MFC r357714-r357715: cron(8): rip out some legacy bits

r357714: cron(8): convert vfork() usage to fork()

vfork() is error-prone, and the usage here definitely grew to not be
clearly OK given vfork-semantics; e.g. setusercontext(3) within the child.

Rip out vfork() and the rest of the references to it. fork is heavier, but
it's unclear that the difference will be all that obvious.

Reported by: Andrew Gierth and sigsys@gmail.com

r357715: cron(8): rip out do_univ

This was an old Dynix hack, the function is a NOP on FreeBSD. We have no
need to retain this; Dynix was discontinued long ago.

MFC r356103: cron(8): use proper variable to determine mailer process status

While the mailer is normally opened/set if the mailto is set, this is not
the case if the grandchild actually didn't produce any output. This change
corrects the situation to only attempt to kill/close the mail process if it
was actually opened in the first place.

The reporter initially stumbled on the -n (suppress mail on success) flag
leading to a SIGKILL of the process group, but simultaneously
discovered/reported the behavior with !-n jobs if MAILTO was set and no
output happened.

All of these places that are checking mailto should actually be checking
whether mail is set, so do that for consistency+correctness.

This set of bugs were introduced by r352668.

MFC r352668: cron: log suppression and mail suppression for successful runs

This commit adds two new extensions to crontab, ported from OpenBSD:
- -n: suppress mail on succesful run
- -q: suppress logging of command execution

The -q option appears decades old, but -n is relatively new. The
original proposal by Job Snijder can be found here [1], and gives very
convincing reasons for inclusion in base.

This patch is a nearly identical port of OpenBSD cron for -q and -n
features. It is written to follow existing conventions and style of the
existing codebase.

Example usage:

# should only send email, but won't show up in log
* * * * * -q date

# should not send email
* * * * * -n date

# should not send email or log
* * * * * -n -q date

# should send email because of ping failure
* * * * * -n -q ping -c 1 5.5.5.5

[1]: https://marc.info/?l=openbsd-tech&m=152874866117948&w=2

PR: 237538
Relnotes: yes

MFC r346427: cron(8): schedule interval jobs that loaded during execution

Jobs using the @<second> syntax currently only get executed if they exist
when cron is started. The simplest reproducer of this is:

echo '@20 root echo "Hello!"' >> /etc/cron.d/myjob

myjob will get loaded at the next second==0, but this echo job will not
run until cron restarts. These jobs are normally handled in
run_reboot_jobs(), which sets e->lastexit of INTERVAL jobs to the startup
time so they run 'n' seconds later.

Fix this by special-casing TargetTime > 0 in the database load. Preexisting
jobs will be handled at startup during run_reboot_jobs as normal, but if
we've reloaded a database during runtime we'll hit this case and set
e->lastexit to the current time when we process it. They will then run every
'n' seconds from that point, and a full restart of cron is no longer
required to make these jobs work.

MFC r346252: cron(8): Add MAILFROM ability for crontabs

This changes the sender mail address in a similar fashion to how MAILTO may
change the recipient. The default from address remains unchanged.

PR: 140304

MFC r334817, r334910

r334817:
Add new functionality and syntax to cron(1) to allow to run jobs at a
given interval, which is counted in seconds since exit of the previous
invocation of the job. Example user crontab entry:

@25 sleep 10

The example will launch 'sleep 10' every 35 seconds. This is a rather
useless example above, but clearly explains the functionality.

The practical goal here is to avoid overlap of previous job invocation
to a new one, or to avoid too short interval(s) for jobs that last long
and doesn't have any point of immediate launch soon after previous run.

Another useful effect of interval jobs can be noticed when a cluster of
machines periodically communicates with a single node. Running the task
time based creates too much load on the node. Running interval based
spreads invocations across machines in cluster. Note that -j/-J won't
help in this case.

r334910:
Remove old, dead compat code.

We no longer need to od these things conditionally, and the fallbacks
are to 4.2BSD era defaults, which nobody uses anymore. Vixie cron has
diverged from upstream anyway in our tree, and it's not clear there's
actually a viable upstream anymore. Plus, we don't follow the
vendor-supplied code pattern here.

I'm doing this to reduce false positives from grep.

MFC r332429, r332431

r332429:
cron(8): Reload database if an existing job in cron.d changed as well

Directory mtime will only change if a file is added or removed, not
modified. For /var/cron/tabs, this is fine because of how crontab(1) manages
it using temp files so all crontab(1) changes will trigger a reload of the
database.

For /etc/cron.d and /usr/local/etc/cron.d, this is not necessarily the case.
Instead of checking their mtime, we should descend into them and check mtime
on all jobs also.

r332431:
cron(8): Correct test sense

We're about to use the result of fstat(2) either way, so don't do that if it
fails...

MFC r321240:

cron(8) manpage updates

- Document /etc/cron.d and /usr/local/etc/cron.d under FILES.
- Reword documentation for -n: add appropriate soft-stop and remove
contraction to appease igor.

MFC r310329:
r310329 (by cem):

Add a 'force' option for non-interactive crontab removal

Add a '-f' option to force crontab '-r' to be non-interactive.

MFC r321235:

Fix trivial whitespace bug introduced in usage message changes for -n
support (r304570).

MFC r314659,r314676:

r314659:

usr.sbin: normalize paths using SRCTOP-relative paths or :H when possible

This simplifies make logic/output

r314676:

Fix build after r314656

Some of the changes I introduced to use .ALLSRC were correct in spirit,
but incorrect in reality -- in particular, ../Makefile.inc hadn't been
pulled in via bsd.init.mk (via bsd.lib.mk, bsd.prog.mk), so the value
of .ALLSRC (evaluated immediately) was empty. .include bsd.init.mk
explicitly so we can be certain that the values used as dependencies in
the targets are defined when the target recipe has been evaluated.

Reminder: thou shalt separate out separate functional changes before
committing them.

(YUGE) Pointyhat to: ngie
In collaboration with: bdrewery

MFC r308139, r308157-r308158

r308139:
cron(8): add support for /etc/cron.d and /usr/local/etc/cron.d

For automation tools it is way easier to maintain files in directories rather
than modifying /etc/crontab.

The files in those directories are in the same format as /etc/crontab

Reviewed by: adrian
MFC after: 2 weeks
Relnotes: yes
Sponsored by: Gandi.net
Differential Revision: https://reviews.freebsd.org/D8400

r308157:
Fix typo in cron(8) date

Reported by: jilles

r308158:
Allow symlinks to be followed in cron.d directories and fix detection of
regular files on NFS

Reported by: jilles

MFC r304570:

Add the "-n" flag to cron(8), to prevent it from daemonizing.
This makes it possible to use it with external supervisors.
The "-n" flag name is compatible with Linux, NetBSD, and OpenBSD.

MFC r305269: cron: use existing maximum username constant MAXLOGNAME

Previously cron had its own maximum username length limit, which was
smaller than the system's MAXLOGNAME. This could lead to crontab -u
updating the wrong user's crontab (if the name was truncated, and
matched another user).

PR: 212305
Reported by: Andrii Kuzik

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

usr.sbin: minor spelling fixes on comments.

No functional change.

crontab: ftruncate() with ftello() instead of ftell().

Obtained from: OpenBSD (CVS rev. 1.47)

cron: use (char *)NULL instead of (char *)0 in execle.

Obtained from: OpenBSD (CVS Rev 1.25)

Add sbin and /usr/local directories to _PATH_DEFPATH.

Set _PATH_DEFPATH to
/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin. This is the
path in the default class in the default /etc/login.conf,
excluding ~/bin which would not be expanded properly in a string
constant.

For normal logins, _PATH_DEFPATH is overridden by /etc/login.conf,
~/.login_conf or shell startup files. _PATH_DEFPATH is still used as a
default by execlp(), execvp(), posix_spawnp() and sh if PATH is not set, and
by cron. Especially the latter is a common trap (most recently in PR
204813).

PR: 204813
Reviewed by: secteam (delphij), alfred

Undo change from r292607 that was not meant to be there

Pointyhat: me

cron: Check the return value of pipe(2)

Fix inspired by: OpenBSD (rev 1.56)
CID: 1009830

crontab: properly free an entry

This should close memory leak.

Obtained from: OpenBSD (rev. 1.62)
CID: 271773

crontab: replace malloc + bzero with calloc

Obtained from: OpenBSD (Rev 1.20)

Add META_MODE support.

Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision: D2796
Reviewed by: brooks imp

Readd Makefile.inc that were used to include upper level Makefile.inc and
set (among other things) the destination where the binary should be installed

Convert usr.sbin to LIBADD
Reduce overlinking

Revert r267233 for now. PIE support needs to be reworked.

1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.

We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.

Reported by: kib

Check gethostname(2) return code - but even if it succeeds it may not
null terminate.

Temporarily use "From: $user@$hostname" rather than "From: $user".
The latter exposes incompatible behavior if using dma(8). sendmail(8)
(and other alternatives) canonify either form on submission (even
if masquerading), but dma will leak a non-compliant address to
the internet.

use .Mt to mark up email addresses consistently (part2)

PR: 191174
Submitted by: Franco Fichtner <franco@lastsummer.de>

In preparation for ASLR [1] support add WITH_PIE to support building with -fPIE.

This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.

Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]

Mark known build failures as NO_PIE for now.

The only known runtime failure was rtld.

[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]

Bad timespec_subtract() calculations produce negative tv_nsec on i386
which cause EINVAL returned from nanosleep() which cause loop in
cron_sleep() and making all cron jobs to start about 30 seconds earlier
(which cause f.e. logfiles rotation by newsyslog delayed by 1 hour).

Use simple and proved calculations from kernel's timespecsub() instead.

MFC after: 3 days

Second attempt to add @every_second keyword support. Due to multiple
requests, default to the previous 60-seconds scheduling method
unless there is any @every_second entries to conserve CPU cycles and
power.

This change also improves scheduling in the default mode by running
as close to the beginning of the minnute as possible by replacing
sleep(3) with nanosleep(2). Previously, the tasks would run anywhere
within the first second of the minute and that offset drifted back
and forth each time cron(8) was engaged.

MFC after: 1 month

Fully backout latest changes.

Pointy hat to: sobomax

Remove harmless, but superfluous local change that creeped in along
with the r241649.

Revert latest changes to cron, until better version is worked out (I hope).

Requested by: few

o Use nanosleep(2) to sleep exact amount of time till the next second,
not multiple of 1 second, which results in actual time to drift back
and forth every run within 1 second of the actual action has
been set for.

Suggested by: Ian Lepore

o Schedule the first run in 1 second after starting up, not on the
boundary of the next minute, which results in the every_second jobs
not being run.

Properly handle non-keyword case by setting e->second to 0.

Add per-second scheduling into the cron(8). Right now it's
only available via the new @every_second shortcut. ENOTIME to
implement crontab(5) format extensions to allow more flexible
scheduling.

In order to address some concerns expressed by Terry Lambert
while discussing the topic few years ago, about per-second cron
possibly causing some bad effects on /etc/crontab by stat()ing
it every second instead of every minute now (i.e. atime update),
only check that database needs to be reloaded on every 60-th
loop run. This should be close enough to the current behaviour.

Add "@every_minute" shortcut while I am here.

MFC after: 1 month

Fix build with LOG_FILE undefined and DEBUGGING disabled.

Fix build with DEBUGGING disabled.

Rework all non-contributed files that use `struct timezone'.

This structure is not part of POSIX. According to POSIX, gettimeofday()
has the following prototype:

int gettimeofday(struct timeval *restrict tp, void *restrict tzp);

Also, POSIX states that gettimeofday() shall return 0 (as long as tzp is
not used). Remove dead error handling code. Also use NULL for a
nul-pointer instead of integer 0.

While there, change all pieces of code that only use tv_sec to use
time(3), as this provides less overhead.

Add a one second sleep before touching the spool directory. If the touch
occurs in the same second as the earlier operations to create the temporary
file and the cron(8) daemon is rescans the spool directory during that
second, then the daemon may miss a cron edit and not properly update its
internal database.

MFC after: 1 month

As cron(8) is started with '-s' by default, timezones that observe
DST should not need to worry about scheduling jobs when the DST time
changes.

Rather than removing the BUGS section in crontab(5) regarding this,
note that disabling '-s' may still cause jobs to be executed twice or
not at all.

PR: 166318
Submitted by: Florian k Unglaub (f.unglaub%googlemail!com)
MFC After: 1 week

Drop setuid status while doing file operations to prevent potential
information leak. This changeset is intended to be a minimal one
to make backports easier.

Reviewed by: kevlo, remko
MFC after: 1 week

Since April 2, 2006, Indiana has observed DST.

MFC after: 5 days

Spelling fixes for usr.sbin/

Point out that @reboot runs at every cron startup, not just system
startup.

Discussed on: hackers@

Approved by: gjb (mentor)
MFC after: 1 week

List /var/cron/tabs in FILES and add descriptions for the other entries.

PR: 145912
Submitted by: Julian H. Stacey <jhs@berklix.com>
Obtained from: OpenBSD
MFC after: 1 week

The last big commit: let usr.sbin/ use WARNS=6 by default.

Avoid sshd, cron, syslogd and inetd to be killed under high-pressure swap
environments.
Please note that this can't be done while such processes run in jails.

Note: in future it would be interesting to find a way to do that
selectively for any desired proccess (choosen by user himself), probabilly
via a ptrace interface or whatever.

Obtained from: Sandvine Incorporated
Reviewed by: emaste, arch@
Sponsored by: Sandvine Incorporated
MFC: 1 month

Fix typo.

Approved by: ru

remove a pointless prototype and static-fy the corresponding function

MFC after: 3 days

use WARNS?= instead of WARNS=

MFC after: 3 days

Be more precise and use sizeof(tn)
Pointed out by: glewis@

MFC after: 3 days

Use WARNS?= instead of WARNS=

MFC after: 3 days

Make usr.sbin/cron/crontab and usr.sbin/cron/lib WARNS=3 clean

Tested with: make universe

MFC after: 3 days

Revert to previous revision.
I should not commit anything at 3.50 AM.
In addition to danfe's comments, I got others.
I'll work on a better version of the patch.

Don't leave files in /var/cront/tabs when interrupted

PR: 17363
MFC after: 3 days

Be paranoid and use snprintf

PR: bin/122137
Submitted by: Steven Kreuzer <skreuzer@exit2shell.com>
MFC after: 3 days

Be paranoid and zero out passwd

PR: 122070
Submitted by: Steven Kreuzer <skreuzer@exit2shell.com>
Reminded by: gnn@
MFC after: 3 days

Fix empty mailto (-m "") handling: somehow I missed all checks but the first,
hence output would be written to the wrong filehandle.

Submitted by: reg
Approved by: yar (implicit)
MFC after: ASAP
Pointy hat to: marck

Add -m option to cron(8), overriding default mail recipient for cron mails,
unless explicitly provided by MAILTO= line in crontab. This feature can be
useful in massive hosting environment, where most users do not care about
autogenerated mails.

Setting recipient to null string disables default mails at all.

Approved by: yar
MFC after: 4 weeks

Cleanup of userland __P use

Fixed static linkage (build with -DNO_SHARED).

Approved by: re (kensmith)

Add PAM support to cron(8). Now cron(8) will skip commands scheduled
by unavailable accounts, e.g., those locked, expired, not allowed in at
the moment by nologin(5), or whatever, depending on cron's pam.conf(5).
This applies to personal crontabs only, /etc/crontab is unaffected.

In other words, now the account management policy will apply to
commands scheduled by users via crontab(1) so that a user can no
longer use cron(8) to set up a delayed backdoor and run commands
during periods when the admin doesn't want him to.

The PAM check is done just before running a command, not when loading
a crontab, because accounts can get locked, expired, and re-enabled
any time with no changes to their crontabs. E.g., imagine that you
provide a system with payed access, or better a cluster of such
systems with centralized account management via PAM. When a user
pays for some days of access, you set his expire field respectively.
If the account expires before its owner pays more, its crontab
commands won't run until the next payment is made. Then it'll be
enough to set the expire field in future for the commands to run
again. And so on.

Document this change in the cron(8) manpage, which includes adding
a FILES section and touching the document date.

X-Security: should benefit as users have access to cron(8) by default

Fix a bug where HOME was not allowed to be overridden by an user's crontab
as crontab(5) states it can be. This is supported by all vixie-cron derived
implementations; not sure why FreeBSD was any different.

PR: bin/106442
MFC after: 2 weeks

Behave as documented when reading fields saying "X/Y" where X != *
rather than mis-parsing them as "X".

MFC after: 1 day

Use a #define to refer to /etc/crontab.

Don't use "implicit int". Move the opening { of the functions to the next
line while there.

o Finally learn how to spell "privileges".

English trainer: ceri

o Spell "privledges" correctly. Re-style comment.

o Better be safe than sorry: check return code from setuid(2),
setgid(2), setlogin(2) and initgroups(3). In theory they could
fail for root with some third party mac(4) policies.

Submitted by: Kostik Belousov
MFC after: 1 month

/etc/crontab is similar enough to parse as correct if you run
"crontab /etc/crontab", but not the same format due to the who field.
Add some limited anti-foot-shooting support and refuse to load
/etc/crontab as someone's crontab. Users wishing shoot their foot in
this manner may copy /etc/crontab elsewhere. :)

MFC After: 1 week

Pidfiles should be created with permission preventing users from opening
them for reading. When user can open file for reading, he can also
flock(2) it, which can lead to confusions.

Pointed out by: green

Use pidfile(3) in cron(8).

Note, that when cron(8) cannot create pidfile, it'll exit. I didn't
changed this behaviour, but its better to ignore errors other than
EEXIST, so daemon can be started on systems where /var/ file system
doesn't support locking (like NFS without rpc.lockd(8)).

Mention the default value of PATH and that it may be overridden.

Submitted by: Roman Divacky
MFC after: 3 days

Remove kludges intended to support src trees with partial obj trees.

Discussed with: ru

Fix parsing of '0' and non-alphanumerics in steps. Previously, an
entry having stepping value of zero can cause crontab to hang there,
and if the main crontab is being changed in this way, then cron(8)
will keep spining.

Obtained from: OpenBSD [src/usr.sbin/cron/entry.c,v 1.17]
PR: 68683 (my own, but forgot to commit it...)
MFC After: 1 week

Expand contractions.

Expand *n't contractions.

Properly initialise the variable `deny'.

Sort sections.

Introduce the PRECIOUSPROG knob in bsd.prog.mk, similar
to PRECIOUSLIB from bsd.lib.mk. The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.

Reviewed by: oliver

For variables that are only checked with defined(), don't provide
any fake value.

Ensure that edits that do not span a clock tick are not lost.

PR: bin/22612
MT5: 4 weeks
MT4: 2 weeks

Refactoring: move two similar code blocks into a seprate function.

Fix for the following behavior:
$ crontab -e
[Add an entry with an error in the crontab file.]
crontab: errors in crontab file, can't install
Do you want to retry the same edit? yes
[Exit the editor without any changes.]
crontab: no changes made to crontab
[Entry is lost.]

Now crontab will loop until the error is fixed, or the
user answers no.

Mechanically kill hard sentence breaks.

Trim whitespace at EOL.

Markup nits.

Add two new options to cron(8), -J and -j. They allow to specify
the maximum amount of time jitter for root and other users, respectively.
Before starting a job, cron(8) will sleep a random number of seconds,
from 0 to the amount specified. This can help to smooth down load spikes
when a lot of jobs are to start at the beginning of a particular minute
(e.g., the first minute of an hour.)

PR: bin/66474
Submitted by: Dmitry Morozovsky <marck <@> rinet.ru>

Eliminate hard sentence breaks.
General markup fixes (use the .Dq macro).

Discuss the 'MAILTO' option.

PR: 58783
Submitted by: Marc Silver <marcs@draenor.org>

Mention the fact that our crontab is not fully POSIX.2 conform, because
it doesn't allow the dangerous variant of calling it without any
argument.

Fix a coredump that would occur when fdopen was unable to
return a valid fd.

PR: 49096
Submitted by: demon
MFC after: 3 days

Allow inner whitespace in the right-hand side of an environment variable
assignment even if it is not quoted (as advertised by the man page).
This fixes a regression wrt RELENG_4 introduced in rev. 1.11.

Problem noted and patch tested by: CHOI Junho <cjh@kr.FreeBSD.org>
Reviewed by: roberto

english(4) police.

Actually use the exitstatus value that we maintain.

PR: 43562
Submitted by: Marc Olzheim <marcolz@ilse.nl>

Never allow a user to use crontab if opening /var/cron/{allow,deny} fails
for any reason other than ENOENT (think resource limits). Close allow and
deny files before allowed() returns to stop the user's EDITOR being able to
read them.

Obtained from: OpenBSD (partially)

The .Nm utility

load_env(), the function that attempts to parse a crontab
line as an environment variable assignment, is broken
and not conformant to its description in the manual page.

I think it is worthwhile to have that fix in 4.6.

PR: bin/38374
Submitted by: Thomas Quinot <thomas@cuivre.fr.eu.org>
MFC after: 2 days

Mark all internal libraries with INTERNALLIB.

Use `The .Nm utility'

Only remove the '\n' at the end of a line if there is one.
I missed this as part of the fix to the PR below.

PR: 31265
Submitted by: Matthew D. Fuller <fullermd@over-yonder.net>
MFC after: 1 week

Be a bit more verbose. "modtime" means nothing.
"modification time" is a lot better.

MFC after: 3 days

Grammar fix: "When at least one of the fields .. matches ...".

MFC after: 3 days

Describe the format of the allow and deny files. This is more-or-less
the patch Matthew submitted, but I broke the lines in a more FreeBSD
way and made one small wording change.

PR: 31265
Submitted by: Matthew D. Fuller <fullermd@over-yonder.net>
MFC after: 3 weeks

Make cron actually build without defining LOGIN_CAP.

Reviewed by: jkh

Document the -x debugging option.

PR: docs/33784
Submitted by: Mike Makonnen <mike_makonnen@yahoo.com>

Fix the @monthly and @weekly shortcuts so that they actually run
monthly and weekly, respectively. Also fix the @yearly shortcut so
that it doesn't execute daily during January. OpenBSD and NetBSD also
appear to have this bug.

PR: bin/21152

mdoc(7) police: s/BSD/.Bx/ where appropriate.

mdoc(7) police: fixed the "new sentence" bogons.

fix misspelling introduced in rev 1.14 (sames as -> same as)

Fix a possible NULL reference that would be triggered
by invalid input in /etc/crontab.

MFC after: 2 days

Perform a major cleanup of the usr.sbin Makefiles.
These are not perfectly in agreement with each other style-wise, but they
are orders of orders of magnitude more consistent style-wise than before.

Remove an unused variable, and don't try to print a char[] using %d.

Submitted by: Mark Peek <mark@whistle.com>

free_entry(): Don't free e->envp if it's already NULL; likewise for
e->cmd. free_entry() now does the right thing with
partially-initialized structures.

load_entry(): Don't call env_free() on e->envp throughout the routine
before jumping to eof; the free_entry() call at that label will take
care of it. The previous behavior resulted in e->envp being free'd
twice (well, the second time would usually result in a crash, but
that's besides the point); once in load_entry(), and once in
free_entry() after the former called the latter. Also note that the
check added to free_entry() (above) doesn't help, since e->envp wasn't
reset to NULL after env_free().

Submitted by: Mark Peek <mark@whistle.com>

Remove whitespace at EOL.

Fix the type of the NULL arg to execl()

Idea from: Theo de Raadt <deraadt@openbsd.org>

Where is the pointy hat? Fix cut/paste error. (hey, it compiled! :-)

Plug two memory leaks: call login_close() after login_getclass(), and
use free_entry() instead of free() to free a struct _entry.

PR: 28108
Submitted by: Mark Peek <mark@whistle.com>

Remove the 'DO NOT EDIT THIS FILE' crud that we spit out with 'crontab -l'.
Otherwise, "crontab -l > file; vi file; crontab file" adds an extra set
of "DO NOT EDIT" markers each and every time which is a bit silly.

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for usr.sbin/ to 8.

Stop cron from shouting in the syslog. Use setproctitle() instead, since
smashing argv[0] doesn't have the intended effect of changing the ps(1)
output these days.

PR: 25850

mdoc(7) police revision 1.15:

- replaced Oo/Oc enclosures with Op;
- removed hard sentence breaks;
- removed doubled space.

The new version of the daylight time saving support. This time it works
for any change of the time zone offset from GMT. To enable use the
option -s.

Properly detach at startup. We could be passing revoked fd's to
child processes or starting children with no fd 0 (stdin) at all etc.
This is currently breaking on hub.freebsd.org.

Fix typo: seperate -> separate.

Seperate does not exist in the english language.

mdoc(7) police: split punctuation characters + misc fixes.

Backed out the DST support changes.

mdoc(7) police: ``Ds'' is not certified (no macro with such name exist)
to be used as the -width parameter, it is provided solely for backwards
compatibility with old mdoc(7). To make this work, mdocNG is forced to
provide a dummy ``Ds'' macro.

Made the special handling of the daylight time switches optional,
enabled by the option "-s" (for dSt). This returned the default behavior
to its original form.

The new option name is not "-d" because that would cause associations with
"debug" and cron already has "-x" for debugging, so this would cause
confusion.

Added sensible handling of switch to and from daylight saving time
for the jobs that fall into the disappearing or duplicated time
interval.

PR: bin/24494

mdoc(7) police: removed leading whitespaces that are not inside
Bd/Ed; these hardly degrade the quality of the produced output.

Prepare for mdoc(7)NG.

Add `_PATH_DEVZERO'.
Use _PATH_* where where possible.

Correct definition of MAXHOSTNAMELEN in ifdef'ed out code

mdoc(7) police: use the new features of the Nm macro.

Avoid use of direct troff requests in mdoc(7) manual pages.

Attempt to fix problem with users being able to convince the crontab
program to read any file which is a valid crontab file.

The fix is based on that used in NetBSD and OpenBSD - we keep the
file open while the user is editing it. This means that files must
be edited in place. Cron attempts to warn you if your editor does
not do this. The fact that the file must be edited in place is also
noted in the man page.

This patch has been confirmed to work by atleast one person on
-security and has been tested locally.

Obtained from: OpenBSD

Since -e and -r are right next to each other prompt before clobbering
a crontab you were planning to edit.

Call login_close() to prevent parent from memory leaking in some
cases due to vfork()

Prevent user from breaking his limits and restrictions or
abusing sendmail by any other way via MAILTO tag (since sendmail is running
from daemon). Now run sendmail from user, as any other cron user command.

Obtained from: Inspired by OpenBSD, but implementation is different

Make sure argv gets NULL terminated if cron entry has >= MAX_ARGS arguments

Obtained from: OpenBSD popen.c v1.3

Enable SIGCHLD to stop childs complaining to SIG_IGN of it.
It helps perl f.e.

Obtained from: OpenBSD do_command.c v1.7

Catch and report fdopen failures.

Catch and report memory allocation failures.

Allocate space for arrays of type "char *", not "char **".
Rev 1.8 made the type consistently incorrect.

Noted by: Ben Smithurst <ben@scientia.demon.co.uk>

Fix a situation where a pointer which should point to dynamically
allocated memory was instead pointed to a static string. A later
free() on the value of the pointer was a possible source of reported
"warning: pointer to wrong page" messages from cron.

Use consistent types in sizeof when malloc'ing memory for the
environment.

PR: kern/12248, bin/11169, bin/9722

Revive rev 1.12 (NetBSD improvements including @ shortcuts).

Fix parsing of commands after @ keywords (@hourly, @daily, etc.).
Fix setting of "hour" bitmap when @hourly keyword is specified.

MFC candidate after 4.0-RELEASE.

Problem-found-by: Sheldon Hearn <sheldonh@uunet.co.za>

Back out previous commit. The code is not ready for it.

Merge in NetBSD improvements:

* Clarify quoting value in of name = value pairs.
* Describe the @reboot, @yearly, @annually, @monthly, @weekly,
@daily, @midnight and @hourly extensions.

PR: 17261
Submitted by: MIHIRA Yoshiro <sanpei@sanpei.org>
Obtained from: NetBSD

$Id$ -> $FreeBSD$

Bad reference of su(8) changed to su(1).

Christen a BUGS section for an explanation of the impact of Daylight
Savings Time on cron(8). If we ever introduce some work-around code for
handling jobs scheduled for a time that "doesn't happen" due to DST,
the section should be renamed to IMPLEMENTATION NOTES.

PR: 10947
Reported by: Scott Drassinower <scottd@cloud9.net>
Submitted by: Seth Bromberger <seth@freebie.dp.ny.frb.org>
Reviewed by: mpp

Changed 'overriding what /etc/passwd says' to 'overriding default set
by cron'

PR: 12520
Submitted by: (not specified)

This is a hack. Cron runs with stdin/out/err pointing to /dev/console,
which init thoughtfully revoke()'s when starting a getty on ttyv0. This
Cron's popen() was passing these fd's through to cron children (ie:
sendmail, *not* normal cron jobs). The side effects were usually
not noticed, but it tripped up postfix which did a sanity check to see
that stdin/out/err were open, and got EBADF even thought the fd's were
in use. I seem to recall sendmail itself has hacks to work around
this problem, it had a checkfd012() function, possibly for this same
problem. (Postfix has a workaround too now though..)

This is a hack, not a fix. It's probably best to check and perhaps
close/reopen() /dev/console if needed each time around the event loop.
It would probably be useful to actually see any error messages from cron.

y2k nit: print 4 digit years correctly.
PR: 9506
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>

PR: bin/5572

Prevent cron from going crazy if the time steps. For example, if you
have a system with hundreds of users and lots of different crontabs
and your time steps back an hour, the old cron would then attempt to
run an hours worth of cron jobs in a few seconds.

Fixed printf format errors.

.Sh AUTHOR -> .Sh AUTHORS. Use .An/.Aq.

Added forgotten new file for `-Lfoo -lbar' -> `foo/bar.a' change.

Use `foo/bar.a' instead of `-Lfoo -lbar' for linking to static internal
libraries so that `ld -f' in can create correct dependencies for
yet-to-be-built libraries.

Get the default BINDIR correctly (by including ../Makefile.inc recursively.
Override the default it it is wrong.

Don't override defaults when the defaults are correct.

Don't use LDDESTDIR. Just put the -L arg in LDADD.

Log run-time parsing errors now

Use getpwnam before getpwuid since two users with same uids can exists
(affects new login classes code only)

The same fixes as in inetd: by default run `system crontab things' with
daemon login class now, not restrict them to user class breaking
compatibility with old way (so-called nobody limits problem)

Implement user[:group][/login-class] syntax in system crontab
for more flexible control (the same as in inetd)

Sort cross refereces in section SEE ALSO.

Use err(3). Rewrote man page in mdoc format.

NOSHARED takes a yes/YES no/NO value, not "true, false, hey mon!".
NOPIC is used to not generate a shared library, not NOSHARED.
Make NOSHARED advisory where appropriate.
Remove bogus NOSHARED (kbdio).

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Tone down the paranoia a bit in from the previous commit. setusercontext()
automatically Does The Right Thing when lc == NULL, which just happens to
be what the extra code in cron was trying to do. Simplify.

For some reason, the old login class code didn't seem to be working here.
I suspect it was because the child exec code's parent was doing the
initial lookups, then forking, then doing other things (possibly trashing
the static data in the getpw*() buffer), then attempting to dereference
*pwd and *lc. Also, no error checking appeared to be done - I've allowed
it to fall back to the old "become user" code on critical failure rather than
risk running a user's cron jobs as root.

Revert $FreeBSD$ to $Id$

crontab(5) incorrectly documented the dom/month arguments.
They have valid ranges of 1-31 and 1-12, not 0-31 and 0-12.

Fix compile breakage: link against libutil.

Make cron login class savvy.
Use setusercontext() rather than setuid()/setgid()/setlogin()/initgroups()
which is all handled. Login environment is NOT set by this call as crontab
provides its own means of doing so.

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Replace my "inane" usage of snprintf to copy strings with strncpy as
used by OpenBSD. (Quite frankly, I think it's perfectly reasonable to
use snprintf to copy strings, given that the semantics for strncpy()
are utterly idiotic and there is no POSIX sstrncpy().)

While I'm at it, incorporate some of OpenBSD's bugfixes to cron.

NOT for 2.2

Close yet another buffer overrun

Add sendmail option '-oi'

-oi Do not take dots on a line by themselves as a
message terminator.

Now this crontab entry works:
* * * * * echo foo; echo .; echo blah

personal (ie: with the crontab command) cron tabs were broken by the
last change. :-(
ie: /var/cron/log would report: .. cron[206]: (usage) CAN'T OPEN (%s/%s)

Fix some buffer overflow problems...

Gratuitous whitespace change so that I can commit the source of the recent
buffer overflow patch.
Reviewed by: pst
Submitted by: Dave Andersen <angio@aros.net>

Fix up some more buffer overflow problems.

fix: debug flag 'test' cause endless loop
document debug flags

close PR bin/683

Bring in my changes for removing the pestilent obj links (unless you
really want them) from /usr/src. This is the final version of the
patches, incorporating the feedback I've received from -current.

Quick patch to fix a bug where issuing ctl-c while in crontab -e
leaves editor running in background (PR: bin/751)

Submitted by: candy@fct.kgc.co.jp (Toshihiro Kanda)

This commit was generated by cvs2svn to compensate for changes in r13122,
which included commits to RCS files with non-trunk default branches.

Fix a bug that prevented %'s and \'s from being passed to the program
invoked.

Submitted by: fenner@parc.xerox.com (Bill Fenner)

Check for expired passwords before allowing access to the system.

Remove LOG_FILE definition, close PR 595
Submitted by: roberto@blaise.ibp.fr

Remove trailing whitespace.

Fix nested comments for -Wcomment warnings.

HAVE_SAVED_UIDS not depends of BSD version but depends
of _POSIX_SAVED_IDS from unistd.h, fix it.

Fix typo in HAVE_SAVED_UIDS define

Fix MAILTO hole by passing -t to sendmail
Submitted by: Mike Pritchard <pritc003@maroon.tc.umn.edu>

Really fix MAILTO hole by parsing spaces.
Remove local bitstring copy

Don't set -or0s (timeout 0) for possible network MAILTO

Fix home dir cheating

Close MAILTO security hole

Now crontab works not only for vi editor, i.e. refers to
file name not to file fd

Make /usr/bin/crontab install setuid root. (doesn't work otherwise)
The distributed makefile in the package installs it setuid root..
Reviewed by: jkh

Use LDDESTDIR and DPADD more consistently with what Bruce suggests..
Submitted by: jkh

Make the LDADD stuff work properly with obj dirs. Whoops.
Submitted by: jkh

Prevent installation.
Submitted by: jkh

Set proper destination directory for cron.
Submitted by: jkh

This commit was generated by cvs2svn to compensate for changes in r2311,
which included commits to RCS files with non-trunk default branches.