RHBA-2011:0788 - Bug Fix Advisory

Topic

Updated cronie packages that fix various bugs are now available.

Description

Cronie contains the standard UNIX daemon crond that runs specified
programs at scheduled times and related tools. It is a fork of the
original vixie-cron and has security and configuration enhancements
like the ability to use pam and SELinux.

This update fixes the following bugs:

• The initscript output written to /var/log/boot.log contained a

double output of "OK", printed by /etc/init.d/crond and daemon. This
error has been corrected: the echo from /etc/init.d/crond is removed,
thus the output is now as expected. (BZ#615107)

• Cronie didn't close file descriptor, which caused other

applications such as anacron that are subsequently started by cronie
to inherit the file descriptor. This caused SELinux to prevent
/bin/bash access. With this update, the file descriptor is no longer
inherited by other applications, thus SELinux no longer prevents
/bin/bash access. (BZ#624043)

• An incorrect option in the bash script caused anacron to run daily

instead of hourly if the /var/spool/anacron/cron.daily file existed.
The error has been corrected: the bash script option is fixed and
anacron now runs once a day if the /var/spool/anacron/cron.daily file
exists. (BZ#675077)

• RELRO flags were previously not set by default from crond. This is

now fixed so that cronie is compiled with RELRO protection enabled.
(BZ#676040)

• The /usr/bin/crontab was set to use both setuid and setgid

permissions, but this was changed to use only setuid.
(BZ#676081)

• Multiple code quality improvements were made, which include:
• In src/crontab.c, mkstemp expects six X's to be replaced with

digits at the end of each filename. This fix removes the extra X's.

• In src/security.c, ccon was not freed after a return. This

is fixed and ccon is now freed using context_free.

• In anacron/run_job.c, fdin was tested before being initialized.

This is fixed to ensure that fdin is now initialized prior to testing.
(BZ#677364)

All users of cronie are advised to upgrade to this updated package,
which resolves these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 615107 - echos "OK" twice in init script
• BZ - 624043 - cronie is leaking a file descriptor?
• BZ - 675077 - anacron runs hourly instead of daily

CVEs

(none)

References

(none)