (e->class != NULL) 301 lc = login_getclass(e->class); 302 } 303 if (pwd && 304 setusercontext(lc, pwd, e->uid, 305 LOGIN_SETALL) == 0) 306 (void) endpwent(); 307 else { 308 /* fall back to the old method */ 309 (void) endpwent(); 310 # endif 311 /* set our directory, uid and gid. Set gid first, 312 * since once we set uid, we've lost root privileges. 313 */ 314 if (setgid(e->gid) != 0) { 315 log_it(usernm, getpid(), 316 "error", "setgid failed"); 317 _exit(ERROR_EXIT); 318 } 319 # if defined(BSD) 320 if (initgroups(usernm, e->gid) != 0) { 321 log_it(usernm, getpid(), 322 "error", "initgroups failed"); 323 _exit(ERROR_EXIT); 324 } 325 # endif 326 if (setlogin(usernm) != 0) { 327 log_it(usernm, getpid(), 328 "error", "setlogin failed"); 329 _exit(ERROR_EXIT); 330 } 331 if (setuid(e->uid) != 0) { 332 log_it(usernm, getpid(), 333 "error", "setuid failed"); 334 _exit(ERROR_EXIT); 335 } 336 /* we aren't root after this..*/ 337 #if defined(LOGIN_CAP) 338 } 339 if (lc != NULL) 340 login_close(lc); 341 #endif 342 343 /* For compatibility, we chdir to the value of HOME if it was 344 * specified explicitly in the crontab file, but not if it was 345 * set in the environment by some other mechanism. We chdir to 346 * the homedir given by the pw entry otherwise. 347 * 348 * If !LOGIN_CAP, then HOME is always set in e->envp. 349 * 350 * XXX: probably should also consult PAM. 351 */ 352 { 353 char *new_home = env_get("HOME", e->envp); 354 if (new_home != NULL && new_home[0] != '\0') 355 chdir(new_home); 356 else if (homedir != NULL) 357 chdir(homedir); 358 else 359 chdir("/"); 360 } 361 362 /* exec the command. Note that SHELL is not respected from 363 * either login.conf or pw_shell, only an explicit setting 364 * in the crontab. (default of _PATH_BSHELL is supplied when 365 * setting up the entry) 366 */ 367 { 368 char *shell = env_get("SHELL", e->envp); 369 char **p; 370 371 /* Apply the environment from the entry, overriding 372 * existing values (this will always set LOGNAME and 373 * SHELL). putenv should not fail unless malloc does. 374 */ 375 for (p = e->envp; *p; ++p) { 376 if (putenv(*p) != 0) { 377 warn("putenv"); 378 _exit(ERROR_EXIT); 379 } 380 } 381 382 /* HOME in login.conf overrides pw, and HOME in the 383 * crontab overrides both. So set pw's value only if 384 * nothing was already set (overwrite==0). 385 */ 386 if (homedir != NULL 387 && setenv("HOME", homedir, 0) < 0) { 388 warn("setenv(HOME)"); 389 _exit(ERROR_EXIT); 390 } 391 392 /* PATH in login.conf is respected, but the crontab 393 * overrides; set a default value only if nothing 394 * already set. 395 */ 396 if (setenv("PATH", _PATH_DEFPATH, 0) < 0) { 397 warn("setenv(PATH)"); 398 _exit(ERROR_EXIT); 399 } 400 401 # if DEBUGGING 402 if (DebugFlags & DTEST) { 403 fprintf(stderr, 404 "debug DTEST is on, not exec'ing command.\n"); 405 fprintf(stderr, 406 "\tcmd='%s' shell='%s'\n", e->cmd, shell); 407 _exit(OK_EXIT); 408 } 409 # endif /*DEBUGGING*/ 410 execl(shell, shell, "-c", e->cmd, (char *)NULL); 411 warn("execl: couldn't exec `%s'", shell); 412 _exit(ERROR_EXIT); 413 } 414 break; 415 default: 416 /* parent process */ 417 break; 418 } 419 420 /* middle process, child of original cron, parent of process running 421 * the user's command. 422 */ 423 424 Debug(DPROC, ("[%d] child continues, closing pipes\n", getpid())) 425 426 /* close the ends of the pipe that will only be referenced in the 427 * grandchild process... 428 */ 429 close(stdin_pipe[READ_PIPE]); 430 close(stdout_pipe[WRITE_PIPE]); 431 432 /* 433 * write, to the pipe connected to child's stdin, any input specified 434 * after a % in the crontab entry. while we copy, convert any 435 * additional %'s to newlines. when done, if some characters were 436 * written and the last one wasn't a newline, write a newline. 437 * 438 * Note that if the input data won't fit into one pipe buffer (2K 439 * or 4K on most BSD systems), and the child doesn't read its stdin, 440 * we would block here. thus we must fork again. 441 */ 442 443 if (*input_data && (stdinjob = fork()) == 0) { 444 register FILE *out = fdopen(stdin_pipe[WRITE_PIPE], "w"); 445 register int need_newline = FALSE; 446 register int escaped = FALSE; 447 register int ch; 448 449 if (out == NULL) { 450 warn("fdopen failed in child2"); 451 _exit(ERROR_EXIT); 452 } 453 454 Debug(DPROC, ("[%d] child2 sending data to grandchild\n", getpid())) 455 456 /* close the pipe we don't use, since we inherited it and 457 * are part of its reference count now. 458 */ 459 close(stdout_pipe[READ_PIPE]); 460 461 /* translation: 462 * \% -> % 463 * % -> \n 464 * \x -> \x for all x != % 465 */ 466 while ((ch = *input_data++)) { 467 if (escaped) { 468 if (ch != '%') 469 putc('\\', out); 470 } else { 471 if (ch == '%') 472 ch = '\n'; 473 } 474 475 if (!(escaped = (ch == '\\'))) { 476 putc(ch, out); 477 need_newline = (ch != '\n'); 478 } 479 } 480 if (escaped) 481 putc('\\', out); 482 if (need_newline) 483 putc('\n', out); 484 485 /* close the pipe, causing an EOF condition. fclose causes 486 * stdin_pipe[WRITE_PIPE] to be closed, too. 487 */ 488 fclose(out); 489 490 Debug(DPROC, ("[%d] child2 done sending to grandchild\n", getpid())) 491 exit(0); 492 } 493 494 /* close the pipe to the grandkiddie's stdin, since its wicked uncle 495 * ernie back there has it open and will close it when he's done. 496 */ 497 close(stdin_pipe[WRITE_PIPE]); 498 499 /* 500 * read output from the grandchild. it's stderr has been redirected to 501 * it's stdout, which has been redirected to our pipe. if there is any 502 * output, we'll be mailing it to the user whose crontab this is... 503 * when the grandchild exits, we'll get EOF. 504 */ 505 506 Debug(DPROC, ("[%d] child reading output from grandchild\n", getpid())) 507 508 /*local*/{ 509 register FILE *in = fdopen(stdout_pipe[READ_PIPE], "r"); 510 register int ch; 511 512 if (in == NULL) { 513 warn("fdopen failed in child"); 514 _exit(ERROR_EXIT); 515 } 516 517 mail = NULL; 518 519 ch = getc(in); 520 if (ch != EOF) { 521 Debug(DPROC|DEXT, 522 ("[%d] got data (%x:%c) from grandchild\n", 523 getpid(), ch, ch)) 524 525 /* get name of recipient. this is MAILTO if set to a 526 * valid local username; USER otherwise. 527 */ 528 if (mailto == NULL) { 529 /* MAILTO not present, set to USER, 530 * unless globally overridden. 531 */ 532 if (defmailto) 533 mailto = defmailto; 534 else 535 mailto = usernm; 536 } 537 if (mailto && *mailto == '\0') 538 mailto = NULL; 539 540 /* if we are supposed to be mailing, MAILTO will 541 * be non-NULL. only in this case should we set 542 * up the mail command and subjects and stuff... 543 */ 544 545 if (mailto) { 546 register char **env; 547 auto char mailcmd[MAX_COMMAND]; 548 auto char hostname[MAXHOSTNAMELEN]; 549 550 if (gethostname(hostname, MAXHOSTNAMELEN) == -1) 551 hostname[0] = '\0'; 552 hostname[sizeof(hostname) - 1] = '\0'; 553 (void) snprintf(mailcmd, sizeof(mailcmd), 554 MAILARGS, MAILCMD); 555 if (!(mail = cron_popen(mailcmd, "w", e, &mailpid))) { 556 warn("%s", MAILCMD); 557 (void) _exit(ERROR_EXIT); 558 } 559 if (mailfrom == NULL || *mailfrom == '\0') 560 fprintf(mail, "From: Cron Daemon <%s@%s>\n", 561 usernm, hostname); 562 else 563 fprintf(mail, "From: Cron Daemon <%s>\n", 564 mailfrom); 565 fprintf(mail, "To: %s\n", mailto); 566 fprintf(mail, "Subject: Cron <%s@%s> %s\n", 567 usernm, first_word(hostname, "."), 568 e->cmd); 569 # if defined(MAIL_DATE) 570 fprintf(mail, "Date: %s\n", 571 arpadate(&TargetTime)); 572 # endif /* MAIL_DATE */ 573 for (env = e->envp; *env; env++) 574 fprintf(mail, "X-Cron-Env: <%s>\n", 575 *env); 576 fprintf(mail, "\n"); 577 578 /* this was the first char from the pipe 579 */ 580 putc(ch, mail); 581 } 582 583 /* we have to read the input pipe no matter whether 584 * we mail or not, but obviously we only write to 585 * mail pipe if we ARE mailing. 586 */ 587 588 while (EOF != (ch = getc(in))) { 589 bytes++; 590 if (mail) 591 putc(ch, mail); 592 } 593 } 594 /*if data from grandchild*/ 595 596 Debug(DPROC, ("[%d] got EOF from grandchild\n", getpid())) 597 598 /* also closes stdout_pipe[READ_PIPE] */ 599 fclose(in); 600 } 601 602 /* wait for children to die. 603 */ 604 if (jobpid > 0) { 605 WAIT_T waiter; 606 607 waiter = wait_on_child(jobpid, "grandchild command job"); 608 609 /* If everything went well, and -n was set, _and_ we have mail, 610 * we won't be mailing... so shoot the messenger! 611 */ 612 if (WIFEXITED(waiter) && WEXITSTATUS(waiter) == 0 613 && (e->flags & MAIL_WHEN_ERR) == MAIL_WHEN_ERR 614 && mail) { 615 Debug(DPROC, ("[%d] %s executed successfully, mail suppressed\n", 616 getpid(), "grandchild command job")) 617 kill(mailpid, SIGKILL); 618 (void)fclose(mail); 619 mail = NULL; 620 } 621 622 623 /* only close pipe if we opened it -- i.e., we're 624 * mailing... 625 */ 626 627 if (mail) { 628 Debug(DPROC, ("[%d] closing pipe to mail\n", 629 getpid())) 630 /* Note: the pclose will probably see 631 * the termination of the grandchild 632 * in addition to the mail process, since 633 * it (the grandchild) is likely to exit 634 * after closing its stdout. 635 */ 636 status = cron_pclose(mail); 637 638 /* if there was output and we could not mail it, 639 * log the facts so the poor user can figure out 640 * what's going on. 641 */ 642 if (status) { 643 char buf[MAX_TEMPSTR]; 644 645 snprintf(buf, sizeof(buf), 646 "mailed %d byte%s of output but got status 0x%04x\n", 647 bytes, (bytes==1)?"":"s", 648 status); 649 log_it(usernm, getpid(), "MAIL", buf); 650 } 651 } 652 } 653 654 if (*input_data && stdinjob > 0) 655 wait_on_child(stdinjob, "grandchild stdinjob"); 656 } 657 658 static WAIT_T 659 wait_on_child(PID_T childpid, const char *name) { 660 WAIT_T waiter; 661 PID_T pid; 662 663 Debug(DPROC, ("[%d] waiting for %s (%d) to finish\n", 664 getpid(), name, childpid)) 665 666 #ifdef POSIX 667 while ((pid = waitpid(childpid, &waiter, 0)) < 0 && errno == EINTR) 668 #else 669 while ((pid = wait4(childpid, &waiter, 0, NULL)) < 0 && errno == EINTR) 670 #endif 671 ; 672 673 if (pid < OK) 674 return waiter; 675 676 Debug(DPROC, ("[%d] %s (%d) finished, status=%04x", 677 getpid(), name, pid, WEXITSTATUS(waiter))) 678 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter)) 679 Debug(DPROC, (", dumped core")) 680 Debug(DPROC, ("\n")) 681 682 return waiter; 683 } 684