Upgrade.

Close security holes reported.

3 files changed, 419 insertions, 239 deletions

diff --git a/libexec/atrun/Makefile b/libexec/atrun/Makefile
index 27b8ea3..cb69fd1 100644
--- a/libexec/atrun/Makefile
+++ b/libexec/atrun/Makefile
@@ -1,13 +1,25 @@
-#	$Id: Makefile,v 1.2 1993/12/05 12:26:10 cgd Exp $
+#	$Id: Makefile,v 1.1 1994/01/05 01:02:56 nate Exp $
+
+MAINSRC= ${.CURDIR}/../../usr.bin/at
+
+.include "$(MAINSRC)/Makefile.inc"
 
 PROG=	atrun
 MAN8=	atrun.8
 
-BINDIR=	/usr/libexec
-BINOWN=	root
+BINDIR= $(ATLIB_DIR)
+MANSRC= .
+CLEANFILES += ${MAN8}
+MANDEPEND = ${MAN8}
+
+CFLAGS+= -I$(MAINSRC)
 
-CFLAGS+= -I${.CURDIR}/../../usr.bin/at
-LDADD+=	-lutil
-DPADD+=	${LIBUTIL}
+${MAN8}: atrun.man
+	sed -e \
+		"s@_ATSPOOL_DIR@$(ATSPOOL_DIR)@g; \
+		s@_ATJOB_DIR@$(ATJOB_DIR)@g; \
+		s@_ATLIB_DIR@$(ATLIB_DIR)@g; \
+		s@_LOADAVG_MX@$(LOADAVG_MX)@g;" \
+		< $? > $@
 
 .include <bsd.prog.mk>
diff --git a/libexec/atrun/atrun.c b/libexec/atrun/atrun.c
index 3b84ec9..4ab933d 100644
--- a/libexec/atrun/atrun.c
+++ b/libexec/atrun/atrun.c
@@ -1,7 +1,6 @@
-/*
- * atrun.c - run jobs queued by at; run with root privileges.
- * Copyright (c) 1993 by Thomas Koenig
- * All rights reserved.
+/* 
+ *  atrun.c - run jobs queued by at; run with root privileges.
+ *  Copyright (C) 1993, 1994 Thomas Koenig
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,9 +29,11 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
+#include <ctype.h>
 #include <dirent.h>
 #include <errno.h>
 #include <pwd.h>
+#include <grp.h>
 #include <signal.h>
 #include <stddef.h>
 #include <stdio.h>
@@ -41,287 +42,388 @@
 #include <time.h>
 #include <unistd.h>
 #include <syslog.h>
-
+#ifndef __FreeBSD__
+#include <getopt.h>
+#else
 #include <paths.h>
+#endif
 
 /* Local headers */
 
+#ifndef __FreeBSD__
+#include "gloadavg.h"
+#endif
 #define MAIN
 #include "privs.h"
-#include "pathnames.h"
-#include "atrun.h"
+
+/* Macros */
+
+#ifndef ATJOB_DIR
+#define ATJOB_DIR "/usr/spool/atjobs/"
+#endif
+
+#ifndef ATSPOOL_DIR
+#define ATSPOOL_DIR "/usr/spool/atspool/"
+#endif
+
+#ifndef LOADAVG_MX
+#define LOADAVG_MX 1.5
+#endif
 
 /* File scope variables */
 
 static char *namep;
-static char rcsid[] = "$Id: atrun.c,v 1.1 1993/12/05 11:36:38 cgd Exp $";
+static char rcsid[] = "$Id: atrun.c,v 1.1 1994/05/10 18:23:08 kernel Exp $";
+static debug = 0;
 
 /* Local functions */
 static void
-perr(a)
-	const char *a;
+perr(const char *a)
 {
+    if (debug)
+    {
+	perror(a);
+    }
+    else
 	syslog(LOG_ERR, "%s: %m", a);
-	exit(EXIT_FAILURE);
+
+    exit(EXIT_FAILURE);
 }
 
 static int
-write_string(fd, a)
-	int fd;
-	const char *a;
+write_string(int fd, const char* a)
 {
-	return write(fd, a, strlen(a));
+    return write(fd, a, strlen(a));
 }
 
-static void
-run_file(filename, uid, gid)
-	const char *filename;
-	uid_t uid;
-	gid_t gid;
+#ifdef DEBUG_FORK
+static pid_t
+myfork()
 {
-	/*
-	 * Run a file by by spawning off a process which redirects I/O,
-	 * spawns a subshell, then waits for it to complete and spawns another
-	 * process to send mail to the user.
-	 */
-	pid_t pid;
-	int fd_out, fd_in;
-	int queue;
-	char mailbuf[9];
-	char *mailname = NULL;
-	FILE *stream;
-	int send_mail = 0;
-	struct stat buf;
-	off_t size;
-	struct passwd *pentry;
-	int fflags;
-
-	pid = fork();
-	if (pid == -1)
-		perr("Cannot fork");
-	else if (pid > 0)
-		return;
-
-	/*
-	 * Let's see who we mail to.  Hopefully, we can read it from the
-	 * command file; if not, send it to the owner, or, failing that, to
-	 * root.
-	 */
+	pid_t res;
+	res = fork();
+	if (res == 0)
+	    kill(getpid(),SIGSTOP);
+	return res;
+}
 
-	PRIV_START
+#define fork myfork
+#endif
 
-	    stream = fopen(filename, "r");
+static void
+run_file(const char *filename, uid_t uid, gid_t gid)
+{
+/* Run a file by by spawning off a process which redirects I/O,
+ * spawns a subshell, then waits for it to complete and sends
+ * mail to the user.
+ */
+    pid_t pid;
+    int fd_out, fd_in;
+    int queue;
+    char mailbuf[9];
+    char *mailname = NULL;
+    FILE *stream;
+    int send_mail = 0;
+    struct stat buf;
+    off_t size;
+    struct passwd *pentry;
+    int fflags;
+
+
+    PRIV_START
+
+    if (chmod(filename, S_IRUSR) != 0)
+    {
+	perr("Cannot change file permissions");
+    }
+
+    PRIV_END
+
+    pid = fork();
+    if (pid == -1)
+	perr("Cannot fork");
+    
+    else if (pid > 0)
+	return;
+
+    /* Let's see who we mail to.  Hopefully, we can read it from
+     * the command file; if not, send it to the owner, or, failing that,
+     * to root.
+     */
+
+    pentry = getpwuid(uid);
+    if (pentry == NULL)
+    {
+	syslog(LOG_ERR,"Userid %lu not found - aborting job %s",
+	       (unsigned long) uid, filename);
+	exit(EXIT_FAILURE);
+    }
+    PRIV_START
 
-	PRIV_END
+    stream=fopen(filename, "r");
 
-	if (stream == NULL)
-		perr("Cannot open input file");
+    PRIV_END
 
-	if ((fd_in = dup(fileno(stream))) < 0)
-		perr("Error duplicating input file descriptor");
+    if (stream == NULL)
+	perr("Cannot open input file");
 
-	if ((fflags = fcntl(fd_in, F_GETFD)) < 0)
-		perr("Error in fcntl");
+    if ((fd_in = dup(fileno(stream))) <0)
+	perr("Error duplicating input file descriptor");
 
-	fcntl(fd_in, F_SETFD, fflags & ~FD_CLOEXEC);
+    if ((fflags = fcntl(fd_in, F_GETFD)) <0)
+	perr("Error in fcntl");
 
-	if (fscanf(stream, "#! /bin/sh\n# mail %8s %d", mailbuf, &send_mail) == 2) {
-		mailname = mailbuf;
-	} else {
-		pentry = getpwuid(uid);
-		if (pentry == NULL)
-			mailname = "root";
-		else
-			mailname = pentry->pw_name;
-	}
-	fclose(stream);
-	if (chdir(_PATH_ATSPOOL) < 0)
-		perr("Cannot chdir to " _PATH_ATSPOOL);
+    fcntl(fd_in, F_SETFD, fflags & ~FD_CLOEXEC);
 
-	/*
-	 * Create a file to hold the output of the job we are  about to
-	 * run. Write the mail header.
+    if (fscanf(stream, "#! /bin/sh\n# mail %8s %d", mailbuf, &send_mail) == 2)
+    {
+	mailname = mailbuf;
+	pentry = getpwnam(mailname);
+	if (pentry == NULL || pentry->pw_uid != uid) {
+		syslog(LOG_ERR,"Userid %lu mismatch name %s - aborting job %s",
+		       (unsigned long) uid, mailname, filename);
+		exit(EXIT_FAILURE);
+	}
+    }
+    else
+    {
+	mailname = pentry->pw_name;
+    }
+    fclose(stream);
+    if (chdir(ATSPOOL_DIR) < 0)
+	perr("Cannot chdir to " ATSPOOL_DIR);
+    
+    /* Create a file to hold the output of the job we are about to run.
+     * Write the mail header.
+     */    
+    if((fd_out=open(filename,
+		O_WRONLY | O_CREAT | O_EXCL, S_IWUSR | S_IRUSR)) < 0)
+	perr("Cannot create output file");
+
+    write_string(fd_out, "Subject: Output from your job ");
+    write_string(fd_out, filename);
+    write_string(fd_out, "\n\n");
+    fstat(fd_out, &buf);
+    size = buf.st_size;
+
+    close(STDIN_FILENO);
+    close(STDOUT_FILENO);
+    close(STDERR_FILENO);
+ 
+    pid = fork();
+    if (pid < 0)
+	perr("Error in fork");
+
+    else if (pid == 0)
+    {
+	char *nul = NULL;
+	char **nenvp = &nul;
+
+	/* Set up things for the child; we want standard input from the input file,
+	 * and standard output and error sent to our output file.
 	 */
-	if ((fd_out = open(filename,
-		    O_WRONLY | O_CREAT | O_EXCL, S_IWUSR | S_IRUSR)) < 0)
-		perr("Cannot create output file");
 
-	write_string(fd_out, "Subject: Output from your job ");
-	write_string(fd_out, filename);
-	write_string(fd_out, "\n\n");
-	fstat(fd_out, &buf);
-	size = buf.st_size;
+	if (lseek(fd_in, (off_t) 0, SEEK_SET) < 0)
+	    perr("Error in lseek");
 
-	close(STDIN_FILENO);
-	close(STDOUT_FILENO);
-	close(STDERR_FILENO);
+	if (dup(fd_in) != STDIN_FILENO)
+	    perr("Error in I/O redirection");
 
-	pid = fork();
-	if (pid < 0)
-		perr("Error in fork");
-	else if (pid == 0) {
-		char *nul = NULL;
-		char **nenvp = &nul;
+	if (dup(fd_out) != STDOUT_FILENO)
+	    perr("Error in I/O redirection");
 
-		/*
-		 * Set up things for the child; we want standard input from
-		 * the input file, and standard output and error sent to
-		 * our output file.
-		 */
+	if (dup(fd_out) != STDERR_FILENO)
+	    perr("Error in I/O redirection");
 
-		if (lseek(fd_in, (off_t) 0, SEEK_SET) < 0)
-			perr("Error in lseek");
-
-		if (dup(fd_in) != STDIN_FILENO)
-			perr("Error in I/O redirection");
-
-		if (dup(fd_out) != STDOUT_FILENO)
-			perr("Error in I/O redirection");
-
-		if (dup(fd_out) != STDERR_FILENO)
-			perr("Error in I/O redirection");
-
-		close(fd_in);
-		close(fd_out);
-		if (chdir(_PATH_ATJOBS) < 0)
-			perr("Cannot chdir to " _PATH_ATJOBS);
+	close(fd_in);
+	close(fd_out);
+	if (chdir(ATJOB_DIR) < 0)
+	    perr("Cannot chdir to " ATJOB_DIR);
 
-		queue = *filename;
+	queue = *filename;
 
-		PRIV_START
+	PRIV_START
 
-		    if (queue > 'b')
-			nice(queue - 'b');
+        nice(tolower(queue) - 'a');
+	
+	chdir(pentry->pw_dir);
 
-		if (setgid(gid) < 0)
-			perr("Cannot change group");
+	if (initgroups(pentry->pw_name,pentry->pw_gid))
+	    perr("Cannot delete saved userids");
 
-		if (setuid(uid) < 0)
-			perr("Cannot set user id");
+	if (setgid(gid) < 0)
+	    perr("Cannot change group");
 
-		chdir("/");
+	if (setuid(uid) < 0)
+	    perr("Cannot set user id");
 
-		if (execle("/bin/sh", "sh", (char *) NULL, nenvp) != 0)
-			perr("Exec failed");
+	if(execle("/bin/sh","sh",(char *) NULL, nenvp) != 0)
+	    perr("Exec failed");
 
-		PRIV_END
-	}
-	/* We're the parent.  Let's wait. */
-	close(fd_in);
-	close(fd_out);
-	waitpid(pid, (int *) NULL, 0);
-
-	stat(filename, &buf);
-	if ((buf.st_size != size) || send_mail) {
-		/* Fork off a child for sending mail */
-		pid = fork();
-		if (pid < 0)
-			perr("Fork failed");
-		else if (pid == 0) {
-			if (open(filename, O_RDONLY) != STDIN_FILENO)
-				perr("Cannot reopen output file");
-
-			execl(_PATH_SENDMAIL, _PATH_SENDMAIL, mailname,
-			    (char *) NULL);
-			perr("Exec failed");
-		}
-		waitpid(pid, (int *) NULL, 0);
-	}
-	unlink(filename);
-	exit(EXIT_SUCCESS);
+	PRIV_END
+    }
+    /* We're the parent.  Let's wait.
+     */
+    close(fd_in);
+    close(fd_out);
+    waitpid(pid, (int *) NULL, 0);
+
+    /* Send mail.  Unlink the output file first, so it is deleted after
+     * the run.
+     */
+    stat(filename, &buf);
+    if (open(filename, O_RDONLY) != STDIN_FILENO)
+        perr("Open of jobfile failed");
+
+    unlink(filename);
+    if ((buf.st_size != size) || send_mail)
+    {    
+#ifdef __FreeBSD__
+	execl(_PATH_SENDMAIL, "sendmail", "-F", "Atrun Service",
+			mailname, (char *) NULL);
+#else
+        execl(MAIL_CMD, MAIL_CMD, mailname, (char *) NULL);
+#endif
+	perr("Exec failed");
+    }
+    exit(EXIT_SUCCESS);
 }
 
 /* Global functions */
 
 int
-main(argc, argv)
-	int argc;
-	char *argv[];
+main(int argc, char *argv[])
 {
-	/*
-	 * Browse through  _PATH_ATJOBS, checking all the jobfiles wether
-	 * they should be executed and or deleted. The queue is coded into
-	 * the first byte of the job filename, the date (in minutes since
-	 * Eon) as a hex number in the following eight bytes, followed by
-	 * a dot and a serial number.  A file which has not been executed
-	 * yet is denoted by its execute - bit set.  For those files which
-	 * are to be executed, run_file() is called, which forks off a
-	 * child which takes care of I/O redirection, forks off another
-	 * child for execution and yet another one, optionally, for sending
-	 * mail.  Files which already have run are removed during the
-	 * next invocation.
-	 */
-	DIR *spool;
-	struct dirent *dirent;
-	struct stat buf;
-	int older;
-	unsigned long ctm;
-	char queue;
-
-	/*
-	 * We don't need root privileges all the time; running under uid
-	 * and gid daemon is fine.
-	 */
+/* Browse through  ATJOB_DIR, checking all the jobfiles wether they should
+ * be executed and or deleted. The queue is coded into the first byte of
+ * the job filename, the date (in minutes since Eon) as a hex number in the
+ * following eight bytes, followed by a dot and a serial number.  A file
+ * which has not been executed yet is denoted by its execute - bit set.
+ * For those files which are to be executed, run_file() is called, which forks
+ * off a child which takes care of I/O redirection, forks off another child
+ * for execution and yet another one, optionally, for sending mail.
+ * Files which already have run are removed during the next invocation.
+ */
+    DIR *spool;
+    struct dirent *dirent;
+    struct stat buf;
+    unsigned long ctm;
+    char queue;
+    time_t now, run_time;
+    char batch_name[] = "Z2345678901234";
+    uid_t batch_uid;
+    gid_t batch_gid;
+    int c;
+    int run_batch;
+    double load_avg = LOADAVG_MX;
+
+/* We don't need root privileges all the time; running under uid and gid daemon
+ * is fine.
+ */
 
-	RELINQUISH_PRIVS_ROOT(0) /* it's setuid root */
-	openlog("atrun", LOG_PID, LOG_CRON);
-
-	namep = argv[0];
-	if (chdir(_PATH_ATJOBS) != 0)
-		perr("Cannot change to " _PATH_ATJOBS);
-
-	/*
-	 * Main loop. Open spool directory for reading and look over all
-	 * the files in there. If the filename indicates that the job
-	 * should be run and the x bit is set, fork off a child which sets
-	 * its user and group id to that of the files and exec a /bin/sh
-	 * which executes the shell script. Unlink older files if they
-	 * should no longer be run.  For deletion, their r bit has to be
-	 * turned on.
+    RELINQUISH_PRIVS_ROOT(DAEMON_UID, DAEMON_GID)
+
+    openlog("atrun", LOG_PID, LOG_CRON);
+
+    opterr = 0;
+    errno = 0;
+    while((c=getopt(argc, argv, "dl:"))!= EOF)
+    {
+	switch (c)
+	{
+	case 'l': 
+	    if (sscanf(optarg, "%lf", &load_avg) != 1)
+		perr("garbled option -l");
+	    if (load_avg <= 0.)
+		load_avg = LOADAVG_MX;
+	    break;
+
+	case 'd':
+	    debug ++;
+	    break;
+
+	case '?':
+	    perr("unknown option");
+	    break;
+
+	default:
+	    perr("idiotic option - aborted");
+	    break;
+	}
+    }
+
+    namep = argv[0];
+    if (chdir(ATJOB_DIR) != 0)
+	perr("Cannot change to " ATJOB_DIR);
+
+    /* Main loop. Open spool directory for reading and look over all the
+     * files in there. If the filename indicates that the job should be run
+     * and the x bit is set, fork off a child which sets its user and group
+     * id to that of the files and exec a /bin/sh which executes the shell
+     * script. Unlink older files if they should no longer be run.  For
+     * deletion, their r bit has to be turned on.
+     *
+     * Also, pick the oldest batch job to run, at most one per invocation of
+     * atrun.
+     */
+    if ((spool = opendir(".")) == NULL)
+	perr("Cannot read " ATJOB_DIR);
+
+    now = time(NULL);
+    run_batch = 0;
+    batch_uid = (uid_t) -1;
+    batch_gid = (gid_t) -1;
+
+    while ((dirent = readdir(spool)) != NULL)
+    {
+	if (stat(dirent->d_name,&buf) != 0)
+	    perr("Cannot stat in " ATJOB_DIR);
+
+	/* We don't want directories
 	 */
-	if ((spool = opendir(".")) == NULL)
-		perr("Cannot read " _PATH_ATJOBS);
-
-	while ((dirent = readdir(spool)) != NULL) {
-		double la;
-
-		if (stat(dirent->d_name, &buf) != 0)
-			perr("Cannot stat in " _PATH_ATJOBS);
-
-		/* We don't want directories */
-		if (!S_ISREG(buf.st_mode))
-			continue;
-
-		if (sscanf(dirent->d_name, "%c%8lx", &queue, &ctm) != 2)
-			continue;
-
-		if ((queue == 'b') && ((getloadavg(&la, 1) != 1) ||
-		    (la > ATRUN_MAXLOAD)))
-			continue;
-
-		older = (time_t) ctm *60 <= time(NULL);
-
-		/* The file is executable and old enough */
-		if (older && (S_IXUSR & buf.st_mode)) {
-			/*
-			 * Now we know we want to run the file, we can turn
-			 * off the execute bit
-			 */
-
-			PRIV_START
-
-			    if (chmod(dirent->d_name, S_IRUSR) != 0)
-				perr("Cannot change file permissions");
-
-			PRIV_END
-
-			run_file(dirent->d_name, buf.st_uid, buf.st_gid);
-		}
-		/* Delete older files */
-		if (older && !(S_IXUSR & buf.st_mode) &&
-		    (S_IRUSR & buf.st_mode))
-			unlink(dirent->d_name);
+	if (!S_ISREG(buf.st_mode)) 
+	    continue;
+
+	if (sscanf(dirent->d_name,"%c%8lx",&queue,&ctm) != 2)
+	    continue;
+
+	run_time = (time_t) ctm*60;
+
+	if ((S_IXUSR & buf.st_mode) && (run_time <=now))
+	{
+	    if (isupper(queue) && (strcmp(batch_name,dirent->d_name) > 0))
+	    {
+		run_batch = 1;
+		strncpy(batch_name, dirent->d_name, sizeof(batch_name));
+		batch_uid = buf.st_uid;
+		batch_gid = buf.st_gid;
+	    }
+	
+	/* The file is executable and old enough
+	 */
+	    if (islower(queue))
+		run_file(dirent->d_name, buf.st_uid, buf.st_gid);
 	}
-	closelog();
-	exit(EXIT_SUCCESS);
+	/*  Delete older files
+	 */
+	if ((run_time < now) && !(S_IXUSR & buf.st_mode) && (S_IRUSR & buf.st_mode))
+	    unlink(dirent->d_name);
+    }
+    /* run the single batch file, if any
+    */
+#ifndef __FreeBSD__
+    if (run_batch && (gloadavg() < load_avg)) {
+#else
+    if (run_batch) {
+	double la;
+
+	if (getloadavg(&la, 1) != 1)
+	    perr("Error in getloadavg");
+	if (la < load_avg)
+#endif
+	    run_file(batch_name, batch_uid, batch_gid);
+    }
+
+    closelog();
+    exit(EXIT_SUCCESS);
 }
diff --git a/libexec/atrun/atrun.man b/libexec/atrun/atrun.man
new file mode 100644
index 0000000..abce667
--- /dev/null
+++ b/libexec/atrun/atrun.man
@@ -0,0 +1,66 @@
+.\" $Id: atrun.man,v 1.1 1994/05/10 18:23:08 kernel Exp $
+.Dd April 12, 1995
+.Dt ATRUN 8
+.Os "FreeBSD 2.1"
+.Sh NAME
+.Nm atrun
+.Nd run jobs queued for later execution
+.Sh SYNOPSIS
+.Nm atrun
+.Op Fl l Ar load_avg
+.Op Fl d
+.Sh DESCRIPTION
+.Nm Atrun
+runs jobs queued by
+.Xr at 1 .
+Root's
+.Xr crontab 5
+file
+.Pa /etc/crontab
+has to contain the line
+.nf
+*/5     *       *       *       *       root    _ATLIB_DIR/atrun
+.fi
+so
+.Xr atrun 8
+gets called every five minutes.
+.Pp
+At every invocation, every job in lowercase queues whose starting time
+has passed is started.
+A maximum of one batch jobs (denoted by uppercase queues) are started
+each time
+.Nm atrun
+is invoked.
+.Sh OPTIONS
+.Bl -tag -width indent
+.It Fl l Ar load_avg
+Specifies a limiting load factor, over which batch jobs should
+not be run, instead of the compiled \- in value of _LOADAVG_MX.
+.It Fl d
+Debug; print error messages to standard error instead of using
+.Xr syslog 3 .
+.El
+.Sh WARNINGS
+For
+.Nm atrun
+to work, you have to start up a
+.Xr cron 8
+daemon.
+.Sh FILES
+.Bl -tag -width _ATSPOOL_DIR -compact
+.It Pa _ATSPOOL_DIR
+Directory containing output spool files
+.It Pa _ATJOB_DIR
+Directory containing job files
+.El
+.Sh SEE ALSO
+.Xr cron 8 ,
+.Xr crontab 1 ,
+.Xr crontab 5 ,
+.Xr at 1 ,
+.Xr syslog 3 .
+.Sh BUGS
+The functionality of 
+.Nm atrun
+should be merged into
+.Xr cron 8 .