1 /* Copyright 1988,1990,1993,1994 by Paul Vixie
2 * All rights reserved
3 *
4 * Distribute freely, except: don't remove my name from the source or
5 * documentation (don't take credit for my work), mark your changes (don't
6 * get me blamed for your possible bugs), don't alter or remove this
7 * notice. May be sold if buildable source is provided to buyer. No
8 * warrantee of any kind, express or implied, is included with this
9 * software; use at your own risk, responsibility for damages (if any) to
10 * anyone resulting from the use of this software rests entirely with the
11 * user.
12 *
13 * Send bug reports, bug fixes, enhancements, requests, flames, etc., and
14 * I'll try to keep a version up to date. I can be reached as follows:
15 * Paul Vixie <paul@vix.com> uunet!decwrl!vixie!paul
16 *
17 * $FreeBSD: src/usr.sbin/cron/cron/do_command.c,v 1.27 2007/06/17 17:25:53 yar Exp $
18 * $DragonFly: src/usr.sbin/cron/cron/do_command.c,v 1.8 2008/01/07 14:11:23 matthias Exp $
19 */
20
21 #include "cron.h"
22 #include <sys/signal.h>
23 #if defined(sequent)
24 # include <sys/universe.h>
25 #endif
26 #if defined(SYSLOG)
27 # include <syslog.h>
28 #endif
29 #if defined(LOGIN_CAP)
30 # include <login_cap.h>
31 #endif
32 #ifdef PAM
33 # include <security/pam_appl.h>
34 # include <security/openpam.h>
35 #endif
36
37 static void child_process(entry *, user *),
38 do_univ(user *);
39
40
41 void
do_command(entry * e,user * u)42 do_command(entry *e, user *u)
43 {
44 Debug(DPROC, ("[%d] do_command(%s, (%s,%d,%d))\n",
45 getpid(), e->cmd, u->name, e->uid, e->gid))
46
47 /* fork to become asynchronous -- parent process is done immediately,
48 * and continues to run the normal cron code, which means return to
49 * tick(). the child and grandchild don't leave this function, alive.
50 *
51 * vfork() is unsuitable, since we have much to do, and the parent
52 * needs to be able to run off and fork other processes.
53 */
54 switch (fork()) {
55 case -1:
56 log_it("CRON",getpid(),"error","can't fork");
57 break;
58 case 0:
59 /* child process */
60 acquire_daemonlock(1);
61 child_process(e, u);
62 Debug(DPROC, ("[%d] child process done, exiting\n", getpid()))
63 _exit(OK_EXIT);
64 break;
65 default:
66 /* parent process */
67 break;
68 }
69 Debug(DPROC, ("[%d] main process returning to work\n", getpid()))
70 }
71
72
73 static void
child_process(entry * e,user * u)74 child_process(entry *e, user *u)
75 {
76 int stdin_pipe[2], stdout_pipe[2];
77 int jitter;
78 char *input_data;
79 char *usernm, *mailto;
80 int children = 0;
81 # if defined(LOGIN_CAP)
82 struct passwd *pwd;
83 login_cap_t *lc;
84 # endif
85
86 Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd))
87
88 /* mark ourselves as different to PS command watchers by upshifting
89 * our program name. This has no effect on some kernels.
90 */
91 setproctitle("running job");
92
93 /* discover some useful and important environment settings
94 */
95 usernm = env_get("LOGNAME", e->envp);
96 mailto = env_get("MAILTO", e->envp);
97
98 #ifdef PAM
99 /* use PAM to see if the user's account is available,
100 * i.e., not locked or expired or whatever. skip this
101 * for system tasks from /etc/crontab -- they can run
102 * as any user.
103 */
104 if (strcmp(u->name, SYS_NAME)) { /* not equal */
105 pam_handle_t *pamh = NULL;
106 int pam_err;
107 struct pam_conv pamc = {
108 .conv = openpam_nullconv,
109 .appdata_ptr = NULL
110 };
111
112 Debug(DPROC, ("[%d] checking account with PAM\n", getpid()))
113
114 /* u->name keeps crontab owner name while LOGNAME is the name
115 * of user to run command on behalf of. they should be the
116 * same for a task from a per-user crontab.
117 */
118 if (strcmp(u->name, usernm)) {
119 log_it(usernm, getpid(), "username ambiguity", u->name);
120 exit(ERROR_EXIT);
121 }
122
123 pam_err = pam_start("cron", usernm, &pamc, &pamh);
124 if (pam_err != PAM_SUCCESS) {
125 log_it("CRON", getpid(), "error", "can't start PAM");
126 exit(ERROR_EXIT);
127 }
128
129 pam_err = pam_acct_mgmt(pamh, PAM_SILENT);
130 /* Expired password shouldn't prevent the job from running. */
131 if (pam_err != PAM_SUCCESS && pam_err != PAM_NEW_AUTHTOK_REQD) {
132 log_it(usernm, getpid(), "USER", "account unavailable");
133 exit(ERROR_EXIT);
134 }
135
136 pam_end(pamh, pam_err);
137 }
138 #endif
139
140 #ifdef USE_SIGCHLD
141 /* our parent is watching for our death by catching SIGCHLD. we
142 * do not care to watch for our children's deaths this way -- we
143 * use wait() explictly. so we have to disable the signal (which
144 * was inherited from the parent).
145 */
146 signal(SIGCHLD, SIG_DFL);
147 #else
148 /* on system-V systems, we are ignoring SIGCLD. we have to stop
149 * ignoring it now or the wait() in cron_pclose() won't work.
150 * because of this, we have to wait() for our children here, as well.
151 */
152 signal(SIGCLD, SIG_DFL);
153 #endif /*BSD*/
154
155 /* create some pipes to talk to our future child
156 */
157 pipe(stdin_pipe); /* child's stdin */
158 pipe(stdout_pipe); /* child's stdout */
159
160 /* since we are a forked process, we can diddle the command string
161 * we were passed -- nobody else is going to use it again, right?
162 *
163 * if a % is present in the command, previous characters are the
164 * command, and subsequent characters are the additional input to
165 * the command. Subsequent %'s will be transformed into newlines,
166 * but that happens later.
167 *
168 * If there are escaped %'s, remove the escape character.
169 */
170 /*local*/{
171 int escaped = FALSE;
172 int ch;
173 char *p;
174
175 for (input_data = p = e->cmd; (ch = *input_data);
176 input_data++, p++) {
177 if (p != input_data)
178 *p = ch;
179 if (escaped) {
180 if (ch == '%' || ch == '\\')
181 *--p = ch;
182 escaped = FALSE;
183 continue;
184 }
185 if (ch == '\\') {
186 escaped = TRUE;
187 continue;
188 }
189 if (ch == '%') {
190 *input_data++ = '\0';
191 break;
192 }
193 }
194 *p = '\0';
195 }
196
197 /* fork again, this time so we can exec the user's command.
198 */
199 switch (vfork()) {
200 case -1:
201 log_it("CRON",getpid(),"error","can't vfork");
202 exit(ERROR_EXIT);
203 /*NOTREACHED*/
204 case 0:
205 Debug(DPROC, ("[%d] grandchild process Vfork()'ed\n",
206 getpid()))
207
208 jitter = (e->uid == ROOT_UID) ? RootJitter : Jitter;
209 if (jitter != 0) {
210 srandom(getpid());
211 sleep(random() % jitter);
212 }
213
214 /* write a log message. we've waited this long to do it
215 * because it was not until now that we knew the PID that
216 * the actual user command shell was going to get and the
217 * PID is part of the log message.
218 */
219 /*local*/{
220 char *x = mkprints((u_char *)e->cmd, strlen(e->cmd));
221
222 log_it(usernm, getpid(), "CMD", x);
223 free(x);
224 }
225
226 /* that's the last thing we'll log. close the log files.
227 */
228 #ifdef SYSLOG
229 closelog();
230 #endif
231
232 /* get new pgrp, void tty, etc.
233 */
234 setsid();
235
236 /* close the pipe ends that we won't use. this doesn't affect
237 * the parent, who has to read and write them; it keeps the
238 * kernel from recording us as a potential client TWICE --
239 * which would keep it from sending SIGPIPE in otherwise
240 * appropriate circumstances.
241 */
242 close(stdin_pipe[WRITE_PIPE]);
243 close(stdout_pipe[READ_PIPE]);
244
245 /* grandchild process. make std{in,out} be the ends of
246 * pipes opened by our daddy; make stderr go to stdout.
247 */
248 close(STDIN); dup2(stdin_pipe[READ_PIPE], STDIN);
249 close(STDOUT); dup2(stdout_pipe[WRITE_PIPE], STDOUT);
250 close(STDERR); dup2(STDOUT, STDERR);
251
252 /* close the pipes we just dup'ed. The resources will remain.
253 */
254 close(stdin_pipe[READ_PIPE]);
255 close(stdout_pipe[WRITE_PIPE]);
256
257 /* set our login universe. Do this in the grandchild
258 * so that the child can invoke /usr/lib/sendmail
259 * without surprises.
260 */
261 do_univ(u);
262
263 # if defined(LOGIN_CAP)
264 /* Set user's entire context, but skip the environment
265 * as cron provides a separate interface for this
266 */
267 if ((pwd = getpwnam(usernm)) == NULL)
268 pwd = getpwuid(e->uid);
269 lc = NULL;
270 if (pwd != NULL) {
271 pwd->pw_gid = e->gid;
272 if (e->class != NULL)
273 lc = login_getclass(e->class);
274 }
275 if (pwd &&
276 setusercontext(lc, pwd, e->uid,
277 LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETENV)) == 0)
278 endpwent();
279 else {
280 /* fall back to the old method */
281 endpwent();
282 # endif
283 /* set our directory, uid and gid. Set gid first,
284 * since once we set uid, we've lost root privledges.
285 */
286 setgid(e->gid);
287 # if defined(BSD)
288 initgroups(usernm, e->gid);
289 # endif
290 setlogin(usernm);
291 setuid(e->uid); /* we aren't root after this..*/
292 #if defined(LOGIN_CAP)
293 }
294 if (lc != NULL)
295 login_close(lc);
296 #endif
297 chdir(env_get("HOME", e->envp));
298
299 /* exec the command.
300 */
301 {
302 char *shell = env_get("SHELL", e->envp);
303
304 # if DEBUGGING
305 if (DebugFlags & DTEST) {
306 fprintf(stderr,
307 "debug DTEST is on, not exec'ing command.\n");
308 fprintf(stderr,
309 "\tcmd='%s' shell='%s'\n", e->cmd, shell);
310 _exit(OK_EXIT);
311 }
312 # endif /*DEBUGGING*/
313 execle(shell, shell, "-c", e->cmd, NULL, e->envp);
314 warn("execl: couldn't exec `%s'", shell);
315 _exit(ERROR_EXIT);
316 }
317 break;
318 default:
319 /* parent process */
320 break;
321 }
322
323 children++;
324
325 /* middle process, child of original cron, parent of process running
326 * the user's command.
327 */
328
329 Debug(DPROC, ("[%d] child continues, closing pipes\n", getpid()))
330
331 /* close the ends of the pipe that will only be referenced in the
332 * grandchild process...
333 */
334 close(stdin_pipe[READ_PIPE]);
335 close(stdout_pipe[WRITE_PIPE]);
336
337 /*
338 * write, to the pipe connected to child's stdin, any input specified
339 * after a % in the crontab entry. while we copy, convert any
340 * additional %'s to newlines. when done, if some characters were
341 * written and the last one wasn't a newline, write a newline.
342 *
343 * Note that if the input data won't fit into one pipe buffer (2K
344 * or 4K on most BSD systems), and the child doesn't read its stdin,
345 * we would block here. thus we must fork again.
346 */
347
348 if (*input_data && fork() == 0) {
349 FILE *out;
350 int need_newline = FALSE;
351 int escaped = FALSE;
352 int ch;
353
354 out = fdopen(stdin_pipe[WRITE_PIPE], "w");
355 if (out == NULL) {
356 warn("fdopen failed in child2");
357 _exit(ERROR_EXIT);
358 }
359
360 Debug(DPROC, ("[%d] child2 sending data to grandchild\n", getpid()))
361
362 /* close the pipe we don't use, since we inherited it and
363 * are part of its reference count now.
364 */
365 close(stdout_pipe[READ_PIPE]);
366
367 /* translation:
368 * \% -> %
369 * % -> \n
370 * \x -> \x for all x != %
371 */
372 while ((ch = *input_data++)) {
373 if (escaped) {
374 if (ch != '%')
375 putc('\\', out);
376 } else {
377 if (ch == '%')
378 ch = '\n';
379 }
380
381 if (!(escaped = (ch == '\\'))) {
382 putc(ch, out);
383 need_newline = (ch != '\n');
384 }
385 }
386 if (escaped)
387 putc('\\', out);
388 if (need_newline)
389 putc('\n', out);
390
391 /* close the pipe, causing an EOF condition. fclose causes
392 * stdin_pipe[WRITE_PIPE] to be closed, too.
393 */
394 fclose(out);
395
396 Debug(DPROC, ("[%d] child2 done sending to grandchild\n", getpid()))
397 exit(0);
398 }
399
400 /* close the pipe to the grandkiddie's stdin, since its wicked uncle
401 * ernie back there has it open and will close it when he's done.
402 */
403 close(stdin_pipe[WRITE_PIPE]);
404
405 children++;
406
407 /*
408 * read output from the grandchild. it's stderr has been redirected to
409 * it's stdout, which has been redirected to our pipe. if there is any
410 * output, we'll be mailing it to the user whose crontab this is...
411 * when the grandchild exits, we'll get EOF.
412 */
413
414 Debug(DPROC, ("[%d] child reading output from grandchild\n", getpid()))
415
416 /*local*/{
417 FILE *in;
418 int ch;
419
420 in = fdopen(stdout_pipe[READ_PIPE], "r");
421 if (in == NULL) {
422 warn("fdopen failed in child");
423 _exit(ERROR_EXIT);
424 }
425
426 ch = getc(in);
427 if (ch != EOF) {
428 FILE *mail;
429 int bytes = 1;
430 int status = 0;
431
432 Debug(DPROC|DEXT,
433 ("[%d] got data (%x:%c) from grandchild\n",
434 getpid(), ch, ch))
435
436 /* get name of recipient. this is MAILTO if set to a
437 * valid local username; USER otherwise.
438 */
439 if (mailto) {
440 /* MAILTO was present in the environment
441 */
442 if (!*mailto) {
443 /* ... but it's empty. set to NULL
444 */
445 mailto = NULL;
446 }
447 } else {
448 /* MAILTO not present, set to USER.
449 */
450 mailto = usernm;
451 }
452
453 /* if we are supposed to be mailing, MAILTO will
454 * be non-NULL. only in this case should we set
455 * up the mail command and subjects and stuff...
456 */
457
458 if (mailto) {
459 char **env;
460 char mailcmd[MAX_COMMAND];
461 char hostname[MAXHOSTNAMELEN];
462
463 gethostname(hostname, MAXHOSTNAMELEN);
464 snprintf(mailcmd, sizeof(mailcmd),
465 MAILARGS, MAILCMD);
466 if (!(mail = cron_popen(mailcmd, "w", e))) {
467 warn("%s", MAILCMD);
468 _exit(ERROR_EXIT);
469 }
470 fprintf(mail, "From: %s (Cron Daemon)\n", usernm);
471 fprintf(mail, "To: %s\n", mailto);
472 fprintf(mail, "Subject: Cron <%s@%s> %s\n",
473 usernm, first_word(hostname, "."),
474 e->cmd);
475 # if defined(MAIL_DATE)
476 fprintf(mail, "Date: %s\n",
477 arpadate(&TargetTime));
478 # endif /* MAIL_DATE */
479 for (env = e->envp; *env; env++)
480 fprintf(mail, "X-Cron-Env: <%s>\n",
481 *env);
482 fprintf(mail, "\n");
483
484 /* this was the first char from the pipe
485 */
486 putc(ch, mail);
487 }
488
489 /* we have to read the input pipe no matter whether
490 * we mail or not, but obviously we only write to
491 * mail pipe if we ARE mailing.
492 */
493
494 while (EOF != (ch = getc(in))) {
495 bytes++;
496 if (mailto)
497 putc(ch, mail);
498 }
499
500 /* only close pipe if we opened it -- i.e., we're
501 * mailing...
502 */
503
504 if (mailto) {
505 Debug(DPROC, ("[%d] closing pipe to mail\n",
506 getpid()))
507 /* Note: the pclose will probably see
508 * the termination of the grandchild
509 * in addition to the mail process, since
510 * it (the grandchild) is likely to exit
511 * after closing its stdout.
512 */
513 status = cron_pclose(mail);
514 }
515
516 /* if there was output and we could not mail it,
517 * log the facts so the poor user can figure out
518 * what's going on.
519 */
520 if (mailto && status) {
521 char buf[MAX_TEMPSTR];
522
523 snprintf(buf, sizeof(buf),
524 "mailed %d byte%s of output but got status 0x%04x\n",
525 bytes, (bytes==1)?"":"s",
526 status);
527 log_it(usernm, getpid(), "MAIL", buf);
528 }
529
530 } /*if data from grandchild*/
531
532 Debug(DPROC, ("[%d] got EOF from grandchild\n", getpid()))
533
534 fclose(in); /* also closes stdout_pipe[READ_PIPE] */
535 }
536
537 /* wait for children to die.
538 */
539 for (; children > 0; children--)
540 {
541 WAIT_T waiter;
542 PID_T pid;
543
544 Debug(DPROC, ("[%d] waiting for grandchild #%d to finish\n",
545 getpid(), children))
546 pid = wait(&waiter);
547 if (pid < OK) {
548 Debug(DPROC, ("[%d] no more grandchildren--mail written?\n",
549 getpid()))
550 break;
551 }
552 Debug(DPROC, ("[%d] grandchild #%d finished, status=%04x",
553 getpid(), pid, WEXITSTATUS(waiter)))
554 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter))
555 Debug(DPROC, (", dumped core"))
556 Debug(DPROC, ("\n"))
557 }
558 }
559
560
561 static void
do_univ(user * u)562 do_univ(user *u)
563 {
564 #if defined(sequent)
565 /* Dynix (Sequent) hack to put the user associated with
566 * the passed user structure into the ATT universe if
567 * necessary. We have to dig the gecos info out of
568 * the user's password entry to see if the magic
569 * "universe(att)" string is present.
570 */
571
572 struct passwd *p;
573 char *s;
574 int i;
575
576 p = getpwuid(u->uid);
577 endpwent();
578
579 if (p == NULL)
580 return;
581
582 s = p->pw_gecos;
583
584 for (i = 0; i < 4; i++)
585 {
586 if ((s = strchr(s, ',')) == NULL)
587 return;
588 s++;
589 }
590 if (strcmp(s, "universe(att)"))
591 return;
592
593 universe(U_ATT);
594 #endif
595 }
596