| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
|
| |
|
|
|
|
|
| |
Did this ever work?
* src/mcron/scripts/cron.scm (main): install signal handlers using numbers
that symbols evaluate to instead of symbols.
|
| |
|
|
|
| |
* src/cron.in: remove the options
* src/mcron/scripts/cron.scm: no need for extra processing
|
| |
|
|
|
|
|
|
|
| |
This is a pre-emptive delta which will make use of new facilities
in a future Guile for command-line option processing---a fuller
description will appear with later patches.
* src/{cron,crontab,mcron}.in: use new facility
* src/mcron/scripts/{cron,crontab,mcron}.scm: remove old option-scanning code
|
| |
|
|
|
|
|
|
| |
This makes the behaviour backwards compatible with all previous uses of mcron.
* src/mcron/base.scm: establish %do-logging parameter and act on it
* src/mcron/scripts/mcron.scm: set %do-logging according to command line
* tests/base.scm: some tests require %do-logging to be set
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Before this change, it was difficult to discern which job emitted which
output, as there was no information connecting the job to the output it
produced. This change rectifies that by annotating each line output by
cron/mcron with a prefix that contains a timestamp and the job name. It also
reports about when the job runs and whether it completed successfully or
failed. It was initially suggested here: <https://issues.guix.gnu.org/36510>.
Thanks to the fine people from the #guile libera.chat IRC channel for
providing ideas and help; this change would not have been possible without
them!
* src/mcron/base.scm (install-suspendable-ports!): Install suspendable ports.
(%date-format, %log-format): New parameters.
(validate-date-format, validate-log-format): New procedures.
(<job-data>): New record.
(run-job): Update doc. Redirect stdout and stderr to a pipe. Return a
<job-data> instance containing the input port and other information about the
job. Output job status messages.
(process-output): New procedure.
(child-cleanup): Add docstring. Use positive logic. Call 'process-output'
one last time after a child process is collected.
(run-job-loop): Add a CHILDREN-DATA variable to the loop. Provide the open
file descriptors of the children ports to select*, and collect their output
when they trigger select.
* tests/base.scm ("run-job: basic"): Adjust and fix indentation.
(dummy-job/capture-output): New procedure.
("run-job, output"): New test.
("validate-date-format, valid", "validate-date-format, invalid")
("validate-log-format, valid", "validate-log-format, invalid")
("run-job, output with custom format", "run-job, failure")
("run-job, failure in shell action"): New tests.
* src/mcron/scripts/cron.scm (show-help): Document new options.
(%options) [log-format, date-format]: New options.
(main): Parameterize the main loop with the new parameter options (or their
default values when not provided); move exception handling elsewhere (see
below).
* src/mcron/scripts/mcron.scm: Likewise.
* src/cron.in: Install error handler here.
* src/mcron.in: Likewise.
* doc/mcron.texi: Document new cron and mcron options, as well as new
(mcron base) APIs.
* tests/basic.sh: Test the new options.
Suggested-by: Robert Vollmert <rob@vllmrt.net>
|
| |
|
|
| |
* src/mcron/scripts/mcron.scm: modified string literal
|
| |
|
|
| |
* src/mcron/scripts/mcron.scm: modified string literal
|
| |
|
|
|
|
|
|
|
|
| |
This patch gets rid of the thin veneer that we currently have around the three
executables. This was done for historical reasons (circa 2003 Guile couldnʼt
deal with process signals and forks). In fact these problems were fixed many
moons ago, and there is now no need for it. The project becomes 100% Guile!
Many files are affected; interested coders should use the GIT repository to
understand the details of all the changes.
|
| |
|
|
|
|
|
|
|
| |
Previously were looking for files listed on the command line in
Guile's modules directory. This is a bug-fix; running
'make check' will reveal one less failure than before.
* src/mcron/scripts/mcron.scm (process-user-file): use read and eval
instead of load.
|
| |
|
|
|
|
|
|
| |
It seems that it is not useful to catch 'misc-error exception when
calling 'getopt-long'. Since 'parse-args' purpose was only to catch
this particular error, it can be deleted.
* src/mcron/utils.scm (parse-args): Remove.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
* src/mcron/utils.scm (for-each-file): Delete.
* src/mcron/scripts/cron.scm (process-files-in-system-directory): Use
'scandir' which has the benefit of being deterministic.
* src/mcron/scripts/mcron.scm (process-files-in-user-directory):
Likewise.
* tests/schedule.sh: Update expected output which is now more reliable.
* NEWS: Update.
Suggested-by: Ludovic Courtès <ludo@gnu.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
This procedure is a more generic and less coupled version of
'get-schedule' which has been kept for backward compatibility and
deprecated.
* src/mcron/base.scm (display-schedule): New procedure.
(get-schedule): Move to ...
* src/mcron/core.scm: ... here.
* src/mcron/scripts/cron.scm (main): Use 'display-schedule'.
* src/mcron/scripts/mcron.scm (main): Likewise.
* doc/mcron.texi (The base module): Document it.
|
| |
|
|
|
| |
* src/mcron/scripts/crontab.scm (in-access-file?)
(hit-server): New procedures.
|
| |
|
|
|
|
|
|
|
|
|
| |
'argp' is a convenient and maintainable way to parse command line arguments.
Guile doesn't offer an equivalent of this, so the command line handling has
been moved to C.
* src/mcron.c (parse_args, parse_opt): New functions.
(inner_main): Call 'parse_args'.
* src/mcron/scripts/mcron.scm (show-help, %options): Delete.
(main): Remove command line handling.
|
| |
|
|
|
|
|
| |
* src/mcron/utils.scm: Re-export 'read-string'.
(stdin->string): Delete.
* src/mcron/scripts/crontab.scm (main): Use 'read-string' instead.
* src/mcron/scripts/mcron.scm (process-user-file): Likewise.
|
| |
|
|
|
|
|
|
|
| |
* src/mcron/main.scm: Rename to ...
* src/mcron/utils.scm: ... this.
* src/mcron/scripts/cron.scm: Adapt.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Likewise.
|
|
|
This improves readability and complies with the GNU Coding Standards by
making the behavior of the programs independent of the name used to
invoke them.
* src/mcron/scripts/cron.scm: New file.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Remove 'src/mcron/crontab.scm'.
(bin_PROGRAMS): Add 'crontab'.
(sbin_PROGRAMS): Add 'cron'.
(mcron_CFLAGS, mcron_LDADD): Rename to ...
(AM_CFLAGS, LDADD): ... these.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES)
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES)
(mcron_CPPFLAGS, mcronscriptdir, dist_mcronscript_DATA): New variables.
(modules): Redefine it in terms of other '_DATA' variables.
* src/mcron/crontab.scm: Remove file.
* src/mcron/main.scm (parse-args): New procedure.
(command-name, command-type, options): Remove.
(show-version): Adapt.
(show-help, process-files-in-system-directory, cron-file-descriptors)
(main, process-user-file, process-files-in-user-directory): Move
procedures in the new files.
* src/mcron.c (inner_main): Define the current module at compile time.
* TODO: Update.
* .gitignore: Likewise.
|
