cron job deletes files it shouldn't have rights to..

farslayer · 11-07-2014, 12:41 PM

I'm not sure what I'm missing here. I created a cron job to delete files off an asterisk system to manage old files. I tried running the cron in the user context as a test to ensure it couldn't delete files it did not have rights to, but instead it was able to delete those files..

Here are the cron jobs

Code:

20 10 * * * someguy /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm -f {} \; >> /home/someguy/TEST/cronlog 2>&1
20 10 * * * someguy /usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm -f {} \; >> /home/someguy/TEST/cronlog 2>&1

Code:

someguy@debian01:~/TEST$ ls -al
total 16
drwxr-xr-x  2 someguy someguy 4096 Nov  6 10:08 .
drwxr-xr-x 28 someguy someguy 4096 Nov  6 07:53 ..
-rw-------  1 root    root       0 Nov  1 11:59 Doc16.php
-rw-r--r--  1 someguy someguy    0 Nov  1 11:59 Doc16.txt
-rw-------  1 root    root       0 Nov  2 11:59 Doc17.php
-rw-r--r--  1 someguy someguy    0 Nov  2 11:59 Doc17.txt
-rw-------  1 root    root       0 Nov  3 11:59 Doc18.php
-rw-r--r--  1 someguy someguy    0 Nov  3 11:59 Doc18.txt
-rw-------  1 root    root       0 Nov  4 11:59 Doc19.php
-rw-r--r--  1 someguy someguy    0 Nov  4 11:59 Doc19.txt
-rw-------  1 root    root       0 Nov  5 11:59 Doc20.php
-rw-r--r--  1 someguy someguy    0 Nov  5 11:59 Doc20.txt
-rw-------  1 root    root       0 Nov  6  2014 Doc21.php
-rw-r--r--  1 someguy someguy    0 Nov  6  2014 Doc21.txt

I believe the cron should be able to delete the .txt files, but should fail on the .php files thart are owned by root. but surprise the cron jobs are able to delete both the .txt and php files.

when I view the log it sure looks like it's running as user someguy, how is it deleting files owned by root ?

Code:

Nov  6 10:10:01 debian01 /USR/SBIN/CRON[22483]: (root) CMD (someguy /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm -f {} \; >/dev/null 2>&1)
Nov  6 10:10:01 debian01 /USR/SBIN/CRON[22484]: (root) CMD (someguy /usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm -f {} \; >/dev/null 2>&1)

Code:

someguy@debian01:~$ groups
someguy cdrom floppy audio dip video plugdev scanner bluetooth netdev

so what am I missing ?

thanks for your assistance.

suicidaleggroll · 11-07-2014, 12:59 PM

When you're testing a command in cron, you should redirect the output to a file so you can view it. You should only switch the output to /dev/null once you're confident it's working correctly.

Also, your cron job at the top does not match what was actually run at the bottom. The mtime is different and there's an "rm -f" in the bottom set, but only "rm" in the top set. Are you sure you're looking at the right information?

And finally, your output at the bottom shows that it's being run as root:

Code:

Nov  6 10:10:01 debian01 /USR/SBIN/CRON[22483]: (root) CMD (someguy /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm -f {} \; >/dev/null 2>&1)

Who's cron is this job in?

rknichols · 11-07-2014, 02:06 PM

Plus, removing a file from a directory only requires write permission in the directory. The permissions on the file itself have nothing to do with it. Yes, an interactive rm command will prompt for confirmation if you try to delete a file for which you do not have write permission, but that is just a courtesy, not anything enforced by the OS.

farslayer · 11-07-2014, 02:13 PM

Yep you are right I grabbed the wrong entry from the log, Sorry for the confusion.

I initially tried running the job from the system cron using the following (which matches the log I posted above.)

Code:

root@debian01:/# crontab -e

Code:

20 10 * * * someguy /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm -f {} \; >> /home/someguy/TEST/cronlog 2>&1
20 10 * * * someguy /usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm -f {} \; >> /home/someguy/TEST/cronlog 2>&1

Code:

Nov  6 10:10:01 debian01 /USR/SBIN/CRON[22483]: (root) CMD (someguy /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm -f {} \; >/dev/null 2>&1)
Nov  6 10:10:01 debian01 /USR/SBIN/CRON[22484]: (root) CMD (someguy /usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm -f {} \; >/dev/null 2>&1)

Which didn't work, it deleted the files owned by root.

so I then tried it in cron under the someguy account.

Code:

someguy@debian01:~$ crontab -u someguy -e

Code:

06 10 * * * /usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm  {} \; >/dev/null 2>&1
06 10 * * * /usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm  {} \; >/dev/null 2>&1

which resulted in the following log

Code:

Nov  7 10:06:01 debian01 /USR/SBIN/CRON[26286]: (someguy) CMD (/usr/bin/find /home/someguy/TEST/*.txt -type f -mtime +14 -exec rm  {} \; >/dev/null 2>&1)
Nov  7 10:06:01 debian01 /USR/SBIN/CRON[26287]: (someguy) CMD (/usr/bin/find /home/someguy/TEST/*.php -type f -mtime +14 -exec rm  {} \; >/dev/null 2>&1)

Both methods resulted in the cron job deleting the .php files owned by root.

farslayer · 11-07-2014, 02:17 PM

Quote:

Originally Posted by rknichols

Plus, removing a file from a directory only requires write permission in the directory. The permissions on the file itself have nothing to do with it. Yes, an interactive rm command will prompt for confirmation if you try to delete a file for which you do not have write permission, but that is just a courtesy, not anything enforced by the OS.

so what you are saying is since someguy has write permissions on the directory, he is able to delete the files owned by root in that directory.

That is the piece I was overlooking during my testing then.

thank you.

rknichols · 11-07-2014, 02:28 PM

Quote:

Originally Posted by farslayer

so what you are saying is since someguy has write permissions on the directory, he is able to delete the files owned by root in that directory.

Yes.

I should add, if you set the "sticky" bit on that directory (chmod +t), then someguy would only be able to delete the files that he owns.