Hello community, here is the log from the commit of package cronie for openSUSE:Factory checked in at 2019-03-24 14:57:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cronie (Old) and /work/SRC/openSUSE:Factory/.cronie.new.25356 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cronie" Sun Mar 24 14:57:00 2019 rev:70 rq:686472 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/cronie/cronie.changes 2019-02-11 21:16:29.627365671 +0100 +++ /work/SRC/openSUSE:Factory/.cronie.new.25356/cronie.changes 2019-03-24 14:57:02.499201807 +0100 @@ -1,0 +2,15 @@ +Sun Mar 17 10:37:44 UTC 2019 - Kristýna Streitová <[email protected]> + +- update to 1.5.3 + * Fix CVE-2019-9704 [bnc#1128937] and CVE-2019-9705 [bnc#1128935] + to avoid local DoS of the crond + * crontab: Make crontab without arguments fail + * crond: In PAM configuration include system-auth instead of + password-auth + * crond: In the systemd service file restart crond if it fails + * crond: Use the role from the crond context for system job + contexts + * Multiple small cleanups and fixes. +- refresh cronie-nheader_lines.diff and cronie-pam_config.diff + +------------------------------------------------------------------- Old: ---- cronie-1.5.2.tar.gz New: ---- cronie-1.5.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cronie.spec ++++++ --- /var/tmp/diff_new_pack.NnnZUO/_old 2019-03-24 14:57:04.519201594 +0100 +++ /var/tmp/diff_new_pack.NnnZUO/_new 2019-03-24 14:57:04.547201591 +0100 @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via https://bugs.opensuse.org/ +# Please submit bugfixes or comments via http://bugs.opensuse.org/ # @@ -23,7 +23,7 @@ %define cron_configs %{_sysconfdir}/pam.d/crond %{_sysconfdir}/crontab %{_sysconfdir}/cron.deny Name: cronie -Version: 1.5.2 +Version: 1.5.3 Release: 0 Summary: Cron Daemon License: BSD-3-Clause AND GPL-2.0-only AND MIT ++++++ cronie-1.5.2.tar.gz -> cronie-1.5.3.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/ChangeLog new/cronie-cronie-1.5.3/ChangeLog --- old/cronie-cronie-1.5.2/ChangeLog 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/ChangeLog 2019-03-15 11:20:30.000000000 +0100 @@ -1,3 +1,63 @@ +2019-03-15 Tomas Mraz <[email protected]> + + * Fix warnings in anacron and crond code. + +2019-03-15 Tomas Mraz <[email protected]> + + * Fix CVE-2019-9704 and CVE-2019-9705 + +2019-03-15 Tomas Mraz <[email protected]> + + * Remove leftover debugging message. + +2019-03-11 Marcel Plch <[email protected]> + + * Make crond run after autofs mounts + +2019-02-15 Tomas Mraz <[email protected]> + + * crontab: Make crontab without arguments fail. + +2018-12-07 Marcel Plch <[email protected]> + + * Use system-auth instead of password-auth for PAM authentication (#25) + +2018-11-23 Marcel Plch <[email protected]> + + * Restart crond if it fails + +2018-11-19 Tomas Mraz <[email protected]> + + * load_env: parse the environment variables in-place + +2018-11-19 Tomáš Mráz <[email protected]> + + * Update readme.md with the latest release and better link to Fedora + +2018-11-18 Oliver Kurz <[email protected]> + + * readme.md: Replace dead link to openSUSE ML with package link + +2018-10-18 Tomas Mraz <[email protected]> + + * Use the role from the crond context for system job contexts. + +2018-08-28 Marcel Plch <[email protected]> + + * Fix unsafe code + +2018-08-28 Marcel Plch <[email protected]> + + * Fix possible memory leaks + +2018-05-03 Tomas Mraz <[email protected]> + + * Release new version 1.5.2 + +2018-05-03 Tomas Mraz <[email protected]> + + * Silence may be used uninitialized warning. + 2018-05-03 Tomas Mraz <[email protected]> * crontab: do not try to replace the crontab with a directory diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/INSTALL new/cronie-cronie-1.5.3/INSTALL --- old/cronie-cronie-1.5.2/INSTALL 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/INSTALL 2019-03-15 11:20:30.000000000 +0100 @@ -1,22 +1,14 @@ Basic Installation ================== -In the vixie-cron directory run: -autoreconf -These commands create from configure.ac executable ./configure - -Then you can start installation: +Run the usual autotools combination of: +./configure make make install -The executable files will be installed in /usr/local/* - -Options -======= -In the default package are used configure options: ---with-pam ---with-selinux ---with-audit - - +The executable files will be installed in /usr/local/* by default. +Configure Options +================= +Please see the ./configure --help output for available build-time +options. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/NEWS new/cronie-cronie-1.5.3/NEWS --- old/cronie-cronie-1.5.2/NEWS 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/NEWS 2019-03-15 11:20:30.000000000 +0100 @@ -1,5 +1,13 @@ cronie NEWS -- history of user-visible changes. +Release 1.5.3 +* Fix CVE-2019-9704 and CVE-2019-9705 to avoid local DoS of the crond. +* crontab: Make crontab without arguments fail. +* crond: In PAM configuration include system-auth instead of password-auth. +* crond: In the systemd service file restart crond if it fails. +* crond: Use the role from the crond context for system job contexts. +* Multiple small cleanups and fixes. + Release 1.5.2 * cronnext: New useful utility to find out time of the next job run. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/anacron/readtab.c new/cronie-cronie-1.5.3/anacron/readtab.c --- old/cronie-cronie-1.5.2/anacron/readtab.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/anacron/readtab.c 2019-03-15 11:20:30.000000000 +0100 @@ -134,8 +134,19 @@ var_len = (int)strlen(env_var); val_len = (int)strlen(value); + if (!var_len) { + return; + } + er = obstack_alloc(&tab_o, sizeof(env_rec)); + if (er == NULL) { + die_e("Cannot allocate memory."); + } + er->assign = obstack_alloc(&tab_o, var_len + 1 + val_len + 1); + if (er->assign == NULL) { + die_e("Cannot allocate memory."); + } strcpy(er->assign, env_var); er->assign[var_len] = '='; strcpy(er->assign + var_len + 1, value); @@ -167,15 +178,24 @@ return; } jr = obstack_alloc(&tab_o, sizeof(job_rec)); + if (jr == NULL) { + die_e("Cannot allocate memory."); + } jr->period = period; jr->named_period = 0; delay += random_number; jr->delay = delay; jr->tab_line = line_num; jr->ident = obstack_alloc(&tab_o, ident_len + 1); + if (jr->ident == NULL) { + die_e("Cannot allocate memory."); + } strcpy(jr->ident, ident); jr->arg_num = job_arg_num(ident); jr->command = obstack_alloc(&tab_o, command_len + 1); + if (jr->command == NULL) { + die_e("Cannot allocate memory."); + } strcpy(jr->command, command); jr->job_pid = jr->mailer_pid = 0; if (last_job_rec != NULL) last_job_rec->next = jr; @@ -208,6 +228,9 @@ } jr = obstack_alloc(&tab_o, sizeof(job_rec)); + if (jr == NULL) { + die_e("Cannot allocate memory."); + } if (!strncmp ("@monthly", periods, 8)) { jr->named_period = 1; } else if (!strncmp("@yearly", periods, 7) || !strncmp("@annually", periods, 9) || !strncmp(/* backwards compat misspelling */"@annualy", periods, 8)) { @@ -225,9 +248,15 @@ jr->delay = delay; jr->tab_line = line_num; jr->ident = obstack_alloc(&tab_o, ident_len + 1); + if (jr->ident == NULL) { + die_e("Cannot allocate memory."); + } strcpy(jr->ident, ident); jr->arg_num = job_arg_num(ident); jr->command = obstack_alloc(&tab_o, command_len + 1); + if (jr->command == NULL) { + die_e("Cannot allocate memory."); + } strcpy(jr->command, command); jr->job_pid = jr->mailer_pid = 0; if (last_job_rec != NULL) last_job_rec->next = jr; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/anacron/runjob.c new/cronie-cronie-1.5.3/anacron/runjob.c --- old/cronie-cronie-1.5.2/anacron/runjob.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/anacron/runjob.c 2019-03-15 11:20:30.000000000 +0100 @@ -104,9 +104,43 @@ static void xputenv(const char *s) { - char *copy = strdup (s); - if (!copy) die_e("Not enough memory to set the environment"); - if (putenv(copy)) die_e("Can't set the environment"); + char *name = NULL, *val = NULL; + char *eq_ptr; + size_t eq_index; + + if (s == NULL) { + die_e("Invalid environment string"); + } + + eq_ptr = strchr(s, '='); + if (eq_ptr == NULL) { + die_e("Invalid environment string"); + } + + eq_index = (size_t) (eq_ptr - s); + + name = malloc((eq_index + 1) * sizeof(char)); + if (name == NULL) { + die_e("Not enough memory to set the environment"); + } + + val = malloc((strlen(s) - eq_index) * sizeof(char)); + if (val == NULL) { + die_e("Not enough memory to set the environment"); + } + + strncpy(name, s, eq_index); + name[eq_index] = '\0'; + strcpy(val, s + eq_index + 1); + + if (setenv(name, val, 1)) { + die_e("Can't set the environment"); + } + + free(name); + free(val); + return; + } static void diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/configure.ac new/cronie-cronie-1.5.3/configure.ac --- old/cronie-cronie-1.5.2/configure.ac 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/configure.ac 2019-03-15 11:20:30.000000000 +0100 @@ -1,4 +1,4 @@ -AC_INIT([cronie],[1.5.2],[[email protected],[email protected]]) +AC_INIT([cronie],[1.5.3],[[email protected],[email protected]]) AC_CONFIG_HEADER([config.h]) AC_PREREQ(2.60) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/contrib/cronie.systemd new/cronie-cronie-1.5.3/contrib/cronie.systemd --- old/cronie-cronie-1.5.2/contrib/cronie.systemd 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/contrib/cronie.systemd 2019-03-15 11:20:30.000000000 +0100 @@ -1,12 +1,14 @@ [Unit] Description=Command Scheduler -After=auditd.service nss-user-lookup.target systemd-user-sessions.service time-sync.target ypbind.service +After=auditd.service nss-user-lookup.target systemd-user-sessions.service time-sync.target ypbind.service autofs.service [Service] EnvironmentFile=/etc/sysconfig/crond ExecStart=/usr/sbin/crond -n $CRONDARGS ExecReload=/bin/kill -HUP $MAINPID KillMode=process +Restart=on-failure +RestartSec=30s [Install] WantedBy=multi-user.target diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/man/crontab.1 new/cronie-cronie-1.5.3/man/crontab.1 --- old/cronie-cronie-1.5.2/man/crontab.1 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/man/crontab.1 2019-03-15 11:20:30.000000000 +0100 @@ -28,16 +28,18 @@ .SH SYNOPSIS .B crontab .RB [ -u -.IR user ] " file" +.IR user ] +.RI < "file" +.RB | \ - > .br .B crontab .RB [ -u .IR user ] -.RB [ -l " | " -r " | " -e ]\ [ -i ] +.RB < -l " | " -r " | " -e >\ [ -i ] .RB [ -s ] .br .B crontab -.BR -n\ [ +.BR -n \ [ .IR "hostname " ] .br .B crontab @@ -102,19 +104,11 @@ .SH "OPTIONS" .TP .B "\-u" -Appends the name of the user whose crontab is to be modified. If this +Specifies the name of the user whose crontab is to be modified. If this option is not used, .I crontab examines "your" crontab, i.e., the crontab of the person executing the -command. Note that -.BR su (8) -may confuse -.IR crontab , -thus, when executing commands under -.BR su (8) -you should always use the -.B -u -option. If no crontab exists for a particular user, it is created for +command. If no crontab exists for a particular user, it is created for him the first time the .B crontab -u command is used under his username. @@ -195,7 +189,10 @@ .SH STANDARDS The .I crontab -command conforms to IEEE Std1003.2-1992 (``POSIX''). This new command +command conforms to IEEE Std1003.2-1992 (``POSIX'') with one exception: +For replacing the current crontab with data from standard input the +.B \- +has to be specified on the command line. This new command syntax differs from previous versions of Vixie Cron, as well as from the classic SVR3 syntax. .SH DIAGNOSTICS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/pam/crond new/cronie-cronie-1.5.3/pam/crond --- old/cronie-cronie-1.5.2/pam/crond 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/pam/crond 2019-03-15 11:20:30.000000000 +0100 @@ -4,8 +4,8 @@ # # Although no PAM authentication is called, auth modules # are used for credential setting -auth include password-auth +auth include system-auth account required pam_access.so -account include password-auth +account include system-auth session required pam_loginuid.so -session include password-auth +session include system-auth diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/readme.md new/cronie-cronie-1.5.3/readme.md --- old/cronie-cronie-1.5.2/readme.md 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/readme.md 2019-03-15 11:20:30.000000000 +0100 @@ -7,7 +7,7 @@ And why cronie? [http://www.urbandictionary.com/define.php?term=cronie] # Download -Latest released version is 1.5.1. +Latest released version is 1.5.2. User visible changes: - crontab: Use temporary file name that is ignored by crond. @@ -19,11 +19,11 @@ The source can be downloaded from [https://github.com/cronie-crond/cronie/releases] Cronie is packaged by these distributions: -- Fedora [http://koji.fedoraproject.org/koji/packageinfo?packageID=5724] +- Fedora [https://apps.fedoraproject.org/packages/cronie] - Mandriva [http://sophie.zarb.org/srpm/Mandriva,cooker,/cronie/history] - Gentoo [http://packages.gentoo.org/package/sys-process/cronie] - Source Mage [http://dbg.download.sourcemage.org/grimoire/codex/stable/utils/cronie/] -- OpenSUSE replacement of default with cronie [http://lists.suse.com/opensuse-features/2010-09/msg00217.html] +- openSUSE [https://software.opensuse.org/package/cronie] - Arch Linux [https://www.archlinux.org/packages/core/x86_64/cronie/] # Contact diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/cronnext.c new/cronie-cronie-1.5.3/src/cronnext.c --- old/cronie-cronie-1.5.2/src/cronnext.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/cronnext.c 2019-03-15 11:20:30.000000000 +0100 @@ -71,13 +71,13 @@ /* * print entry flags */ -char *flagname[]= { - [MIN_STAR] = "MIN_STAR", - [HR_STAR] = "HR_STAR", - [DOM_STAR] = "DOM_STAR", - [DOW_STAR] = "DOW_STAR", - [WHEN_REBOOT] = "WHEN_REBOOT", - [DONT_LOG] = "DONT_LOG" +const char *flagname[]= { + "MIN_STAR", + "HR_STAR", + "DOM_STAR", + "DOW_STAR", + "WHEN_REBOOT", + "DONT_LOG" }; void printflags(char *indent, int flags) { @@ -85,8 +85,8 @@ int first = 1; printf("%s flagnames:", indent); - for (f = 1; f < sizeof(flagname); f = f << 1) - if (flags & f) { + for (f = 0; f < sizeof(flagname)/sizeof(char *); f++) + if (flags & (int)1 << f) { printf("%s%s", first ? " " : "|", flagname[f]); first = 0; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/crontab.c new/cronie-cronie-1.5.3/src/crontab.c --- old/cronie-cronie-1.5.2/src/crontab.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/crontab.c 2019-03-15 11:20:30.000000000 +0100 @@ -135,8 +135,6 @@ int main(int argc, char *argv[]) { int exitstatus; - char n[] = "-"; /*set the n string to - so we have a valid string to use */ - char *nargv[] = { argv[0], n, NULL }; if ((ProgramName=strrchr(argv[0], '/')) == NULL) { ProgramName = argv[0]; @@ -154,10 +152,6 @@ #if defined(BSD) setlinebuf(stderr); #endif - /*should we desire to make changes to behavior later. */ - if (argv[1] == NULL) { /* change behavior to allow crontab to take stdin with no '-' */ - argv = nargv; - } parse_args(argc, argv); /* sets many globals, opens a file */ check_spool_dir(); if (!allowed(RealUser, CRON_ALLOW, CRON_DENY)) { @@ -328,7 +322,7 @@ endpwent(); - if (Option == opt_hostset && argv[optind] != NULL) { + if (Option == opt_hostset && argv[optind] != NULL) { HostSpecified = 1; if (strlen(argv[optind]) >= sizeof Host) usage("hostname too long"); @@ -348,7 +342,7 @@ (void) strcpy(Filename, argv[optind]); } else - usage("file name must be specified for replace"); + usage("file name or - (for stdin) must be specified for replace"); } if (Option == opt_replace) { @@ -759,6 +753,7 @@ uid_t file_owner; char **envp; char *safename; + int envs = 0, entries = 0; safename = host_specific_filename("#tmp", "XXXXXXXXXX"); @@ -838,6 +833,10 @@ } while (!CheckErrorCount && !eof) { + if (!skip_comments(tmp)) { + check_error("too many garbage characters"); + break; + } switch (load_env(envstr, tmp)) { case ERR: /* check for data before the EOF */ @@ -849,14 +848,30 @@ break; case FALSE: e = load_entry(tmp, check_error, pw, envp); - if (e) + if (e) { + ++entries; free_entry(e); + } break; case TRUE: + ++envs; break; } } env_free(envp); + if (envs > MAX_USER_ENVS) { + fprintf(stderr, "More than %d environment variables in crontab file, can't install.\n", MAX_USER_ENVS); + fclose(tmp); + error = -1; + goto done; + } + + if (entries > MAX_USER_ENTRIES) { + fprintf(stderr, "More than %d entries in crontab file, can't install.\n", MAX_USER_ENTRIES); + fclose(tmp); + error = -1; + goto done; + } if (CheckErrorCount != 0) { fprintf(stderr, "errors in crontab file, can't install.\n"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/database.c new/cronie-cronie-1.5.3/src/database.c --- old/cronie-cronie-1.5.2/src/database.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/database.c 2019-03-15 11:20:30.000000000 +0100 @@ -407,7 +407,7 @@ if (not_a_crontab(dp)) continue; - strncpy(fname, dp->d_name, NAME_MAX); + strncpy(fname, dp->d_name, NAME_MAX + 1); if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, dp->d_name, '/')) @@ -566,7 +566,7 @@ if (not_a_crontab(dp)) continue; - strncpy(fname, dp->d_name, NAME_MAX); + strncpy(fname, dp->d_name, NAME_MAX + 1); if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, fname, '/')) continue; /* XXX log? */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/do_command.c new/cronie-cronie-1.5.3/src/do_command.c --- old/cronie-cronie-1.5.2/src/do_command.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/do_command.c 2019-03-15 11:20:30.000000000 +0100 @@ -418,7 +418,7 @@ if (mailto && safe_p(usernm, mailto) && strncmp(MailCmd,"off",3) && !SyslogOutput) { char **env; - char mailcmd[MAX_COMMAND]; + char mailcmd[MAX_COMMAND+1]; /* +1 for terminator */ char hostname[MAXHOSTNAMELEN]; char *content_type = env_get("CONTENT_TYPE", jobenv), *content_transfer_encoding = @@ -434,7 +434,7 @@ } } else { - strncpy(mailcmd, MailCmd, MAX_COMMAND); + strncpy(mailcmd, MailCmd, MAX_COMMAND+1); } if (!(mail = cron_popen(mailcmd, "w", e->pwd, jobenv))) { perror(mailcmd); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/entry.c new/cronie-cronie-1.5.3/src/entry.c --- old/cronie-cronie-1.5.2/src/entry.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/entry.c 2019-03-15 11:20:30.000000000 +0100 @@ -93,18 +93,17 @@ */ ecode_e ecode = e_none; - entry *e; + entry *e = NULL; int ch; char cmd[MAX_COMMAND]; char envstr[MAX_ENVSTR]; char **tenvp; char *p; struct passwd temppw; + int i; Debug(DPARS, ("load_entry()...about to eat comments\n")); - skip_comments(file); - ch = get_char(file); if (ch == EOF) return (NULL); @@ -115,6 +114,10 @@ */ e = (entry *) calloc(sizeof (entry), sizeof (char)); + if (e == NULL) { + ecode = e_memory; + goto eof; + } /* check for '-' as a first character, this option will disable * writing a syslog message about command getting executed @@ -131,8 +134,10 @@ goto eof; } ch = get_char(file); - if (ch == EOF) + if (ch == EOF) { + free(e); return NULL; + } } if (ch == '@') { @@ -410,17 +415,19 @@ Debug(DPARS, ("load_entry()...returning successfully\n")); - /* success, fini, return pointer to the entry we just created... - */ - return (e); + /* success, fini, return pointer to the entry we just created... + */ + return (e); eof: - if (e->envp) - env_free(e->envp); - free(e->pwd); - free(e->cmd); - free(e); - while (ch != '\n' && !feof(file)) + if (e) { + if (e->envp) + env_free(e->envp); + free(e->pwd); + free(e->cmd); + free(e); + } + for (i = 0; i < MAX_COMMAND && ch != '\n' && !feof(file); i++) ch = get_char(file); if (ecode != e_none && error_func) (*error_func) (ecodes[(int) ecode]); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/env.c new/cronie-cronie-1.5.3/src/env.c --- old/cronie-cronie-1.5.2/src/env.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/env.c 2019-03-15 11:20:30.000000000 +0100 @@ -63,7 +63,7 @@ for (i = 0; i < count; i++) if ((p[i] = strdup(envp[i])) == NULL) { save_errno = errno; - while (--i >= 0) + while (i-- > 0) free(p[i]); free(p); errno = save_errno; @@ -181,21 +181,16 @@ long filepos; int fileline; enum env_state state; - char name[MAX_ENVSTR], val[MAX_ENVSTR]; - char quotechar, *c, *str; + char quotechar, *c, *str, *val; filepos = ftell(f); fileline = LineNumber; - skip_comments(f); if (EOF == get_string(envstr, MAX_ENVSTR, f, "\n")) return (ERR); Debug(DPARS, ("load_env, read <%s>\n", envstr)); - memset(name, 0, sizeof name); - memset(val, 0, sizeof val); - - str = name; + str = envstr; state = NAMEI; quotechar = '\0'; c = envstr; @@ -239,8 +234,9 @@ case EQ1: if (*c == '=') { state++; - str = val; quotechar = '\0'; + *str++ = *c; + val = str; } else { if (!isspace((unsigned char) *c)) @@ -263,27 +259,19 @@ } if (state != FINI && state != EQ2 && !(state == VALUE && !quotechar)) { Debug(DPARS, ("load_env, not an env var, state = %d\n", state)); - fseek(f, filepos, 0); + if (fseek(f, filepos, 0)) { + return ERR; + } Set_LineNum(fileline); return (FALSE); } + *str = '\0'; if (state == VALUE) { /* End of unquoted value: trim trailing whitespace */ - c = val + strlen(val); - while (c > val && isspace((unsigned char) c[-1])) - *(--c) = '\0'; + while (str > val && isspace((unsigned char)str[-1])) + *(--str) = '\0'; } - - /* 2 fields from parser; looks like an env setting */ - - /* - * This can't overflow because get_string() limited the size of the - * name and val fields. Still, it doesn't hurt to be careful... - */ - if (!glue_strings(envstr, MAX_ENVSTR, name, val, '=')) - return (FALSE); - Debug(DPARS, ("load_env, <%s> <%s> -> <%s>\n", name, val, envstr)); - return (TRUE); + return TRUE; } char *env_get(const char *name, char **envp) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/funcs.h new/cronie-cronie-1.5.3/src/funcs.h --- old/cronie-cronie-1.5.2/src/funcs.h 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/funcs.h 2019-03-15 11:20:30.000000000 +0100 @@ -49,7 +49,6 @@ unget_char(int, FILE *), free_entry(entry *), acquire_daemonlock(int), - skip_comments(FILE *), log_it(const char *, PID_T, const char *, const char *, int), log_close(void), check_orphans(cron_db *); @@ -71,6 +70,7 @@ cron_pclose(FILE *), glue_strings(char *, size_t, const char *, const char *, char), strcmp_until(const char *, const char *, char), + skip_comments(FILE *), allowed(const char * ,const char * ,const char *); size_t strlens(const char *, ...), diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/globals.h new/cronie-cronie-1.5.3/src/globals.h --- old/cronie-cronie-1.5.2/src/globals.h 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/globals.h 2019-03-15 11:20:30.000000000 +0100 @@ -77,7 +77,7 @@ XTRN time_t StartTime; XTRN int NoFork; XTRN int PermitAnyCrontab; -XTRN char MailCmd[MAX_COMMAND]; +XTRN char MailCmd[MAX_COMMAND+1]; /* +1 for terminator */ XTRN char cron_default_mail_charset[MAX_ENVSTR]; XTRN int EnableClustering; XTRN int ChangePath; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/macros.h new/cronie-cronie-1.5.3/src/macros.h --- old/cronie-cronie-1.5.2/src/macros.h 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/macros.h 2019-03-15 11:20:30.000000000 +0100 @@ -58,6 +58,9 @@ #define MAX_UNAME 256 /* max length of username */ #define ROOT_UID 0 /* don't change this, it really must be root */ #define ROOT_USER "root" /* ditto */ +#define MAX_USER_ENVS 1000 /* maximum environment variables in user's crontab */ +#define MAX_USER_ENTRIES 1000 /* maximum crontab entries in user's crontab */ +#define MAX_GARBAGE 32768 /* max num of chars of comments and whitespaces between entries */ /* NOTE: these correspond to DebugFlagNames, * defined below. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/misc.c new/cronie-cronie-1.5.3/src/misc.c --- old/cronie-cronie-1.5.2/src/misc.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/misc.c 2019-03-15 11:20:30.000000000 +0100 @@ -418,14 +418,20 @@ /* skip_comments(file) : read past comment (if any) */ -void skip_comments(FILE * file) { +int skip_comments(FILE * file) { int ch; + int n = 0; while (EOF != (ch = get_char(file))) { /* ch is now the first character of a line. */ - while (ch == ' ' || ch == '\t') + if (++n > MAX_GARBAGE) + return FALSE; + while (ch == ' ' || ch == '\t') { ch = get_char(file); + if (++n > MAX_GARBAGE) + return FALSE; + } if (ch == EOF) break; @@ -440,15 +446,18 @@ * character on a line. */ - while (ch != '\n' && ch != EOF) + while (ch != '\n' && ch != EOF) { ch = get_char(file); - + if (++n > MAX_GARBAGE) + return FALSE; + } /* ch is now the newline of a line which we're going to * ignore. */ } if (ch != EOF) unget_char(ch, file); + return TRUE; } /* int in_file(const char *string, FILE *file, int error) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/security.c new/cronie-cronie-1.5.3/src/security.c --- old/cronie-cronie-1.5.2/src/security.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/security.c 2019-03-15 11:20:30.000000000 +0100 @@ -417,7 +417,7 @@ } } - if (strcmp(u->scontext, ucontext)) { + if (!ucontext || strcmp(u->scontext, ucontext)) { if (!cron_authorize_range(u->scontext, ucontext)) { if (security_getenforce() > 0) { # ifdef WITH_AUDIT @@ -505,6 +505,7 @@ retval = get_default_context_with_level(seuser, level, NULL, &scontext); } else { + const char *current_user, *current_role; if (getcon(¤t_context_str) < 0) { log_it(name, getpid(), "getcon FAILED", "", 0); return (security_getenforce() > 0); @@ -517,8 +518,9 @@ return (security_getenforce() > 0); } - const char *current_user = context_user_get(current_context); - retval = get_default_context_with_level(current_user, level, NULL, &scontext); + current_user = context_user_get(current_context); + current_role = context_role_get(current_context); + retval = get_default_context_with_rolelevel(current_user, current_role, level, NULL, &scontext); freecon(current_context_str); context_free(current_context); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/cronie-cronie-1.5.2/src/user.c new/cronie-cronie-1.5.3/src/user.c --- old/cronie-cronie-1.5.2/src/user.c 2018-05-03 18:58:09.000000000 +0200 +++ new/cronie-cronie-1.5.3/src/user.c 2019-03-15 11:20:30.000000000 +0100 @@ -44,6 +44,10 @@ free_user (user * u) { entry *e, *ne; + if (!u) { + return; + } + free(u->name); free(u->tabname); for (e = u->crontab; e != NULL; e = ne) { @@ -65,6 +69,7 @@ entry *e; int status = TRUE, save_errno = 0; char **envp = NULL, **tenvp; + int envs = 0, entries = 0; if (!(file = fdopen(crontab_fd, "r"))) { save_errno = errno; @@ -111,9 +116,20 @@ #endif /* load the crontab */ - while ((status = load_env (envstr, file)) >= OK) { + while (status >= TRUE) { + if (!skip_comments(file) && !u->system) { + log_error("too many garbage characters"); + break; + } + status = load_env (envstr, file); switch (status) { case FALSE: + ++entries; + if (!u->system && entries > MAX_USER_ENTRIES) { + log_error("too many entries"); + status = TRUE; + goto done; + } FileName = tabname; e = load_entry(file, log_error, pw, envp); if (e) { @@ -122,6 +138,11 @@ } break; case TRUE: + ++envs; + if (!u->system && envs > MAX_USER_ENVS) { + log_error("too many environment variables"); + goto done; + } if ((tenvp = env_set (envp, envstr)) == NULL) { save_errno = errno; goto done; ++++++ cronie-nheader_lines.diff ++++++ --- /var/tmp/diff_new_pack.NnnZUO/_old 2019-03-24 14:57:04.655201580 +0100 +++ /var/tmp/diff_new_pack.NnnZUO/_new 2019-03-24 14:57:04.655201580 +0100 @@ -2,7 +2,7 @@ =================================================================== --- src/crontab.c.orig +++ src/crontab.c -@@ -65,7 +65,7 @@ +@@ -64,7 +64,7 @@ #include "pathnames.h" #include "structs.h" @@ -11,7 +11,7 @@ enum opt_t {opt_unknown, opt_list, opt_delete, opt_edit, opt_replace, opt_hostset, opt_hostget}; -@@ -475,7 +475,7 @@ static void edit_cmd(void) { +@@ -485,7 +485,7 @@ static void edit_cmd(void) { char n[MAX_FNAME], q[MAX_TEMPSTR]; const char *editor; FILE *f; @@ -20,7 +20,7 @@ struct stat statbuf; struct utimbuf utimebuf; WAIT_T waiter; -@@ -527,13 +527,25 @@ static void edit_cmd(void) { +@@ -537,13 +537,25 @@ static void edit_cmd(void) { } Set_LineNum(1) @@ -53,15 +53,15 @@ while (EOF != (ch = get_char(f))) putc(ch, NewCrontab); -@@ -741,6 +753,7 @@ static int replace_cmd(void) { +@@ -751,6 +763,7 @@ static int replace_cmd(void) { int error = 0; entry *e; uid_t file_owner; + time_t now = time(NULL); char **envp; char *safename; - -@@ -770,10 +783,10 @@ static int replace_cmd(void) { + int envs = 0, entries = 0; +@@ -781,10 +794,10 @@ static int replace_cmd(void) { * * VERY IMPORTANT: make sure NHEADER_LINES agrees with this code. */ ++++++ cronie-pam_config.diff ++++++ --- /var/tmp/diff_new_pack.NnnZUO/_old 2019-03-24 14:57:04.659201579 +0100 +++ /var/tmp/diff_new_pack.NnnZUO/_new 2019-03-24 14:57:04.659201579 +0100 @@ -1,16 +1,16 @@ -Index: cronie-cronie-1.5.2/pam/crond +Index: cronie-cronie-1.5.3/pam/crond =================================================================== ---- cronie-cronie-1.5.2.orig/pam/crond -+++ cronie-cronie-1.5.2/pam/crond +--- cronie-cronie-1.5.3.orig/pam/crond ++++ cronie-cronie-1.5.3/pam/crond @@ -4,8 +4,9 @@ # # Although no PAM authentication is called, auth modules # are used for credential setting --auth include password-auth +-auth include system-auth -account required pam_access.so --account include password-auth +-account include system-auth -session required pam_loginuid.so --session include password-auth +-session include system-auth +auth sufficient pam_rootok.so +account sufficient pam_listfile.so item=user sense=allow file=/etc/cron.allow onerr=succeed quiet +auth include common-auth
