Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC: r261146

Bad timespec_subtract() calculations produce negative tv_nsec on i386
which cause EINVAL returned from nanosleep() which cause loop in
cron_sleep() and making all cron jobs to start about 30 seconds earlier
(which cause f.e. logfiles rotation by newsyslog delayed by 1 hour).

Use simple and proved calculations from kernel's timespecsub() instead.

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Second attempt to add @every_second keyword support. Due to multiple
requests, default to the previous 60-seconds scheduling method
unless there is any @every_second entries to conserve CPU cycles and
power.

This change also improves scheduling in the default mode by running
as close to the beginning of the minnute as possible by replacing
sleep(3) with nanosleep(2). Previously, the tasks would run anywhere
within the first second of the minute and that offset drifted back
and forth each time cron(8) was engaged.

MFC after: 1 month

Fully backout latest changes.

Pointy hat to: sobomax

Remove harmless, but superfluous local change that creeped in along
with the r241649.

Revert latest changes to cron, until better version is worked out (I hope).

Requested by: few

o Use nanosleep(2) to sleep exact amount of time till the next second,
not multiple of 1 second, which results in actual time to drift back
and forth every run within 1 second of the actual action has
been set for.

Suggested by: Ian Lepore

o Schedule the first run in 1 second after starting up, not on the
boundary of the next minute, which results in the every_second jobs
not being run.

Add per-second scheduling into the cron(8). Right now it's
only available via the new @every_second shortcut. ENOTIME to
implement crontab(5) format extensions to allow more flexible
scheduling.

In order to address some concerns expressed by Terry Lambert
while discussing the topic few years ago, about per-second cron
possibly causing some bad effects on /etc/crontab by stat()ing
it every second instead of every minute now (i.e. atime update),
only check that database needs to be reloaded on every 60-th
loop run. This should be close enough to the current behaviour.

Add "@every_minute" shortcut while I am here.

MFC after: 1 month

Fix build with DEBUGGING disabled.

Spelling fixes for usr.sbin/

The last big commit: let usr.sbin/ use WARNS=6 by default.

Avoid sshd, cron, syslogd and inetd to be killed under high-pressure swap
environments.
Please note that this can't be done while such processes run in jails.

Note: in future it would be interesting to find a way to do that
selectively for any desired proccess (choosen by user himself), probabilly
via a ptrace interface or whatever.

Obtained from: Sandvine Incorporated
Reviewed by: emaste, arch@
Sponsored by: Sandvine Incorporated
MFC: 1 month

Make usr.sbin/cron/crontab and usr.sbin/cron/lib WARNS=3 clean

Tested with: make universe

MFC after: 3 days

Fix empty mailto (-m "") handling: somehow I missed all checks but the first,
hence output would be written to the wrong filehandle.

Submitted by: reg
Approved by: yar (implicit)
MFC after: ASAP
Pointy hat to: marck

Add -m option to cron(8), overriding default mail recipient for cron mails,
unless explicitly provided by MAILTO= line in crontab. This feature can be
useful in massive hosting environment, where most users do not care about
autogenerated mails.

Setting recipient to null string disables default mails at all.

Approved by: yar
MFC after: 4 weeks

Cleanup of userland __P use

Fixed static linkage (build with -DNO_SHARED).

Approved by: re (kensmith)

Add PAM support to cron(8). Now cron(8) will skip commands scheduled
by unavailable accounts, e.g., those locked, expired, not allowed in at
the moment by nologin(5), or whatever, depending on cron's pam.conf(5).
This applies to personal crontabs only, /etc/crontab is unaffected.

In other words, now the account management policy will apply to
commands scheduled by users via crontab(1) so that a user can no
longer use cron(8) to set up a delayed backdoor and run commands
during periods when the admin doesn't want him to.

The PAM check is done just before running a command, not when loading
a crontab, because accounts can get locked, expired, and re-enabled
any time with no changes to their crontabs. E.g., imagine that you
provide a system with payed access, or better a cluster of such
systems with centralized account management via PAM. When a user
pays for some days of access, you set his expire field respectively.
If the account expires before its owner pays more, its crontab
commands won't run until the next payment is made. Then it'll be
enough to set the expire field in future for the commands to run
again. And so on.

Document this change in the cron(8) manpage, which includes adding
a FILES section and touching the document date.

X-Security: should benefit as users have access to cron(8) by default

Don't use "implicit int". Move the opening { of the functions to the next
line while there.

o Finally learn how to spell "privileges".

English trainer: ceri

o Spell "privledges" correctly. Re-style comment.

o Better be safe than sorry: check return code from setuid(2),
setgid(2), setlogin(2) and initgroups(3). In theory they could
fail for root with some third party mac(4) policies.

Submitted by: Kostik Belousov
MFC after: 1 month

Pidfiles should be created with permission preventing users from opening
them for reading. When user can open file for reading, he can also
flock(2) it, which can lead to confusions.

Pointed out by: green

Use pidfile(3) in cron(8).

Note, that when cron(8) cannot create pidfile, it'll exit. I didn't
changed this behaviour, but its better to ignore errors other than
EEXIST, so daemon can be started on systems where /var/ file system
doesn't support locking (like NFS without rpc.lockd(8)).

Expand contractions.

Expand *n't contractions.

Mechanically kill hard sentence breaks.

Add two new options to cron(8), -J and -j. They allow to specify
the maximum amount of time jitter for root and other users, respectively.
Before starting a job, cron(8) will sleep a random number of seconds,
from 0 to the amount specified. This can help to smooth down load spikes
when a lot of jobs are to start at the beginning of a particular minute
(e.g., the first minute of an hour.)

PR: bin/66474
Submitted by: Dmitry Morozovsky <marck <@> rinet.ru>

Fix a coredump that would occur when fdopen was unable to
return a valid fd.

PR: 49096
Submitted by: demon
MFC after: 3 days

The .Nm utility

Be a bit more verbose. "modtime" means nothing.
"modification time" is a lot better.

MFC after: 3 days

Make cron actually build without defining LOGIN_CAP.

Reviewed by: jkh

Document the -x debugging option.

PR: docs/33784
Submitted by: Mike Makonnen <mike_makonnen@yahoo.com>

Perform a major cleanup of the usr.sbin Makefiles.
These are not perfectly in agreement with each other style-wise, but they
are orders of orders of magnitude more consistent style-wise than before.

Remove whitespace at EOL.

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for usr.sbin/ to 8.

Stop cron from shouting in the syslog. Use setproctitle() instead, since
smashing argv[0] doesn't have the intended effect of changing the ps(1)
output these days.

PR: 25850

mdoc(7) police revision 1.15:

- replaced Oo/Oc enclosures with Op;
- removed hard sentence breaks;
- removed doubled space.

The new version of the daylight time saving support. This time it works
for any change of the time zone offset from GMT. To enable use the
option -s.

Properly detach at startup. We could be passing revoked fd's to
child processes or starting children with no fd 0 (stdin) at all etc.
This is currently breaking on hub.freebsd.org.

mdoc(7) police: split punctuation characters + misc fixes.

Backed out the DST support changes.

mdoc(7) police: ``Ds'' is not certified (no macro with such name exist)
to be used as the -width parameter, it is provided solely for backwards
compatibility with old mdoc(7). To make this work, mdocNG is forced to
provide a dummy ``Ds'' macro.

Made the special handling of the daylight time switches optional,
enabled by the option "-s" (for dSt). This returned the default behavior
to its original form.

The new option name is not "-d" because that would cause associations with
"debug" and cron already has "-x" for debugging, so this would cause
confusion.

Added sensible handling of switch to and from daylight saving time
for the jobs that fall into the disappearing or duplicated time
interval.

PR: bin/24494

Prepare for mdoc(7)NG.

Add `_PATH_DEVZERO'.
Use _PATH_* where where possible.

Correct definition of MAXHOSTNAMELEN in ifdef'ed out code

mdoc(7) police: use the new features of the Nm macro.

Call login_close() to prevent parent from memory leaking in some
cases due to vfork()

Prevent user from breaking his limits and restrictions or
abusing sendmail by any other way via MAILTO tag (since sendmail is running
from daemon). Now run sendmail from user, as any other cron user command.

Obtained from: Inspired by OpenBSD, but implementation is different

Make sure argv gets NULL terminated if cron entry has >= MAX_ARGS arguments

Obtained from: OpenBSD popen.c v1.3

Enable SIGCHLD to stop childs complaining to SIG_IGN of it.
It helps perl f.e.

Obtained from: OpenBSD do_command.c v1.7

Catch and report fdopen failures.

$Id$ -> $FreeBSD$

This is a hack. Cron runs with stdin/out/err pointing to /dev/console,
which init thoughtfully revoke()'s when starting a getty on ttyv0. This
Cron's popen() was passing these fd's through to cron children (ie:
sendmail, *not* normal cron jobs). The side effects were usually
not noticed, but it tripped up postfix which did a sanity check to see
that stdin/out/err were open, and got EBADF even thought the fd's were
in use. I seem to recall sendmail itself has hacks to work around
this problem, it had a checkfd012() function, possibly for this same
problem. (Postfix has a workaround too now though..)

This is a hack, not a fix. It's probably best to check and perhaps
close/reopen() /dev/console if needed each time around the event loop.
It would probably be useful to actually see any error messages from cron.

PR: bin/5572

Prevent cron from going crazy if the time steps. For example, if you
have a system with hundreds of users and lots of different crontabs
and your time steps back an hour, the old cron would then attempt to
run an hours worth of cron jobs in a few seconds.

Fixed printf format errors.

.Sh AUTHOR -> .Sh AUTHORS. Use .An/.Aq.

Use `foo/bar.a' instead of `-Lfoo -lbar' for linking to static internal
libraries so that `ld -f' in can create correct dependencies for
yet-to-be-built libraries.

Get the default BINDIR correctly (by including ../Makefile.inc recursively.
Override the default it it is wrong.

Don't override defaults when the defaults are correct.

Don't use LDDESTDIR. Just put the -L arg in LDADD.

Log run-time parsing errors now

Use getpwnam before getpwuid since two users with same uids can exists
(affects new login classes code only)

The same fixes as in inetd: by default run `system crontab things' with
daemon login class now, not restrict them to user class breaking
compatibility with old way (so-called nobody limits problem)

Implement user[:group][/login-class] syntax in system crontab
for more flexible control (the same as in inetd)

Use err(3). Rewrote man page in mdoc format.

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Tone down the paranoia a bit in from the previous commit. setusercontext()
automatically Does The Right Thing when lc == NULL, which just happens to
be what the extra code in cron was trying to do. Simplify.

For some reason, the old login class code didn't seem to be working here.
I suspect it was because the child exec code's parent was doing the
initial lookups, then forking, then doing other things (possibly trashing
the static data in the getpw*() buffer), then attempting to dereference
*pwd and *lc. Also, no error checking appeared to be done - I've allowed
it to fall back to the old "become user" code on critical failure rather than
risk running a user's cron jobs as root.

Revert $FreeBSD$ to $Id$

Fix compile breakage: link against libutil.

Make cron login class savvy.
Use setusercontext() rather than setuid()/setgid()/setlogin()/initgroups()
which is all handled. Login environment is NOT set by this call as crontab
provides its own means of doing so.

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Replace my "inane" usage of snprintf to copy strings with strncpy as
used by OpenBSD. (Quite frankly, I think it's perfectly reasonable to
use snprintf to copy strings, given that the semantics for strncpy()
are utterly idiotic and there is no POSIX sstrncpy().)

While I'm at it, incorporate some of OpenBSD's bugfixes to cron.

NOT for 2.2

Add sendmail option '-oi'

-oi Do not take dots on a line by themselves as a
message terminator.

Now this crontab entry works:
* * * * * echo foo; echo .; echo blah

personal (ie: with the crontab command) cron tabs were broken by the
last change. :-(
ie: /var/cron/log would report: .. cron[206]: (usage) CAN'T OPEN (%s/%s)

Fix some buffer overflow problems...

Fix up some more buffer overflow problems.

fix: debug flag 'test' cause endless loop
document debug flags

close PR bin/683

Bring in my changes for removing the pestilent obj links (unless you
really want them) from /usr/src. This is the final version of the
patches, incorporating the feedback I've received from -current.

This commit was generated by cvs2svn to compensate for changes in r13122,
which included commits to RCS files with non-trunk default branches.

Fix a bug that prevented %'s and \'s from being passed to the program
invoked.

Submitted by: fenner@parc.xerox.com (Bill Fenner)

Remove LOG_FILE definition, close PR 595
Submitted by: roberto@blaise.ibp.fr

Remove trailing whitespace.

Fix nested comments for -Wcomment warnings.

HAVE_SAVED_UIDS not depends of BSD version but depends
of _POSIX_SAVED_IDS from unistd.h, fix it.

Fix MAILTO hole by passing -t to sendmail
Submitted by: Mike Pritchard <pritc003@maroon.tc.umn.edu>

Really fix MAILTO hole by parsing spaces.
Remove local bitstring copy

Don't set -or0s (timeout 0) for possible network MAILTO

Close MAILTO security hole

Use LDDESTDIR and DPADD more consistently with what Bruce suggests..
Submitted by: jkh

Make the LDADD stuff work properly with obj dirs. Whoops.
Submitted by: jkh

Set proper destination directory for cron.
Submitted by: jkh

This commit was generated by cvs2svn to compensate for changes in r2311,
which included commits to RCS files with non-trunk default branches.