| [ << ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Copyright (C) 2004 Bruce Guenter
This document explains ...
Name comes from: Busy/Bee/Bruce's/Better cron.
/) that happens to also be a username, fcron interprets
this word as the userid to run the job under, even for non-root users.
This causes problems for jobs line bin/something when user
bin exists.
MAILTO can only contain a username, not a full email address.
Anacron is only really useful for running jobs once a day or less frequently. From what I've seen, it's good at what it does, just not useful at much else.
I am choosing to make a number of relatively unorthodox choices in order to avoid many of the security issues that have plagued vixie-cron and other related systems.
In particular, the system must support:
$MAILTO if the job produces any output
(and possibly if the job exits non-zero)
This means that the system MUST support:
One of the biggest frustrations I have had with dealing with vixie-cron is its complete inability to deal with time jumps in an intelligent manner. In particular, when DST changes happen, jobs will either get skipped (when time jumps forward) or executed twice (when time jumps backwards). This is unacceptable.
In one of the target installations, we need to set up ulimits (limiting CPU time and memory) before executing commands. It would be easy enough to ulimit the entire daemon, but then the daemon itself would be vulnerable to getting killed when it has run for long enough. Our current setup is to run jobs through a global wrapper script, which can set any necessary limits (or anything else) and then execute the job.
There are two basic methods of submitting crontab files:
By seperating job submission from job execution, exploiting the system to run arbitrary jobs as privileged users is made even harder. It also makes the design of those individual programs much simpler.
This section lists all the non-trivial patches found for vixie-cron, what problem they appear to address, and (if appropriate) how bcron will avoid the same problem. The patches listed come from multiple sources, including the latest RPM (Fedora Core IIRC).
This patch modifies the `crontab.5' man page to remove allowing `0' for day of month or month numbers.
On some systems, signal handlers are single-shot. This patch modifies the SIGHUP handler to reactivate itself before it returns. bcron will use the bglibs signal functions, which use sigaction to create suitable handlers, where appropriate. bcron uses named pipe triggers instead of signals to deliver notifications, removing the need for most signal handlers.
This patch increases the maximum username length from 20 to 32, and modifies calls to strcpy to use strncpy to ensure all string copies are length bounded. bcron uses dynamically allocated strings to eliminate the possibility of buffer overflows.
This patch modifies the cron daemon to close stdin, stdout, and stderr on startup, and to reopen them as `/dev/null'. The bcron daemons run under supervise, and have no need of such handling.
Adds support for `/etc/cron.d'
Appears to modify `crontab''s command-line handling such that no argument is interpreted as to read the crontab from standard input.
Documents several builtin macros to replace the first 5 fields. This macros consist of: `@reboot', `@yearly', `@annually', `@monthly', `@weekly', `@daily', `@midnight', and `@hourly'. bcron will not, at least initially, support these macros.
Modifies crontab to use strncpy and snprintf when writing into length-bounded strings.
Patches the crontab man page to reference `/etc/crontab'.
Patches the crontab man page to point out that DST may cause jobs to be skipped or repeated.
Appears to modify how the cron daemon handles sending messages to syslog. bcron will log messages to stderr, avoiding syslog entirely.
Adds `-i' to the list of arguments sent to sendmail (result is `-FCronDaemon -i -odi -oem'). Only useful for sendmail, but still needed.
Sanity checks the use of `-u' against UID and/or root.
Does some sanity checking on mailto, and does a setuid before sending mail. bcron plays safe with mailto by putting it into a message header, and always drops root privileges before executing commands.
Return the SIGCHLD handler to its default state before executing commands.
More sprintf -> snprintf conversions.
Sync all the crontabs before sleeping to handle changes in the system time.
The previous patch created double execution issues with small backwards adjustments in the clock time.
| [ << ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |