1 /* Copyright 1988,1990,1993,1994 by Paul Vixie 2 * All rights reserved 3 * 4 * Distribute freely, except: don't remove my name from the source or 5 * documentation (don't take credit for my work), mark your changes (don't 6 * get me blamed for your possible bugs), don't alter or remove this 7 * notice. May be sold if buildable source is provided to buyer. No 8 * warrantee of any kind, express or implied, is included with this 9 * software; use at your own risk, responsibility for damages (if any) to 10 * anyone resulting from the use of this software rests entirely with the 11 * user. 12 * 13 * Send bug reports, bug fixes, enhancements, requests, flames, etc., and 14 * I'll try to keep a version up to date. I can be reached as follows: 15 * Paul Vixie <paul@vix.com> uunet!decwrl!vixie!paul 16 * 17 * $FreeBSD: src/usr.sbin/cron/cron/do_command.c,v 1.27 2007/06/17 17:25:53 yar Exp $ 18 * $DragonFly: src/usr.sbin/cron/cron/do_command.c,v 1.8 2008/01/07 14:11:23 matthias Exp $ 19 */ 20 21 #include "cron.h" 22 #include <sys/signal.h> 23 #if defined(sequent) 24 # include <sys/universe.h> 25 #endif 26 #if defined(SYSLOG) 27 # include <syslog.h> 28 #endif 29 #if defined(LOGIN_CAP) 30 # include <login_cap.h> 31 #endif 32 #ifdef PAM 33 # include <security/pam_appl.h> 34 # include <security/openpam.h> 35 #endif 36 37 static void child_process(entry *, user *), 38 do_univ(user *); 39 40 41 void 42 do_command(entry *e, user *u) 43 { 44 Debug(DPROC, ("[%d] do_command(%s, (%s,%d,%d))\n", 45 getpid(), e->cmd, u->name, e->uid, e->gid)) 46 47 /* fork to become asynchronous -- parent process is done immediately, 48 * and continues to run the normal cron code, which means return to 49 * tick(). the child and grandchild don't leave this function, alive. 50 * 51 * vfork() is unsuitable, since we have much to do, and the parent 52 * needs to be able to run off and fork other processes. 53 */ 54 switch (fork()) { 55 case -1: 56 log_it("CRON",getpid(),"error","can't fork"); 57 break; 58 case 0: 59 /* child process */ 60 acquire_daemonlock(1); 61 child_process(e, u); 62 Debug(DPROC, ("[%d] child process done, exiting\n", getpid())) 63 _exit(OK_EXIT); 64 break; 65 default: 66 /* parent process */ 67 break; 68 } 69 Debug(DPROC, ("[%d] main process returning to work\n", getpid())) 70 } 71 72 73 static void 74 child_process(entry *e, user *u) 75 { 76 int stdin_pipe[2], stdout_pipe[2]; 77 int jitter; 78 char *input_data; 79 char *usernm, *mailto; 80 int children = 0; 81 # if defined(LOGIN_CAP) 82 struct passwd *pwd; 83 login_cap_t *lc; 84 # endif 85 86 Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd)) 87 88 /* mark ourselves as different to PS command watchers by upshifting 89 * our program name. This has no effect on some kernels. 90 */ 91 setproctitle("running job"); 92 93 /* discover some useful and important environment settings 94 */ 95 usernm = env_get("LOGNAME", e->envp); 96 mailto = env_get("MAILTO", e->envp); 97 98 #ifdef PAM 99 /* use PAM to see if the user's account is available, 100 * i.e., not locked or expired or whatever. skip this 101 * for system tasks from /etc/crontab -- they can run 102 * as any user. 103 */ 104 if (strcmp(u->name, SYS_NAME)) { /* not equal */ 105 pam_handle_t *pamh = NULL; 106 int pam_err; 107 struct pam_conv pamc = { 108 .conv = openpam_nullconv, 109 .appdata_ptr = NULL 110 }; 111 112 Debug(DPROC, ("[%d] checking account with PAM\n", getpid())) 113 114 /* u->name keeps crontab owner name while LOGNAME is the name 115 * of user to run command on behalf of. they should be the 116 * same for a task from a per-user crontab. 117 */ 118 if (strcmp(u->name, usernm)) { 119 log_it(usernm, getpid(), "username ambiguity", u->name); 120 exit(ERROR_EXIT); 121 } 122 123 pam_err = pam_start("cron", usernm, &pamc, &pamh); 124 if (pam_err != PAM_SUCCESS) { 125 log_it("CRON", getpid(), "error", "can't start PAM"); 126 exit(ERROR_EXIT); 127 } 128 129 pam_err = pam_acct_mgmt(pamh, PAM_SILENT); 130 /* Expired password shouldn't prevent the job from running. */ 131 if (pam_err != PAM_SUCCESS && pam_err != PAM_NEW_AUTHTOK_REQD) { 132 log_it(usernm, getpid(), "USER", "account unavailable"); 133 exit(ERROR_EXIT); 134 } 135 136 pam_end(pamh, pam_err); 137 } 138 #endif 139 140 #ifdef USE_SIGCHLD 141 /* our parent is watching for our death by catching SIGCHLD. we 142 * do not care to watch for our children's deaths this way -- we 143 * use wait() explictly. so we have to disable the signal (which 144 * was inherited from the parent). 145 */ 146 signal(SIGCHLD, SIG_DFL); 147 #else 148 /* on system-V systems, we are ignoring SIGCLD. we have to stop 149 * ignoring it now or the wait() in cron_pclose() won't work. 150 * because of this, we have to wait() for our children here, as well. 151 */ 152 signal(SIGCLD, SIG_DFL); 153 #endif /*BSD*/ 154 155 /* create some pipes to talk to our future child 156 */ 157 pipe(stdin_pipe); /* child's stdin */ 158 pipe(stdout_pipe); /* child's stdout */ 159 160 /* since we are a forked process, we can diddle the command string 161 * we were passed -- nobody else is going to use it again, right? 162 * 163 * if a % is present in the command, previous characters are the 164 * command, and subsequent characters are the additional input to 165 * the command. Subsequent %'s will be transformed into newlines, 166 * but that happens later. 167 * 168 * If there are escaped %'s, remove the escape character. 169 */ 170 /*local*/{ 171 int escaped = FALSE; 172 int ch; 173 char *p; 174 175 for (input_data = p = e->cmd; (ch = *input_data); 176 input_data++, p++) { 177 if (p != input_data) 178 *p = ch; 179 if (escaped) { 180 if (ch == '%' || ch == '\\') 181 *--p = ch; 182 escaped = FALSE; 183 continue; 184 } 185 if (ch == '\\') { 186 escaped = TRUE; 187 continue; 188 } 189 if (ch == '%') { 190 *input_data++ = '\0'; 191 break; 192 } 193 } 194 *p = '\0'; 195 } 196 197 /* fork again, this time so we can exec the user's command. 198 */ 199 switch (vfork()) { 200 case -1: 201 log_it("CRON",getpid(),"error","can't vfork"); 202 exit(ERROR_EXIT); 203 /*NOTREACHED*/ 204 case 0: 205 Debug(DPROC, ("[%d] grandchild process Vfork()'ed\n", 206 getpid())) 207 208 jitter = (e->uid == ROOT_UID) ? RootJitter : Jitter; 209 if (jitter != 0) { 210 srandom(getpid()); 211 sleep(random() % jitter); 212 } 213 214 /* write a log message. we've waited this long to do it 215 * because it was not until now that we knew the PID that 216 * the actual user command shell was going to get and the 217 * PID is part of the log message. 218 */ 219 /*local*/{ 220 char *x = mkprints((u_char *)e->cmd, strlen(e->cmd)); 221 222 log_it(usernm, getpid(), "CMD", x); 223 free(x); 224 } 225 226 /* that's the last thing we'll log. close the log files. 227 */ 228 #ifdef SYSLOG 229 closelog(); 230 #endif 231 232 /* get new pgrp, void tty, etc. 233 */ 234 setsid(); 235 236 /* close the pipe ends that we won't use. this doesn't affect 237 * the parent, who has to read and write them; it keeps the 238 * kernel from recording us as a potential client TWICE -- 239 * which would keep it from sending SIGPIPE in otherwise 240 * appropriate circumstances. 241 */ 242 close(stdin_pipe[WRITE_PIPE]); 243 close(stdout_pipe[READ_PIPE]); 244 245 /* grandchild process. make std{in,out} be the ends of 246 * pipes opened by our daddy; make stderr go to stdout. 247 */ 248 close(STDIN); dup2(stdin_pipe[READ_PIPE], STDIN); 249 close(STDOUT); dup2(stdout_pipe[WRITE_PIPE], STDOUT); 250 close(STDERR); dup2(STDOUT, STDERR); 251 252 /* close the pipes we just dup'ed. The resources will remain. 253 */ 254 close(stdin_pipe[READ_PIPE]); 255 close(stdout_pipe[WRITE_PIPE]); 256 257 /* set our login universe. Do this in the grandchild 258 * so that the child can invoke /usr/lib/sendmail 259 * without surprises. 260 */ 261 do_univ(u); 262 263 # if defined(LOGIN_CAP) 264 /* Set user's entire context, but skip the environment 265 * as cron provides a separate interface for this 266 */ 267 if ((pwd = getpwnam(usernm)) == NULL) 268 pwd = getpwuid(e->uid); 269 lc = NULL; 270 if (pwd != NULL) { 271 pwd->pw_gid = e->gid; 272 if (e->class != NULL) 273 lc = login_getclass(e->class); 274 } 275 if (pwd && 276 setusercontext(lc, pwd, e->uid, 277 LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETENV)) == 0) 278 endpwent(); 279 else { 280 /* fall back to the old method */ 281 endpwent(); 282 # endif 283 /* set our directory, uid and gid. Set gid first, 284 * since once we set uid, we've lost root privledges. 285 */ 286 setgid(e->gid); 287 # if defined(BSD) 288 initgroups(usernm, e->gid); 289 # endif 290 setlogin(usernm); 291 setuid(e->uid); /* we aren't root after this..*/ 292 #if defined(LOGIN_CAP) 293 } 294 if (lc != NULL) 295 login_close(lc); 296 #endif 297 chdir(env_get("HOME", e->envp)); 298 299 /* exec the command. 300 */ 301 { 302 char *shell = env_get("SHELL", e->envp); 303 304 # if DEBUGGING 305 if (DebugFlags & DTEST) { 306 fprintf(stderr, 307 "debug DTEST is on, not exec'ing command.\n"); 308 fprintf(stderr, 309 "\tcmd='%s' shell='%s'\n", e->cmd, shell); 310 _exit(OK_EXIT); 311 } 312 # endif /*DEBUGGING*/ 313 execle(shell, shell, "-c", e->cmd, NULL, e->envp); 314 warn("execl: couldn't exec `%s'", shell); 315 _exit(ERROR_EXIT); 316 } 317 break; 318 default: 319 /* parent process */ 320 break; 321 } 322 323 children++; 324 325 /* middle process, child of original cron, parent of process running 326 * the user's command. 327 */ 328 329 Debug(DPROC, ("[%d] child continues, closing pipes\n", getpid())) 330 331 /* close the ends of the pipe that will only be referenced in the 332 * grandchild process... 333 */ 334 close(stdin_pipe[READ_PIPE]); 335 close(stdout_pipe[WRITE_PIPE]); 336 337 /* 338 * write, to the pipe connected to child's stdin, any input specified 339 * after a % in the crontab entry. while we copy, convert any 340 * additional %'s to newlines. when done, if some characters were 341 * written and the last one wasn't a newline, write a newline. 342 * 343 * Note that if the input data won't fit into one pipe buffer (2K 344 * or 4K on most BSD systems), and the child doesn't read its stdin, 345 * we would block here. thus we must fork again. 346 */ 347 348 if (*input_data && fork() == 0) { 349 FILE *out; 350 int need_newline = FALSE; 351 int escaped = FALSE; 352 int ch; 353 354 out = fdopen(stdin_pipe[WRITE_PIPE], "w"); 355 if (out == NULL) { 356 warn("fdopen failed in child2"); 357 _exit(ERROR_EXIT); 358 } 359 360 Debug(DPROC, ("[%d] child2 sending data to grandchild\n", getpid())) 361 362 /* close the pipe we don't use, since we inherited it and 363 * are part of its reference count now. 364 */ 365 close(stdout_pipe[READ_PIPE]); 366 367 /* translation: 368 * \% -> % 369 * % -> \n 370 * \x -> \x for all x != % 371 */ 372 while ((ch = *input_data++)) { 373 if (escaped) { 374 if (ch != '%') 375 putc('\\', out); 376 } else { 377 if (ch == '%') 378 ch = '\n'; 379 } 380 381 if (!(escaped = (ch == '\\'))) { 382 putc(ch, out); 383 need_newline = (ch != '\n'); 384 } 385 } 386 if (escaped) 387 putc('\\', out); 388 if (need_newline) 389 putc('\n', out); 390 391 /* close the pipe, causing an EOF condition. fclose causes 392 * stdin_pipe[WRITE_PIPE] to be closed, too. 393 */ 394 fclose(out); 395 396 Debug(DPROC, ("[%d] child2 done sending to grandchild\n", getpid())) 397 exit(0); 398 } 399 400 /* close the pipe to the grandkiddie's stdin, since its wicked uncle 401 * ernie back there has it open and will close it when he's done. 402 */ 403 close(stdin_pipe[WRITE_PIPE]); 404 405 children++; 406 407 /* 408 * read output from the grandchild. it's stderr has been redirected to 409 * it's stdout, which has been redirected to our pipe. if there is any 410 * output, we'll be mailing it to the user whose crontab this is... 411 * when the grandchild exits, we'll get EOF. 412 */ 413 414 Debug(DPROC, ("[%d] child reading output from grandchild\n", getpid())) 415 416 /*local*/{ 417 FILE *in; 418 int ch; 419 420 in = fdopen(stdout_pipe[READ_PIPE], "r"); 421 if (in == NULL) { 422 warn("fdopen failed in child"); 423 _exit(ERROR_EXIT); 424 } 425 426 ch = getc(in); 427 if (ch != EOF) { 428 FILE *mail; 429 int bytes = 1; 430 int status = 0; 431 432 Debug(DPROC|DEXT, 433 ("[%d] got data (%x:%c) from grandchild\n", 434 getpid(), ch, ch)) 435 436 /* get name of recipient. this is MAILTO if set to a 437 * valid local username; USER otherwise. 438 */ 439 if (mailto) { 440 /* MAILTO was present in the environment 441 */ 442 if (!*mailto) { 443 /* ... but it's empty. set to NULL 444 */ 445 mailto = NULL; 446 } 447 } else { 448 /* MAILTO not present, set to USER. 449 */ 450 mailto = usernm; 451 } 452 453 /* if we are supposed to be mailing, MAILTO will 454 * be non-NULL. only in this case should we set 455 * up the mail command and subjects and stuff... 456 */ 457 458 if (mailto) { 459 char **env; 460 char mailcmd[MAX_COMMAND]; 461 char hostname[MAXHOSTNAMELEN]; 462 463 gethostname(hostname, MAXHOSTNAMELEN); 464 snprintf(mailcmd, sizeof(mailcmd), 465 MAILARGS, MAILCMD); 466 if (!(mail = cron_popen(mailcmd, "w", e))) { 467 warn("%s", MAILCMD); 468 _exit(ERROR_EXIT); 469 } 470 fprintf(mail, "From: %s (Cron Daemon)\n", usernm); 471 fprintf(mail, "To: %s\n", mailto); 472 fprintf(mail, "Subject: Cron <%s@%s> %s\n", 473 usernm, first_word(hostname, "."), 474 e->cmd); 475 # if defined(MAIL_DATE) 476 fprintf(mail, "Date: %s\n", 477 arpadate(&TargetTime)); 478 # endif /* MAIL_DATE */ 479 for (env = e->envp; *env; env++) 480 fprintf(mail, "X-Cron-Env: <%s>\n", 481 *env); 482 fprintf(mail, "\n"); 483 484 /* this was the first char from the pipe 485 */ 486 putc(ch, mail); 487 } 488 489 /* we have to read the input pipe no matter whether 490 * we mail or not, but obviously we only write to 491 * mail pipe if we ARE mailing. 492 */ 493 494 while (EOF != (ch = getc(in))) { 495 bytes++; 496 if (mailto) 497 putc(ch, mail); 498 } 499 500 /* only close pipe if we opened it -- i.e., we're 501 * mailing... 502 */ 503 504 if (mailto) { 505 Debug(DPROC, ("[%d] closing pipe to mail\n", 506 getpid())) 507 /* Note: the pclose will probably see 508 * the termination of the grandchild 509 * in addition to the mail process, since 510 * it (the grandchild) is likely to exit 511 * after closing its stdout. 512 */ 513 status = cron_pclose(mail); 514 } 515 516 /* if there was output and we could not mail it, 517 * log the facts so the poor user can figure out 518 * what's going on. 519 */ 520 if (mailto && status) { 521 char buf[MAX_TEMPSTR]; 522 523 snprintf(buf, sizeof(buf), 524 "mailed %d byte%s of output but got status 0x%04x\n", 525 bytes, (bytes==1)?"":"s", 526 status); 527 log_it(usernm, getpid(), "MAIL", buf); 528 } 529 530 } /*if data from grandchild*/ 531 532 Debug(DPROC, ("[%d] got EOF from grandchild\n", getpid())) 533 534 fclose(in); /* also closes stdout_pipe[READ_PIPE] */ 535 } 536 537 /* wait for children to die. 538 */ 539 for (; children > 0; children--) 540 { 541 WAIT_T waiter; 542 PID_T pid; 543 544 Debug(DPROC, ("[%d] waiting for grandchild #%d to finish\n", 545 getpid(), children)) 546 pid = wait(&waiter); 547 if (pid < OK) { 548 Debug(DPROC, ("[%d] no more grandchildren--mail written?\n", 549 getpid())) 550 break; 551 } 552 Debug(DPROC, ("[%d] grandchild #%d finished, status=%04x", 553 getpid(), pid, WEXITSTATUS(waiter))) 554 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter)) 555 Debug(DPROC, (", dumped core")) 556 Debug(DPROC, ("\n")) 557 } 558 } 559 560 561 static void 562 do_univ(user *u) 563 { 564 #if defined(sequent) 565 /* Dynix (Sequent) hack to put the user associated with 566 * the passed user structure into the ATT universe if 567 * necessary. We have to dig the gecos info out of 568 * the user's password entry to see if the magic 569 * "universe(att)" string is present. 570 */ 571 572 struct passwd *p; 573 char *s; 574 int i; 575 576 p = getpwuid(u->uid); 577 endpwent(); 578 579 if (p == NULL) 580 return; 581 582 s = p->pw_gecos; 583 584 for (i = 0; i < 4; i++) 585 { 586 if ((s = strchr(s, ',')) == NULL) 587 return; 588 s++; 589 } 590 if (strcmp(s, "universe(att)")) 591 return; 592 593 universe(U_ATT); 594 #endif 595 } 596