On 8/20/2010 1:18 PM, Wietse Venema wrote:
Jordan Russell:
Whenever cron (cronie-1.4.5-2.fc13.i686 on Fedora 13) sends mail to a
non-root local user, e.g.:
12 * * * * someuser echo test
In which file is this? /etc/crontab does not document the use of
username fields in my Fedora 13 test box, nor would I expect to
see username fields in per-user crontab files.
It's in a file under /etc/cron.d.
Quoting man 5 crontab:
Jobs in /etc/cron.d/
The jobs in cron.d and /etc/crontab are system jobs, which are used
usually
for more than one user. That's the reason why is name of the user
needed.
MAILTO on the first line is optional.
Something (cron, /bin/mail, whatever...) executes the Postfix
sendmail command with effective UID zero (root) and with real UID
non-zero. I find that sloppy.
Looks like cron is indeed the culprit:
"The jobs is setuid to user before exec. Mail runs under root
permissions."
http://git.fedorahosted.org/git/?p=cronie.git;a=commitdiff;h=dd21409b93dafa427cf31f45c2a7c75bfb9ae9ec
Should I just ignore the warnings from postfix? Does invoking sendmail
this way present any sort of security risk?
--
Jordan Russell
