1 /* $OpenBSD: do_command.c,v 1.11 2001/10/24 17:28:16 millert Exp $ */ 2 /* Copyright 1988,1990,1993,1994 by Paul Vixie 3 * All rights reserved 4 */ 5 6 /* 7 * Copyright (c) 1997,2000 by Internet Software Consortium, Inc. 8 * 9 * Permission to use, copy, modify, and distribute this software for any 10 * purpose with or without fee is hereby granted, provided that the above 11 * copyright notice and this permission notice appear in all copies. 12 * 13 * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS 14 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES 15 * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE 16 * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL 17 * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR 18 * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS 19 * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS 20 * SOFTWARE. 21 */ 22 23 #if !defined(lint) && !defined(LINT) 24 static char rcsid[] = "$OpenBSD: do_command.c,v 1.11 2001/10/24 17:28:16 millert Exp $"; 25 #endif 26 27 #include "cron.h" 28 29 static void child_process(entry *, user *); 30 static int safe_p(const char *, const char *); 31 32 void 33 do_command(entry *e, user *u) { 34 Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n", 35 (long)getpid(), e->cmd, u->name, 36 (long)e->uid, (long)e->gid)) 37 38 /* fork to become asynchronous -- parent process is done immediately, 39 * and continues to run the normal cron code, which means return to 40 * tick(). the child and grandchild don't leave this function, alive. 41 * 42 * vfork() is unsuitable, since we have much to do, and the parent 43 * needs to be able to run off and fork other processes. 44 */ 45 switch (fork()) { 46 case -1: 47 log_it("CRON", getpid(), "error", "can't fork"); 48 break; 49 case 0: 50 /* child process */ 51 acquire_daemonlock(1); 52 child_process(e, u); 53 Debug(DPROC, ("[%ld] child process done, exiting\n", 54 (long)getpid())) 55 _exit(OK_EXIT); 56 break; 57 default: 58 /* parent process */ 59 break; 60 } 61 Debug(DPROC, ("[%ld] main process returning to work\n",(long)getpid())) 62 } 63 64 static void 65 child_process(entry *e, user *u) { 66 int stdin_pipe[2], stdout_pipe[2]; 67 char *usernm; 68 char * volatile input_data, * volatile mailto; 69 volatile int children = 0; 70 71 Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd)) 72 73 #ifdef CAPITALIZE_FOR_PS 74 /* mark ourselves as different to PS command watchers by upshifting 75 * our program name. This has no effect on some kernels. 76 */ 77 /*local*/{ 78 char *pch; 79 80 for (pch = ProgramName; *pch; pch++) 81 *pch = MkUpper(*pch); 82 } 83 #endif /* CAPITALIZE_FOR_PS */ 84 85 /* discover some useful and important environment settings 86 */ 87 usernm = env_get("LOGNAME", e->envp); 88 mailto = env_get("MAILTO", e->envp); 89 90 /* our parent is watching for our death by catching SIGCHLD. we 91 * do not care to watch for our children's deaths this way -- we 92 * use wait() explictly. so we have to reset the signal (which 93 * was inherited from the parent). 94 */ 95 (void) signal(SIGCHLD, SIG_DFL); 96 97 /* create some pipes to talk to our future child 98 */ 99 pipe(stdin_pipe); /* child's stdin */ 100 pipe(stdout_pipe); /* child's stdout */ 101 102 /* since we are a forked process, we can diddle the command string 103 * we were passed -- nobody else is going to use it again, right? 104 * 105 * if a % is present in the command, previous characters are the 106 * command, and subsequent characters are the additional input to 107 * the command. Subsequent %'s will be transformed into newlines, 108 * but that happens later. 109 * 110 * If there are escaped %'s, remove the escape character. 111 */ 112 /*local*/{ 113 int escaped = FALSE; 114 int ch; 115 char *p; 116 117 for (input_data = p = e->cmd; 118 (ch = *input_data) != '\0'; 119 input_data++, p++) { 120 if (p != input_data) 121 *p = ch; 122 if (escaped) { 123 if (ch == '%' || ch == '\\') 124 *--p = ch; 125 escaped = FALSE; 126 continue; 127 } 128 if (ch == '\\') { 129 escaped = TRUE; 130 continue; 131 } 132 if (ch == '%') { 133 *input_data++ = '\0'; 134 break; 135 } 136 } 137 *p = '\0'; 138 } 139 140 /* fork again, this time so we can exec the user's command. 141 */ 142 switch (fork()) { 143 case -1: 144 log_it("CRON", getpid(), "error", "can't vfork"); 145 exit(ERROR_EXIT); 146 /*NOTREACHED*/ 147 case 0: 148 Debug(DPROC, ("[%ld] grandchild process Vfork()'ed\n", 149 (long)getpid())) 150 151 /* write a log message. we've waited this long to do it 152 * because it was not until now that we knew the PID that 153 * the actual user command shell was going to get and the 154 * PID is part of the log message. 155 */ 156 if ((e->flags & DONT_LOG) == 0) { 157 char *x = mkprints((u_char *)e->cmd, strlen(e->cmd)); 158 159 log_it(usernm, getpid(), "CMD", x); 160 free(x); 161 } 162 163 /* that's the last thing we'll log. close the log files. 164 */ 165 #ifdef SYSLOG 166 closelog(); 167 #endif 168 169 /* get new pgrp, void tty, etc. 170 */ 171 (void) setsid(); 172 173 /* close the pipe ends that we won't use. this doesn't affect 174 * the parent, who has to read and write them; it keeps the 175 * kernel from recording us as a potential client TWICE -- 176 * which would keep it from sending SIGPIPE in otherwise 177 * appropriate circumstances. 178 */ 179 close(stdin_pipe[WRITE_PIPE]); 180 close(stdout_pipe[READ_PIPE]); 181 182 /* grandchild process. make std{in,out} be the ends of 183 * pipes opened by our daddy; make stderr go to stdout. 184 */ 185 if (stdin_pipe[READ_PIPE] != STDIN) { 186 dup2(stdin_pipe[READ_PIPE], STDIN); 187 close(stdin_pipe[READ_PIPE]); 188 } 189 if (stdout_pipe[WRITE_PIPE] != STDOUT) { 190 close(STDOUT); 191 dup2(stdout_pipe[WRITE_PIPE], STDOUT); 192 } 193 dup2(STDOUT, STDERR); 194 195 /* set our directory, uid and gid. Set gid first, since once 196 * we set uid, we've lost root privledges. 197 */ 198 #ifdef LOGIN_CAP 199 { 200 struct passwd *pwd; 201 char *ep, *np; 202 203 /* XXX - should just pass in a login_cap_t * */ 204 pwd = getpwuid(e->uid); 205 if (pwd == NULL) { 206 fprintf(stderr, "getpwuid: couldn't get entry for %d\n", e->uid); 207 _exit(ERROR_EXIT); 208 } 209 if (setusercontext(0, pwd, e->uid, LOGIN_SETALL) < 0) { 210 fprintf(stderr, "setusercontext failed for %d\n", e->uid); 211 _exit(ERROR_EXIT); 212 } 213 #ifdef BSD_AUTH 214 if (auth_approval(0, 0, pwd->pw_name, "cron") <= 0) { 215 fprintf(stderr, "approval failed for %d\n", e->uid); 216 _exit(ERROR_EXIT); 217 } 218 #endif /* BSD_AUTH */ 219 /* If no PATH specified in crontab file but 220 * we just added one via login.conf, add it to 221 * the crontab environment. 222 */ 223 if (env_get("PATH", e->envp) == NULL && 224 (ep = getenv("PATH"))) { 225 np = malloc(strlen(ep) + 6); 226 if (np) { 227 strcpy(np, "PATH="); 228 strcat(np, ep); 229 e->envp = env_set(e->envp, np); 230 } 231 } 232 233 } 234 #else 235 setgid(e->gid); 236 initgroups(env_get("LOGNAME", e->envp), e->gid); 237 setlogin(usernm); 238 setuid(e->uid); /* we aren't root after this... */ 239 240 #endif /* LOGIN_CAP */ 241 chdir(env_get("HOME", e->envp)); 242 243 /* 244 * Exec the command. 245 */ 246 { 247 char *shell = env_get("SHELL", e->envp); 248 249 # if DEBUGGING 250 if (DebugFlags & DTEST) { 251 fprintf(stderr, 252 "debug DTEST is on, not exec'ing command.\n"); 253 fprintf(stderr, 254 "\tcmd='%s' shell='%s'\n", e->cmd, shell); 255 _exit(OK_EXIT); 256 } 257 # endif /*DEBUGGING*/ 258 execle(shell, shell, "-c", e->cmd, (char *)0, e->envp); 259 fprintf(stderr, "execl: couldn't exec `%s'\n", shell); 260 perror("execl"); 261 _exit(ERROR_EXIT); 262 } 263 break; 264 default: 265 /* parent process */ 266 break; 267 } 268 269 children++; 270 271 /* middle process, child of original cron, parent of process running 272 * the user's command. 273 */ 274 275 Debug(DPROC, ("[%ld] child continues, closing pipes\n",(long)getpid())) 276 277 /* close the ends of the pipe that will only be referenced in the 278 * grandchild process... 279 */ 280 close(stdin_pipe[READ_PIPE]); 281 close(stdout_pipe[WRITE_PIPE]); 282 283 /* 284 * write, to the pipe connected to child's stdin, any input specified 285 * after a % in the crontab entry. while we copy, convert any 286 * additional %'s to newlines. when done, if some characters were 287 * written and the last one wasn't a newline, write a newline. 288 * 289 * Note that if the input data won't fit into one pipe buffer (2K 290 * or 4K on most BSD systems), and the child doesn't read its stdin, 291 * we would block here. thus we must fork again. 292 */ 293 294 if (*input_data && fork() == 0) { 295 FILE *out = fdopen(stdin_pipe[WRITE_PIPE], "w"); 296 int need_newline = FALSE; 297 int escaped = FALSE; 298 int ch; 299 300 Debug(DPROC, ("[%ld] child2 sending data to grandchild\n", 301 (long)getpid())) 302 303 /* close the pipe we don't use, since we inherited it and 304 * are part of its reference count now. 305 */ 306 close(stdout_pipe[READ_PIPE]); 307 308 /* translation: 309 * \% -> % 310 * % -> \n 311 * \x -> \x for all x != % 312 */ 313 while ((ch = *input_data++) != '\0') { 314 if (escaped) { 315 if (ch != '%') 316 putc('\\', out); 317 } else { 318 if (ch == '%') 319 ch = '\n'; 320 } 321 322 if (!(escaped = (ch == '\\'))) { 323 putc(ch, out); 324 need_newline = (ch != '\n'); 325 } 326 } 327 if (escaped) 328 putc('\\', out); 329 if (need_newline) 330 putc('\n', out); 331 332 /* close the pipe, causing an EOF condition. fclose causes 333 * stdin_pipe[WRITE_PIPE] to be closed, too. 334 */ 335 fclose(out); 336 337 Debug(DPROC, ("[%ld] child2 done sending to grandchild\n", 338 (long)getpid())) 339 exit(0); 340 } 341 342 /* close the pipe to the grandkiddie's stdin, since its wicked uncle 343 * ernie back there has it open and will close it when he's done. 344 */ 345 close(stdin_pipe[WRITE_PIPE]); 346 347 children++; 348 349 /* 350 * read output from the grandchild. it's stderr has been redirected to 351 * it's stdout, which has been redirected to our pipe. if there is any 352 * output, we'll be mailing it to the user whose crontab this is... 353 * when the grandchild exits, we'll get EOF. 354 */ 355 356 Debug(DPROC, ("[%ld] child reading output from grandchild\n", 357 (long)getpid())) 358 359 /*local*/{ 360 FILE *in = fdopen(stdout_pipe[READ_PIPE], "r"); 361 int ch = getc(in); 362 363 if (ch != EOF) { 364 FILE * volatile mail; 365 int bytes = 1; 366 int status = 0; 367 368 Debug(DPROC|DEXT, 369 ("[%ld] got data (%x:%c) from grandchild\n", 370 (long)getpid(), ch, ch)) 371 372 /* get name of recipient. this is MAILTO if set to a 373 * valid local username; USER otherwise. 374 */ 375 if (mailto && safe_p(usernm, mailto)) { 376 /* MAILTO was present in the environment 377 */ 378 if (!*mailto) { 379 /* ... but it's empty. set to NULL 380 */ 381 mailto = NULL; 382 } 383 } else { 384 /* MAILTO not present, set to USER. 385 */ 386 mailto = usernm; 387 } 388 389 /* if we are supposed to be mailing, MAILTO will 390 * be non-NULL. only in this case should we set 391 * up the mail command and subjects and stuff... 392 */ 393 394 if (mailto) { 395 char **env; 396 char mailcmd[MAX_COMMAND]; 397 char hostname[MAXHOSTNAMELEN]; 398 399 gethostname(hostname, MAXHOSTNAMELEN); 400 if (snprintf(mailcmd, sizeof mailcmd, MAILFMT, 401 MAILARG) >= sizeof mailcmd) { 402 fprintf(stderr, "mailcmd too long\n"); 403 (void) _exit(ERROR_EXIT); 404 } 405 if (!(mail = cron_popen(mailcmd, "w", e))) { 406 perror(mailcmd); 407 (void) _exit(ERROR_EXIT); 408 } 409 fprintf(mail, "From: root (Cron Daemon)\n"); 410 fprintf(mail, "To: %s\n", mailto); 411 fprintf(mail, "Subject: Cron <%s@%s> %s\n", 412 usernm, first_word(hostname, "."), 413 e->cmd); 414 #ifdef MAIL_DATE 415 fprintf(mail, "Date: %s\n", 416 arpadate(&StartTime)); 417 #endif /*MAIL_DATE*/ 418 for (env = e->envp; *env; env++) 419 fprintf(mail, "X-Cron-Env: <%s>\n", 420 *env); 421 fprintf(mail, "\n"); 422 423 /* this was the first char from the pipe 424 */ 425 fputc(ch, mail); 426 } 427 428 /* we have to read the input pipe no matter whether 429 * we mail or not, but obviously we only write to 430 * mail pipe if we ARE mailing. 431 */ 432 433 while (EOF != (ch = getc(in))) { 434 bytes++; 435 if (mailto) 436 fputc(ch, mail); 437 } 438 439 /* only close pipe if we opened it -- i.e., we're 440 * mailing... 441 */ 442 443 if (mailto) { 444 Debug(DPROC, ("[%ld] closing pipe to mail\n", 445 (long)getpid())) 446 /* Note: the pclose will probably see 447 * the termination of the grandchild 448 * in addition to the mail process, since 449 * it (the grandchild) is likely to exit 450 * after closing its stdout. 451 */ 452 status = cron_pclose(mail); 453 } 454 455 /* if there was output and we could not mail it, 456 * log the facts so the poor user can figure out 457 * what's going on. 458 */ 459 if (mailto && status) { 460 char buf[MAX_TEMPSTR]; 461 462 snprintf(buf, sizeof buf, 463 "mailed %d byte%s of output but got status 0x%04x\n", 464 bytes, (bytes==1)?"":"s", 465 status); 466 log_it(usernm, getpid(), "MAIL", buf); 467 } 468 469 } /*if data from grandchild*/ 470 471 Debug(DPROC, ("[%ld] got EOF from grandchild\n", 472 (long)getpid())) 473 474 fclose(in); /* also closes stdout_pipe[READ_PIPE] */ 475 } 476 477 /* wait for children to die. 478 */ 479 for (; children > 0; children--) { 480 WAIT_T waiter; 481 PID_T pid; 482 483 Debug(DPROC, ("[%ld] waiting for grandchild #%d to finish\n", 484 (long)getpid(), children)) 485 pid = wait(&waiter); 486 if (pid < OK) { 487 if (errno == EINTR) 488 continue; 489 Debug(DPROC, 490 ("[%ld] no more grandchildren--mail written?\n", 491 (long)getpid())) 492 break; 493 } 494 Debug(DPROC, ("[%ld] grandchild #%ld finished, status=%04x", 495 (long)getpid(), (long)pid, WEXITSTATUS(waiter))) 496 if (WIFSIGNALED(waiter) && WCOREDUMP(waiter)) 497 Debug(DPROC, (", dumped core")) 498 Debug(DPROC, ("\n")) 499 } 500 } 501 502 static int 503 safe_p(const char *usernm, const char *s) { 504 static const char safe_delim[] = "@!:%-.,"; /* conservative! */ 505 const char *t; 506 int ch, first; 507 508 for (t = s, first = 1; (ch = *t++) != '\0'; first = 0) { 509 if (isascii(ch) && isprint(ch) && 510 (isalnum(ch) || (!first && strchr(safe_delim, ch)))) 511 continue; 512 log_it(usernm, getpid(), "UNSAFE", s); 513 return (FALSE); 514 } 515 return (TRUE); 516 } 517