1/*	$NetBSD: atrun.c,v 1.20 2011/08/01 12:28:54 mbalmer Exp $	*/
2
3/*
4 *  atrun.c - run jobs queued by at; run with root privileges.
5 *  Copyright (C) 1993, 1994 Thomas Koenig
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. The name of the author(s) may not be used to endorse or promote
13 *    products derived from this software without specific prior written
14 *    permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28/* System Headers */
29#include <sys/cdefs.h>
30#include <sys/types.h>
31#include <sys/wait.h>
32
33#include <ctype.h>
34#include <errno.h>
35#include <dirent.h>
36#include <fcntl.h>
37#include <stdio.h>
38#include <stdlib.h>
39#include <string.h>
40#include <limits.h>
41#include <time.h>
42#include <unistd.h>
43#include <syslog.h>
44#include <pwd.h>
45#include <grp.h>
46#include <err.h>
47#include <paths.h>
48#include <stdarg.h>
49
50/* Local headers */
51
52#define MAIN
53#include "privs.h"
54#include "pathnames.h"
55#include "atrun.h"
56
57/* File scope variables */
58
59#if 0
60static char rcsid[] = "$OpenBSD: atrun.c,v 1.7 1997/09/08 22:12:10 millert Exp $";
61#else
62__RCSID("$NetBSD: atrun.c,v 1.20 2011/08/01 12:28:54 mbalmer Exp $");
63#endif
64
65static int debug = 0;
66
67/* Local functions */
68static void perr(const char *, ...) __dead;
69static void perrx(const char *, ...) __dead;
70static int write_string(int, const char *);
71static void run_file(const char *, uid_t, gid_t);
72static void become_user(struct passwd *, uid_t);
73
74static const char nobody[] = "nobody";
75
76static void
77perr(const char *fmt, ...)
78{
79	char buf[2048];
80	va_list ap;
81
82	va_start(ap, fmt);
83	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
84	va_end(ap);
85
86	if (debug)
87		warn("%s", buf);
88	else
89		syslog(LOG_ERR, "%s: %m", buf);
90
91	exit(EXIT_FAILURE);
92}
93
94static void
95perrx(const char *fmt, ...)
96{
97	va_list ap;
98
99	va_start(ap, fmt);
100
101	if (debug)
102		vwarnx(fmt, ap);
103	else
104		vsyslog(LOG_ERR, fmt, ap);
105
106	va_end(ap);
107
108	exit(EXIT_FAILURE);
109}
110
111static int
112write_string(int fd, const char *a)
113{
114	return write(fd, a, strlen(a));
115}
116
117static void
118become_user(struct passwd *pentry, uid_t uid)
119{
120	if (initgroups(pentry->pw_name, pentry->pw_gid) == -1)
121		perr("Cannot init group list for `%s'", pentry->pw_name);
122
123	if (setegid(pentry->pw_gid) == -1 || setgid(pentry->pw_gid) == -1)
124		perr("Cannot change primary group to %lu",
125		    (unsigned long)pentry->pw_gid);
126
127	if (setsid() == -1)
128		perr("Cannot create a session");
129
130	if (setlogin(pentry->pw_name) == -1)
131		perr("Cannot set login name to `%s'", pentry->pw_name);
132
133	if (setuid(uid) == -1 || seteuid(uid) == -1)
134		perr("Cannot set user id to %lu", (unsigned long)uid);
135
136	if (chdir(pentry->pw_dir) == -1)
137		(void)chdir("/");
138}
139
140static void
141run_file(const char *filename, uid_t uid, gid_t gid)
142{
143	/*
144	 * Run a file by by spawning off a process which redirects I/O,
145	 * spawns a subshell, then waits for it to complete and spawns another
146	 * process to send mail to the user.
147	 */
148	pid_t pid;
149	int fd_out, fd_in;
150	int queue;
151	char mailbuf[LOGIN_NAME_MAX], fmt[49];
152	char *mailname = NULL;
153	FILE *stream;
154	int send_mail = 0;
155	struct stat buf, lbuf;
156	off_t size;
157	struct passwd *pentry;
158	int fflags;
159	uid_t nuid;
160	gid_t ngid;
161	int serrno;
162
163	PRIV_START;
164
165	if (chmod(filename, S_IRUSR) == -1)
166		perr("Cannot change file permissions to `%s'", filename);
167
168	PRIV_END;
169
170	pid = fork();
171	if (pid == -1)
172		perr("Cannot fork");
173	else if (pid != 0)
174		return;
175
176	/*
177	 * Let's see who we mail to.  Hopefully, we can read it from the
178	 * command file; if not, send it to the owner, or, failing that, to
179	 * root.
180	 */
181
182	pentry = getpwuid(uid);
183	if (pentry == NULL)
184		perrx("Userid %lu not found - aborting job `%s'",
185		    (unsigned long)uid, filename);
186
187	PRIV_START;
188
189	stream = fopen(filename, "r");
190	serrno = errno;
191
192	PRIV_END;
193
194	if (stream == NULL) {
195		errno = serrno;
196		perr("Cannot open input file");
197	}
198
199	if (pentry->pw_expire && time(NULL) >= pentry->pw_expire)
200		perrx("Userid %lu has expired - aborting job `%s'",
201		    (unsigned long)uid, filename);
202
203	if ((fd_in = dup(fileno(stream))) == -1)
204		perr("Error duplicating input file descriptor");
205
206	if (fstat(fd_in, &buf) == -1)
207		perr("Error in fstat of input file descriptor");
208
209	PRIV_START;
210
211	if (lstat(filename, &lbuf) == -1)
212		perr("Error in lstat of `%s'", filename);
213
214	PRIV_END;
215
216	if (S_ISLNK(lbuf.st_mode))
217		perrx("Symbolic link encountered in job `%s' - aborting",
218		    filename);
219
220	if ((lbuf.st_dev != buf.st_dev) || (lbuf.st_ino != buf.st_ino) ||
221	    (lbuf.st_uid != buf.st_uid) || (lbuf.st_gid != buf.st_gid) ||
222	    (lbuf.st_size!=buf.st_size))
223		perrx("Somebody changed files from under us for job `%s' "
224		    "- aborting", filename);
225
226	if (buf.st_nlink > 1)
227		perrx("Somebody is trying to run a linked script for job `%s'",
228		    filename);
229
230	if ((fflags = fcntl(fd_in, F_GETFD)) < 0)
231		perr("Error in fcntl");
232
233	(void)fcntl(fd_in, F_SETFD, fflags & ~FD_CLOEXEC);
234
235	(void)snprintf(fmt, sizeof(fmt),
236	    "#!/bin/sh\n# atrun uid=%%u gid=%%u\n# mail %%%ds %%d",
237	    LOGIN_NAME_MAX);
238
239	if (fscanf(stream, fmt, &nuid, &ngid, mailbuf, &send_mail) != 4)
240		perrx("File `%s' is in wrong format - aborting", filename);
241
242	if (mailbuf[0] == '-')
243		perrx("Illegal mail name `%s' in `%s'", mailbuf, filename);
244
245	mailname = mailbuf;
246	if (nuid != uid)
247		perrx("Job `%s' - userid %lu does not match file uid %lu",
248		    filename, (unsigned long)nuid, (unsigned long)uid);
249
250	if (ngid != gid)
251		perrx("Job `%s' - groupid %lu does not match file gid %lu",
252		    filename, (unsigned long)ngid, (unsigned long)gid);
253
254	(void)fclose(stream);
255
256	PRIV_START;
257
258	if (chdir(_PATH_ATSPOOL) == -1)
259		perr("Cannot chdir to `%s'", _PATH_ATSPOOL);
260
261	/*
262	 * Create a file to hold the output of the job we are  about to
263	 * run. Write the mail header.
264	 */
265
266	if ((fd_out = open(filename,
267		    O_WRONLY | O_CREAT | O_EXCL, S_IWUSR | S_IRUSR)) == -1)
268		perr("Cannot create output file `%s'", filename);
269
270	PRIV_END;
271
272	write_string(fd_out, "To: ");
273	write_string(fd_out, mailname);
274	write_string(fd_out, "\nSubject: Output from your job ");
275	write_string(fd_out, filename);
276	write_string(fd_out, "\n\n");
277	if (fstat(fd_out, &buf) == -1)
278		perr("Error in fstat of output file descriptor");
279	size = buf.st_size;
280
281	(void)close(STDIN_FILENO);
282	(void)close(STDOUT_FILENO);
283	(void)close(STDERR_FILENO);
284
285	pid = fork();
286	if (pid < 0)
287		perr("Error in fork");
288	else if (pid == 0) {
289		char *nul = NULL;
290		char **nenvp = &nul;
291
292		/*
293		 * Set up things for the child; we want standard input from
294		 * the input file, and standard output and error sent to
295		 * our output file.
296		 */
297		if (lseek(fd_in, (off_t) 0, SEEK_SET) == (off_t)-1)
298			perr("Error in lseek");
299
300		if (dup(fd_in) != STDIN_FILENO)
301			perr("Error in I/O redirection");
302
303		if (dup(fd_out) != STDOUT_FILENO)
304			perr("Error in I/O redirection");
305
306		if (dup(fd_out) != STDERR_FILENO)
307			perr("Error in I/O redirection");
308
309		(void)close(fd_in);
310		(void)close(fd_out);
311
312		PRIV_START;
313
314		if (chdir(_PATH_ATJOBS) == -1)
315			perr("Cannot chdir to `%s'", _PATH_ATJOBS);
316
317		queue = *filename;
318
319		if (queue > 'b')
320		    nice(queue - 'b');
321
322		become_user(pentry, uid);
323
324		(void)execle("/bin/sh", "sh", (char *)NULL, nenvp);
325		perr("Exec failed for /bin/sh");
326	}
327	/* We're the parent.  Let's wait. */
328	(void)close(fd_in);
329	(void)close(fd_out);
330	(void)waitpid(pid, NULL, 0);
331
332	/*
333	 * Send mail.  Unlink the output file first, so it is deleted
334	 * after the run.
335	 */
336	PRIV_START;
337
338	if (stat(filename, &buf) == -1)
339		perr("Error in stat of output file `%s'", filename);
340	if (open(filename, O_RDONLY) != STDIN_FILENO)
341		perr("Open of jobfile `%s' failed", filename);
342
343	(void)unlink(filename);
344
345	PRIV_END;
346
347	if ((buf.st_size != size) || send_mail) {
348		/* Fork off a child for sending mail */
349
350		PRIV_START;
351
352		become_user(pentry, uid);
353
354		execl(_PATH_SENDMAIL, "sendmail", "-F", "Atrun Service",
355		    "-odi", "-oem", "-t", (char *) NULL);
356		perr("Exec failed for mail command `%s'", _PATH_SENDMAIL);
357
358		PRIV_END;
359	}
360	exit(EXIT_SUCCESS);
361}
362
363/* Global functions */
364
365int
366main(int argc, char *argv[])
367{
368	/*
369	 * Browse through  _PATH_ATJOBS, checking all the jobfiles whether
370	 * they should be executed and or deleted. The queue is coded into
371	 * the first byte of the job filename, the date (in minutes since
372	 * Eon) as a hex number in the following eight bytes, followed by
373	 * a dot and a serial number.  A file which has not been executed
374	 * yet is denoted by its execute - bit set.  For those files which
375	 * are to be executed, run_file() is called, which forks off a
376	 * child which takes care of I/O redirection, forks off another
377	 * child for execution and yet another one, optionally, for sending
378	 * mail.  Files which already have run are removed during the
379	 * next invocation.
380	 */
381	DIR *spool;
382	struct dirent *dirent;
383	struct stat buf;
384	unsigned long ctm;
385	int jobno;
386	char queue;
387	time_t now, run_time;
388	char batch_name[] = "Z2345678901234";
389	uid_t batch_uid;
390	gid_t batch_gid;
391	int c;
392	int run_batch;
393	double la, load_avg = ATRUN_MAXLOAD;
394	struct group *grp;
395	struct passwd *pwd;
396
397	openlog("atrun", LOG_PID, LOG_CRON);
398
399	if ((grp = getgrnam(nobody)) == NULL)
400		perrx("Cannot get gid for `%s'", nobody);
401
402	if ((pwd = getpwnam(nobody)) == NULL)
403		perrx("Cannot get uid for `%s'", nobody);
404
405	/*
406	 * We don't need root privileges all the time; running under uid
407	 * and gid nobody is fine except for privileged operations.
408	 */
409	RELINQUISH_PRIVS_ROOT(pwd->pw_uid, grp->gr_gid);
410
411	opterr = 0;
412	errno = 0;
413	while ((c = getopt(argc, argv, "dl:")) != -1) {
414		switch (c) {
415		case 'l':
416			if (sscanf(optarg, "%lf", &load_avg) != 1)
417				perrx("Bad argument to option -l: ", optarg);
418			if (load_avg <= 0)
419				load_avg = ATRUN_MAXLOAD;
420			break;
421
422		case 'd':
423			debug++;
424			break;
425
426		case '?':
427			perrx("Usage: %s [-l <loadav>] [-d]", getprogname());
428			/*NOTREACHED*/
429
430		default:
431			perrx("Invalid option: %c", c);
432			/*NOTREACHED*/
433		}
434	}
435
436	PRIV_START;
437
438	if (chdir(_PATH_ATJOBS) == -1)
439		perr("Cannot change directory to `%s'", _PATH_ATJOBS);
440
441	/*
442	 * Main loop. Open spool directory for reading and look over all
443	 * the files in there. If the filename indicates that the job
444	 * should be run and the x bit is set, fork off a child which sets
445	 * its user and group id to that of the files and exec a /bin/sh
446	 * which executes the shell script. Unlink older files if they
447	 * should no longer be run.  For deletion, their r bit has to be
448	 * turned on.
449	 *
450	 * Also, pick the oldest batch job to run, at most one per
451	 * invocation of atrun.
452	 */
453	if ((spool = opendir(".")) == NULL)
454		perr("Cannot open `%s'", _PATH_ATJOBS);
455
456	PRIV_END;
457
458	now = time(NULL);
459	run_batch = 0;
460	batch_uid = (uid_t) -1;
461	batch_gid = (gid_t) -1;
462
463	while ((dirent = readdir(spool)) != NULL) {
464		PRIV_START;
465
466		if (stat(dirent->d_name, &buf) == -1)
467			perr("Cannot stat `%s' in `%s'", dirent->d_name,
468			    _PATH_ATJOBS);
469
470		PRIV_END;
471
472		/* We don't want directories */
473		if (!S_ISREG(buf.st_mode))
474			continue;
475
476		if (sscanf(dirent->d_name, "%c%5x%8lx", &queue, &jobno,
477		    &ctm) != 3)
478			continue;
479
480		run_time = (time_t) ctm * 60;
481
482		if ((S_IXUSR & buf.st_mode) && (run_time <= now)) {
483			if (isupper((unsigned char)queue) &&
484			    (strcmp(batch_name, dirent->d_name) > 0)) {
485				run_batch = 1;
486				(void)strlcpy(batch_name, dirent->d_name,
487				    sizeof(batch_name));
488				batch_uid = buf.st_uid;
489				batch_gid = buf.st_gid;
490			}
491
492			/* The file is executable and old enough */
493			if (islower((unsigned char)queue))
494				run_file(dirent->d_name, buf.st_uid,
495				    buf.st_gid);
496		}
497
498		/* Delete older files */
499		if ((run_time < now) && !(S_IXUSR & buf.st_mode) &&
500		    (S_IRUSR & buf.st_mode)) {
501			PRIV_START;
502
503			(void)unlink(dirent->d_name);
504
505			PRIV_END;
506		}
507	}
508
509	/* Run the single batch file, if any */
510	if (run_batch && ((getloadavg(&la, 1) == 1) && la < load_avg))
511		run_file(batch_name, batch_uid, batch_gid);
512
513	closelog();
514	return EXIT_SUCCESS;
515}
516