xref: /illumos-gate/usr/src/cmd/cron/cron.c (revision cbea7aca3fd7787405cbdbd93752998f03dfc25f)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2013 Joshua M. Clulow <josh@sysmgr.org>
 *
 * Copyright (c) 2014 Gary Mills
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2022 Sebastian Wiedenroth
 * Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved	*/

/*	Copyright (c) 1987, 1988 Microsoft Corporation	*/
/*	  All Rights Reserved	*/

#include <sys/contract/process.h>
#include <sys/ctfs.h>
#include <sys/param.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/task.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/utsname.h>
#include <sys/wait.h>

#include <security/pam_appl.h>

#include <alloca.h>
#include <ctype.h>
#include <deflt.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <libcontract.h>
#include <libcontract_priv.h>
#include <limits.h>
#include <locale.h>
#include <poll.h>
#include <project.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stropts.h>
#include <time.h>
#include <unistd.h>
#include <libzoneinfo.h>

#include "cron.h"

/*
 * #define	DEBUG
 */

#define	MAIL		"/usr/bin/mail"	/* mail program to use */
#define	CONSOLE		"/dev/console"	/* where messages go when cron dies */

#define	TMPINFILE	"/tmp/crinXXXXXX"  /* file to put stdin in for cmd  */
#define	TMPDIR		"/tmp"
#define	PFX		"crout"
#define	TMPOUTFILE	"/tmp/croutXXXXXX" /* file to place stdout, stderr */

#define	INMODE		00400		/* mode for stdin file	*/
#define	OUTMODE		00600		/* mode for stdout file */
#define	ISUID		S_ISUID		/* mode for verifing at jobs */

#define	INFINITY	2147483647L	/* upper bound on time	*/
#define	CUSHION		180L
#define	ZOMB		100		/* proc slot used for mailing output */

#define	JOBF		'j'
#define	NICEF		'n'
#define	USERF		'u'
#define	WAITF		'w'

#define	BCHAR		'>'
#define	ECHAR		'<'

#define	DEFAULT		0
#define	LOAD		1
#define	QBUFSIZ		80

/* Defined actions for crabort() routine */
#define	NO_ACTION	000
#define	REMOVE_FIFO	001
#define	CONSOLE_MSG	002

#define	BADCD		"can't change directory to the crontab directory."
#define	NOREADDIR	"can't read the crontab directory."

#define	BADJOBOPEN	"unable to read your at job."
#define	BADSHELL	"because your login shell \
isn't /usr/bin/sh, you can't use cron."

#define	BADSTAT		"can't access your crontab or at-job file. Resubmit it."
#define	BADPROJID	"can't set project id for your job."
#define	CANTCDHOME	"can't change directory to %s.\
\nYour commands will not be executed."
#define	CANTEXECSH	"unable to exec the shell, %s, for one of your \
commands."
#define	CANT_STR_LEN (sizeof (CANTEXECSH) > sizeof (CANTCDHOME) ? \
	sizeof (CANTEXECSH) : sizeof (CANTCDHOME))
#define	NOREAD		"can't read your crontab file.  Resubmit it."
#define	BADTYPE		"crontab or at-job file is not a regular file.\n"
#define	NOSTDIN		"unable to create a standard input file for \
one of your crontab commands. \
\nThat command was not executed."

#define	NOTALLOWED	"you are not authorized to use cron.  Sorry."
#define	STDERRMSG	"\n\n********************************************\
*****\nCron: The previous message is the \
standard output and standard error \
\nof one of your cron commands.\n"

#define	STDOUTERR	"one of your commands generated output or errors, \
but cron was unable to mail you this output.\
\nRemember to redirect standard output and standard \
error for each of your commands."

#define	CLOCK_DRIFT	"clock time drifted backwards after event!\n"
#define	PIDERR		"unexpected pid returned %d (ignored)"
#define	CRONTABERR	"Subject: Your crontab file has an error in it\n\n"
#define	MALLOCERR	"out of space, cannot create new string\n"

#define	DIDFORK didfork
#define	NOFORK !didfork

#define	MAILBUFLEN	(8*1024)
#define	LINELIMIT	80
#define	MAILBINITFREE	(MAILBUFLEN - (sizeof (cte_intro) - 1) \
	    - (sizeof (cte_trail1) - 1) - (sizeof (cte_trail2) - 1) - 1)

#define	ERR_CRONTABENT	0	/* error in crontab file entry */
#define	ERR_UNIXERR	1	/* error in some system call */
#define	ERR_CANTEXECCRON 2	/* error setting up "cron" job environment */
#define	ERR_CANTEXECAT	3	/* error setting up "at" job environment */
#define	ERR_NOTREG	4	/* error not a regular file */

#define	PROJECT		"project="

#define	MAX_LOST_CONTRACTS	2048	/* reset if this many failed abandons */

#define	FORMAT	"%a %b %e %H:%M:%S %Y"
static char	timebuf[80];

static struct message msgbuf;

struct shared {
	int count;			/* usage count */
	void (*free)(void *obj);	/* routine that will free obj */
	void *obj;			/* object */
};

struct event {
	time_t time;	/* time of the event	*/
	short etype;	/* what type of event; 0=cron, 1=at	*/
	char *cmd;	/* command for cron, job name for at	*/
	struct usr *u;	/* ptr to the owner (usr) of this event	*/
	struct event *link;	/* ptr to another event for this user */
	union {
		struct { /* for crontab events */
			char *minute;	/*  (these	*/
			char *hour;	/*   fields	*/
			char *daymon;	/*   are	*/
			char *month;	/*   from	*/
			char *dayweek;	/*   crontab)	*/
			char *input;	/* ptr to stdin	*/
			struct shared *tz;	/* timezone of this event */
			struct shared *home;	/* directory for this event */
			struct shared *shell;	/* shell for this event */
			uint32_t max_random_delay;	/* max. random delay */
		} ct;
		struct { /* for at events */
			short exists;	/* for revising at events	*/
			int eventid;	/* for el_remove-ing at events	*/
		} at;
	} of;
};

struct usr {
	char *name;	/* name of user (e.g. "root")	*/
	char *home;	/* home directory for user	*/
	uid_t uid;	/* user id	*/
	gid_t gid;	/* group id	*/
	int aruncnt;	/* counter for running jobs per uid */
	int cruncnt;	/* counter for running cron jobs per uid */
	int ctid;	/* for el_remove-ing crontab events */
	short ctexists;	/* for revising crontab events	*/
	struct event *ctevents;	/* list of this usr's crontab events */
	struct event *atevents;	/* list of this usr's at events */
	struct usr *nextusr;
};	/* ptr to next user	*/

static struct	queue
{
	int njob;	/* limit */
	int nice;	/* nice for execution */
	int nwait;	/* wait time to next execution attempt */
	int nrun;	/* number running */
}
	qd = {100, 2, 60},		/* default values for queue defs */
	qt[NQUEUE];
static struct	queue	qq;

static struct runinfo
{
	pid_t	pid;
	short	que;
	struct  usr *rusr;	/* pointer to usr struct */
	char	*outfile;	/* file where stdout & stderr are trapped */
	short	jobtype;	/* what type of event: 0=cron, 1=at */
	char	*jobname;	/* command for "cron", jobname for "at" */
	int	mailwhendone;	/* 1 = send mail even if no ouptut */
	struct runinfo *next;
}	*rthead;

static struct miscpid {
	pid_t		pid;
	struct miscpid	*next;
}	*miscpid_head;

static pid_t cron_pid;	/* own pid */
static char didfork = 0; /* flag to see if I'm process group leader */
static int msgfd;	/* file descriptor for fifo queue */
static int ecid = 1;	/* event class id for el_remove(); MUST be set to 1 */
static int delayed;	/* is job being rescheduled or did it run first time */
static int cwd;		/* current working directory */
static struct event *next_event;	/* the next event to execute	*/
static struct usr *uhead;		/* ptr to the list of users	*/

/* Variables for error handling at reading crontabs. */
static char cte_intro[] = "Line(s) with errors:\n\n";
static char cte_trail1[] = "\nMax number of errors encountered.";
static char cte_trail2[] = " Evaluation of crontab aborted.\n";
static int cte_free = MAILBINITFREE;	/* Free buffer space */
static char *cte_text = NULL;		/* Text buffer pointer */
static char *cte_lp;			/* Next free line in cte_text */
static int cte_nvalid;			/* Valid lines found */

/* user's default environment for the shell */
#define	ROOTPATH	"PATH=/usr/sbin:/usr/bin"
#define	NONROOTPATH	"PATH=/usr/bin:"

static char *Def_supath	= NULL;
static char *Def_path		= NULL;
static char path[LINE_MAX]	= "PATH=";
static char supath[LINE_MAX]	= "PATH=";
static char homedir[LINE_MAX]	= ENV_HOME;
static char logname[LINE_MAX]	= "LOGNAME=";
static char tzone[LINE_MAX]	= ENV_TZ;
static char *envinit[] = {
	homedir,
	logname,
	ROOTPATH,
	"SHELL=/usr/bin/sh",
	tzone,
	NULL
};

extern char **environ;

#define	DEFTZ		"GMT"
static	int	log = 0;
static	char	hzname[10];

static void cronend(int);
static void thaw_handler(int);
static void child_handler(int);
static void child_sigreset(void);

static void mod_ctab(char *, time_t);
static void mod_atjob(char *, time_t);
static void add_atevent(struct usr *, char *, time_t, int);
static void rm_ctevents(struct usr *);
static void cleanup(struct runinfo *rn, int r);
static void crabort(char *, int);
static void msg(char *fmt, ...);
static void ignore_msg(char *, char *, struct event *);
static void logit(int, struct runinfo *, int);
static void parsqdef(char *);
static void defaults();
static void initialize(int);
static void quedefs(int);
static int idle(long);
static struct usr *find_usr(char *);
static int ex(struct event *e);
static void read_dirs(int);
static void mail(char *, char *, int);
static void readcron(struct usr *, time_t);
static int next_ge(int, char *);
static void free_if_unused(struct usr *);
static void del_atjob(char *, char *);
static void del_ctab(char *);
static void resched(int);
static int msg_wait(long);
static struct runinfo *rinfo_get(pid_t);
static void rinfo_free(struct runinfo *rp);
static void mail_result(struct usr *p, struct runinfo *pr, size_t filesize);
static time_t next_time(struct event *, time_t);
static time_t get_switching_time(int, time_t);
static time_t xmktime(struct tm *);
static void process_msg(struct message *, time_t);
static void reap_child(void);
static void miscpid_insert(pid_t);
static int miscpid_delete(pid_t);
static void contract_set_template(void);
static void contract_clear_template(void);
static void contract_abandon_latest(pid_t);

static void cte_init(void);
static void cte_add(int, char *);
static void cte_valid(void);
static int cte_istoomany(void);
static void cte_sendmail(char *);

static int set_user_cred(const struct usr *, struct project *);

static struct shared *create_shared_str(char *str);
static struct shared *dup_shared(struct shared *obj);
static void rel_shared(struct shared *obj);
static void *get_obj(struct shared *obj);
/*
 * last_time is set immediately prior to exection of an event (via ex())
 * to indicate the last time an event was executed.  This was (surely)
 * it's original intended use.
 */
static time_t last_time, init_time, t_old;
static int reset_needed; /* set to 1 when cron(8) needs to re-initialize */

static int		refresh;
static sigset_t		defmask, sigmask;

/*
 * BSM hooks
 */
extern int	audit_cron_session(char *, char *, uid_t, gid_t, char *);
extern void	audit_cron_new_job(char *, int, void *);
extern void	audit_cron_bad_user(char *);
extern void	audit_cron_user_acct_expired(char *);
extern int	audit_cron_create_anc_file(char *, char *, char *, uid_t);
extern int	audit_cron_delete_anc_file(char *, char *);
extern int	audit_cron_is_anc_name(char *);
extern int	audit_cron_mode();

static int cron_conv(int, const struct pam_message **,
    struct pam_response **, void *);

static struct pam_conv pam_conv = {cron_conv, NULL};
static pam_handle_t *pamh;	/* Authentication handle */

/*
 * Function to help check a user's credentials.
 */

static int verify_user_cred(struct usr *u);

/*
 * Values returned by verify_user_cred and set_user_cred:
 */

#define	VUC_OK		0
#define	VUC_BADUSER	1
#define	VUC_NOTINGROUP	2
#define	VUC_EXPIRED	3
#define	VUC_NEW_AUTH	4

/*
 * Modes of process_anc_files function
 */
#define	CRON_ANC_DELETE	1
#define	CRON_ANC_CREATE	0

/*
 * Functions to remove a user or job completely from the running database.
 */
static void clean_out_atjobs(struct usr *u);
static void clean_out_ctab(struct usr *u);
static void clean_out_user(struct usr *u);
static void cron_unlink(char *name);
static void process_anc_files(int);

/*
 * functions in elm.c
 */
extern void el_init(int, time_t, time_t, int);
extern int el_add(void *, time_t, int);
extern void el_remove(int, int);
extern int el_empty(void);
extern void *el_first(void);
extern void el_delete(void);

static int valid_entry(char *, int);
static struct usr *create_ulist(char *, int);
static void init_cronevent(char *, int);
static void init_atevent(char *, time_t, int, int);
static void update_atevent(struct usr *, char *, time_t, int);

int
main(int argc, char *argv[])
{
	time_t t;
	time_t ne_time;		/* amt of time until next event execution */
	time_t newtime, lastmtime = 0L;
	struct usr *u;
	struct event *e, *e2, *eprev;
	struct stat buf;
	pid_t rfork;
	struct sigaction act;

	/*
	 * reset_needed is set to 1 whenever el_add() finds out that a cron
	 * job is scheduled to be run before the time when cron(8) daemon
	 * initialized.
	 * Other cases where a reset is needed is when ex() finds that the
	 * event to be executed is being run at the wrong time, or when idle()
	 * determines that time was reset.
	 * We immediately return to the top of the while (TRUE) loop in
	 * main() where the event list is cleared and rebuilt, and reset_needed
	 * is set back to 0.
	 */
	reset_needed = 0;

	/*
	 * Only the privileged user can run this command.
	 */
	if (getuid() != 0)
		crabort(NOTALLOWED, 0);

begin:
	(void) setlocale(LC_ALL, "");
	/* fork unless 'nofork' is specified */
	if ((argc <= 1) || (strcmp(argv[1], "nofork"))) {
		if ((rfork = fork()) != 0) {
			if (rfork == (pid_t)-1) {
				(void) sleep(30);
				goto begin;
			}
			return (0);
		}
		didfork++;
		(void) setpgrp();	/* detach cron from console */
	}

	(void) umask(022);
	(void) signal(SIGHUP, SIG_IGN);
	(void) signal(SIGINT, SIG_IGN);
	(void) signal(SIGQUIT, SIG_IGN);
	(void) signal(SIGTERM, cronend);

	defaults();
	initialize(1);
	quedefs(DEFAULT);	/* load default queue definitions */
	cron_pid = getpid();
	msg("*** cron started ***   pid = %d", cron_pid);

	/* setup THAW handler */
	act.sa_handler = thaw_handler;
	act.sa_flags = 0;
	(void) sigemptyset(&act.sa_mask);
	(void) sigaction(SIGTHAW, &act, NULL);

	/* setup CHLD handler */
	act.sa_handler = child_handler;
	act.sa_flags = 0;
	(void) sigemptyset(&act.sa_mask);
	(void) sigaddset(&act.sa_mask, SIGCLD);
	(void) sigaction(SIGCLD, &act, NULL);

	(void) sigemptyset(&defmask);
	(void) sigemptyset(&sigmask);
	(void) sigaddset(&sigmask, SIGCLD);
	(void) sigaddset(&sigmask, SIGTHAW);
	(void) sigprocmask(SIG_BLOCK, &sigmask, NULL);

	t_old = init_time;
	last_time = t_old;
	for (;;) {		/* MAIN LOOP */
		t = time(NULL);
		if ((t_old > t) || (t-last_time > CUSHION) || reset_needed) {
			reset_needed = 0;
			/*
			 * the time was set backwards or forward or
			 * refresh is requested.
			 */
			if (refresh)
				msg("re-scheduling jobs");
			else
				msg("time was reset, re-initializing");
			el_delete();
			u = uhead;
			while (u != NULL) {
				rm_ctevents(u);
				e = u->atevents;
				while (e != NULL) {
					free(e->cmd);
					e2 = e->link;
					free(e);
					e = e2;
				}
				u->atevents = NULL;
				u = u->nextusr;
			}
			(void) close(msgfd);
			initialize(0);
			t = time(NULL);
			last_time = t;
			/*
			 * reset_needed might have been set in the functions
			 * call path from initialize()
			 */
			if (reset_needed) {
				continue;
			}
		}
		t_old = t;

		if (next_event == NULL && !el_empty()) {
			next_event = (struct event *)el_first();
		}
		if (next_event == NULL) {
			ne_time = INFINITY;
		} else {
			ne_time = next_event->time - t;
#ifdef DEBUG
			cftime(timebuf, "%+", &next_event->time);
			(void) fprintf(stderr, "next_time=%ld %s\n",
			    next_event->time, timebuf);
#endif
		}
		if (ne_time > 0) {
			/*
			 * reset_needed may be set in the functions call path
			 * from idle()
			 */
			if (idle(ne_time) || reset_needed) {
				reset_needed = 1;
				continue;
			}
		}

		if (stat(QUEDEFS, &buf)) {
			msg("cannot stat QUEDEFS file");
		} else if (lastmtime != buf.st_mtime) {
			quedefs(LOAD);
			lastmtime = buf.st_mtime;
		}

		last_time = next_event->time; /* save execution time */

		/*
		 * reset_needed may be set in the functions call path
		 * from ex()
		 */
		if (ex(next_event) || reset_needed) {
			reset_needed = 1;
			continue;
		}

		switch (next_event->etype) {
		case CRONEVENT:
			/* add cronevent back into the main event list */
			if (delayed) {
				delayed = 0;
				break;
			}

			/*
			 * check if time(0)< last_time. if so, then the
			 * system clock has gone backwards. to prevent this
			 * job from being started twice, we reschedule this
			 * job for the >>next time after last_time<<, and
			 * then set next_event->time to this. note that
			 * crontab's resolution is 1 minute.
			 */

			if (last_time > time(NULL)) {
				msg(CLOCK_DRIFT);
				/*
				 * bump up to next 30 second
				 * increment
				 * 1 <= newtime <= 30
				 */
				newtime = 30 - (last_time % 30);
				newtime += last_time;

				/*
				 * get the next scheduled event,
				 * not the one that we just
				 * kicked off!
				 */
				next_event->time =
				    next_time(next_event, newtime);
				t_old = time(NULL);
			} else {
				next_event->time =
				    next_time(next_event, (time_t)0);
			}
#ifdef DEBUG
			cftime(timebuf, "%+", &next_event->time);
			(void) fprintf(stderr,
			    "pushing back cron event %s at %ld (%s)\n",
			    next_event->cmd, next_event->time, timebuf);
#endif

			switch (el_add(next_event, next_event->time,
			    (next_event->u)->ctid)) {
			case -1:
				ignore_msg("main", "cron", next_event);
				break;
			case -2: /* event time lower than init time */
				reset_needed = 1;
				break;
			}
			break;
		default:
			/* remove at or batch job from system */
			if (delayed) {
				delayed = 0;
				break;
			}
			eprev = NULL;
			e = (next_event->u)->atevents;
			while (e != NULL) {
				if (e == next_event) {
					if (eprev == NULL)
						(e->u)->atevents = e->link;
					else
						eprev->link = e->link;
					free(e->cmd);
					free(e);
					break;
				} else {
					eprev = e;
					e = e->link;
				}
			}
			break;
		}
		next_event = NULL;
	}

	/*NOTREACHED*/
}

static void
initialize(int firstpass)
{
#ifdef DEBUG
	(void) fprintf(stderr, "in initialize\n");
#endif
	if (firstpass) {
		/* for mail(1), make sure messages come from root */
		if (putenv("LOGNAME=root") != 0) {
			crabort("cannot expand env variable",
			    REMOVE_FIFO|CONSOLE_MSG);
		}
		if (access(FIFO, R_OK) == -1) {
			if (errno == ENOENT) {
				if (mknod(FIFO, S_IFIFO|0600, 0) != 0)
					crabort("cannot create fifo queue",
					    REMOVE_FIFO|CONSOLE_MSG);
			} else {
				if (NOFORK) {
					/* didn't fork... init(8) is waiting */
					(void) sleep(60);
				}
				perror("FIFO");
				crabort("cannot access fifo queue",
				    REMOVE_FIFO|CONSOLE_MSG);
			}
		} else {
			if (NOFORK) {
				/* didn't fork... init(8) is waiting */
				(void) sleep(60);
				/*
				 * the wait is painful, but we don't want
				 * init respawning this quickly
				 */
			}
			crabort("cannot start cron; FIFO exists", CONSOLE_MSG);
		}
	}

	if ((msgfd = open(FIFO, O_RDWR)) < 0) {
		perror("! open");
		crabort("cannot open fifo queue", REMOVE_FIFO|CONSOLE_MSG);
	}

	init_time = time(NULL);
	el_init(8, init_time, (time_t)(60*60*24), 10);

	init_time = time(NULL);
	el_init(8, init_time, (time_t)(60*60*24), 10);

	/*
	 * read directories, create users list, and add events to the
	 * main event list. Only zero user list on firstpass.
	 */
	if (firstpass)
		uhead = NULL;
	read_dirs(firstpass);
	next_event = NULL;

	if (!firstpass)
		return;

	/* stdout is log file */
	if (freopen(ACCTFILE, "a", stdout) == NULL)
		(void) fprintf(stderr, "cannot open %s\n", ACCTFILE);

	/* log should be root-only */
	(void) fchmod(1, S_IRUSR|S_IWUSR);

	/* stderr also goes to ACCTFILE */
	(void) close(fileno(stderr));
	(void) dup(1);
	/* null for stdin */
	(void) freopen("/dev/null", "r", stdin);

	contract_set_template();
}

static void
read_dirs(int first)
{
	DIR		*dir;
	struct dirent	*dp;
	char		*ptr;
	int		jobtype;
	time_t		tim;


	if (chdir(CRONDIR) == -1)
		crabort(BADCD, REMOVE_FIFO|CONSOLE_MSG);
	cwd = CRON;
	if ((dir = opendir(".")) == NULL)
		crabort(NOREADDIR, REMOVE_FIFO|CONSOLE_MSG);
	while ((dp = readdir(dir)) != NULL) {
		if (!valid_entry(dp->d_name, CRONEVENT))
			continue;
		init_cronevent(dp->d_name, first);
	}
	(void) closedir(dir);

	if (chdir(ATDIR) == -1) {
		msg("cannot chdir to at directory");
		return;
	}
	if ((dir = opendir(".")) == NULL) {
		msg("cannot read at at directory");
		return;
	}
	cwd = AT;
	while ((dp = readdir(dir)) != NULL) {
		if (!valid_entry(dp->d_name, ATEVENT))
			continue;
		ptr = dp->d_name;
		if (((tim = num(&ptr)) == 0) || (*ptr != '.'))
			continue;
		ptr++;
		if (!isalpha(*ptr))
			continue;
		jobtype = *ptr - 'a';
		if (jobtype >= NQUEUE) {
			cron_unlink(dp->d_name);
			continue;
		}
		init_atevent(dp->d_name, tim, jobtype, first);
	}
	(void) closedir(dir);
}

static int
valid_entry(char *name, int type)
{
	struct stat	buf;

	if (strcmp(name, ".") == 0 ||
	    strcmp(name, "..") == 0)
		return (0);

	/* skip over ancillary file names */
	if (audit_cron_is_anc_name(name))
		return (0);

	if (stat(name, &buf)) {
		mail(name, BADSTAT, ERR_UNIXERR);
		cron_unlink(name);
		return (0);
	}
	if (!S_ISREG(buf.st_mode)) {
		mail(name, BADTYPE, ERR_NOTREG);
		cron_unlink(name);
		return (0);
	}
	if (type == ATEVENT) {
		if (!(buf.st_mode & ISUID)) {
			cron_unlink(name);
			return (0);
		}
	}
	return (1);
}

struct usr *
create_ulist(char *name, int type)
{
	struct usr	*u;

	u = xcalloc(1, sizeof (struct usr));
	u->name = xstrdup(name);
	if (type == CRONEVENT) {
		u->ctexists = TRUE;
		u->ctid = ecid++;
	} else {
		u->ctexists = FALSE;
		u->ctid = 0;
	}
	u->uid = (uid_t)-1;
	u->gid = (uid_t)-1;
	u->nextusr = uhead;
	uhead = u;
	return (u);
}

void
init_cronevent(char *name, int first)
{
	struct usr	*u;

	if (first) {
		u = create_ulist(name, CRONEVENT);
		readcron(u, 0);
	} else {
		if ((u = find_usr(name)) == NULL) {
			u = create_ulist(name, CRONEVENT);
			readcron(u, 0);
		} else {
			u->ctexists = TRUE;
			rm_ctevents(u);
			el_remove(u->ctid, 0);
			readcron(u, 0);
		}
	}
}

void
init_atevent(char *name, time_t tim, int jobtype, int first)
{
	struct usr	*u;

	if (first) {
		u = create_ulist(name, ATEVENT);
		add_atevent(u, name, tim, jobtype);
	} else {
		if ((u = find_usr(name)) == NULL) {
			u = create_ulist(name, ATEVENT);
			add_atevent(u, name, tim, jobtype);
		} else {
			update_atevent(u, name, tim, jobtype);
		}
	}
}

static void
mod_ctab(char *name, time_t reftime)
{
	struct	passwd	*pw;
	struct	stat	buf;
	struct	usr	*u;
	char	namebuf[LINE_MAX];
	char	*pname;

	/* skip over ancillary file names */
	if (audit_cron_is_anc_name(name))
		return;

	if ((pw = getpwnam(name)) == NULL) {
		msg("No such user as %s - cron entries not created", name);
		return;
	}
	if (cwd != CRON) {
		if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
		    CRONDIR, name) >= sizeof (namebuf)) {
			msg("Too long path name %s - cron entries not created",
			    namebuf);
			return;
		}
		pname = namebuf;
	} else {
		pname = name;
	}
	/*
	 * a warning message is given by the crontab command so there is
	 * no need to give one here......  use this code if you only want
	 * users with a login shell of /usr/bin/sh to use cron
	 */
#ifdef BOURNESHELLONLY
	if ((strcmp(pw->pw_shell, "") != 0) &&
	    (strcmp(pw->pw_shell, SHELL) != 0)) {
		mail(name, BADSHELL, ERR_CANTEXECCRON);
		cron_unlink(pname);
		return;
	}
#endif
	if (stat(pname, &buf)) {
		mail(name, BADSTAT, ERR_UNIXERR);
		cron_unlink(pname);
		return;
	}
	if (!S_ISREG(buf.st_mode)) {
		mail(name, BADTYPE, ERR_CRONTABENT);
		return;
	}
	if ((u = find_usr(name)) == NULL) {
#ifdef DEBUG
		(void) fprintf(stderr, "new user (%s) with a crontab\n", name);
#endif
		u = create_ulist(name, CRONEVENT);
		u->home = xmalloc(strlen(pw->pw_dir) + 1);
		(void) strcpy(u->home, pw->pw_dir);
		u->uid = pw->pw_uid;
		u->gid = pw->pw_gid;
		readcron(u, reftime);
	} else {
		u->uid = pw->pw_uid;
		u->gid = pw->pw_gid;
		if (u->home != NULL) {
			if (strcmp(u->home, pw->pw_dir) != 0) {
				free(u->home);
				u->home = xmalloc(strlen(pw->pw_dir) + 1);
				(void) strcpy(u->home, pw->pw_dir);
			}
		} else {
			u->home = xmalloc(strlen(pw->pw_dir) + 1);
			(void) strcpy(u->home, pw->pw_dir);
		}
		u->ctexists = TRUE;
		if (u->ctid == 0) {
#ifdef DEBUG
			(void) fprintf(stderr, "%s now has a crontab\n",
			    u->name);
#endif
			/* user didnt have a crontab last time */
			u->ctid = ecid++;
			u->ctevents = NULL;
			readcron(u, reftime);
			return;
		}
#ifdef DEBUG
		(void) fprintf(stderr, "%s has revised their crontab\n",
		    u->name);
#endif
		rm_ctevents(u);
		el_remove(u->ctid, 0);
		readcron(u, reftime);
	}
}

static void
mod_atjob(char *name, time_t reftime __unused)
{
	char	*ptr;
	time_t	tim;
	struct	passwd	*pw;
	struct	stat	buf;
	struct	usr	*u;
	char	namebuf[PATH_MAX];
	char	*pname;
	int	jobtype;

	ptr = name;
	if (((tim = num(&ptr)) == 0) || (*ptr != '.'))
		return;
	ptr++;
	if (!isalpha(*ptr))
		return;
	jobtype = *ptr - 'a';

	/* check for audit ancillary file */
	if (audit_cron_is_anc_name(name))
		return;

	if (cwd != AT) {
		if (snprintf(namebuf, sizeof (namebuf), "%s/%s", ATDIR, name)
		    >= sizeof (namebuf)) {
			return;
		}
		pname = namebuf;
	} else {
		pname = name;
	}
	if (stat(pname, &buf) || jobtype >= NQUEUE) {
		cron_unlink(pname);
		return;
	}
	if (!(buf.st_mode & ISUID) || !S_ISREG(buf.st_mode)) {
		cron_unlink(pname);
		return;
	}
	if ((pw = getpwuid(buf.st_uid)) == NULL) {
		cron_unlink(pname);
		return;
	}
	/*
	 * a warning message is given by the at command so there is no
	 * need to give one here......use this code if you only want
	 * users with a login shell of /usr/bin/sh to use cron
	 */
#ifdef BOURNESHELLONLY
	if ((strcmp(pw->pw_shell, "") != 0) &&
	    (strcmp(pw->pw_shell, SHELL) != 0)) {
		mail(pw->pw_name, BADSHELL, ERR_CANTEXECAT);
		cron_unlink(pname);
		return;
	}
#endif
	if ((u = find_usr(pw->pw_name)) == NULL) {
#ifdef DEBUG
		(void) fprintf(stderr, "new user (%s) with an at job = %s\n",
		    pw->pw_name, name);
#endif
		u = create_ulist(pw->pw_name, ATEVENT);
		u->home = xstrdup(pw->pw_dir);
		u->uid = pw->pw_uid;
		u->gid = pw->pw_gid;
		add_atevent(u, name, tim, jobtype);
	} else {
		u->uid = pw->pw_uid;
		u->gid = pw->pw_gid;
		free(u->home);
		u->home = xstrdup(pw->pw_dir);
		update_atevent(u, name, tim, jobtype);
	}
}

static void
add_atevent(struct usr *u, char *job, time_t tim, int jobtype)
{
	struct event *e;

	e = xmalloc(sizeof (struct event));
	e->etype = jobtype;
	e->cmd = xmalloc(strlen(job) + 1);
	(void) strcpy(e->cmd, job);
	e->u = u;
	e->link = u->atevents;
	u->atevents = e;
	e->of.at.exists = TRUE;
	e->of.at.eventid = ecid++;
	if (tim < init_time)	/* old job */
		e->time = init_time;
	else
		e->time = tim;
#ifdef DEBUG
	(void) fprintf(stderr, "add_atevent: user=%s, job=%s, time=%ld\n",
	    u->name, e->cmd, e->time);
#endif
	if (el_add(e, e->time, e->of.at.eventid) < 0) {
		ignore_msg("add_atevent", "at", e);
	}
}

void
update_atevent(struct usr *u, char *name, time_t tim, int jobtype)
{
	struct event *e;

	e = u->atevents;
	while (e != NULL) {
		if (strcmp(e->cmd, name) == 0) {
			e->of.at.exists = TRUE;
			break;
		} else {
			e = e->link;
		}
	}
	if (e == NULL) {
#ifdef DEBUG
		(void) fprintf(stderr, "%s has a new at job = %s\n",
		    u->name, name);
#endif
			add_atevent(u, name, tim, jobtype);
	}
}

static char line[CTLINESIZE];	/* holds a line from a crontab file */
static int cursor;		/* cursor for the above line */

static void
readcron(struct usr *u, time_t reftime)
{
	/*
	 * readcron reads in a crontab file for a user (u). The list of
	 * events for user u is built, and u->events is made to point to
	 * this list. Each event is also entered into the main event
	 * list.
	 */
	FILE *cf;	/* cf will be a user's crontab file */
	struct event *e;
	int start;
	unsigned int i;
	char namebuf[PATH_MAX];
	char *pname;
	struct shared *tz = NULL;
	struct shared *home = NULL;
	struct shared *shell = NULL;
	uint32_t max_random_delay = 0;
	int lineno = 0;
	const char *errstr;

	/* read the crontab file */
	cte_init();		/* Init error handling */
	if (cwd != CRON) {
		if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
		    CRONDIR, u->name) >= sizeof (namebuf)) {
			return;
		}
		pname = namebuf;
	} else {
		pname = u->name;
	}
	if ((cf = fopen(pname, "r")) == NULL) {
		mail(u->name, NOREAD, ERR_UNIXERR);
		return;
	}
	while (fgets(line, CTLINESIZE, cf) != NULL) {
		char *tmp;
		/* process a line of a crontab file */
		lineno++;
		if (cte_istoomany())
			break;
		cursor = 0;
		while (line[cursor] == ' ' || line[cursor] == '\t')
			cursor++;
		if (line[cursor] == '#' || line[cursor] == '\n')
			continue;

		if (strncmp(&line[cursor], ENV_TZ,
		    strlen(ENV_TZ)) == 0) {
			if ((tmp = strchr(&line[cursor], '\n')) != NULL) {
				*tmp = '\0';
			}

			if (!isvalid_tz(&line[cursor + strlen(ENV_TZ)], NULL,
			    _VTZ_ALL)) {
				cte_add(lineno, line);
				break;
			}
			if (tz == NULL || strcmp(&line[cursor], get_obj(tz))) {
				rel_shared(tz);
				tz = create_shared_str(&line[cursor]);
			}
			continue;
		}

		if (strncmp(&line[cursor], ENV_HOME,
		    strlen(ENV_HOME)) == 0) {
			if ((tmp = strchr(&line[cursor], '\n')) != NULL) {
				*tmp = '\0';
			}
			if (home == NULL ||
			    strcmp(&line[cursor], get_obj(home))) {
				rel_shared(home);
				home = create_shared_str(
				    &line[cursor + strlen(ENV_HOME)]);
			}
			continue;
		}

		if (strncmp(&line[cursor], ENV_SHELL,
		    strlen(ENV_SHELL)) == 0) {
			if ((tmp = strchr(&line[cursor], '\n')) != NULL) {
				*tmp = '\0';
			}
			if (shell == NULL ||
			    strcmp(&line[cursor], get_obj(shell))) {
				rel_shared(shell);
				shell = create_shared_str(&line[cursor]);
			}
			continue;
		}

		if (strncmp(&line[cursor], ENV_RANDOM_DELAY,
		    strlen(ENV_RANDOM_DELAY)) == 0) {
			if ((tmp = strchr(&line[cursor], '\n')) != NULL) {
				*tmp = '\0';
			}

			max_random_delay = strtonum(
			    &line[cursor + strlen(ENV_RANDOM_DELAY)], 0,
			    UINT32_MAX / 60, &errstr);
			if (errstr != NULL) {
				cte_add(lineno, line);
				break;
			}

			continue;
		}

		e = xmalloc(sizeof (struct event));
		e->etype = CRONEVENT;

		if (next_field(0, 59, line, &cursor,
		    &e->of.ct.minute) != CFOK ||
		    next_field(0, 23, line, &cursor, &e->of.ct.hour) != CFOK ||
		    next_field(1, 31, line, &cursor,
		    &e->of.ct.daymon) != CFOK ||
		    next_field(1, 12, line, &cursor, &e->of.ct.month) != CFOK ||
		    next_field(0, 6, line, &cursor,
		    &e->of.ct.dayweek) != CFOK) {
#ifdef DEBUG
			(void) fprintf(stderr, "Error: %d %s", lineno, line);
#endif
			free(e);
			cte_add(lineno, line);
			continue;
		}
		while (line[cursor] == ' ' || line[cursor] == '\t')
			cursor++;
		if (line[cursor] == '\n' || line[cursor] == '\0')
			continue;
		/* get the command to execute	*/
		start = cursor;
again:
		while ((line[cursor] != '%') &&
		    (line[cursor] != '\n') &&
		    (line[cursor] != '\0') &&
		    (line[cursor] != '\\'))
			cursor++;
		if (line[cursor] == '\\') {
			cursor += 2;
			goto again;
		}
		e->cmd = xmalloc(cursor-start + 1);
		(void) strncpy(e->cmd, line + start, cursor-start);
		e->cmd[cursor-start] = '\0';
		/* see if there is any standard input	*/
		if (line[cursor] == '%') {
			e->of.ct.input = xmalloc(strlen(line)-cursor + 1);
			(void) strcpy(e->of.ct.input, line + cursor + 1);
			for (i = 0; i < strlen(e->of.ct.input); i++) {
				if (e->of.ct.input[i] == '%')
					e->of.ct.input[i] = '\n';
			}
		} else {
			e->of.ct.input = NULL;
		}
		/* set the timezone of this entry */
		e->of.ct.tz = dup_shared(tz);
		/* set the shell of this entry */
		e->of.ct.shell = dup_shared(shell);
		/* set the home of this entry */
		e->of.ct.home = dup_shared(home);
		/* set the maximum random delay */
		e->of.ct.max_random_delay = max_random_delay;
		/* have the event point to it's owner	*/
		e->u = u;
		/* insert this event at the front of this user's event list */
		e->link = u->ctevents;
		u->ctevents = e;
		/* set the time for the first occurance of this event	*/
		e->time = next_time(e, reftime);
		/* finally, add this event to the main event list	*/
		switch (el_add(e, e->time, u->ctid)) {
		case -1:
			ignore_msg("readcron", "cron", e);
			break;
		case -2: /* event time lower than init time */
			reset_needed = 1;
			break;
		}
		cte_valid();
#ifdef DEBUG
		cftime(timebuf, "%+", &e->time);
		(void) fprintf(stderr, "inserting cron event %s at %ld (%s)\n",
		    e->cmd, e->time, timebuf);
#endif
	}
	cte_sendmail(u->name);	/* mail errors if any to user */
	(void) fclose(cf);
	rel_shared(tz);
	rel_shared(shell);
	rel_shared(home);
}

/*
 * Below are the functions for handling of errors in crontabs. Concept is to
 * collect faulty lines and send one email at the end of the crontab
 * evaluation. If there are erroneous lines only ((cte_nvalid == 0), evaluation
 * of crontab is aborted. Otherwise reading of crontab is continued to the end
 * of the file but no further error logging appears.
 */
static void
cte_init()
{
	if (cte_text == NULL)
		cte_text = xmalloc(MAILBUFLEN);
	(void) strlcpy(cte_text, cte_intro, MAILBUFLEN);
	cte_lp = cte_text + sizeof (cte_intro) - 1;
	cte_free = MAILBINITFREE;
	cte_nvalid = 0;
}

static void
cte_add(int lineno, char *ctline)
{
	int len;
	char *p;

	if (cte_free >= LINELIMIT) {
		(void) sprintf(cte_lp, "%4d: ", lineno);
		(void) strlcat(cte_lp, ctline, LINELIMIT - 1);
		len = strlen(cte_lp);
		if (cte_lp[len - 1] != '\n') {
			cte_lp[len++] = '\n';
			cte_lp[len] = '\0';
		}
		for (p = cte_lp; *p; p++) {
			if (isprint(*p) || *p == '\n' || *p == '\t')
				continue;
			*p = '.';
		}
		cte_lp += len;
		cte_free -= len;
		if (cte_free < LINELIMIT) {
			size_t buflen = MAILBUFLEN - (cte_lp - cte_text);
			(void) strlcpy(cte_lp, cte_trail1, buflen);
			if (cte_nvalid == 0)
				(void) strlcat(cte_lp, cte_trail2, buflen);
		}
	}
}

static void
cte_valid()
{
	cte_nvalid++;
}

static int
cte_istoomany()
{
	/*
	 * Return TRUE only if all lines are faulty. So evaluation of
	 * a crontab is not aborted if at least one valid line was found.
	 */
	return (cte_nvalid == 0 && cte_free < LINELIMIT);
}

static void
cte_sendmail(char *username)
{
	if (cte_free < MAILBINITFREE)
		mail(username, cte_text, ERR_CRONTABENT);
}

/*
 * Send mail with error message to a user
 */
static void
mail(char *usrname, char *mesg, int format)
{
	/* mail mails a user a message.	*/
	FILE *pipe;
	char *temp;
	struct passwd	*ruser_ids;
	pid_t fork_val;
	int saveerrno = errno;
	struct utsname	name;

#ifdef TESTING
	return;
#endif
	(void) uname(&name);
	if ((fork_val = fork()) == (pid_t)-1) {
		msg("cron cannot fork\n");
		return;
	}
	if (fork_val == 0) {
		child_sigreset();
		contract_clear_template();
		if ((ruser_ids = getpwnam(usrname)) == NULL)
			exit(0);
		(void) setuid(ruser_ids->pw_uid);
		temp = xmalloc(strlen(MAIL) + strlen(usrname) + 2);
		(void) sprintf(temp, "%s %s", MAIL, usrname);
		pipe = popen(temp, "w");
		if (pipe != NULL) {
			(void) fprintf(pipe, "To: %s\n", usrname);
			switch (format) {
			case ERR_CRONTABENT:
				(void) fprintf(pipe, CRONTABERR);
				(void) fprintf(pipe, "Your \"crontab\" on %s\n",
				    name.nodename);
				(void) fprintf(pipe, mesg);
				(void) fprintf(pipe,
				    "\nEntries or crontab have been ignored\n");
				break;
			case ERR_UNIXERR:
				(void) fprintf(pipe, "Subject: %s\n\n", mesg);
				(void) fprintf(pipe,
				    "The error on %s was \"%s\"\n",
				    name.nodename, errmsg(saveerrno));
				break;

			case ERR_CANTEXECCRON:
				(void) fprintf(pipe,
				"Subject: Couldn't run your \"cron\" job\n\n");
				(void) fprintf(pipe,
				    "Your \"cron\" job on %s ", name.nodename);
				(void) fprintf(pipe, "couldn't be run\n");
				(void) fprintf(pipe, "%s\n", mesg);
				(void) fprintf(pipe,
				"The error was \"%s\"\n", errmsg(saveerrno));
				break;

			case ERR_CANTEXECAT:
				(void) fprintf(pipe,
				"Subject: Couldn't run your \"at\" job\n\n");
				(void) fprintf(pipe, "Your \"at\" job on %s ",
				    name.nodename);
				(void) fprintf(pipe, "couldn't be run\n");
				(void) fprintf(pipe, "%s\n", mesg);
				(void) fprintf(pipe,
				"The error was \"%s\"\n", errmsg(saveerrno));
				break;

			default:
				break;
			}
			(void) pclose(pipe);
		}
		free(temp);
		exit(0);
	}

	contract_abandon_latest(fork_val);

	if (cron_pid == getpid()) {
		miscpid_insert(fork_val);
	}
}

#define	tm_cmp(t1, t2) (\
	(t1)->tm_year == (t2)->tm_year && \
	(t1)->tm_mon == (t2)->tm_mon && \
	(t1)->tm_mday == (t2)->tm_mday && \
	(t1)->tm_hour == (t2)->tm_hour && \
	(t1)->tm_min == (t2)->tm_min)

#define	tm_setup(tp, yr, mon, dy, hr, min, dst) \
	(tp)->tm_year = yr; \
	(tp)->tm_mon = mon; \
	(tp)->tm_mday = dy; \
	(tp)->tm_hour = hr; \
	(tp)->tm_min = min; \
	(tp)->tm_isdst = dst; \
	(tp)->tm_sec = 0; \
	(tp)->tm_wday = 0; \
	(tp)->tm_yday = 0;

/*
 * modification for bugid 1104537. the second argument to next_time is
 * now the value of time(2) to be used. if this is 0, then use the
 * current time. otherwise, the second argument is the time from which to
 * calculate things. this is useful to correct situations where you've
 * gone backwards in time (I.e. the system's internal clock is correcting
 * itself backwards).
 */



static time_t
tz_next_time(struct event *e, time_t tflag)
{
	/*
	 * returns the integer time for the next occurance of event e.
	 * the following fields have ranges as indicated:
	 * PRGM  | min	hour	day of month	mon	day of week
	 * ------|-------------------------------------------------------
	 * cron  | 0-59	0-23	    1-31	1-12	0-6 (0=sunday)
	 * time  | 0-59	0-23	    1-31	0-11	0-6 (0=sunday)
	 * NOTE: this routine is hard to understand.
	 */

	struct tm *tm, ref_tm, tmp, tmp1, tmp2;
	int tm_mon, tm_mday, tm_wday, wday, m, min, h, hr, carry, day, days;
	int d1, day1, carry1, d2, day2, carry2, daysahead, mon, yr, db, wd;
	int today;
	time_t t, ref_t, t1, t2, zone_start;
	int fallback;
	extern int days_btwn(int, int, int, int, int, int);

	if (tflag == 0) {
		t = time(NULL);	/* original way of doing things	*/
	} else {
		t =  tflag;
	}

	tm = &ref_tm;	/* use a local variable and call localtime_r() */
	ref_t = t;	/* keep a copy of the reference time */

recalc:
	fallback = 0;

	(void) localtime_r(&t, tm);

	if (daylight) {
		tmp = *tm;
		tmp.tm_isdst = (tm->tm_isdst > 0 ? 0 : 1);
		t1 = xmktime(&tmp);
		/*
		 * see if we will have timezone switch over, and clock will
		 * fall back. zone_start will hold the time when it happens
		 * (ie time of PST -> PDT switch over).
		 */
		if (tm->tm_isdst != tmp.tm_isdst &&
		    (t1 - t) == (timezone - altzone) &&
		    tm_cmp(tm, &tmp)) {
			zone_start = get_switching_time(tmp.tm_isdst, t);
			fallback = 1;
		}
	}

	tm_mon = next_ge(tm->tm_mon + 1, e->of.ct.month) - 1;	/* 0-11 */
	tm_mday = next_ge(tm->tm_mday, e->of.ct.daymon);	/* 1-31 */
	tm_wday = next_ge(tm->tm_wday, e->of.ct.dayweek);	/* 0-6	*/
	today = TRUE;
	if ((strcmp(e->of.ct.daymon, "*") == 0 && tm->tm_wday != tm_wday) ||
	    (strcmp(e->of.ct.dayweek, "*") == 0 && tm->tm_mday != tm_mday) ||
	    (tm->tm_mday != tm_mday && tm->tm_wday != tm_wday) ||
	    (tm->tm_mon != tm_mon)) {
		today = FALSE;
	}
	m = tm->tm_min + (t == ref_t ? 1 : 0);
	if ((tm->tm_hour + 1) <= next_ge(tm->tm_hour, e->of.ct.hour)) {
		m = 0;
	}
	min = next_ge(m%60, e->of.ct.minute);
	carry = (min < m) ? 1 : 0;
	h = tm->tm_hour + carry;
	hr = next_ge(h%24, e->of.ct.hour);
	carry = (hr < h) ? 1 : 0;

	if (carry == 0 && today) {
		/* this event must occur today */
		tm_setup(&tmp, tm->tm_year, tm->tm_mon, tm->tm_mday,
		    hr, min, tm->tm_isdst);
		tmp1 = tmp;
		if ((t1 = xmktime(&tmp1)) == (time_t)-1) {
			return (0);
		}
		if (daylight && tmp.tm_isdst != tmp1.tm_isdst) {
			/* In case we are falling back */
			if (fallback) {
				/* we may need to run the job once more. */
				t = zone_start;
				goto recalc;
			}

			/*
			 * In case we are not in falling back period,
			 * calculate the time assuming the DST. If the
			 * date/time is not altered by mktime, it is the
			 * time to execute the job.
			 */
			tmp2 = tmp;
			tmp2.tm_isdst = tmp1.tm_isdst;
			if ((t1 = xmktime(&tmp2)) == (time_t)-1) {
				return (0);
			}
			if (tmp1.tm_isdst == tmp2.tm_isdst &&
			    tm_cmp(&tmp, &tmp2)) {
				/*
				 * We got a valid time.
				 */
				return (t1);
			} else {
				/*
				 * If the date does not match even if
				 * we assume the alternate timezone, then
				 * it must be the invalid time. eg
				 * 2am while switching 1:59am to 3am.
				 * t1 should point the time before the
				 * switching over as we've calculate the
				 * time with assuming alternate zone.
				 */
				if (tmp1.tm_isdst != tmp2.tm_isdst) {
					t = get_switching_time(tmp1.tm_isdst,
					    t1);
				} else {
					/* does this really happen? */
					t = get_switching_time(tmp1.tm_isdst,
					    t1 - abs(timezone - altzone));
				}
				if (t == (time_t)-1) {
					return (0);
				}
			}
			goto recalc;
		}
		if (tm_cmp(&tmp, &tmp1)) {
			/* got valid time */
			return (t1);
		} else {
			/*
			 * This should never happen, but just in
			 * case, we fall back to the old code.
			 */
			if (tm->tm_min > min) {
				t += (time_t)(hr-tm->tm_hour-1) * HOUR +
				    (time_t)(60-tm->tm_min + min) * MINUTE;
			} else {
				t += (time_t)(hr-tm->tm_hour) * HOUR +
				    (time_t)(min-tm->tm_min) * MINUTE;
			}
			t1 = t;
			t -= (time_t)tm->tm_sec;
			(void) localtime_r(&t, &tmp);
			if ((tm->tm_isdst == 0) && (tmp.tm_isdst > 0))
				t -= (timezone - altzone);
			return ((t <= ref_t) ? t1 : t);
		}
	}

	/*
	 * Job won't run today, however if we have a switch over within
	 * one hour and we will have one hour time drifting back in this
	 * period, we may need to run the job one more time if the job was
	 * set to run on this hour of clock.
	 */
	if (fallback) {
		t = zone_start;
		goto recalc;
	}

	min = next_ge(0, e->of.ct.minute);
	hr = next_ge(0, e->of.ct.hour);

	/*
	 * calculate the date of the next occurance of this event, which
	 * will be on a different day than the current
	 */

	/* check monthly day specification	*/
	d1 = tm->tm_mday + 1;
	day1 = next_ge((d1-1)%days_in_mon(tm->tm_mon, tm->tm_year) + 1,
	    e->of.ct.daymon);
	carry1 = (day1 < d1) ? 1 : 0;

	/* check weekly day specification	*/
	d2 = tm->tm_wday + 1;
	wday = next_ge(d2%7, e->of.ct.dayweek);
	if (wday < d2)
		daysahead = 7 - d2 + wday;
	else
		daysahead = wday - d2;
	day2 = (d1 + daysahead-1)%days_in_mon(tm->tm_mon, tm->tm_year) + 1;
	carry2 = (day2 < d1) ? 1 : 0;

	/*
	 *	based on their respective specifications, day1, and day2 give
	 *	the day of the month for the next occurance of this event.
	 */
	if ((strcmp(e->of.ct.daymon, "*") == 0) &&
	    (strcmp(e->of.ct.dayweek, "*") != 0)) {
		day1 = day2;
		carry1 = carry2;
	}
	if ((strcmp(e->of.ct.daymon, "*") != 0) &&
	    (strcmp(e->of.ct.dayweek, "*") == 0)) {
		day2 = day1;
		carry2 = carry1;
	}

	yr = tm->tm_year;
	if ((carry1 && carry2) || (tm->tm_mon != tm_mon)) {
		/* event does not occur in this month	*/
		m = tm->tm_mon + 1;
		mon = next_ge(m%12 + 1, e->of.ct.month) - 1;	/* 0..11 */
		carry = (mon < m) ? 1 : 0;
		yr += carry;
		/* recompute day1 and day2	*/
		day1 = next_ge(1, e->of.ct.daymon);
		db = days_btwn(tm->tm_mon, tm->tm_mday, tm->tm_year, mon,
		    1, yr) + 1;
		wd = (tm->tm_wday + db)%7;
		/* wd is the day of the week of the first of month mon	*/
		wday = next_ge(wd, e->of.ct.dayweek);
		if (wday < wd)
			day2 = 1 + 7 - wd + wday;
		else
			day2 = 1 + wday - wd;
		if ((strcmp(e->of.ct.daymon, "*") != 0) &&
		    (strcmp(e->of.ct.dayweek, "*") == 0))
			day2 = day1;
		if ((strcmp(e->of.ct.daymon, "*") == 0) &&
		    (strcmp(e->of.ct.dayweek, "*") != 0))
			day1 = day2;
		day = (day1 < day2) ? day1 : day2;
	} else {			/* event occurs in this month	*/
		mon = tm->tm_mon;
		if (!carry1 && !carry2)
			day = (day1 < day2) ? day1 : day2;
		else if (!carry1)
			day = day1;
		else
			day = day2;
	}

	/*
	 * now that we have the min, hr, day, mon, yr of the next event,
	 * figure out what time that turns out to be.
	 */
	tm_setup(&tmp, yr, mon, day, hr, min, -1);
	tmp2 = tmp;
	if ((t1 = xmktime(&tmp2)) == (time_t)-1) {
		return (0);
	}
	if (tm_cmp(&tmp, &tmp2)) {
		/*
		 * mktime returns clock for the current time zone. If the
		 * target date was in fallback period, it needs to be adjusted
		 * to the time comes first.
		 * Suppose, we are at Jan and scheduling job at 1:30am10/26/03.
		 * mktime returns the time in PST, but 1:30am in PDT comes
		 * first. So reverse the tm_isdst, and see if we have such
		 * time/date.
		 */
		if (daylight) {
			int dst = tmp2.tm_isdst;

			tmp2 = tmp;
			tmp2.tm_isdst = (dst > 0 ? 0 : 1);
			if ((t2 = xmktime(&tmp2)) == (time_t)-1) {
				return (0);
			}
			if (tm_cmp(&tmp, &tmp2)) {
				/*
				 * same time/date found in the opposite zone.
				 * check the clock to see which comes early.
				 */
				if (t2 > ref_t && t2 < t1) {
					t1 = t2;
				}
			}
		}
		return (t1);
	} else {
		/*
		 * mktime has set different time/date for the given date.
		 * This means that the next job is scheduled to be run on the
		 * invalid time. There are three possible invalid date/time.
		 * 1. Non existing day of the month. such as April 31th.
		 * 2. Feb 29th in the non-leap year.
		 * 3. Time gap during the DST switch over.
		 */
		d1 = days_in_mon(mon, yr);
		if ((mon != 1 && day > d1) || (mon == 1 && day > 29)) {
			/*
			 * see if we have got a specific date which
			 * is invalid.
			 */
			if (strcmp(e->of.ct.dayweek, "*") == 0 &&
			    mon == (next_ge((mon + 1)%12 + 1,
			    e->of.ct.month) - 1) &&
			    day <= next_ge(1, e->of.ct.daymon)) {
				/* job never run */
				return (0);
			}
			/*
			 * Since the day has gone invalid, we need to go to
			 * next month, and recalcuate the first occurrence.
			 * eg the cron tab such as:
			 * 0 0 1,15,31 1,2,3,4,5 * /usr/bin....
			 * 2/31 is invalid, so the next job is 3/1.
			 */
			tmp2 = tmp;
			tmp2.tm_min = 0;
			tmp2.tm_hour = 0;
			tmp2.tm_mday = 1; /* 1st day of the month */
			if (mon == 11) {
				tmp2.tm_mon = 0;
				tmp2.tm_year = yr + 1;
			} else {
				tmp2.tm_mon = mon + 1;
			}
			if ((t = xmktime(&tmp2)) == (time_t)-1) {
				return (0);
			}
		} else if (mon == 1 && day > d1) {
			/*
			 * ie 29th in the non-leap year. Forwarding the
			 * clock to Feb 29th 00:00 (March 1st), and recalculate
			 * the next time.
			 */
			tmp2 = tmp;
			tmp2.tm_min = 0;
			tmp2.tm_hour = 0;
			if ((t = xmktime(&tmp2)) == (time_t)-1) {
				return (0);
			}
		} else if (daylight) {
			/*
			 * Non existing time, eg 2am PST during summer time
			 * switch.
			 * We need to get the correct isdst which we are
			 * swithing to, by adding time difference to make sure
			 * that t2 is in the zone being switched.
			 */
			t2 = t1;
			t2 += abs(timezone - altzone);
			(void) localtime_r(&t2, &tmp2);
			zone_start = get_switching_time(tmp2.tm_isdst,
			    t1 - abs(timezone - altzone));
			if (zone_start == (time_t)-1) {
				return (0);
			}
			t = zone_start;
		} else {
			/*
			 * This should never happen, but fall back to the
			 * old code.
			 */
			days = days_btwn(tm->tm_mon,
			    tm->tm_mday, tm->tm_year, mon, day, yr);
			t += (time_t)(23-tm->tm_hour)*HOUR
			    + (time_t)(60-tm->tm_min)*MINUTE
			    + (time_t)hr*HOUR + (time_t)min*MINUTE
			    + (time_t)days*DAY;
			t1 = t;
			t -= (time_t)tm->tm_sec;
			(void) localtime_r(&t, &tmp);
			if ((tm->tm_isdst == 0) && (tmp.tm_isdst > 0))
				t -= (timezone - altzone);
			return (t <= ref_t ? t1 : t);
		}
		goto recalc;
	}
	/*NOTREACHED*/
}

static time_t
next_time(struct event *e, time_t tflag)
{
	time_t ret;

	if (e->of.ct.tz != NULL) {
		(void) putenv((char *)get_obj(e->of.ct.tz));
		tzset();
		ret = tz_next_time(e, tflag);
		(void) putenv(tzone);
		tzset();
	} else {
		ret = tz_next_time(e, tflag);
	}

	if (e->of.ct.max_random_delay > 0) {
		ret += arc4random_uniform(e->of.ct.max_random_delay * 60 - 1);
	}
	return (ret);
}

/*
 * This returns TOD in time_t that zone switch will happen, and this
 * will be called when clock fallback is about to happen.
 * (ie 30minutes before the time of PST -> PDT switch. 2:00 AM PST
 * will fall back to 1:00 PDT. So this function will be called only
 * for the time between 1:00 AM PST and 2:00 PST(1:00 PST)).
 * First goes through the common time differences to see if zone
 * switch happens at those minutes later. If not, check every minutes
 * until 6 hours ahead see if it happens(We might have 45minutes
 * fallback).
 */
static time_t
get_switching_time(int to_dst, time_t t_ref)
{
	time_t t, t1;
	struct tm tmp, tmp1;
	int hints[] = { 60, 120, 30, 90, 0}; /* minutes */
	int i;

	(void) localtime_r(&t_ref, &tmp);
	tmp1 = tmp;
	tmp1.tm_sec = 0;
	tmp1.tm_min = 0;
	if ((t = xmktime(&tmp1)) == (time_t)-1)
		return ((time_t)-1);

	/* fast path */
	for (i = 0; hints[i] != 0; i++) {
		t1 = t + hints[i] * 60;
		(void) localtime_r(&t1, &tmp1);
		if (tmp1.tm_isdst == to_dst) {
			t1--;
			(void) localtime_r(&t1, &tmp1);
			if (tmp1.tm_isdst != to_dst) {
				return (t1 + 1);
			}
		}
	}

	/* ugly, but don't know other than this. */
	tmp1 = tmp;
	tmp1.tm_sec = 0;
	if ((t = xmktime(&tmp1)) == (time_t)-1)
		return ((time_t)-1);
	while (t < (t_ref + 6*60*60)) { /* 6 hours should be enough */
		t += 60; /* at least one minute, I assume */
		(void) localtime_r(&t, &tmp);
		if (tmp.tm_isdst == to_dst)
			return (t);
	}
	return ((time_t)-1);
}

static time_t
xmktime(struct tm *tmp)
{
	time_t ret;

	if ((ret = mktime(tmp)) == (time_t)-1) {
		if (errno == EOVERFLOW) {
			return ((time_t)-1);
		}
		crabort("internal error: mktime failed",
		    REMOVE_FIFO|CONSOLE_MSG);
	}
	return (ret);
}

#define	DUMMY	100

static int
next_ge(int current, char *list)
{
	/*
	 * list is a character field as in a crontab file;
	 * for example: "40, 20, 50-10"
	 * next_ge returns the next number in the list that is
	 * greater than  or equal to current. if no numbers of list
	 * are >= current, the smallest element of list is returned.
	 * NOTE: current must be in the appropriate range.
	 */

	char *ptr;
	int n, n2, min, min_gt;

	if (strcmp(list, "*") == 0)
		return (current);
	ptr = list;
	min = DUMMY;
	min_gt = DUMMY;
	for (;;) {
		if ((n = (int)num(&ptr)) == current)
			return (current);
		if (n < min)
			min = n;
		if ((n > current) && (n < min_gt))
			min_gt = n;
		if (*ptr == '-') {
			ptr++;
			if ((n2 = (int)num(&ptr)) > n) {
				if ((current > n) && (current <= n2))
					return (current);
			} else {	/* range that wraps around */
				if (current > n)
					return (current);
				if (current <= n2)
					return (current);
			}
		}
		if (*ptr == '\0')
			break;
		ptr += 1;
	}
	if (min_gt != DUMMY)
		return (min_gt);
	else
		return (min);
}

static void
free_if_unused(struct usr *u)
{
	struct usr *cur, *prev;
	/*
	 *	To make sure a usr structure is idle we must check that
	 *	there are no at jobs queued for the user; the user does
	 *	not have a crontab, and also that there are no running at
	 *	or cron jobs (since the runinfo structure also has a
	 *	pointer to the usr structure).
	 */
	if (!u->ctexists && u->atevents == NULL &&
	    u->cruncnt == 0 && u->aruncnt == 0) {
#ifdef DEBUG
		(void) fprintf(stderr, "%s removed from usr list\n", u->name);
#endif
		for (cur = uhead, prev = NULL;
		    cur != u;
		    prev = cur, cur = cur->nextusr) {
			if (cur == NULL) {
				return;
			}
		}

		if (prev == NULL)
			uhead = u->nextusr;
		else
			prev->nextusr = u->nextusr;
		free(u->name);
		free(u->home);
		free(u);
	}
}

static void
del_atjob(char *name, char *usrname)
{

	struct	event	*e, *eprev;
	struct	usr	*u;

	if ((u = find_usr(usrname)) == NULL)
		return;
	e = u->atevents;
	eprev = NULL;
	while (e != NULL) {
		if (strcmp(name, e->cmd) == 0) {
			if (next_event == e)
				next_event = NULL;
			if (eprev == NULL)
				u->atevents = e->link;
			else
				eprev->link = e->link;
			el_remove(e->of.at.eventid, 1);
			free(e->cmd);
			free(e);
			break;
		} else {
			eprev = e;
			e = e->link;
		}
	}

	free_if_unused(u);
}

static void
del_ctab(char *name)
{

	struct	usr *u;

	if ((u = find_usr(name)) == NULL)
		return;
	rm_ctevents(u);
	el_remove(u->ctid, 0);
	u->ctid = 0;
	u->ctexists = 0;

	free_if_unused(u);
}

static void
rm_ctevents(struct usr *u)
{
	struct event *e2, *e3;

	/*
	 * see if the next event (to be run by cron) is a cronevent
	 * owned by this user.
	 */

	if ((next_event != NULL) &&
	    (next_event->etype == CRONEVENT) &&
	    (next_event->u == u)) {
		next_event = NULL;
	}
	e2 = u->ctevents;
	while (e2 != NULL) {
		free(e2->cmd);
		rel_shared(e2->of.ct.tz);
		rel_shared(e2->of.ct.shell);
		rel_shared(e2->of.ct.home);
		free(e2->of.ct.minute);
		free(e2->of.ct.hour);
		free(e2->of.ct.daymon);
		free(e2->of.ct.month);
		free(e2->of.ct.dayweek);
		if (e2->of.ct.input != NULL)
			free(e2->of.ct.input);
		e3 = e2->link;
		free(e2);
		e2 = e3;
	}
	u->ctevents = NULL;
}


static struct usr *
find_usr(char *uname)
{
	struct usr *u;

	u = uhead;
	while (u != NULL) {
		if (strcmp(u->name, uname) == 0)
			return (u);
		u = u->nextusr;
	}
	return (NULL);
}

/*
 * Execute cron command or at/batch job.
 * If ever a premature return is added to this function pay attention to
 * free at_cmdfile and outfile plus jobname buffers of the runinfo structure.
 */
static int
ex(struct event *e)
{
	int r;
	int fd;
	pid_t rfork;
	FILE *atcmdfp;
	char mailvar[4];
	char *at_cmdfile = NULL;
	struct stat buf;
	struct queue *qp;
	struct runinfo *rp;
	struct project proj, *pproj = NULL;
	union {
		struct {
			char buf[PROJECT_BUFSZ];
			char buf2[PROJECT_BUFSZ];
		} p;
		char error[CANT_STR_LEN + PATH_MAX];
	} bufs;
	char *tmpfile;
	FILE *fptr;
	time_t dhltime;
	projid_t projid;
	int projflag = 0;
	char *home;
	char *sh;

	qp = &qt[e->etype];	/* set pointer to queue defs */
	if (qp->nrun >= qp->njob) {
		msg("%c queue max run limit reached", e->etype + 'a');
		resched(qp->nwait);
		return (0);
	}

	rp = rinfo_get(0); /* allocating a new runinfo struct */

	/*
	 * the tempnam() function uses malloc(3C) to allocate space for the
	 * constructed file name, and returns a pointer to this area, which
	 * is assigned to rp->outfile. Here rp->outfile is not overwritten.
	 */

	rp->outfile = tempnam(TMPDIR, PFX);
	rp->jobtype = e->etype;
	if (e->etype == CRONEVENT) {
		rp->jobname = xmalloc(strlen(e->cmd) + 1);
		(void) strcpy(rp->jobname, e->cmd);
		/* "cron" jobs only produce mail if there's output */
		rp->mailwhendone = 0;
	} else {
		at_cmdfile = xmalloc(strlen(ATDIR) + strlen(e->cmd) + 2);
		(void) sprintf(at_cmdfile, "%s/%s", ATDIR, e->cmd);
		if ((atcmdfp = fopen(at_cmdfile, "r")) == NULL) {
			if (errno == ENAMETOOLONG) {
				if (chdir(ATDIR) == 0)
					cron_unlink(e->cmd);
			} else {
				cron_unlink(at_cmdfile);
			}
			mail((e->u)->name, BADJOBOPEN, ERR_CANTEXECAT);
			free(at_cmdfile);
			rinfo_free(rp);
			return (0);
		}
		rp->jobname = xmalloc(strlen(at_cmdfile) + 1);
		(void) strcpy(rp->jobname, at_cmdfile);

		/*
		 * Skip over the first two lines.
		 */
		(void) fscanf(atcmdfp, "%*[^\n]\n");
		(void) fscanf(atcmdfp, "%*[^\n]\n");
		if (fscanf(atcmdfp, ": notify by mail: %3s%*[^\n]\n",
		    mailvar) == 1) {
			/*
			 * Check to see if we should always send mail
			 * to the owner.
			 */
			rp->mailwhendone = (strcmp(mailvar, "yes") == 0);
		} else {
			rp->mailwhendone = 0;
		}

		if (fscanf(atcmdfp, "\n: project: %d\n", &projid) == 1) {
			projflag = 1;
		}
		(void) fclose(atcmdfp);
	}

	/*
	 * we make sure that the system time
	 * hasn't drifted backwards. if it has, el_add() is now
	 * called, to make sure that the event queue is back in order,
	 * and we set the delayed flag. cron will pick up the request
	 * later on at the proper time.
	 */
	dhltime = time(NULL);
	if ((dhltime - e->time) < 0) {
		msg("clock time drifted backwards!\n");
		if (next_event->etype == CRONEVENT) {
			msg("correcting cron event\n");
			next_event->time = next_time(next_event, dhltime);
			switch (el_add(next_event, next_event->time,
			    (next_event->u)->ctid)) {
			case -1:
				ignore_msg("ex", "cron", next_event);
				break;
			case -2: /* event time lower than init time */
				reset_needed = 1;
				break;
			}
		} else { /* etype == ATEVENT */
			msg("correcting batch event\n");
			if (el_add(next_event, next_event->time,
			    next_event->of.at.eventid) < 0) {
				ignore_msg("ex", "at", next_event);
			}
		}
		delayed++;
		t_old = time(NULL);
		free(at_cmdfile);
		rinfo_free(rp);
		return (0);
	}

	if ((rfork = fork()) == (pid_t)-1) {
		reap_child();
		if ((rfork = fork()) == (pid_t)-1) {
			msg("cannot fork");
			free(at_cmdfile);
			rinfo_free(rp);
			resched(60);
			(void) sleep(30);
			return (0);
		}
	}
	if (rfork) {		/* parent process */
		contract_abandon_latest(rfork);

		++qp->nrun;
		rp->pid = rfork;
		rp->que = e->etype;
		if (e->etype != CRONEVENT)
			(e->u)->aruncnt++;
		else
			(e->u)->cruncnt++;
		rp->rusr = (e->u);
		logit(BCHAR, rp, 0);
		free(at_cmdfile);

		return (0);
	}

	child_sigreset();
	contract_clear_template();

	if (e->etype != CRONEVENT) {
		/* open jobfile as stdin to shell */
		if (stat(at_cmdfile, &buf)) {
			if (errno == ENAMETOOLONG) {
				if (chdir(ATDIR) == 0)
					cron_unlink(e->cmd);
			} else
				cron_unlink(at_cmdfile);
			mail((e->u)->name, BADJOBOPEN, ERR_CANTEXECCRON);
			exit(1);
		}
		if (!(buf.st_mode&ISUID)) {
			/*
			 * if setuid bit off, original owner has
			 * given this file to someone else
			 */
			cron_unlink(at_cmdfile);
			exit(1);
		}
		if ((fd = open(at_cmdfile, O_RDONLY)) == -1) {
			mail((e->u)->name, BADJOBOPEN, ERR_CANTEXECCRON);
			cron_unlink(at_cmdfile);
			exit(1);
		}
		if (fd != 0) {
			(void) dup2(fd, 0);
			(void) close(fd);
		}
		/*
		 * retrieve the project id of the at job and convert it
		 * to a project name.  fail if it's not a valid project
		 * or if the user isn't a member of the project.
		 */
		if (projflag == 1) {
			if ((pproj = getprojbyid(projid, &proj,
			    (void *)&bufs.p.buf,
			    sizeof (bufs.p.buf))) == NULL ||
			    !inproj(e->u->name, pproj->pj_name,
			    bufs.p.buf2, sizeof (bufs.p.buf2))) {
				cron_unlink(at_cmdfile);
				mail((e->u)->name, BADPROJID, ERR_CANTEXECAT);
				exit(1);
			}
		}
	}

	/*
	 * Put process in a new session, and create a new task.
	 */
	if (setsid() < 0) {
		msg("setsid failed with errno = %d. job failed (%s)"
		    " for user %s", errno, e->cmd, e->u->name);
		if (e->etype != CRONEVENT)
			cron_unlink(at_cmdfile);
		exit(1);
	}

	/*
	 * set correct user identification and check their account
	 */
	r = set_user_cred(e->u, pproj);
	if (r == VUC_EXPIRED) {
		msg("user (%s) account is expired", e->u->name);
		audit_cron_user_acct_expired(e->u->name);
		clean_out_user(e->u);
		exit(1);
	}
	if (r == VUC_NEW_AUTH) {
		msg("user (%s) password has expired", e->u->name);
		audit_cron_user_acct_expired(e->u->name);
		clean_out_user(e->u);
		exit(1);
	}
	if (r != VUC_OK) {
		msg("bad user (%s)", e->u->name);
		audit_cron_bad_user(e->u->name);
		clean_out_user(e->u);
		exit(1);
	}
	/*
	 * check user and initialize the supplementary group access list.
	 * bugid 1230784: deleted from parent to avoid cron hang. Now
	 * only child handles the call.
	 */

	if (verify_user_cred(e->u) != VUC_OK ||
	    setgid(e->u->gid) == -1 ||
	    initgroups(e->u->name, e->u->gid) == -1) {
		msg("bad user (%s) or setgid failed (%s)",
		    e->u->name, e->u->name);
		audit_cron_bad_user(e->u->name);
		clean_out_user(e->u);
		exit(1);
	}

	if ((e->u)->uid == 0) { /* set default path */
		/* path settable in defaults file */
		envinit[2] = supath;
	} else {
		envinit[2] = path;
	}

	if (e->etype != CRONEVENT) {
		r = audit_cron_session(e->u->name, NULL,
		    e->u->uid, e->u->gid, at_cmdfile);
		cron_unlink(at_cmdfile);
	} else {
		r = audit_cron_session(e->u->name, CRONDIR,
		    e->u->uid, e->u->gid, NULL);
	}
	if (r != 0) {
		msg("cron audit problem. job failed (%s) for user %s",
		    e->cmd, e->u->name);
		exit(1);
	}

	audit_cron_new_job(e->cmd, e->etype, (void *)e);

	if (setuid(e->u->uid) == -1)  {
		msg("setuid failed (%s)", e->u->name);
		clean_out_user(e->u);
		exit(1);
	}

	if (e->etype == CRONEVENT) {
		/* check for standard input to command	*/
		if (e->of.ct.input != NULL) {
			if ((tmpfile = strdup(TMPINFILE)) == NULL) {
				mail((e->u)->name, MALLOCERR,
				    ERR_CANTEXECCRON);
				exit(1);
			}
			if ((fd = mkstemp(tmpfile)) == -1 ||
			    (fptr = fdopen(fd, "w")) == NULL) {
				mail((e->u)->name, NOSTDIN,
				    ERR_CANTEXECCRON);
				cron_unlink(tmpfile);
				free(tmpfile);
				exit(1);
			}
			if ((fwrite(e->of.ct.input, sizeof (char),
			    strlen(e->of.ct.input), fptr)) !=
			    strlen(e->of.ct.input)) {
				mail((e->u)->name, NOSTDIN, ERR_CANTEXECCRON);
				cron_unlink(tmpfile);
				free(tmpfile);
				(void) close(fd);
				(void) fclose(fptr);
				exit(1);
			}
			if (fseek(fptr, (off_t)0, SEEK_SET) != -1) {
				if (fd != 0) {
					(void) dup2(fd, 0);
					(void) close(fd);
				}
			}
			cron_unlink(tmpfile);
			free(tmpfile);
			(void) fclose(fptr);
		} else if ((fd = open("/dev/null", O_RDONLY)) > 0) {
			(void) dup2(fd, 0);
			(void) close(fd);
		}
	}

	/* redirect stdout and stderr for the shell	*/
	if ((fd = open(rp->outfile, O_WRONLY|O_CREAT|O_EXCL, OUTMODE)) == 1)
		fd = open("/dev/null", O_WRONLY);

	if (fd >= 0 && fd != 1)
		(void) dup2(fd, 1);

	if (fd >= 0 && fd != 2) {
		(void) dup2(fd, 2);
		if (fd != 1)
			(void) close(fd);
	}

	if (e->etype == CRONEVENT && e->of.ct.home != NULL) {
		home = (char *)get_obj(e->of.ct.home);
	} else {
		home = (e->u)->home;
	}
	(void) strlcat(homedir, home, sizeof (homedir));
	(void) strlcat(logname, (e->u)->name, sizeof (logname));
	environ = envinit;
	if (chdir(home) == -1) {
		snprintf(bufs.error, sizeof (bufs.error), CANTCDHOME, home);
		mail((e->u)->name, bufs.error,
		    e->etype == CRONEVENT ? ERR_CANTEXECCRON :
		    ERR_CANTEXECAT);
		exit(1);
	}
#ifdef TESTING
	exit(1);
#endif
	/*
	 * make sure that all file descriptors EXCEPT 0, 1 and 2
	 * will be closed.
	 */
	closefrom(3);

	if ((e->u)->uid != 0)
		(void) nice(qp->nice);
	if (e->etype == CRONEVENT) {
		if (e->of.ct.tz) {
			(void) putenv((char *)get_obj(e->of.ct.tz));
		}
		if (e->of.ct.shell) {
			char *name;

			sh = (char *)get_obj(e->of.ct.shell);
			name = strrchr(sh, '/');
			if (name == NULL)
				name = sh;
			else
				name++;

			(void) putenv(sh);
			sh += strlen(ENV_SHELL);
			(void) execl(sh, name, "-c", e->cmd, 0);
		} else {
			(void) execl(SHELL, "sh", "-c", e->cmd, 0);
			sh = SHELL;
		}
	} else {		/* type == ATEVENT */
		(void) execl(SHELL, "sh", 0);
		sh = SHELL;
	}
	snprintf(bufs.error, sizeof (bufs.error), CANTEXECSH, sh);
	mail((e->u)->name, bufs.error,
	    e->etype == CRONEVENT ? ERR_CANTEXECCRON : ERR_CANTEXECAT);
	exit(1);
	/*NOTREACHED*/
}

/*
 * Main idle loop.
 * When timed out to run the job, return 0.
 * If for some reasons we need to reschedule jobs, return 1.
 */
static int
idle(long t)
{
	time_t	now;

	refresh = 0;

	while (t > 0L) {
		if (msg_wait(t) != 0) {
			/* we need to run next job immediately */
			return (0);
		}

		reap_child();

		if (refresh) {
			/* We got THAW or REFRESH message  */
			return (1);
		}

		now = time(NULL);
		if (last_time > now) {
			/* clock has been reset to backward */
			return (1);
		}

		if (next_event == NULL && !el_empty()) {
			next_event = (struct event *)el_first();
		}

		if (next_event == NULL)
			t = INFINITY;
		else
			t = (long)next_event->time - now;
	}
	return (0);
}

/*
 * This used to be in the idle(), but moved to the separate function.
 * This called from various place when cron needs to reap the
 * child. It includes the situation that cron hit maxrun, and needs
 * to reschedule the job.
 */
static void
reap_child()
{
	pid_t	pid;
	int	prc;
	struct	runinfo	*rp;

	for (;;) {
		pid = waitpid((pid_t)-1, &prc, WNOHANG);
		if (pid <= 0)
			break;
#ifdef DEBUG
		fprintf(stderr,
		    "wait returned %x for process %d\n", prc, pid);
#endif
		if ((rp = rinfo_get(pid)) == NULL) {
			if (miscpid_delete(pid) == 0) {
				/* not found in anywhere */
				msg(PIDERR, pid);
			}
		} else if (rp->que == ZOMB) {
			(void) unlink(rp->outfile);
			rinfo_free(rp);
		} else {
			cleanup(rp, prc);
		}
	}
}

static void
cleanup(struct runinfo *pr, int rc)
{
	int	nextfork = 1;
	struct	usr	*p;
	struct	stat	buf;

	logit(ECHAR, pr, rc);
	--qt[pr->que].nrun;
	p = pr->rusr;
	if (pr->que != CRONEVENT)
		--p->aruncnt;
	else
		--p->cruncnt;

	if (lstat(pr->outfile, &buf) == 0) {
		if (!S_ISLNK(buf.st_mode) &&
		    (buf.st_size > 0 || pr->mailwhendone)) {
			/* mail user stdout and stderr */
			for (;;) {
				if ((pr->pid = fork()) < 0) {
					/*
					 * if fork fails try forever in doubling
					 * retry times, up to 16 seconds
					 */
					(void) sleep(nextfork);
					if (nextfork < 16)
						nextfork += nextfork;
					continue;
				} else if (pr->pid == 0) {
					child_sigreset();
					contract_clear_template();

					mail_result(p, pr, buf.st_size);
					/* NOTREACHED */
				} else {
					contract_abandon_latest(pr->pid);
					pr->que = ZOMB;
					break;
				}
			}
		} else {
			(void) unlink(pr->outfile);
			rinfo_free(pr);
		}
	} else {
		rinfo_free(pr);
	}

	free_if_unused(p);
}

/*
 * Mail stdout and stderr of a job to user. Get uid for real user and become
 * that person. We do this so that mail won't come from root since this
 * could be a security hole. If failure, quit - don't send mail as root.
 */
static void
mail_result(struct usr *p, struct runinfo *pr, size_t filesize)
{
	struct	passwd	*ruser_ids;
	FILE	*mailpipe;
	FILE	*st;
	struct utsname	name;
	int	nbytes;
	char	iobuf[BUFSIZ];
	char	*cmd;
	char	*lowname = (pr->jobtype == CRONEVENT ? "cron" : "at");

	(void) uname(&name);
	if ((ruser_ids = getpwnam(p->name)) == NULL)
		exit(0);
	(void) setuid(ruser_ids->pw_uid);

	cmd = xmalloc(strlen(MAIL) + strlen(p->name)+2);
	(void) sprintf(cmd, "%s %s", MAIL, p->name);
	mailpipe = popen(cmd, "w");
	free(cmd);
	if (mailpipe == NULL)
		exit(127);
	(void) fprintf(mailpipe, "To: %s\n", p->name);
	(void) fprintf(mailpipe, "Subject: %s <%s@%s> %s\n",
	    (pr->jobtype == CRONEVENT ? "Cron" : "At"),
	    p->name, name.nodename, pr->jobname);

	/*
	 * RFC3834 (Section 5) defines the Auto-Submitted header to prevent
	 * vacation replies, et al, from being sent in response to
	 * machine-generated mail.
	 */
	(void) fprintf(mailpipe, "Auto-Submitted: auto-generated\n");

	/*
	 * Additional headers for mail filtering and diagnostics:
	 */
	(void) fprintf(mailpipe, "X-Mailer: cron (%s %s)\n", name.sysname,
	    name.release);
	(void) fprintf(mailpipe, "X-Cron-User: %s\n", p->name);
	(void) fprintf(mailpipe, "X-Cron-Host: %s\n", name.nodename);
	(void) fprintf(mailpipe, "X-Cron-Job-Name: %s\n", pr->jobname);
	(void) fprintf(mailpipe, "X-Cron-Job-Type: %s\n", lowname);

	/*
	 * Message Body:
	 *
	 * (Temporary file is fopen'ed with "r", secure open.)
	 */
	(void) fprintf(mailpipe, "\n");
	if (filesize > 0 &&
	    (st = fopen(pr->outfile, "r")) != NULL) {
		while ((nbytes = fread(iobuf, sizeof (char), BUFSIZ, st)) != 0)
			(void) fwrite(iobuf, sizeof (char), nbytes, mailpipe);
		(void) fclose(st);
	} else {
		(void) fprintf(mailpipe, "Job completed with no output.\n");
	}
	(void) pclose(mailpipe);
	exit(0);
}

static int
msg_wait(long tim)
{
	struct	message	msg;
	int	cnt;
	time_t	reftime;
	fd_set	fds;
	struct timespec tout, *toutp;
	static int	pending_msg;
	static time_t	pending_reftime;

	if (pending_msg) {
		process_msg(&msgbuf, pending_reftime);
		pending_msg = 0;
		return (0);
	}

	FD_ZERO(&fds);
	FD_SET(msgfd, &fds);

	toutp = NULL;
	if (tim != INFINITY) {
#ifdef CRON_MAXSLEEP
		/*
		 * CRON_MAXSLEEP can be defined to have cron periodically wake
		 * up, so that cron can detect a change of TOD and adjust the
		 * sleep time more frequently.
		 */
		tim = (tim > CRON_MAXSLEEP) ? CRON_MAXSLEEP : tim;
#endif
		tout.tv_nsec = 0;
		tout.tv_sec = tim;
		toutp = &tout;
	}

	cnt = pselect(msgfd + 1, &fds, NULL, NULL, toutp, &defmask);
	if (cnt == -1 && errno != EINTR)
		perror("! pselect");

	/* pselect timeout or interrupted */
	if (cnt <= 0)
		return (0);

	errno = 0;
	if ((cnt = read(msgfd, &msg, sizeof (msg))) != sizeof (msg)) {
		if (cnt != -1 || errno != EAGAIN)
			perror("! read");
		return (0);
	}
	reftime = time(NULL);
	if (next_event != NULL && reftime >= next_event->time) {
		/*
		 * we need to run the job before reloading crontab.
		 */
		(void) memcpy(&msgbuf, &msg, sizeof (msg));
		pending_msg = 1;
		pending_reftime = reftime;
		return (1);
	}
	process_msg(&msg, reftime);
	return (0);
}

/*
 * process the message supplied via pipe. This will be called either
 * immediately after cron read the message from pipe, or idle time
 * if the message was pending due to the job execution.
 */
static void
process_msg(struct message *pmsg, time_t reftime)
{
	if (pmsg->etype == 0)
		return;

	switch (pmsg->etype) {
	case AT:
		if (pmsg->action == DELETE)
			del_atjob(pmsg->fname, pmsg->logname);
		else
			mod_atjob(pmsg->fname, (time_t)0);
		break;
	case CRON:
		if (pmsg->action == DELETE)
			del_ctab(pmsg->fname);
		else
			mod_ctab(pmsg->fname, reftime);
		break;
	case REFRESH:
		refresh = 1;
		pmsg->etype = 0;
		return;
	default:
		msg("message received - bad format");
		break;
	}
	if (next_event != NULL) {
		if (next_event->etype == CRONEVENT) {
			switch (el_add(next_event, next_event->time,
			    (next_event->u)->ctid)) {
			case -1:
				ignore_msg("process_msg", "cron", next_event);
				break;
			case -2: /* event time lower than init time */
				reset_needed = 1;
				break;
			}
		} else { /* etype == ATEVENT */
			if (el_add(next_event, next_event->time,
			    next_event->of.at.eventid) < 0) {
				ignore_msg("process_msg", "at", next_event);
			}
		}
		next_event = NULL;
	}
	(void) fflush(stdout);
	pmsg->etype = 0;
}

/*
 * Allocate a new or find an existing runinfo structure
 */
static struct runinfo *
rinfo_get(pid_t pid)
{
	struct runinfo *rp;

	if (pid == 0) {		/* allocate a new entry */
		rp = xcalloc(1, sizeof (struct runinfo));
		rp->next = rthead;	/* link the entry into the list */
		rthead = rp;
		return (rp);
	}
	/* search the list for an existing entry */
	for (rp = rthead; rp != NULL; rp = rp->next) {
		if (rp->pid == pid)
			break;
	}
	return (rp);
}

/*
 * Free a runinfo structure and its associated memory
 */
static void
rinfo_free(struct runinfo *entry)
{
	struct runinfo **rpp;
	struct runinfo *rp;

#ifdef DEBUG
	(void) fprintf(stderr, "freeing job %s\n", entry->jobname);
#endif
	for (rpp = &rthead; (rp = *rpp) != NULL; rpp = &rp->next) {
		if (rp == entry) {
			*rpp = rp->next;	/* unlink the entry */
			free(rp->outfile);
			free(rp->jobname);
			free(rp);
			break;
		}
	}
}

static void
thaw_handler(int sig __unused)
{
	refresh = 1;
}


static void
cronend(int sig __unused)
{
	crabort("SIGTERM", REMOVE_FIFO);
}

static void
child_handler(int sig __unused)
{
	;
}

static void
child_sigreset(void)
{
	(void) signal(SIGCLD, SIG_DFL);
	(void) sigprocmask(SIG_SETMASK, &defmask, NULL);
}

/*
 * crabort() - handle exits out of cron
 */
static void
crabort(char *mssg, int action)
{
	int	c;

	if (action & REMOVE_FIFO) {
		/* FIFO vanishes when cron finishes */
		if (unlink(FIFO) < 0)
			perror("cron could not unlink FIFO");
	}

	if (action & CONSOLE_MSG) {
		/* write error msg to console */
		if ((c = open(CONSOLE, O_WRONLY)) >= 0) {
			(void) write(c, "cron aborted: ", 14);
			(void) write(c, mssg, strlen(mssg));
			(void) write(c, "\n", 1);
			(void) close(c);
		}
	}

	/* always log the message */
	msg(mssg);
	msg("******* CRON ABORTED ********");
	exit(1);
}

/*
 * msg() - time-stamped error reporting function
 */
/*PRINTFLIKE1*/
static void
msg(char *fmt, ...)
{
	va_list args;
	time_t	t;

	t = time(NULL);

	(void) fflush(stdout);

	(void) fprintf(stderr, "! ");

	va_start(args, fmt);
	(void) vfprintf(stderr, fmt, args);
	va_end(args);

	(void) strftime(timebuf, sizeof (timebuf), FORMAT, localtime(&t));
	(void) fprintf(stderr, " %s\n", timebuf);

	(void) fflush(stderr);
}

static void
ignore_msg(char *func_name, char *job_type, struct event *event)
{
	msg("%s: ignoring %s job (user: %s, cmd: %s, time: %ld)",
	    func_name, job_type,
	    event->u->name ? event->u->name : "unknown",
	    event->cmd ? event->cmd : "unknown",
	    event->time);
}

static void
logit(int cc, struct runinfo *rp, int rc)
{
	time_t t;
	int    ret;

	if (!log)
		return;

	t = time(NULL);
	if (cc == BCHAR)
		(void) printf("%c  CMD: %s\n", cc, next_event->cmd);
	(void) strftime(timebuf, sizeof (timebuf), FORMAT, localtime(&t));
	(void) printf("%c  %s %u %c %s",
	    cc, (rp->rusr)->name, rp->pid, QUE(rp->que), timebuf);
	if ((ret = TSTAT(rc)) != 0)
		(void) printf(" ts=%d", ret);
	if ((ret = RCODE(rc)) != 0)
		(void) printf(" rc=%d", ret);
	(void) putchar('\n');
	(void) fflush(stdout);
}

static void
resched(int delay)
{
	time_t	nt;

	/* run job at a later time */
	nt = next_event->time + delay;
	if (next_event->etype == CRONEVENT) {
		next_event->time = next_time(next_event, (time_t)0);
		if (nt < next_event->time)
			next_event->time = nt;
		switch (el_add(next_event, next_event->time,
		    (next_event->u)->ctid)) {
		case -1:
			ignore_msg("resched", "cron", next_event);
			break;
		case -2: /* event time lower than init time */
			reset_needed = 1;
			break;
		}
		delayed = 1;
		msg("rescheduling a cron job");
		return;
	}
	add_atevent(next_event->u, next_event->cmd, nt, next_event->etype);
	msg("rescheduling at job");
}

static void
quedefs(int action)
{
	int	i;
	int	j;
	char	qbuf[QBUFSIZ];
	FILE	*fd;

	/* set up default queue definitions */
	for (i = 0; i < NQUEUE; i++) {
		qt[i].njob = qd.njob;
		qt[i].nice = qd.nice;
		qt[i].nwait = qd.nwait;
	}
	if (action == DEFAULT)
		return;
	if ((fd = fopen(QUEDEFS, "r")) == NULL) {
		msg("cannot open quedefs file");
		msg("using default queue definitions");
		return;
	}
	while (fgets(qbuf, QBUFSIZ, fd) != NULL) {
		if ((j = qbuf[0]-'a') < 0 || j >= NQUEUE || qbuf[1] != '.')
			continue;
		parsqdef(&qbuf[2]);
		qt[j].njob = qq.njob;
		qt[j].nice = qq.nice;
		qt[j].nwait = qq.nwait;
	}
	(void) fclose(fd);
}

static void
parsqdef(char *name)
{
	int i;

	qq = qd;
	while (*name) {
		i = 0;
		while (isdigit(*name)) {
			i *= 10;
			i += *name++ - '0';
		}
		switch (*name++) {
		case JOBF:
			qq.njob = i;
			break;
		case NICEF:
			qq.nice = i;
			break;
		case WAITF:
			qq.nwait = i;
			break;
		}
	}
}

/*
 * defaults - read defaults from /etc/default/cron
 */
static void
defaults()
{
	int  flags;
	char *deflog;
	char *hz, *tz;

	/*
	 * get HZ value for environment
	 */
	if ((hz = getenv("HZ")) == (char *)NULL)
		(void) sprintf(hzname, "HZ=%d", HZ);
	else
		(void) snprintf(hzname, sizeof (hzname), "HZ=%s", hz);
	/*
	 * get TZ value for environment
	 */
	(void) snprintf(tzone, sizeof (tzone), "TZ=%s",
	    ((tz = getenv("TZ")) != NULL) ? tz : DEFTZ);

	if (defopen(DEFFILE) == 0) {
		/* ignore case */
		flags = defcntl(DC_GETFLAGS, 0);
		TURNOFF(flags, DC_CASE);
		(void) defcntl(DC_SETFLAGS, flags);

		if (((deflog = defread("CRONLOG=")) == NULL) ||
		    (*deflog == 'N') || (*deflog == 'n'))
			log = 0;
		else
			log = 1;
		/* fix for 1087611 - allow paths to be set in defaults file */
		if ((Def_path = defread("PATH=")) != NULL) {
			(void) strlcat(path, Def_path, LINE_MAX);
		} else {
			(void) strlcpy(path, NONROOTPATH, LINE_MAX);
		}
		if ((Def_supath = defread("SUPATH=")) != NULL) {
			(void) strlcat(supath, Def_supath, LINE_MAX);
		} else {
			(void) strlcpy(supath, ROOTPATH, LINE_MAX);
		}
		(void) defopen(NULL);
	}
}

/*
 * Determine if a user entry for a job is still ok.  The method used here
 * is a lot (about 75x) faster than using setgrent() / getgrent()
 * endgrent().  It should be safe because we use the sysconf to determine
 * the max, and it tolerates the max being 0.
 */

static int
verify_user_cred(struct usr *u)
{
	struct passwd *pw;
	size_t numUsrGrps = 0;
	size_t numOrigGrps = 0;
	size_t i;
	int retval;

	/*
	 * Maximum number of groups a user may be in concurrently.  This
	 * is a value which we obtain at runtime through a sysconf()
	 * call.
	 */

	static size_t nGroupsMax = (size_t)-1;

	/*
	 * Arrays for cron user's group list, constructed at startup to
	 * be nGroupsMax elements long, used for verifying user
	 * credentials prior to execution.
	 */

	static gid_t *UsrGrps;
	static gid_t *OrigGrps;

	if ((pw = getpwnam(u->name)) == NULL)
		return (VUC_BADUSER);
	if (u->home != NULL) {
		if (strcmp(u->home, pw->pw_dir) != 0) {
			free(u->home);
			u->home = xmalloc(strlen(pw->pw_dir) + 1);
			(void) strcpy(u->home, pw->pw_dir);
		}
	} else {
		u->home = xmalloc(strlen(pw->pw_dir) + 1);
		(void) strcpy(u->home, pw->pw_dir);
	}
	if (u->uid != pw->pw_uid)
		u->uid = pw->pw_uid;
	if (u->gid != pw->pw_gid)
		u->gid  = pw->pw_gid;

	/*
	 * Create the group id lists needed for job credential
	 * verification.
	 */

	if (nGroupsMax == (size_t)-1) {
		if ((nGroupsMax = sysconf(_SC_NGROUPS_MAX)) > 0) {
			UsrGrps = xcalloc(nGroupsMax, sizeof (gid_t));
			OrigGrps = xcalloc(nGroupsMax, sizeof (gid_t));
		}

#ifdef DEBUG
		(void) fprintf(stderr, "nGroupsMax = %ld\n", nGroupsMax);
#endif
	}

#ifdef DEBUG
	(void) fprintf(stderr, "verify_user_cred (%s-%d)\n", pw->pw_name,
	    pw->pw_uid);
	(void) fprintf(stderr, "verify_user_cred: pw->pw_gid = %d, "
	    "u->gid = %d\n", pw->pw_gid, u->gid);
#endif

	retval = (u->gid == pw->pw_gid) ? VUC_OK : VUC_NOTINGROUP;

	if (nGroupsMax > 0) {
		numOrigGrps = getgroups(nGroupsMax, OrigGrps);

		(void) initgroups(pw->pw_name, pw->pw_gid);
		numUsrGrps = getgroups(nGroupsMax, UsrGrps);

		for (i = 0; i < numUsrGrps; i++) {
			if (UsrGrps[i] == u->gid) {
				retval = VUC_OK;
				break;
			}
		}

		if (OrigGrps) {
			(void) setgroups(numOrigGrps, OrigGrps);
		}
	}

#ifdef DEBUG
	(void) fprintf(stderr, "verify_user_cred: VUC = %d\n", retval);
#endif

	return (retval);
}

static int
set_user_cred(const struct usr *u, struct project *pproj)
{
	static char *progname = "cron";
	int r = 0, rval = 0;

	if ((r = pam_start(progname, u->name, &pam_conv, &pamh))
	    != PAM_SUCCESS) {
#ifdef DEBUG
		msg("pam_start returns %d\n", r);
#endif
		rval = VUC_BADUSER;
		goto set_eser_cred_exit;
	}

	r = pam_acct_mgmt(pamh, 0);
#ifdef DEBUG
	msg("pam_acc_mgmt returns %d\n", r);
#endif
	if (r == PAM_ACCT_EXPIRED) {
		rval = VUC_EXPIRED;
		goto set_eser_cred_exit;
	}
	if (r == PAM_NEW_AUTHTOK_REQD) {
		rval = VUC_NEW_AUTH;
		goto set_eser_cred_exit;
	}
	if (r != PAM_SUCCESS) {
		rval = VUC_BADUSER;
		goto set_eser_cred_exit;
	}

	if (pproj != NULL) {
		size_t sz = sizeof (PROJECT) + strlen(pproj->pj_name);
		char *buf = alloca(sz);

		(void) snprintf(buf, sz, PROJECT "%s", pproj->pj_name);
		(void) pam_set_item(pamh, PAM_RESOURCE, buf);
	}

	r = pam_setcred(pamh, PAM_ESTABLISH_CRED);
	if (r != PAM_SUCCESS)
		rval = VUC_BADUSER;

set_eser_cred_exit:
	(void) pam_end(pamh, r);
	return (rval);
}

static void
clean_out_user(struct usr *u)
{
	if (next_event->u == u) {
		next_event = NULL;
	}

	clean_out_ctab(u);
	clean_out_atjobs(u);
	free_if_unused(u);
}

static void
clean_out_atjobs(struct usr *u)
{
	struct event *ev, *pv;

	for (pv = NULL, ev = u->atevents;
	    ev != NULL;
	    pv = ev, ev = ev->link, free(pv)) {
		el_remove(ev->of.at.eventid, 1);
		if (cwd == AT)
			cron_unlink(ev->cmd);
		else {
			char buf[PATH_MAX];
			if (strlen(ATDIR) + strlen(ev->cmd) + 2
			    < PATH_MAX) {
				(void) sprintf(buf, "%s/%s", ATDIR, ev->cmd);
				cron_unlink(buf);
			}
		}
		free(ev->cmd);
	}

	u->atevents = NULL;
}

static void
clean_out_ctab(struct usr *u)
{
	rm_ctevents(u);
	el_remove(u->ctid, 0);
	u->ctid = 0;
	u->ctexists = 0;
}

static void
cron_unlink(char *name)
{
	int r;

	r = unlink(name);
	if (r == 0 || (r == -1 && errno == ENOENT)) {
		(void) audit_cron_delete_anc_file(name, NULL);
	}
}

static void
create_anc_ctab(struct event *e)
{
	if (audit_cron_create_anc_file(e->u->name,
	    (cwd == CRON) ? NULL:CRONDIR,
	    e->u->name, e->u->uid) == -1) {
		process_anc_files(CRON_ANC_DELETE);
		crabort("cannot create ancillary files for crontabs",
		    REMOVE_FIFO|CONSOLE_MSG);
	}
}

static void
delete_anc_ctab(struct event *e)
{
	(void) audit_cron_delete_anc_file(e->u->name,
	    (cwd == CRON) ? NULL:CRONDIR);
}

static void
create_anc_atjob(struct event *e)
{
	if (!e->of.at.exists)
		return;

	if (audit_cron_create_anc_file(e->cmd,
	    (cwd == AT) ? NULL:ATDIR,
	    e->u->name, e->u->uid) == -1) {
		process_anc_files(CRON_ANC_DELETE);
		crabort("cannot create ancillary files for atjobs",
		    REMOVE_FIFO|CONSOLE_MSG);
	}
}

static void
delete_anc_atjob(struct event *e)
{
	if (!e->of.at.exists)
		return;

	(void) audit_cron_delete_anc_file(e->cmd,
	    (cwd == AT) ? NULL:ATDIR);
}


static void
process_anc_files(int del)
{
	struct usr	*u = uhead;
	struct event	*e;

	if (!audit_cron_mode())
		return;

	for (;;) {
		if (u->ctexists && u->ctevents != NULL) {
			e = u->ctevents;
			for (;;) {
				if (del)
					delete_anc_ctab(e);
				else
					create_anc_ctab(e);
				if ((e = e->link) == NULL)
					break;
			}
		}

		if (u->atevents != NULL) {
			e = u->atevents;
			for (;;) {
				if (del)
					delete_anc_atjob(e);
				else
					create_anc_atjob(e);
				if ((e = e->link) == NULL)
					break;
			}
		}

		if ((u = u->nextusr)  == NULL)
			break;
	}
}

static int
cron_conv(int num_msg, const struct pam_message **msgs,
    struct pam_response **response __unused, void *appdata_ptr __unused)
{
	const struct pam_message **m = msgs;
	int i;

	for (i = 0; i < num_msg; i++) {
		switch (m[i]->msg_style) {
		case PAM_ERROR_MSG:
		case PAM_TEXT_INFO:
			if (m[i]->msg != NULL) {
				(void) msg("%s\n", m[i]->msg);
			}
			break;

		default:
			break;
		}
	}
	return (0);
}

/*
 * Cron creates process for other than job. Mail process is the
 * one which rinfo does not cover. Therefore, miscpid will keep
 * track of the pids executed from cron. Otherwise, we will see
 * "unexpected pid returned.." messages appear in the log file.
 */
static void
miscpid_insert(pid_t pid)
{
	struct miscpid *mp;

	mp = xmalloc(sizeof (*mp));
	mp->pid = pid;
	mp->next = miscpid_head;
	miscpid_head = mp;
}

static int
miscpid_delete(pid_t pid)
{
	struct miscpid *mp, *omp;
	int found = 0;

	omp = NULL;
	for (mp = miscpid_head; mp != NULL; mp = mp->next) {
		if (mp->pid == pid) {
			found = 1;
			break;
		}
		omp = mp;
	}
	if (found) {
		if (omp != NULL)
			omp->next = mp->next;
		else
			miscpid_head = NULL;
		free(mp);
	}
	return (found);
}

/*
 * Establish contract terms such that all children are in abandoned
 * process contracts.
 */
static void
contract_set_template(void)
{
	int fd;

	if ((fd = open64(CTFS_ROOT "/process/template", O_RDWR)) < 0)
		crabort("cannot open process contract template",
		    REMOVE_FIFO | CONSOLE_MSG);

	if (ct_pr_tmpl_set_param(fd, 0) ||
	    ct_tmpl_set_informative(fd, 0) ||
	    ct_pr_tmpl_set_fatal(fd, CT_PR_EV_HWERR))
		crabort("cannot establish contract template terms",
		    REMOVE_FIFO | CONSOLE_MSG);

	if (ct_tmpl_activate(fd))
		crabort("cannot activate contract template",
		    REMOVE_FIFO | CONSOLE_MSG);

	(void) close(fd);
}

/*
 * Clear active process contract template.
 */
static void
contract_clear_template(void)
{
	int fd;

	if ((fd = open64(CTFS_ROOT "/process/template", O_RDWR)) < 0)
		crabort("cannot open process contract template",
		    REMOVE_FIFO | CONSOLE_MSG);

	if (ct_tmpl_clear(fd))
		crabort("cannot clear contract template",
		    REMOVE_FIFO | CONSOLE_MSG);

	(void) close(fd);
}

/*
 * Abandon latest process contract unconditionally.  If we have leaked [some
 * critical amount], exit such that the kernel reaps our contracts.
 */
static void
contract_abandon_latest(pid_t pid)
{
	int r;
	ctid_t id;
	static uint_t cts_lost;

	if (cts_lost > MAX_LOST_CONTRACTS)
		crabort("repeated failure to abandon contracts",
		    REMOVE_FIFO | CONSOLE_MSG);

	if ((r = contract_latest(&id)) != 0) {
		msg("could not obtain latest contract for "
		    "PID %ld: %s", pid, strerror(r));
		cts_lost++;
		return;
	}

	if ((r = contract_abandon_id(id)) != 0) {
		msg("could not abandon latest contract %ld: %s", id,
		    strerror(r));
		cts_lost++;
		return;
	}
}

static struct shared *
create_shared(void *obj, void * (*obj_alloc)(void *obj),
    void (*obj_free)(void *))
{
	struct shared *out;

	if ((out = xmalloc(sizeof (struct shared))) == NULL) {
		return (NULL);
	}
	if ((out->obj = obj_alloc(obj)) == NULL) {
		free(out);
		return (NULL);
	}
	out->count = 1;
	out->free = obj_free;

	return (out);
}

static struct shared *
create_shared_str(char *str)
{
	return (create_shared(str, (void *(*)(void *))strdup, free));
}

static struct shared *
dup_shared(struct shared *obj)
{
	if (obj != NULL) {
		obj->count++;
	}
	return (obj);
}

static void
rel_shared(struct shared *obj)
{
	if (obj && (--obj->count) == 0) {
		obj->free(obj->obj);
		free(obj);
	}
}

static void *
get_obj(struct shared *obj)
{
	return (obj->obj);
}