enhanced cron.c, anyone?
gold...@ucf-cs.uucp
A recent problem here underscores the need for cron to run programs
under effective id's other than root; there is no mechanism in cron
to permit that. I can envision a simple hack to cron.c that would
add two fields to crontab for specifying uid and gid under which the
program on the given line would be run. Before I start hacking away,
has anyone done this? Also, are there any other worthwhile enhancements
to cron.c out there?
Oh, yes, we are running 4.1bsd on an 11/780.
Ben Goldfarb
University of Central Florida
uucp: duke!ucf-cs!goldfarb
ARPA: Goldfarb.ucf-cs@Rand-Relay
--
Ben Goldfarb
uucp: {decvax,duke}!ucf-cs!goldfarb
ARPA: goldfarb.ucf-cs@Rand-Relay
gold...@ucf-cs.uucp
A recent problem here underscores the need for cron to run programs
under effective id's other than root; there is no mechanism in cron
to permit that. I can envision a simple hack to cron.c that would
add two fields to crontab for specifying uid and gid under which the
program on the given line would be run. Before I start hacking away,
has anyone done this? Also, are there any other worthwhile enhancements
to cron.c out there?
Oh, yes, we are running 4.1bsd on an 11/780.
--
ch...@umcp-cs.uucp
net.sources), which we use to run as someone other than uid 0, gid 0
from crontab, e.g.
10 6 * * * /usr/local/user news /usr/lib/news/news.daily.sh
User is similar to su, except that it (a) understands groups and (b)
allows a command to follow the user:group specifier. It also changes
ownership of your terminal. Our version even handles suspending
processes, changing terminal ownership back and forth.
I suppose I can send it to ARPA sites that don't get net.sources.
- Chris
--
In-Real-Life: Chris Torek, Univ of MD Comp Sci
UUCP: {seismo,allegra,brl-bmd}!umcp-cs!chris
CSNet: chris@umcp-cs
ARPA: chris.umcp-cs@UDel-Relay
Brian Thomson
to do this:
* 4 * * * su otheruser < commandfile
--
Brian Thomson, CSRG Univ. of Toronto
{linus,ihnp4,uw-beaver,floyd,utzoo}!utcsrgv!thomson
dpk@brl-vgr@sri-unix.uucp
On our pdp-11's we modified cron to have a username field prior
to the command. In the interest of compatability we did not do this on
the Vaxes. Instead, we wrote a program called "alias" which is used
like nohup or nice (e.g. "alias user programs args ...") which if run
by the superuser (like from crontab) will run the given program as the
specified user. All you need to is add "alias user " to the fron of the
command string in the crontab entry.
Cheers,
-Doug-
PS. The following is alias.c. Enjoy!
/*
* A L I A S . C
*
* To compile: cc alias.c -O -o alias
*
* This program allows the superuser to run a program with
* arbitrary arguments with the uid/gid of any account on
* the system. If no program is specified, /bin/sh is
* assumed.
*
* % alias <account-name> [<program>[<args...>]]
*
* R E V I S I O N H I S T O R Y
*
* 05/20/78 RNJ Any program may be run, not just shell.
* New /etc/passwd lookup function.
*
* 10/25/81 DPK Converted to integer UIDs and GIDs & LIB7.
*
* 12/23/81 RSM Fixed to not "blow away" V7 environment.
* Default case now sets argv[0] to "-Alias(account)"
*/
#include <stdio.h>
#include <pwd.h>
char namebuf[30]; /* Argument 0 to new shell */
main(argc, argv)
char **argv;
{
register char *program; /* name of program to be exec ed */
register struct passwd *pw;
if( argc <2 ) {
printf("Usage: %s account [<program> [<args>]]\n", argv[0]);
exit(1);
}
if ((pw = getpwnam(argv[1])) == 0) {
printf("%s: account not found\n", argv[1]);
exit(2);
}
if (setgid( pw->pw_gid ) < 0)
perror ("setgid");
if (setuid( pw->pw_uid ) < 0)
perror ("setuid");
if( argc <= 2 ) {
program = "/bin/sh";
printf("UID = %d; GID = %d\n", pw->pw_uid, pw->pw_gid);
sprintf(namebuf, "-Alias(%s)", argv[1]);
execl(program, namebuf, 0);
} else {
program = argv[2];
argv[argc] = 0;
execv(program, &argv[2]);
}
perror(program);
exit(3);
}
Mike Lutz
1. The uid & gid of a command can be specified in parentheses
just before the command itself, e.g.
(107,81)foobar
will run foobar with uid = 107 and gid = 81. Normally the
command runs with uid & gid set to an innocuous daemon user
and group (i.e., you have to explicitly request execution
with root permissions).
2. If the command name is preceded by a '#', the C shell is used
rather than the Bourne shell to parse and execute the command.
Quite frankly, I thought this was a "standard hack" we'd gotten from
somewhere along the way, but apparently one of the other wizards around
here added it. When I find out who did it, I'll give credit.
Let me know if you'd like to see the changes. If there's enough
interest, I'll post the necessary mods to net.sources, otherwise I'll
mail them individually.
Mike Lutz
{allegra,seismo}!rochester!ritcv!mjl