cron job as a non-privileged user do not run

chakkerz · 05-19-2008, 10:57 PM

I'm running on CentOS 5.1 and RHEL 5.1 same problem in both locations (though the cron jobs are different)

Let's go with CentOS because it's the one i need to get working

the error i'm getting in my /var/log/cron file is:

Code:

2008-05-20T13:34:01.191785+10:00 fact crond[8444]: Permission denied
2008-05-20T13:34:01.192261+10:00 fact crond[8444]: CRON (logcluster) ERROR: failed to open PAM security session: Success
2008-05-20T13:34:01.192306+10:00 fact crond[8444]: CRON (logcluster) ERROR: cannot set security context

the user is logcluster and the crontab for that user looks as follows:

Code:

[root@fact cron]# su - logcluster
-bash-3.1$ crontab -l
#
# synchronize after they are cycled every 15 minutes
#
02,17,32,47 * * * * /logCluster/bin/synchronizeLogs | mail -s "LogCluster log synchronization status" me@whereiswork.edu.au

#
# compact the logs once daily after the day clicks over
#
05 0 * * * /logCluster/bin/compactLogs | mail -s "LogCluster log compression" me@whereiwork.edu.au

* * * * * touch ~/this

I found one source that tells me that the error in the log is indicative of a SE Linux error, but i'm pretty sure it ain't it:

Code:

[root@fact cron]# getenforce 
Permissive

i do not have a cron.allow file, but i do have a cron.deny file:

Code:

[root@fact etc]# ls cron.allow
ls: cron.allow: No such file or directory
[root@fact etc]# ls cron.deny
cron.deny
[root@fact etc]# cat cron.deny
[root@fact etc]#

the scripts work on their own when running as logcluster and eitherway `touch ~/this` should have no issues, besides the error in the log is not indicative of something not being found but relating to PAM...

I've looked around a bit and talked to some people but am not getting any further... any help would be great.

chakkerz

unSpawn · 05-20-2008, 06:52 AM

Quote:

Originally Posted by chakkerz

2008-05-20T13:34:01.192306+10:00 fact crond[8444]: CRON (logcluster) ERROR: cannot set security context

I found one source that tells me that the error in the log is indicative of a SE Linux error, but i'm pretty sure it ain't it

Can you reproduce https://bugzilla.redhat.com/show_bug.cgi?id=241877 as described there?

chakkerz · 06-02-2008, 04:11 PM

Nope, it sure sounded like it, though i'm not using SELinux nor am i using NFS to do something quite like what they describe.

No, the problem ended up being:

/etc/security/access.conf was missing

Code:

+ : ALL : cron crond

One of the team (who had been playing with access.conf) found that my minutely cronjob was interrupting his testing on another issue we were having (RHEL 5.2 has become vicious about UID's being below 500) and since he knew all about access.conf he fixed it

Thanks for that link though

chakkerz

unSpawn · 06-03-2008, 06:06 AM

Well, I *never* could have diagnosed it as a problem with /etc/security/access.conf. Allowing user cron through it doesn't look like a standard solution to me, maybe it's a local modification to do with your cluster stuff or something?

chakkerz · 06-03-2008, 07:30 PM

hmm ... yes i've just taken a look at a clean install and you're right, it is a local issue...

unSpawn · 06-03-2008, 08:28 PM

Thanks for confirming!