Ubuntu
cron package

@reboot in system crontab ignores (some) valid sh command syntax

Bug #308341 reported by Daniel Richard G. on 2008-12-15

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	cron (Ubuntu)	Fix Released	Undecided	Unassigned

Bug Description

Binary package hint: cron

This concerns cron 3.0pl1-104+ubuntu5 in Intrepid.

/etc/cron.d/blah:
--------
SHELL = /bin/sh

@reboot root a=/tmp/cron1.out; echo foo >$a

@reboot root true; a=/tmp/cron2.out; echo foo >$a
--------

For some reason---when the system (and cron) start up---the first command fails to execute, but the second one succeeds. The syslog doesn't even mention the first command; cron just silently ignores it.

This does not occur when the event time is specified with the normal five-field syntax, nor in user crontabs.

Related branches

lp:ubuntu/maverick/cron

CVE References

2006-2607

Revision history for this message

Daniel Richard G. (skunk) wrote on 2010-03-03:

I'm still seeing this on Karmic (3.0pl1-106ubuntu3), and in a user crontab to boot.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2010-06-25:

Download full text (11.3 KiB)

This bug was fixed in the package cron - 3.0pl1-113ubuntu1

---------------
cron (3.0pl1-113ubuntu1) maverick; urgency=low

  * Merge from debian unstable. Fixes:
    - LP: #46493 (this should have been fixed way back in 3.0pl1-87, and I
      confirmed it is no longer a problem)
    - LP: #118168 (Debian #79037)
    - LP: #151231 (Debian #155109, #443615)
    - LP: #308341 (Debian #437180)
  * Remaining changes:
    - debian/control:
      + Build-Depends on debhelper >= 7.3.15ubuntu2, for Upstart
      + Drop MTA and lockfile-args to Suggests
    - add debian/cron.upstart
    - debian/postinst: remove calls to update-rc.d, invoke-rc.d and
      /etc/init.d/cron
    - debian/postrm: remove call to update-rc.d
    - debian/prerm: remove calls to invoke-rc.d and /etc/init.d/cron
    - debian/rules: install Upstart job
  * Drop the following changes, now in debian:
    - popen.c: check return code of initgroups() in cron_popen()
    - debian/control: add missing ${misc:Depends}
    - debian/control: Depends bump on lsb to >= 3.2.12ubuntu2. No longer
      required now that we use Upstart
    - debian/cron.pam: switch from including common-session to including
      the new common-session-noninteractive
    - pathnames.h: use sensible-editor

cron (3.0pl1-113) unstable; urgency=medium

  [ Christian Kastner / Javier Fernandez-Sanguino ]
  * debian/postinst:
    - Now that permissions and ownership of crontabs are changed unconditionally,
      do not attempt to chown user crontabs if none are present. Closes: #585636
    - Only change permissions if the crontabs directory exist

cron (3.0pl1-112) unstable; urgency=low

  [ Christian Kastner ]
  * do_command.c:
    - Don't send mail when a job exits non-zero, only send mail if the job sent
      output to stderr. This behaviour was introduced erroneously; while it
      does have merit, it is completly against standard cron behaviour.
      Closes: #581612
  * debian/compat:
    - Bumped debhelper compatibility to 7
  * debian/control:
    - Bumped Standards-Version to 3.8.4 (no change needed)
    - Build-Depend on debhelper (>= 7.0.50~)
    - Added dependency on ${misc:Depends} to package cron
  * debian/cron.init:
    - Changed Default-Stop from (1) to (empty). rc0 and rc6 were removed in
      3.0pl1-101 because the stop action -- sending SIGTERM/SIGKILL to cron
      on shutdown/reboot -- was redundant. This, however, also applies to
      rc1, because killprocs will do that for us.
  * debian/postinst:
    - Removed obsolete dpkg file backup code, this has been handed over to dpkg
      in 3.0pl1-109
    - Removed last remaining stop action (for rc1) from upate-rc.d (see above)
    - Add dpkg-statoverride for /usr/bin/crontab, and unconditionally change
      permissions of /var/spool/cron/crontabs. Closes: #304036, #460095
  * debian/standard.monthly:
    - Removed because it had been empty for years and therefore served no
      purpose
  * debian/cron.bug-{control,script}
    - Added to extend information submitted by reportbug
  * debian/rules:
    - Applied changes for standard.monthly and cron.bug-{control,script} above
  * debian/copyright:
    - Updated to reflect recent contribution...

This bug was fixed in the package cron - 3.0pl1-113ubuntu1

---------------
cron (3.0pl1-113ubuntu1) maverick; urgency=low

cron (3.0pl1-113) unstable; urgency=medium

cron (3.0pl1-112) unstable; urgency=low

cron (3.0pl1-111) unstable; urgency=low

[ Christian Kastner ]
  * debian/cron.init:
    - When both /etc/environment and /etc/default/locale contain locale
    information, warn that variables from /etc/environment will be ignored.
    Closes: #543895, #580942
    - Add autofs and NIS+ to Should-Starts, because especially NIS+ must be run
    before cron, if present. Closes: #511757
    - init script should be stopped in runlevel 0 and 6, too
  [ Javier Fernandez-Sanguino ]
  * do_command.c: Revert change so that mails are not sent if MAILTO
    is null. Closes: #580938

cron (3.0pl1-110) unstable; urgency=medium

[ Christian Kastner ]
  * user.c
     - Fix broken parsing and handling of crontabs with no-newline-before-EOF
     - Refuse to install such crontabs via crontab(1). Closes: #79037
     - Log crontabs missing newline before EOF to syslog. This is only relevant
       for crontabs not installed via crontab(1), ie. /etc/cron.d/* and
       /etc/crontab. Closes: #76625
     - Add a log message explicitly stating that all jobs of crontabs with
       syntax errors will not be run (ie, all-or-nothing). See #555954
  * crontab.c
     - Tell the user which chars are expected on retry, too
  * cron.c
     - Don't let the daemon die when directories disappear, eg. when moving
       directories around. Patch provided by Justin Pryzby (thanks!).
       Closes: #470564
  * database.c
     - Recover from broken symlinks in /etc/cron.d/ (Closes: #433609)
     - Don't report wrong file owner in /etc/cron.d/ as wrong symlink owner
     - Check the permissions of symlink targets (writeable only by root)
  * do_command.c
     - Don't let long-running commands time out certain MTAs. Patch provided by
       Justin Pryzby, based on an analysis by Alexis Huxley (thanks!). Debian's
       default MTA, exim, does not time out, so it shouldn't have been
       affected.  Closes: #155109, #443615
     - Bypass mail generation/sending code when no MTA is installed.
       Previously, jobs with a lot of output would die once the pipe's buffer
       was filled.  Closes: #577133
  * popen.c
     - Check return value of setgid() call, also associated with the
       CVE-2006-2607 fix
     - Move signal handling away from ancient API. Patch provided by Justin
       Pryzby (thanks!).
  * misc.c
     - On startup, when recreating missing directories, do so with permissions
       reflecting Debian's SGID crontab vs upstream's SUID
  * entry.c
     - Explicitly check for valid ranges in range values instead of upstream's
       broken approach which misses certain combinations of ranges and steps.
       Closes: #533726
  * env.c
     - Backport environment variable parser from 4.1. The 3.0 parser has a
       number of issues, especially with otherwise trivial matters such as
       whitespace. Closes: #437180
  * cron.8
     - Document symlink behaviour.
  * crontab.1
     - Document the new EOF handling described above.
  * crontab.5
     - Clarify parsing of empty variables (Closes: #497742)
  * debian/TODO
     - Remove obsolete entries; add a table of planned milestones
  * debian/NEWS
     - Briefly describe the most important changes since lenny's release
  * debian/control
     - Add Christian Kastner to the Maintainers list (Closes: #565143)

[ Javier Fernandez-Sanguino Pen~a ]
  * debian/rules: Install the cron.default file properly
  * debian/standard.daily:
     - Do not indicate that lost+found does not exist if the filesystem is XFS
       (Closes: #577508 577536)

cron (3.0pl1-109) unstable; urgency=medium

* cron.c:
     - Apply patch derived from OpenBSD's cron by Petya Kohts to
       handle properly DST and avoid running cron jobs twice, or
       skip cron jobs when there is a savings time change.
       Closes: #217836, #458123, #474157, LP: #36690
  * crontab.c:
     - Revert the behaviour  that prevented 'alias crontab="crontab -i"' from
       working. Now the -i flag is allowed regardless of other command line
       switches.  (Closes: #513379)
     - Be more verbose in the example provided for first-time users than run
       'crontab -e'
     - Check if the crontab exists before attempting its removal and before
       prompting the user (whe using -i)
     - When prompting, tell the user which chars are expected
  * crontab.1:
     - Change usage to match crontab's output
     - Clarify use of the cron.allow and cron.deny files (Closes: #511782)
  * crontab.5:
     - Describe a known limitation related to the lack of the cron daemon's
       per-user timezone support (Closes: #497741, 353246, 166533)
     - Describe the use of tilde (~) as a substitute for $HOME (Closes: 477198)
     - Describe the lack of replacements of variables (Closes: #493636)
  * popen.c: Check return call of initgroups(), associated with
     CVE-2006-2607 fix. Thanks to Christian Kastner for the heads up.
  * cron.8:
     - Describe how the environment is managed in Debian
  * debian/cron.init: Also use /etc/timezone to setup the timezone environment
    (TZ) if not set.
  * debian/standard.daily:
     - Do not make a backup copy of dpkg files anymore since dpkg (1.15.4) does
       this already (when #541412 was fixed) (Closes: #541415)
     - Fix a bug in lost+found reporting. Files in lost+found were never +
       actually reported. [ Patch from Teemu Kiviniemi ]
     - Added ext4 for lost+found searches. [ Patch from Teemu Kiviniemi ]
     Closes LP: #367383
  * debian/control:
      - Add a Breaks dpkg (<< 1.15.4) to ensure that one always has the backup
        functionality either via cron or via dpkg.
      - Provides: cron-daemon, which was reinstated in the virtual package
        list in November 2009 (Closes: #349170)

cron (3.0pl1-108) unstable; urgency=high

* Add a Depends: on libpam-runtime (>= 1.0.1-11) since this
    is required for the use of common-session-noninteractive
    (Closes: 575342)

cron (3.0pl1-107) unstable; urgency=low

* debian/cron.pam: Use common-session-noninteractive in pam.d configuration
    instead of common-session so that libpam-ssh is not run. If libpam-ssh was
    installed the previous configuration resulted in cron spawning
    many ssh-agent processes (Closes: #572292)
  * debian/cron.init: Add Should-Start/Stop dependency to slapd so that cron
  * can start up tasks for users define in an LDAP (Closes: #557659, #546367)
  * Fix the use of perror so that the error message is correct when
    printing the reason why an operation failed. Thanks to
    Justin Pryzby for the patch. (Closes: 470587)
  * pathnames.h: Use /usr/bin/sensible-editor instead of /usr/bin/editor when
    calling crontab -e (Closes: #482284)
  * Fix debian/control description, thanks to Justin B Rye for the patch
    (Closes: #535227)
  * crontab.c: Produce a different warning message when root tries to setup a
    crontab for a user that is not allowed to do so, and do not log the
    action (Closes: #505288)
  * Only allow -i if -r has been specified previously (Closes: #513379)
  * Update debian/README.Debian to indicate that the package is
    being maintained at Alioth, thanks Tomas Pospisek for the patch
    (Closes: #511740)
  * crontab.c: Update the usage() call so that it refers to the use
    of -i when removing (-r)
  * crontab.1: Update the manpage:
     - Use the same option listing as in the crontab usage() call
     - Remove 'tweaked', explain what -u does in each context.
     - Remove V3, use 'Vixie Cron' instead
    (Closes: #572249)
     - Update the manpage years (Closes: #563296)
     - Describe the usage of the crontab group wrt /var/spool/cron/crontabs
    (Closes: #539182)
  * Use debhelper compatibility version 5
  * Include cross build support with patch to debian/rules provided by Neil
    Williams  (Closes: #465077)
  * Change maintainer's email address
 -- Jamie Strandboge <jamie@ubuntu.com>   Fri, 25 Jun 2010 16:08:12 -0500

Changed in cron (Ubuntu):
status:	New → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntucron package