Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 525242 - sys-process/fcron - supplied crontab does not escape commands correctly, command name might get interpreted as user name if user exists
Summary: sys-process/fcron - supplied crontab does not escape commands correctly, comm...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Thomas Deutschmann (RETIRED)
URL:
Whiteboard:
Keywords: PATCH
: 630858 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-10-13 09:23 UTC by Christian Burger
Modified: 2017-09-19 22:02 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
patch by quoting (file_525242.txt,896 bytes, text/plain)
2014-10-13 09:23 UTC, Christian Burger
Details
patch by rewriting commands to use absolute paths (file_525242.txt,899 bytes, patch)
2014-10-13 09:27 UTC, Christian Burger
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Burger 2014-10-13 09:23:21 UTC
Created attachment 386598 [details]
patch by quoting

The supplied crontab at

* /etc/crontab or
* /usr/share/doc/fcron-*/crontab

contains

*/10  *  * * *  test -x /usr/sbin/run-crons && /usr/sbin/run-crons

If the user "test" exists in "/etc/passwd" fcron will try to execute "-x /usr/sbin/run-crons && /usr/sbin/run-crons" as user "test" which will fail. Either reference executables in full like "/usr/bin/test" or follow the recommendation of http://fcron.free.fr/doc/en/faq.html#AEN3197 to quote the commands. I will attach possible patches.
Comment 1 Christian Burger 2014-10-13 09:27:04 UTC
Created attachment 386600 [details, diff]
patch by rewriting commands to use absolute paths
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-17 22:04:07 UTC
Thanks for the report. This is now fixed:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=531e27c45e1f413da44d8a51ece0f59e454586fb
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-19 12:00:43 UTC
*** Bug 630858 has been marked as a duplicate of this bug. ***
Comment 4 Alexander Zubkov 2017-09-19 13:29:25 UTC
Hi.

I propose to explicitly put username (root) there. It will break the ambiguity in defininitive way. There will be no chances to interpret command string as user name.
In my opinion, if it tries to interpret it as user - the user name should be there. For example if tomorrow somebody will allow usernames with "/" - it will break crontab again.
Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-19 16:42:26 UTC
Basically, I share your opinion and prefer explicit commands. But in this case you would create a new problem: There's no "root" user on all supported architectures and I don't want to drop prefix support for example for no real reason.
Comment 6 Alexander Zubkov 2017-09-19 19:40:18 UTC
> There's no "root" user on all supported architectures
Yes, that is a good point.

> I don't want to drop prefix support for example for no real reason.
You mean specifying full path like /usr/bin/test? Actually I was not arguing with that.

So if you are saying it is more probable to have achitectures with no "root" user than achitectures which allows "/" in username - then I will need to agree that just adding full path to commands will be better.
Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-19 22:02:28 UTC
No, https://wiki.gentoo.org/wiki/Project:Prefix

When "/" in usernames will be a thing we will re-consider the decision.