Cron Error: Cron <EMAIL> /tmp/.X11-unix/.bash/update >/dev/null 2>&1 (failed)
 

I keep getting this email from my Debian Linux server:

Subject: Cron <MY_EMAIL> /tmp/.X11-unix/.bash/update >/dev/null 2>&1 (failed)
Body: /bin/sh: cannot create /dev/null: Permission denied

Linux Version: Debian GNU/Linux 6.0

Who owns the "/tmp/.X11-unix/.bash/update" file and /tmp/.X11-unix directory? Run 'stat' on them like 'stat /tmp/.X11-unix/.bash/update /tmp/.X11-unix/.bash/'.

There doesn't seem to be a "/tmp/.X11-unix/.bash/update" file?

# stat /tmp/.X11-unix
File: `/tmp/.X11-unix'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 801h/2049d Inode: 1994341 Links: 2
Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-01-19 18:22:29.000000000 -0600
Modify: 2012-01-18 01:31:29.000000000 -0600
Change: 2012-01-18 01:31:29.000000000 -0600

Looks like root owns "/tmp/.X11-unix"

This is the only cron job running:

*/15 * * * * cd /var/www/<domain>.com/cron/;php check_payments1.php

The error email is being sent every minute.

Unless you get email redirected from other accounts (see for example /etc/aliases), what does 'crontab -l' for your user account (as in "<MY_EMAIL>") return?

Yes I am getting email from other accounts:

# /etc/aliases
info: <MY_EMAIL>
webmaster: <MY_EMAIL>
postmaster: <MY_EMAIL>
administrator: <MY_EMAIL>
# Webmin: Admin
admin: <MY_EMAIL>
abuse: <MY_EMAIL>

I see I should have phrased that differently.
Wwhat does 'crontab -l' for your user, as well as for any other accounts you get email redirected from (see /var/spool/cron as root), return?

Ok, that's the issue. The info user had a cron job "/tmp/.X11-unix/.bash/update >/dev/null 2>&1" set to run every minute.

I've commented out the job. But do you have any idea what it's supposed to do?

Can you read the code inside 'update'?

Since you already told us there doesn't seem to exist a "/tmp/.X11-unix/.bash/update" file that will be hard to find out. I do find it odd: even though the /tmp/.X11-unix directory has octal 1777 access perms, anyone could write something there, it should be reserved for only Xorg sockets.
What does (as root) 'getent passwd info; last info; lastlog info; chage -l info' return?