colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cron: fix crontab(5) and cron job PATH

Browse Source 
Switch off HAVE_SAVED_UIDS since it activates a code path for temporary
privilege dropping which does not work on NixOS.

Vixie-cron's sources ship with two implementations. Unfortunately, the
one activated by HAVE_SAVED_UIDS (using setuid()) does not work on
NixOS. Saved UIDs work only if the program which is using them has the
setuid bit set on its own executable, not if called from a setuid
wrapper (as we do it in NixOS). The other implementation (using
setreuid()) works without problems.

Quote from
<http://stackoverflow.com/questions/8499296/realuid-saved-uid-effective-uid-whats-going-on>:

    If you're euid is root and you change the uid, the privileges gets
    dropped permanently.If effective user id is not root then saved user
    id is never touched and you can regain the root privilege back
    anytime you want in your program.

Also extend the default PATH with NixOS-specific bin directories as
vixie-cron's default is not really usable on NixOS.

Re #16518

Closes #16522
This commit is contained in:
Christian Kauhaus 2016-06-26 17:13:15 +02:00 committed by Joachim Fasting
parent b5705aa81e
commit 0c0f068f35
No known key found for this signature in database
GPG Key ID: 4330820E1E04DCF4
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkgs/tools/system/cron/default.nix
View File

@ -14,9 +14,19 @@ stdenv.mkDerivation {
makeFlags="DESTROOT=$out"
# We want to ignore the $glibc/include/paths.h definition of
# sendmail path
echo "#undef _PATH_SENDMAIL" >> pathnames.h
echo '#define _PATH_SENDMAIL "${sendmailPath}"' >> pathnames.h
# sendmail path.
# Also set a usable default PATH (#16518).
cat >> pathnames.h <<__EOT__
#undef _PATH_SENDMAIL
#define _PATH_SENDMAIL "${sendmailPath}"
#undef _PATH_DEFPATH
#define _PATH_DEFPATH "/var/setuid-wrappers:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
__EOT__
# Implicit saved uids do not work here due to way NixOS uses setuid wrappers
# (#16518).
echo "#undef HAVE_SAVED_UIDS" >> externs.h
'';
preInstall = "mkdir -p $out/bin $out/sbin $out/share/man/man1 $out/share/man/man5 $out/share/man/man8";