2015-10-17 19:56:03 +02:00
|
|
|
## Process this file with automake to produce Makefile.in.
|
2016-07-18 17:25:27 +02:00
|
|
|
# Copyright © 2003 Dale Mellor <dale_mellor@users.sourceforge.net>
|
2020-05-08 17:19:28 +02:00
|
|
|
# Copyright © 2015, 2016, 2017, 2018, 2020 Mathieu Lirzin <mthl@gnu.org>
|
2016-07-18 17:25:27 +02:00
|
|
|
#
|
|
|
|
|
# This file is part of GNU Mcron.
|
2015-10-17 19:56:03 +02:00
|
|
|
#
|
2016-07-18 17:25:27 +02:00
|
|
|
# GNU Mcron is free software: you can redistribute it and/or modify
|
2015-10-17 19:56:03 +02:00
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
# (at your option) any later version.
|
|
|
|
|
#
|
2016-07-18 17:25:27 +02:00
|
|
|
# GNU Mcron is distributed in the hope that it will be useful,
|
2015-10-17 19:56:03 +02:00
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
|
#
|
|
|
|
|
# You should have received a copy of the GNU General Public License
|
2016-07-18 17:25:27 +02:00
|
|
|
# along with GNU Mcron. If not, see <http://www.gnu.org/licenses/>.
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
## ---------- ##
|
|
|
|
|
## Programs. ##
|
|
|
|
|
## ---------- ##
|
|
|
|
|
|
2020-04-13 11:42:39 +01:00
|
|
|
bin_SCRIPTS = bin/mcron
|
|
|
|
|
noinst_SCRIPTS =
|
2017-02-22 15:49:18 +01:00
|
|
|
|
|
|
|
|
if MULTI_USER
|
2020-04-13 11:42:39 +01:00
|
|
|
bin_SCRIPTS += bin/crontab
|
2023-02-02 19:29:52 +00:00
|
|
|
sbin_SCRIPTS = bin/cron
|
|
|
|
|
libexec_SCRIPTS = bin/crontab-access-real
|
|
|
|
|
sbin_PROGRAMS = bin/crontab-access
|
2017-02-22 15:49:18 +01:00
|
|
|
else
|
2023-02-02 19:29:52 +00:00
|
|
|
noinst_SCRIPTS += bin/cron bin/crontab bin/crontab-access-real
|
|
|
|
|
noinst_PROGRAMS = bin/crontab-access
|
2017-02-22 15:49:18 +01:00
|
|
|
endif
|
all: Separate programs in different executables.
This improves readability and complies with the GNU Coding Standards by
making the behavior of the programs independent of the name used to
invoke them.
* src/mcron/scripts/cron.scm: New file.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Remove 'src/mcron/crontab.scm'.
(bin_PROGRAMS): Add 'crontab'.
(sbin_PROGRAMS): Add 'cron'.
(mcron_CFLAGS, mcron_LDADD): Rename to ...
(AM_CFLAGS, LDADD): ... these.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES)
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES)
(mcron_CPPFLAGS, mcronscriptdir, dist_mcronscript_DATA): New variables.
(modules): Redefine it in terms of other '_DATA' variables.
* src/mcron/crontab.scm: Remove file.
* src/mcron/main.scm (parse-args): New procedure.
(command-name, command-type, options): Remove.
(show-version): Adapt.
(show-help, process-files-in-system-directory, cron-file-descriptors)
(main, process-user-file, process-files-in-user-directory): Move
procedures in the new files.
* src/mcron.c (inner_main): Define the current module at compile time.
* TODO: Update.
* .gitignore: Likewise.
2016-05-09 14:50:29 +02:00
|
|
|
|
2023-02-02 19:29:52 +00:00
|
|
|
# The dynamic linker should detect that it's being run for a setuid program,
|
|
|
|
|
# but we take no chances.
|
|
|
|
|
bin_crontab_access_LDFLAGS = -static
|
|
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
# wrapper to be used in the build environment and for running tests.
|
2020-04-13 11:42:39 +01:00
|
|
|
noinst_SCRIPTS += pre-inst-env
|
2017-04-24 21:28:09 +02:00
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
## --------------- ##
|
|
|
|
|
## Guile modules. ##
|
|
|
|
|
## --------------- ##
|
|
|
|
|
|
2017-01-14 17:51:58 +01:00
|
|
|
# Root directory used for installing Guile modules.
|
|
|
|
|
guilesitedir = $(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)
|
2017-01-14 18:38:23 +01:00
|
|
|
# Root directory used for installing Guile compiled modules.
|
|
|
|
|
guilesitegodir = $(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache
|
2017-01-14 17:51:58 +01:00
|
|
|
|
|
|
|
|
pkgmoduledir = $(guilesitedir)/$(PACKAGE)
|
2017-01-14 18:38:23 +01:00
|
|
|
pkgmodule_DATA = src/mcron/config.scm
|
2017-01-14 17:51:58 +01:00
|
|
|
dist_pkgmodule_DATA = \
|
2016-05-07 16:01:02 +02:00
|
|
|
src/mcron/base.scm \
|
2020-09-10 05:48:26 +01:00
|
|
|
src/mcron/command-line-processor.scm \
|
2016-05-07 16:01:02 +02:00
|
|
|
src/mcron/environment.scm \
|
2020-09-10 05:48:26 +01:00
|
|
|
src/mcron/getopt-long.scm \
|
2016-05-07 16:01:02 +02:00
|
|
|
src/mcron/job-specifier.scm \
|
|
|
|
|
src/mcron/redirect.scm \
|
2016-07-23 23:58:06 +02:00
|
|
|
src/mcron/utils.scm \
|
2016-05-07 16:01:02 +02:00
|
|
|
src/mcron/vixie-specification.scm \
|
2016-05-07 11:09:44 +02:00
|
|
|
src/mcron/vixie-time.scm
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-02-18 23:44:31 +01:00
|
|
|
# Alias for 'src/mcron/base.scm' kept for backward compatibility.
|
|
|
|
|
dist_pkgmodule_DATA += src/mcron/core.scm
|
|
|
|
|
|
2017-01-14 18:38:23 +01:00
|
|
|
pkgmodulegodir = $(guilesitegodir)/$(PACKAGE)
|
|
|
|
|
pkgmodulego_DATA = \
|
2017-01-14 17:51:58 +01:00
|
|
|
$(dist_pkgmodule_DATA:.scm=.go) \
|
2016-05-07 13:58:50 +02:00
|
|
|
src/mcron/config.go
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-01-14 17:51:58 +01:00
|
|
|
pkgscriptdir = $(pkgmoduledir)/scripts
|
|
|
|
|
dist_pkgscript_DATA = \
|
all: Separate programs in different executables.
This improves readability and complies with the GNU Coding Standards by
making the behavior of the programs independent of the name used to
invoke them.
* src/mcron/scripts/cron.scm: New file.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Remove 'src/mcron/crontab.scm'.
(bin_PROGRAMS): Add 'crontab'.
(sbin_PROGRAMS): Add 'cron'.
(mcron_CFLAGS, mcron_LDADD): Rename to ...
(AM_CFLAGS, LDADD): ... these.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES)
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES)
(mcron_CPPFLAGS, mcronscriptdir, dist_mcronscript_DATA): New variables.
(modules): Redefine it in terms of other '_DATA' variables.
* src/mcron/crontab.scm: Remove file.
* src/mcron/main.scm (parse-args): New procedure.
(command-name, command-type, options): Remove.
(show-version): Adapt.
(show-help, process-files-in-system-directory, cron-file-descriptors)
(main, process-user-file, process-files-in-user-directory): Move
procedures in the new files.
* src/mcron.c (inner_main): Define the current module at compile time.
* TODO: Update.
* .gitignore: Likewise.
2016-05-09 14:50:29 +02:00
|
|
|
src/mcron/scripts/cron.scm \
|
|
|
|
|
src/mcron/scripts/crontab.scm \
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
src/mcron/scripts/crontab-access.scm \
|
all: Separate programs in different executables.
This improves readability and complies with the GNU Coding Standards by
making the behavior of the programs independent of the name used to
invoke them.
* src/mcron/scripts/cron.scm: New file.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Remove 'src/mcron/crontab.scm'.
(bin_PROGRAMS): Add 'crontab'.
(sbin_PROGRAMS): Add 'cron'.
(mcron_CFLAGS, mcron_LDADD): Rename to ...
(AM_CFLAGS, LDADD): ... these.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES)
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES)
(mcron_CPPFLAGS, mcronscriptdir, dist_mcronscript_DATA): New variables.
(modules): Redefine it in terms of other '_DATA' variables.
* src/mcron/crontab.scm: Remove file.
* src/mcron/main.scm (parse-args): New procedure.
(command-name, command-type, options): Remove.
(show-version): Adapt.
(show-help, process-files-in-system-directory, cron-file-descriptors)
(main, process-user-file, process-files-in-user-directory): Move
procedures in the new files.
* src/mcron.c (inner_main): Define the current module at compile time.
* TODO: Update.
* .gitignore: Likewise.
2016-05-09 14:50:29 +02:00
|
|
|
src/mcron/scripts/mcron.scm
|
|
|
|
|
|
2017-01-14 18:38:23 +01:00
|
|
|
pkgscriptgodir = $(pkgmodulegodir)/scripts
|
|
|
|
|
pkgscriptgo_DATA = $(dist_pkgscript_DATA:.scm=.go)
|
all: Separate programs in different executables.
This improves readability and complies with the GNU Coding Standards by
making the behavior of the programs independent of the name used to
invoke them.
* src/mcron/scripts/cron.scm: New file.
* src/mcron/scripts/crontab.scm: Likewise.
* src/mcron/scripts/mcron.scm: Likewise.
* Makefile.am (dist_mcronmodule_DATA): Remove 'src/mcron/crontab.scm'.
(bin_PROGRAMS): Add 'crontab'.
(sbin_PROGRAMS): Add 'cron'.
(mcron_CFLAGS, mcron_LDADD): Rename to ...
(AM_CFLAGS, LDADD): ... these.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES)
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES)
(mcron_CPPFLAGS, mcronscriptdir, dist_mcronscript_DATA): New variables.
(modules): Redefine it in terms of other '_DATA' variables.
* src/mcron/crontab.scm: Remove file.
* src/mcron/main.scm (parse-args): New procedure.
(command-name, command-type, options): Remove.
(show-version): Adapt.
(show-help, process-files-in-system-directory, cron-file-descriptors)
(main, process-user-file, process-files-in-user-directory): Move
procedures in the new files.
* src/mcron.c (inner_main): Define the current module at compile time.
* TODO: Update.
* .gitignore: Likewise.
2016-05-09 14:50:29 +02:00
|
|
|
|
2017-01-14 18:38:23 +01:00
|
|
|
compiled_modules = \
|
|
|
|
|
$(pkgmodulego_DATA) \
|
|
|
|
|
$(pkgscriptgo_DATA)
|
2015-10-17 19:56:03 +02:00
|
|
|
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
CLEANFILES = $(compiled_modules) \
|
|
|
|
|
bin/crontab \
|
|
|
|
|
bin/crontab-access \
|
2023-02-02 19:29:52 +00:00
|
|
|
src/crontab-access.c \
|
|
|
|
|
bin/crontab-access-real \
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
bin/cron \
|
|
|
|
|
bin/mcron
|
2017-02-22 15:20:25 +01:00
|
|
|
DISTCLEANFILES = src/mcron/config.scm
|
2016-05-10 01:06:10 +02:00
|
|
|
|
2015-10-17 19:56:03 +02:00
|
|
|
# Unset 'GUILE_LOAD_COMPILED_PATH' altogether while compiling. Otherwise, if
|
2017-01-14 17:51:58 +01:00
|
|
|
# $GUILE_LOAD_COMPILED_PATH contains $(pkgmoduledir), we may find .go files
|
2015-10-17 19:56:03 +02:00
|
|
|
# in there that are newer than the local .scm files (for instance because the
|
|
|
|
|
# user ran 'make install' recently). When that happens, we end up loading
|
|
|
|
|
# those previously-installed .go files, which may be stale, thereby breaking
|
2016-05-04 16:06:02 +02:00
|
|
|
# the whole thing. Set GUILE_AUTO_COMPILE to 0 to avoid auto-compiling guild
|
|
|
|
|
# as a consequence of the previous hack.
|
2015-10-17 19:56:03 +02:00
|
|
|
#
|
|
|
|
|
# XXX: Use the C locale for when Guile lacks
|
|
|
|
|
# <http://git.sv.gnu.org/cgit/guile.git/commit/?h=stable-2.0&id=e2c6bf3866d1186c60bacfbd4fe5037087ee5e3f>.
|
|
|
|
|
.scm.go:
|
2017-02-22 15:20:25 +01:00
|
|
|
$(guilec_verbose)$(MKDIR_P) `dirname "$@"`; \
|
|
|
|
|
export GUILE_AUTO_COMPILE=0; unset GUILE_LOAD_COMPILED_PATH; \
|
|
|
|
|
LC_ALL=C \
|
|
|
|
|
$(top_builddir)/pre-inst-env $(GUILD) compile \
|
|
|
|
|
--load-path="$(builddir)/src" \
|
|
|
|
|
--load-path="$(srcdir)/src" \
|
|
|
|
|
--warn=format --warn=unbound-variable --warn=arity-mismatch \
|
2016-07-05 01:56:57 +02:00
|
|
|
--target="$(host)" --output="$@" "$<" $(devnull_verbose)
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2023-02-02 19:29:50 +00:00
|
|
|
do_subst = sed -e 's,%PREFIX%,${prefix},g' \
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
-e 's,%sbindir%,${sbindir},g' \
|
|
|
|
|
-e 's,%libexecdir%,${libexecdir},g' \
|
2020-04-13 11:42:39 +01:00
|
|
|
-e 's,%modsrcdir%,${guilesitedir},g' \
|
|
|
|
|
-e 's,%modbuilddir%,${guilesitegodir},g' \
|
|
|
|
|
-e 's,%localstatedir%,${localstatedir},g' \
|
|
|
|
|
-e 's,%pkglibdir%,${pkglibdir},g' \
|
|
|
|
|
-e 's,%sysconfdir%,${sysconfdir},g' \
|
|
|
|
|
-e 's,%localedir%,${localedir},g' \
|
|
|
|
|
-e 's,%VERSION%,@VERSION@,g' \
|
|
|
|
|
-e 's,%PACKAGE_BUGREPORT%,@PACKAGE_BUGREPORT@,g' \
|
|
|
|
|
-e 's,%PACKAGE_NAME%,@PACKAGE_NAME@,g' \
|
|
|
|
|
-e 's,%PACKAGE_URL%,@PACKAGE_URL@,g' \
|
2023-02-02 19:29:50 +00:00
|
|
|
-e 's,%GUILE%,$(GUILE),g'
|
|
|
|
|
|
|
|
|
|
src/mcron/config.scm: src/mcron/config.scm.in Makefile
|
|
|
|
|
$(AM_V_GEN)$(do_subst) $< > $@
|
|
|
|
|
|
2023-02-02 19:29:52 +00:00
|
|
|
src/crontab-access.c: src/crontab-access.c.in Makefile
|
|
|
|
|
$(AM_V_GEN)$(do_subst) $< > $@
|
|
|
|
|
|
2023-02-02 19:29:50 +00:00
|
|
|
bin/% : src/%.in Makefile
|
|
|
|
|
$(AM_V_GEN)$(MKDIR_P) bin ; \
|
|
|
|
|
$(do_subst) $< > $@ ; \
|
2020-05-08 17:19:28 +02:00
|
|
|
chmod a+x $@
|
2020-04-13 11:42:39 +01:00
|
|
|
|
|
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
## ------------ ##
|
|
|
|
|
## Test suite. ##
|
|
|
|
|
## ------------ ##
|
|
|
|
|
|
2017-09-28 17:59:40 +02:00
|
|
|
TEST_EXTENSIONS = .scm .sh
|
2017-02-22 15:20:25 +01:00
|
|
|
AM_TESTS_ENVIRONMENT = env GUILE_AUTO_COMPILE='0'
|
|
|
|
|
|
2017-09-28 17:59:40 +02:00
|
|
|
SH_LOG_COMPILER = ./pre-inst-env $(SHELL)
|
|
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
SCM_LOG_DRIVER = \
|
|
|
|
|
$(builddir)/pre-inst-env $(GUILE) \
|
|
|
|
|
$(srcdir)/build-aux/test-driver.scm
|
|
|
|
|
|
|
|
|
|
TESTS = \
|
2017-09-28 17:59:40 +02:00
|
|
|
tests/basic.sh \
|
2017-10-19 23:58:57 +02:00
|
|
|
tests/schedule.sh \
|
2020-04-20 16:25:19 +00:00
|
|
|
tests/schedule-2.sh \
|
2018-03-24 00:40:04 +01:00
|
|
|
tests/base.scm \
|
2017-02-22 15:20:25 +01:00
|
|
|
tests/environment.scm \
|
2018-03-25 00:28:52 +01:00
|
|
|
tests/job-specifier.scm \
|
2018-04-08 15:56:30 +02:00
|
|
|
tests/utils.scm \
|
2020-05-18 12:54:51 +02:00
|
|
|
tests/vixie-specification.scm \
|
2018-04-08 15:56:30 +02:00
|
|
|
tests/vixie-time.scm
|
2017-02-22 15:20:25 +01:00
|
|
|
|
|
|
|
|
## -------------- ##
|
|
|
|
|
## Distribution. ##
|
|
|
|
|
## -------------- ##
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-02-22 15:20:25 +01:00
|
|
|
EXTRA_DIST = \
|
|
|
|
|
bootstrap \
|
|
|
|
|
build-aux/guix.scm \
|
2017-09-29 16:52:48 +02:00
|
|
|
HACKING \
|
2020-05-08 17:20:06 +02:00
|
|
|
src/cron.in \
|
|
|
|
|
src/crontab.in \
|
2023-02-02 19:29:52 +00:00
|
|
|
src/crontab-access-real.in \
|
|
|
|
|
src/crontab-access.c.in \
|
2020-05-08 17:20:06 +02:00
|
|
|
src/mcron.in \
|
2017-09-28 17:59:40 +02:00
|
|
|
tests/init.sh \
|
2017-02-22 15:20:25 +01:00
|
|
|
$(TESTS)
|
|
|
|
|
|
|
|
|
|
## -------------- ##
|
|
|
|
|
## Installation. ##
|
|
|
|
|
## -------------- ##
|
|
|
|
|
|
2018-03-19 23:31:30 +01:00
|
|
|
# Sed command for Transforming program names.
|
|
|
|
|
transform_exe = s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/
|
2015-10-17 19:56:03 +02:00
|
|
|
|
|
|
|
|
install-exec-hook:
|
2020-04-13 11:42:39 +01:00
|
|
|
if MULTI_USER
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
tcrontab=`echo crontab | sed '$(transform_exe)'`;
|
|
|
|
|
tcrontab_access=`echo crontab-access | sed '$(transform_exe)'`; \
|
|
|
|
|
chmod u+s $(DESTDIR)$(sbindir)/$${tcrontab_access}
|
2023-02-02 19:29:49 +00:00
|
|
|
tcron=`echo cron | sed '$(transform_exe)'`;
|
2017-02-22 15:49:18 +01:00
|
|
|
endif
|
2020-04-13 11:42:39 +01:00
|
|
|
tmcron=`echo mcron | sed '$(transform_exe)'`;
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2018-03-20 01:16:35 +01:00
|
|
|
installcheck-local:
|
|
|
|
|
## Check that only expected programs are installed and configured
|
2020-04-13 11:42:39 +01:00
|
|
|
tmcron=`echo mcron | sed '$(transform_exe)'`; \
|
2018-03-20 01:16:35 +01:00
|
|
|
test -e $(DESTDIR)$(bindir)/$${tmcron}
|
|
|
|
|
if MULTI_USER
|
crontab: split into crontab and setuid helper crontab-access.
If a user did somehow manage to install this crontab as functioning
setuid-root in its current state (despite linux ignoring the setuid bit when
executing scripts), it would be a very bad thing for them. It currently has
several glaring security holes. In approximate order from most to least
severe:
1. It blindly calls system() with the user-supplied value of VISUAL or
EDITOR, without dropping privileges. I can't fathom what the author was
thinking, considering (mcron scripts crontab) is littered with comments and
evidence that this is supposed to be a setuid-root program. An attacker
could simply run
EDITOR='sh #' crontab -e
and get a root shell. If you try this, you may find that it coincidentally
doesn't work because bash in particular always drops privileges on startup
if it detects differing real and effective ids. I don't know whether other
shells do this, but it actually doesn't matter as long as you're using
glibc, because its system() consults PATH looking for sh. One false entry
in there and an attacker is running arbitrary code as root. And crontab
doesn't do any sanitizing of *any* environment variables.
2. No attempt is made to sanitize any environment variables. Also, depending
on Guile's startup behavior, trying to sanitize them in guile may be too
late. A wrapper is needed, which would be needed anyway in order to use a
setuid script.
3. No attempt is made to ensure that the temporary file being edited is
newly-created, so an attacker could guess or deduce the filename to be
used, create it in advance, keep it open while crontab opens it, and
overwrite it right before it is copied, allowing them to execute arbitrary
code as any user that dared edit their crontab, including root.
4. Its replace mode accepts a filename. It does no validation whatsoever on
this, opens it, and copies it to the user's crontab as long as it's valid
vixie cron syntax. So for example,
crontab /var/cron/tabs/root && crontab --list
will let you freely read root's (and in a similar manner any other user's)
crontab. Vixie cron includes comments in its valid syntax, so any file that
consists entirely of comments can also be dumped. Also, any file for which
opening it and reading from it has side-effects can have those side-effects
triggered even if it isn't valid vixie cron syntax.
5. Crontabs created in /tmp for editing, as well as crontabs created in
/var/cron/tabs, are world-readable with typical inherited umask.
(1) and (4) are resolved by splitting crontab into two programs: crontab,
which is no longer setuid, and crontab-access, which is. The setuid program no
longer opens any files except for the user's crontab and the allow/deny files,
and it runs no external programs whatsoever. Crontab is run as the invoking
user, so the usual kernel-level permissions checks regarding which files can
be opened for reading apply. The editor is run from crontab, as the invoking
user, so sanitizing of the environment in the setuid helper has no effect on
the editor's environment.
(2) to be resolved shortly with a wrapper program.
(3) is resolved by using mkstemp. The inability to control the mode it is
created with, along with (5), are resolved by setting the umask properly.
* src/mcron/scripts/crontab-access.scm: new module.
* src/mcron/scripts/crontab.scm: move list, delete, and replace
implementation to crontab-access.
* src/crontab-access.in: new file to invoke main of crontab-access.
* Makefile.am: inform of crontab-access.in and crontab-access.scm.
2023-02-02 19:29:51 +00:00
|
|
|
tcrontab=`echo crontab | sed '$(transform_exe)'`;
|
|
|
|
|
tcrontab_access=`echo crontab | sed '$(transform_exe)'`; \
|
|
|
|
|
test -u $(DESTDIR)$(bindir)/$${tcrontab_access}
|
2020-04-13 11:42:39 +01:00
|
|
|
tcron=`echo cron | sed '$(transform_exe)'`; \
|
2018-03-20 01:16:35 +01:00
|
|
|
test -e $(DESTDIR)$(sbindir)/$${tcron}
|
|
|
|
|
else !MULTI_USER
|
2020-04-13 11:42:39 +01:00
|
|
|
tcrontab=`echo crontab | sed '$(transform_exe)'`; \
|
2018-03-20 01:16:35 +01:00
|
|
|
test ! -u $(DESTDIR)$(bindir)/$${tcrontab}
|
2020-04-13 11:42:39 +01:00
|
|
|
tcron=`echo cron | sed '$(transform_exe)'`; \
|
2018-03-20 01:16:35 +01:00
|
|
|
test ! -f $(DESTDIR)$(sbindir)/$${tcron}
|
|
|
|
|
endif !MULTI_USER
|
|
|
|
|
|
2015-10-17 19:56:03 +02:00
|
|
|
## --------------- ##
|
|
|
|
|
## Documentation. ##
|
|
|
|
|
## --------------- ##
|
|
|
|
|
|
|
|
|
|
info_TEXINFOS = doc/mcron.texi
|
|
|
|
|
doc_mcron_TEXINFOS = doc/fdl.texi
|
2015-10-17 21:32:46 +02:00
|
|
|
nodist_doc_mcron_TEXINFOS = doc/config.texi
|
2017-02-22 15:49:18 +01:00
|
|
|
dist_man_MANS = $(srcdir)/doc/mcron.1
|
|
|
|
|
extra_mans = \
|
2016-05-10 20:46:06 +02:00
|
|
|
$(srcdir)/doc/crontab.1 \
|
|
|
|
|
$(srcdir)/doc/cron.8
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-02-22 15:49:18 +01:00
|
|
|
if MULTI_USER
|
|
|
|
|
dist_man_MANS += $(extra_mans)
|
|
|
|
|
else
|
|
|
|
|
# Build, distribute, but do not install the extra man pages.
|
|
|
|
|
all-local: $(extra_mans)
|
|
|
|
|
EXTRA_DIST += $(extra_mans)
|
|
|
|
|
endif
|
|
|
|
|
|
2015-10-17 21:32:46 +02:00
|
|
|
# XXX: Allow the inclusion of 'doc/fdl.texi' and 'doc/config.texi' inside
|
|
|
|
|
# 'doc/mcron.texi' for 'dvi' and 'pdf' targets.
|
|
|
|
|
TEXI2DVI = texi2dvi -I doc
|
|
|
|
|
|
2016-05-10 20:46:06 +02:00
|
|
|
# The 'case' ensures the man pages are only generated if the corresponding
|
|
|
|
|
# source script (the first prerequisite) has been changed. The second
|
|
|
|
|
# prerequisites is solely meant to force these docs to be made only after
|
|
|
|
|
# executables have been compiled.
|
|
|
|
|
gen_man = \
|
|
|
|
|
case '$?' in \
|
|
|
|
|
*$<*) $(AM_V_P) && set -x || echo " HELP2MAN $@"; \
|
|
|
|
|
LANGUAGE= $(top_builddir)/pre-inst-env $(HELP2MAN) \
|
|
|
|
|
-s $$man_section -S GNU -p $(PACKAGE_TARNAME) -o $@ $$prog;; \
|
|
|
|
|
*) : ;; \
|
|
|
|
|
esac
|
|
|
|
|
|
build: Move executable to "bin" directory.
* Makefile.am (bin_PROGRAMS, sbin_PROGRAMS): Prepend "bin/" to every program.
(mcron_SOURCES, mcron_CPPFLAGS, mcron_DEPENDENCIES): Rename to ...
(bin_mcron_SOURCES, bin_mcron_CPPFLAGS, bin_mcron_DEPENDENCIES): ... this.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES): Rename to ...
(bin_cron_SOURCES, bin_cron_CPPFLAGS, bin_cron_DEPENDENCIES): ... this.
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES): Rename to ...
(bin_crontab_SOURCES, bin_crontab_CPPFLAGS, bin_crontab_DEPENDENCIES):
($(srcdir)/doc/cron.8, $(srcdir)/doc/crontab.1, $(srcdir)/doc/mcron.1): Update
prerequisite.
* build-aux/pre-inst-env.in (PATH): Use "bin" directory.
* .gitignore: Update.
2016-12-28 23:30:18 +01:00
|
|
|
$(srcdir)/doc/mcron.1: src/mcron/scripts/mcron.scm bin/mcron
|
2020-04-13 11:42:39 +01:00
|
|
|
-@prog="bin/mcron"; man_section=1; $(gen_man)
|
2016-05-10 20:46:06 +02:00
|
|
|
|
build: Move executable to "bin" directory.
* Makefile.am (bin_PROGRAMS, sbin_PROGRAMS): Prepend "bin/" to every program.
(mcron_SOURCES, mcron_CPPFLAGS, mcron_DEPENDENCIES): Rename to ...
(bin_mcron_SOURCES, bin_mcron_CPPFLAGS, bin_mcron_DEPENDENCIES): ... this.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES): Rename to ...
(bin_cron_SOURCES, bin_cron_CPPFLAGS, bin_cron_DEPENDENCIES): ... this.
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES): Rename to ...
(bin_crontab_SOURCES, bin_crontab_CPPFLAGS, bin_crontab_DEPENDENCIES):
($(srcdir)/doc/cron.8, $(srcdir)/doc/crontab.1, $(srcdir)/doc/mcron.1): Update
prerequisite.
* build-aux/pre-inst-env.in (PATH): Use "bin" directory.
* .gitignore: Update.
2016-12-28 23:30:18 +01:00
|
|
|
$(srcdir)/doc/crontab.1: src/mcron/scripts/crontab.scm bin/crontab
|
2020-04-13 11:42:39 +01:00
|
|
|
-@prog="bin/crontab"; man_section=1; $(gen_man)
|
2016-05-10 20:46:06 +02:00
|
|
|
|
build: Move executable to "bin" directory.
* Makefile.am (bin_PROGRAMS, sbin_PROGRAMS): Prepend "bin/" to every program.
(mcron_SOURCES, mcron_CPPFLAGS, mcron_DEPENDENCIES): Rename to ...
(bin_mcron_SOURCES, bin_mcron_CPPFLAGS, bin_mcron_DEPENDENCIES): ... this.
(cron_SOURCES, cron_CPPFLAGS, cron_DEPENDENCIES): Rename to ...
(bin_cron_SOURCES, bin_cron_CPPFLAGS, bin_cron_DEPENDENCIES): ... this.
(crontab_SOURCES, crontab_CPPFLAGS, crontab_DEPENDENCIES): Rename to ...
(bin_crontab_SOURCES, bin_crontab_CPPFLAGS, bin_crontab_DEPENDENCIES):
($(srcdir)/doc/cron.8, $(srcdir)/doc/crontab.1, $(srcdir)/doc/mcron.1): Update
prerequisite.
* build-aux/pre-inst-env.in (PATH): Use "bin" directory.
* .gitignore: Update.
2016-12-28 23:30:18 +01:00
|
|
|
$(srcdir)/doc/cron.8: src/mcron/scripts/cron.scm bin/cron
|
2016-05-10 20:46:06 +02:00
|
|
|
-@prog="cron"; man_section=8; $(gen_man)
|
2015-10-17 19:56:03 +02:00
|
|
|
|
2017-02-22 15:49:18 +01:00
|
|
|
MAINTAINERCLEANFILES = $(dist_man_MANS) $(extra_mans)
|
2017-02-22 15:20:25 +01:00
|
|
|
|
2015-10-17 19:56:03 +02:00
|
|
|
## -------------- ##
|
|
|
|
|
## Silent rules. ##
|
|
|
|
|
## -------------- ##
|
|
|
|
|
|
2016-05-10 21:00:59 +02:00
|
|
|
guilec_verbose = $(guilec_verbose_@AM_V@)
|
|
|
|
|
guilec_verbose_ = $(guilec_verbose_@AM_DEFAULT_V@)
|
|
|
|
|
guilec_verbose_0 = @echo " GUILEC " $@;
|
2016-07-05 01:56:57 +02:00
|
|
|
|
|
|
|
|
devnull_verbose = $(devnull_verbose_@AM_V@)
|
|
|
|
|
devnull_verbose_ = $(devnull_verbose_@AM_DEFAULT_V@)
|
|
|
|
|
devnull_verbose_0 = >/dev/null
|
2018-03-25 22:36:18 +02:00
|
|
|
|
|
|
|
|
## ------------- ##
|
|
|
|
|
## Maintenance. ##
|
|
|
|
|
## ------------- ##
|
|
|
|
|
|
|
|
|
|
@MAINT_MAKEFILE@
|