PAM logging was incorrect bz#249870.

The jobs is setuid to user before exec. Mail runs under root
permissions.

diff --git a/src/do_command.c b/src/do_command.c
index c95f9c0b98906d3bad36f001db8f331f20460b0f..de0c35fc0f4f19546a531dad265ba08ea6a11224 100644 (file)
--- a/src/do_command.c
+++ b/src/do_command.c
@@ -164,6 +164,9 @@ child_process(entry *e, user *u) {
                Debug(DPROC, ("[%ld] grandchild process fork()'ed\n",
                              (long)getpid()))
 
+               if (cron_change_user_permanently(e->pwd) < 0)
+                       _exit(ERROR_EXIT);
+
                /* write a log message.  we've waited this long to do it
                 * because it was not until now that we knew the PID that
                 * the actual user command shell was going to get and the
@@ -280,7 +283,8 @@ child_process(entry *e, user *u) {
                 * are part of its reference count now.
                 */
                close(stdout_pipe[READ_PIPE]);
-
+               if (cron_change_user_permanently(e->pwd) < 0)
+                       _exit(ERROR_EXIT);
                /* translation:
                 *      \% -> %
                 *      %  -> \n

diff --git a/src/funcs.h b/src/funcs.h
index 0635cb90bbf8541369e99408b9684cb6032f579d..c00452f7444d76e17b5ae9d94fab32b16d2be7f0 100644 (file)
--- a/src/funcs.h
+++ b/src/funcs.h
@@ -95,6 +95,8 @@ void cron_close_security_session( void );
 
 int cron_change_user( struct passwd *pw, char *homedir );
 
+int cron_change_user_permanently( struct passwd *pw );
+
 int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **envp );
 
 int get_security_context(const char *name, 

diff --git a/src/security.c b/src/security.c
index eb4c9c137c3ff0fa82d7e56232c71750f3cf7af7..5db26ed593cfac44afe737551f8fab3f9b9f05a1 100644 (file)
--- a/src/security.c
+++ b/src/security.c
@@ -199,8 +199,8 @@ int cron_change_user(struct passwd *pw, char *homedir) {
                return -1;      
     }
 
-    if (setuid( pw->pw_uid ) != 0) {
-               log_it("CRON", pid, "ERROR", "setuid failed", errno);
+    if (setreuid( pw->pw_uid, -1 ) != 0) {
+               log_it("CRON", pid, "ERROR", "setreuid failed", errno);
                return -1;
     }
 
@@ -211,6 +211,15 @@ int cron_change_user(struct passwd *pw, char *homedir) {
     return 0;
 }
 
+int cron_change_user_permanently(struct passwd *pw) {
+    if (setreuid( pw->pw_uid, pw->pw_uid ) != 0) {
+        log_it("CRON", getpid(), "ERROR", "setreuid failed", errno);
+        return -1;
+    }
+    return 0;
+}
+
+
 static int cron_authorize_context
 (security_context_t scontext,security_context_t file_context) {
 #ifdef WITH_SELINUX