usr.sbin/cron/cron/do_command.c

   1 /* Copyright 1988,1990,1993,1994 by Paul Vixie
   2  * All rights reserved
   3  *
   4  * Distribute freely, except: don't remove my name from the source or
   5  * documentation (don't take credit for my work), mark your changes (don't
   6  * get me blamed for your possible bugs), don't alter or remove this
   7  * notice.  May be sold if buildable source is provided to buyer.  No
   8  * warrantee of any kind, express or implied, is included with this
   9  * software; use at your own risk, responsibility for damages (if any) to
  10  * anyone resulting from the use of this software rests entirely with the
  11  * user.
  12  *
  13  * Send bug reports, bug fixes, enhancements, requests, flames, etc., and
  14  * I'll try to keep a version up to date.  I can be reached as follows:
  15  * Paul Vixie          <paul@vix.com>          uunet!decwrl!vixie!paul
  16  *
  17  * $FreeBSD: src/usr.sbin/cron/cron/do_command.c,v 1.15.2.5 2001/05/04 00:59:40 peter Exp $
  18  * $DragonFly: src/usr.sbin/cron/cron/do_command.c,v 1.7 2006/03/18 20:29:50 dillon Exp $
  19  */
  20
  21 #include "cron.h"
  22 #include <sys/signal.h>
  23 #if defined(sequent)
  24 # include <sys/universe.h>
  25 #endif
  26 #if defined(SYSLOG)
  27 # include <syslog.h>
  28 #endif
  29 #if defined(LOGIN_CAP)
  30 # include <login_cap.h>
  31 #endif
  32
  33
  34 static void             child_process(entry *, user *),
  35                         do_univ(user *);
  36
  37
  38 void
  39 do_command(entry *e, user *u)
  40 {
  41         Debug(DPROC, ("[%d] do_command(%s, (%s,%d,%d))\n",
  42                 getpid(), e->cmd, u->name, e->uid, e->gid))
  43
  44         /* fork to become asynchronous -- parent process is done immediately,
  45          * and continues to run the normal cron code, which means return to
  46          * tick().  the child and grandchild don't leave this function, alive.
  47          *
  48          * vfork() is unsuitable, since we have much to do, and the parent
  49          * needs to be able to run off and fork other processes.
  50          */
  51         switch (fork()) {
  52         case -1:
  53                 log_it("CRON",getpid(),"error","can't fork");
  54                 break;
  55         case 0:
  56                 /* child process */
  57                 acquire_daemonlock(1);
  58                 child_process(e, u);
  59                 Debug(DPROC, ("[%d] child process done, exiting\n", getpid()))
  60                 _exit(OK_EXIT);
  61                 break;
  62         default:
  63                 /* parent process */
  64                 break;
  65         }
  66         Debug(DPROC, ("[%d] main process returning to work\n", getpid()))
  67 }
  68
  69
  70 static void
  71 child_process(entry *e, user *u)
  72 {
  73         int stdin_pipe[2], stdout_pipe[2];
  74         int jitter;
  75         char *input_data;
  76         char *usernm, *mailto;
  77         int children = 0;
  78 # if defined(LOGIN_CAP)
  79         struct passwd *pwd;
  80         login_cap_t *lc;
  81 # endif
  82
  83         Debug(DPROC, ("[%d] child_process('%s')\n", getpid(), e->cmd))
  84
  85         /* mark ourselves as different to PS command watchers by upshifting
  86          * our program name.  This has no effect on some kernels.
  87          */
  88         setproctitle("running job");
  89
  90         /* discover some useful and important environment settings
  91          */
  92         usernm = env_get("LOGNAME", e->envp);
  93         mailto = env_get("MAILTO", e->envp);
  94
  95 #ifdef USE_SIGCHLD
  96         /* our parent is watching for our death by catching SIGCHLD.  we
  97          * do not care to watch for our children's deaths this way -- we
  98          * use wait() explictly.  so we have to disable the signal (which
  99          * was inherited from the parent).
 100          */
 101         signal(SIGCHLD, SIG_DFL);
 102 #else
 103         /* on system-V systems, we are ignoring SIGCLD.  we have to stop
 104          * ignoring it now or the wait() in cron_pclose() won't work.
 105          * because of this, we have to wait() for our children here, as well.
 106          */
 107         signal(SIGCLD, SIG_DFL);
 108 #endif /*BSD*/
 109
 110         /* create some pipes to talk to our future child
 111          */
 112         pipe(stdin_pipe);       /* child's stdin */
 113         pipe(stdout_pipe);      /* child's stdout */
 114
 115         /* since we are a forked process, we can diddle the command string
 116          * we were passed -- nobody else is going to use it again, right?
 117          *
 118          * if a % is present in the command, previous characters are the
 119          * command, and subsequent characters are the additional input to
 120          * the command.  Subsequent %'s will be transformed into newlines,
 121          * but that happens later.
 122          *
 123          * If there are escaped %'s, remove the escape character.
 124          */
 125         /*local*/{
 126                 int escaped = FALSE;
 127                 int ch;
 128                 char *p;
 129
 130                 for (input_data = p = e->cmd; (ch = *input_data);
 131                      input_data++, p++) {
 132                         if (p != input_data)
 133                             *p = ch;
 134                         if (escaped) {
 135                                 if (ch == '%' || ch == '\\')
 136                                         *--p = ch;
 137                                 escaped = FALSE;
 138                                 continue;
 139                         }
 140                         if (ch == '\\') {
 141                                 escaped = TRUE;
 142                                 continue;
 143                         }
 144                         if (ch == '%') {
 145                                 *input_data++ = '\0';
 146                                 break;
 147                         }
 148                 }
 149                 *p = '\0';
 150         }
 151
 152         /* fork again, this time so we can exec the user's command.
 153          */
 154         switch (vfork()) {
 155         case -1:
 156                 log_it("CRON",getpid(),"error","can't vfork");
 157                 exit(ERROR_EXIT);
 158                 /*NOTREACHED*/
 159         case 0:
 160                 Debug(DPROC, ("[%d] grandchild process Vfork()'ed\n",
 161                               getpid()))
 162
 163                 jitter = (e->uid == ROOT_UID) ? RootJitter : Jitter;
 164                 if (jitter != 0) {
 165                         srandom(getpid());
 166                         sleep(random() % jitter);
 167                 }
 168
 169                 /* write a log message.  we've waited this long to do it
 170                  * because it was not until now that we knew the PID that
 171                  * the actual user command shell was going to get and the
 172                  * PID is part of the log message.
 173                  */
 174                 /*local*/{
 175                         char *x = mkprints((u_char *)e->cmd, strlen(e->cmd));
 176
 177                         log_it(usernm, getpid(), "CMD", x);
 178                         free(x);
 179                 }
 180
 181                 /* that's the last thing we'll log.  close the log files.
 182                  */
 183 #ifdef SYSLOG
 184                 closelog();
 185 #endif
 186
 187                 /* get new pgrp, void tty, etc.
 188                  */
 189                 setsid();
 190
 191                 /* close the pipe ends that we won't use.  this doesn't affect
 192                  * the parent, who has to read and write them; it keeps the
 193                  * kernel from recording us as a potential client TWICE --
 194                  * which would keep it from sending SIGPIPE in otherwise
 195                  * appropriate circumstances.
 196                  */
 197                 close(stdin_pipe[WRITE_PIPE]);
 198                 close(stdout_pipe[READ_PIPE]);
 199
 200                 /* grandchild process.  make std{in,out} be the ends of
 201                  * pipes opened by our daddy; make stderr go to stdout.
 202                  */
 203                 close(STDIN);   dup2(stdin_pipe[READ_PIPE], STDIN);
 204                 close(STDOUT);  dup2(stdout_pipe[WRITE_PIPE], STDOUT);
 205                 close(STDERR);  dup2(STDOUT, STDERR);
 206
 207                 /* close the pipes we just dup'ed.  The resources will remain.
 208                  */
 209                 close(stdin_pipe[READ_PIPE]);
 210                 close(stdout_pipe[WRITE_PIPE]);
 211
 212                 /* set our login universe.  Do this in the grandchild
 213                  * so that the child can invoke /usr/lib/sendmail
 214                  * without surprises.
 215                  */
 216                 do_univ(u);
 217
 218 # if defined(LOGIN_CAP)
 219                 /* Set user's entire context, but skip the environment
 220                  * as cron provides a separate interface for this
 221                  */
 222                 if ((pwd = getpwnam(usernm)) == NULL)
 223                         pwd = getpwuid(e->uid);
 224                 lc = NULL;
 225                 if (pwd != NULL) {
 226                         pwd->pw_gid = e->gid;
 227                         if (e->class != NULL)
 228                                 lc = login_getclass(e->class);
 229                 }
 230                 if (pwd &&
 231                     setusercontext(lc, pwd, e->uid,
 232                             LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETENV)) == 0)
 233                         endpwent();
 234                 else {
 235                         /* fall back to the old method */
 236                         endpwent();
 237 # endif
 238                         /* set our directory, uid and gid.  Set gid first,
 239                          * since once we set uid, we've lost root privledges.
 240                          */
 241                         setgid(e->gid);
 242 # if defined(BSD)
 243                         initgroups(usernm, e->gid);
 244 # endif
 245                         setlogin(usernm);
 246                         setuid(e->uid);         /* we aren't root after this..*/
 247 #if defined(LOGIN_CAP)
 248                 }
 249                 if (lc != NULL)
 250                         login_close(lc);
 251 #endif
 252                 chdir(env_get("HOME", e->envp));
 253
 254                 /* exec the command.
 255                  */
 256                 {
 257                         char    *shell = env_get("SHELL", e->envp);
 258
 259 # if DEBUGGING
 260                         if (DebugFlags & DTEST) {
 261                                 fprintf(stderr,
 262                                 "debug DTEST is on, not exec'ing command.\n");
 263                                 fprintf(stderr,
 264                                 "\tcmd='%s' shell='%s'\n", e->cmd, shell);
 265                                 _exit(OK_EXIT);
 266                         }
 267 # endif /*DEBUGGING*/
 268                         execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
 269                         warn("execl: couldn't exec `%s'", shell);
 270                         _exit(ERROR_EXIT);
 271                 }
 272                 break;
 273         default:
 274                 /* parent process */
 275                 break;
 276         }
 277
 278         children++;
 279
 280         /* middle process, child of original cron, parent of process running
 281          * the user's command.
 282          */
 283
 284         Debug(DPROC, ("[%d] child continues, closing pipes\n", getpid()))
 285
 286         /* close the ends of the pipe that will only be referenced in the
 287          * grandchild process...
 288          */
 289         close(stdin_pipe[READ_PIPE]);
 290         close(stdout_pipe[WRITE_PIPE]);
 291
 292         /*
 293          * write, to the pipe connected to child's stdin, any input specified
 294          * after a % in the crontab entry.  while we copy, convert any
 295          * additional %'s to newlines.  when done, if some characters were
 296          * written and the last one wasn't a newline, write a newline.
 297          *
 298          * Note that if the input data won't fit into one pipe buffer (2K
 299          * or 4K on most BSD systems), and the child doesn't read its stdin,
 300          * we would block here.  thus we must fork again.
 301          */
 302
 303         if (*input_data && fork() == 0) {
 304                 FILE *out;
 305                 int need_newline = FALSE;
 306                 int escaped = FALSE;
 307                 int ch;
 308
 309                 out = fdopen(stdin_pipe[WRITE_PIPE], "w");
 310                 if (out == NULL) {
 311                         warn("fdopen failed in child2");
 312                         _exit(ERROR_EXIT);
 313                 }
 314
 315                 Debug(DPROC, ("[%d] child2 sending data to grandchild\n", getpid()))
 316
 317                 /* close the pipe we don't use, since we inherited it and
 318                  * are part of its reference count now.
 319                  */
 320                 close(stdout_pipe[READ_PIPE]);
 321
 322                 /* translation:
 323                  *      \% -> %
 324                  *      %  -> \n
 325                  *      \x -> \x        for all x != %
 326                  */
 327                 while ((ch = *input_data++)) {
 328                         if (escaped) {
 329                                 if (ch != '%')
 330                                         putc('\\', out);
 331                         } else {
 332                                 if (ch == '%')
 333                                         ch = '\n';
 334                         }
 335
 336                         if (!(escaped = (ch == '\\'))) {
 337                                 putc(ch, out);
 338                                 need_newline = (ch != '\n');
 339                         }
 340                 }
 341                 if (escaped)
 342                         putc('\\', out);
 343                 if (need_newline)
 344                         putc('\n', out);
 345
 346                 /* close the pipe, causing an EOF condition.  fclose causes
 347                  * stdin_pipe[WRITE_PIPE] to be closed, too.
 348                  */
 349                 fclose(out);
 350
 351                 Debug(DPROC, ("[%d] child2 done sending to grandchild\n", getpid()))
 352                 exit(0);
 353         }
 354
 355         /* close the pipe to the grandkiddie's stdin, since its wicked uncle
 356          * ernie back there has it open and will close it when he's done.
 357          */
 358         close(stdin_pipe[WRITE_PIPE]);
 359
 360         children++;
 361
 362         /*
 363          * read output from the grandchild.  it's stderr has been redirected to
 364          * it's stdout, which has been redirected to our pipe.  if there is any
 365          * output, we'll be mailing it to the user whose crontab this is...
 366          * when the grandchild exits, we'll get EOF.
 367          */
 368
 369         Debug(DPROC, ("[%d] child reading output from grandchild\n", getpid()))
 370
 371         /*local*/{
 372                 FILE *in;
 373                 int ch;
 374
 375                 in = fdopen(stdout_pipe[READ_PIPE], "r");
 376                 if (in == NULL) {
 377                         warn("fdopen failed in child");
 378                         _exit(ERROR_EXIT);
 379                 }
 380
 381                 ch = getc(in);
 382                 if (ch != EOF) {
 383                         FILE *mail;
 384                         int bytes = 1;
 385                         int status = 0;
 386
 387                         Debug(DPROC|DEXT,
 388                                 ("[%d] got data (%x:%c) from grandchild\n",
 389                                         getpid(), ch, ch))
 390
 391                         /* get name of recipient.  this is MAILTO if set to a
 392                          * valid local username; USER otherwise.
 393                          */
 394                         if (mailto) {
 395                                 /* MAILTO was present in the environment
 396                                  */
 397                                 if (!*mailto) {
 398                                         /* ... but it's empty. set to NULL
 399                                          */
 400                                         mailto = NULL;
 401                                 }
 402                         } else {
 403                                 /* MAILTO not present, set to USER.
 404                                  */
 405                                 mailto = usernm;
 406                         }
 407
 408                         /* if we are supposed to be mailing, MAILTO will
 409                          * be non-NULL.  only in this case should we set
 410                          * up the mail command and subjects and stuff...
 411                          */
 412
 413                         if (mailto) {
 414                                 char **env;
 415                                 char mailcmd[MAX_COMMAND];
 416                                 char hostname[MAXHOSTNAMELEN];
 417
 418                                 gethostname(hostname, MAXHOSTNAMELEN);
 419                                 snprintf(mailcmd, sizeof(mailcmd),
 420                                          MAILARGS, MAILCMD);
 421                                 if (!(mail = cron_popen(mailcmd, "w", e))) {
 422                                         warn("%s", MAILCMD);
 423                                         _exit(ERROR_EXIT);
 424                                 }
 425                                 fprintf(mail, "From: %s (Cron Daemon)\n", usernm);
 426                                 fprintf(mail, "To: %s\n", mailto);
 427                                 fprintf(mail, "Subject: Cron <%s@%s> %s\n",
 428                                         usernm, first_word(hostname, "."),
 429                                         e->cmd);
 430 # if defined(MAIL_DATE)
 431                                 fprintf(mail, "Date: %s\n",
 432                                         arpadate(&TargetTime));
 433 # endif /* MAIL_DATE */
 434                                 for (env = e->envp;  *env;  env++)
 435                                         fprintf(mail, "X-Cron-Env: <%s>\n",
 436                                                 *env);
 437                                 fprintf(mail, "\n");
 438
 439                                 /* this was the first char from the pipe
 440                                  */
 441                                 putc(ch, mail);
 442                         }
 443
 444                         /* we have to read the input pipe no matter whether
 445                          * we mail or not, but obviously we only write to
 446                          * mail pipe if we ARE mailing.
 447                          */
 448
 449                         while (EOF != (ch = getc(in))) {
 450                                 bytes++;
 451                                 if (mailto)
 452                                         putc(ch, mail);
 453                         }
 454
 455                         /* only close pipe if we opened it -- i.e., we're
 456                          * mailing...
 457                          */
 458
 459                         if (mailto) {
 460                                 Debug(DPROC, ("[%d] closing pipe to mail\n",
 461                                         getpid()))
 462                                 /* Note: the pclose will probably see
 463                                  * the termination of the grandchild
 464                                  * in addition to the mail process, since
 465                                  * it (the grandchild) is likely to exit
 466                                  * after closing its stdout.
 467                                  */
 468                                 status = cron_pclose(mail);
 469                         }
 470
 471                         /* if there was output and we could not mail it,
 472                          * log the facts so the poor user can figure out
 473                          * what's going on.
 474                          */
 475                         if (mailto && status) {
 476                                 char buf[MAX_TEMPSTR];
 477
 478                                 snprintf(buf, sizeof(buf),
 479                         "mailed %d byte%s of output but got status 0x%04x\n",
 480                                         bytes, (bytes==1)?"":"s",
 481                                         status);
 482                                 log_it(usernm, getpid(), "MAIL", buf);
 483                         }
 484
 485                 } /*if data from grandchild*/
 486
 487                 Debug(DPROC, ("[%d] got EOF from grandchild\n", getpid()))
 488
 489                 fclose(in);     /* also closes stdout_pipe[READ_PIPE] */
 490         }
 491
 492         /* wait for children to die.
 493          */
 494         for (;  children > 0;  children--)
 495         {
 496                 WAIT_T          waiter;
 497                 PID_T           pid;
 498
 499                 Debug(DPROC, ("[%d] waiting for grandchild #%d to finish\n",
 500                         getpid(), children))
 501                 pid = wait(&waiter);
 502                 if (pid < OK) {
 503                         Debug(DPROC, ("[%d] no more grandchildren--mail written?\n",
 504                                 getpid()))
 505                         break;
 506                 }
 507                 Debug(DPROC, ("[%d] grandchild #%d finished, status=%04x",
 508                         getpid(), pid, WEXITSTATUS(waiter)))
 509                 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter))
 510                         Debug(DPROC, (", dumped core"))
 511                 Debug(DPROC, ("\n"))
 512         }
 513 }
 514
 515
 516 static void
 517 do_univ(user *u)
 518 {
 519 #if defined(sequent)
 520 /* Dynix (Sequent) hack to put the user associated with
 521  * the passed user structure into the ATT universe if
 522  * necessary.  We have to dig the gecos info out of
 523  * the user's password entry to see if the magic
 524  * "universe(att)" string is present.
 525  */
 526
 527         struct  passwd  *p;
 528         char    *s;
 529         int     i;
 530
 531         p = getpwuid(u->uid);
 532         endpwent();
 533
 534         if (p == NULL)
 535                 return;
 536
 537         s = p->pw_gecos;
 538
 539         for (i = 0; i < 4; i++)
 540         {
 541                 if ((s = strchr(s, ',')) == NULL)
 542                         return;
 543                 s++;
 544         }
 545         if (strcmp(s, "universe(att)"))
 546                 return;
 547
 548         universe(U_ATT);
 549 #endif
 550 }