dist-git conversion

#2781)

.cvsignore

@@ -1 +0,0 @@
-vixie-cron-4.1.tar.gz

.gitignore

@@ -0,0 +1 @@
+vixie-cron-4.3.tar.gz

Makefile

@@ -1,6 +0,0 @@
-# Makefile for source rpm: vixie-cron
-# $Id$
-NAME := vixie-cron
-SPECFILE = $(firstword $(wildcard *.spec))
-
-include ../common/Makefile.common

crond.sysconfig

@@ -1,9 +0,0 @@
-# Settings for the CRON daemon.
-# CRONDARGS= :  any extra command-line startup arguments for crond
-# CRON_VALIDATE_MAILRCPTS=1:a non-empty value of this variable will
-#                           enable vixie-cron-4.1's validation of 
-#                           mail recipient names, which would then be
-#                           restricted to contain only the chars
-#                           from this tr(1) set : [@!:%-_.,:alnum:]
-#                           otherwise mailing is not attempted.
-CRONDARGS=

dead.package

@@ -0,0 +1 @@
+Renamed to cronie.

sources

@@ -1 +0,0 @@
-84dc41e24852e497c21578446e5d9832  vixie-cron-4.1.tar.gz

vixie-cron-4.1-60_seconds.patch

@@ -1,214 +0,0 @@
---- vixie-cron-4.1/cron.c.60_seconds	2006-01-11 15:16:47.000000000 -0500
-+++ vixie-cron-4.1/cron.c	2006-01-11 20:02:08.000000000 -0500
-@@ -37,12 +37,14 @@
- 		sigchld_handler(int),
- 		sighup_handler(int),
- 		sigchld_reaper(void),
-+                sigusr1_handler(int),
- 		quit(int),
- 		parse_args(int c, char *v[]);
- 
- static	volatile sig_atomic_t	got_sighup, got_sigchld;
--static	int			timeRunning, virtualTime, clockTime;
-+static	int			timeRunning, virtualTime, clockTime, drift;
- static	long			GMToff;
-+static  struct timeval          time_last_job_run_tv={0,0};
- 
- static void
- usage(void) {
-@@ -86,6 +88,8 @@
- 	sact.sa_handler = quit;
- 	(void) sigaction(SIGINT, &sact, NULL);
- 	(void) sigaction(SIGTERM, &sact, NULL);
-+	sact.sa_handler = sigusr1_handler;
-+	(void) sigaction(SIGUSR1, &sact, NULL);
- 
- 	acquire_daemonlock(0);
- 	set_cron_uid();
-@@ -137,6 +141,7 @@
- 	set_time(TRUE);
- 	run_reboot_jobs(&database);
- 	timeRunning = virtualTime = clockTime;
-+	drift = 0;
- 
- 	/*
- 	 * Too many clocks, not enough time (Al. Einstein)
-@@ -151,6 +156,9 @@
- 	while (TRUE) {
- 		int timeDiff;
- 		enum timejump wakeupKind;
-+		struct timeval tv;
-+		struct timezone tz={0,0};
-+		struct timespec ts;
- 
- 		/* ... wait for the time (in minutes) to change ... */
- 		do {
-@@ -159,6 +167,31 @@
- 		} while (clockTime == timeRunning);
- 		timeRunning = clockTime;
- 
-+		/* Ensure at least 60 seconds have elapsed between successive job runs.
-+                 */
-+		drift = 0;
-+		if ( time_last_job_run_tv.tv_sec > 0 )
-+		{
-+		    gettimeofday(&tv,&tz);
-+		    double time_since_last_job = 
-+			( (((double)tv.tv_sec) + (((double)tv.tv_usec)/1000000.0))
-+			 -( ((double)time_last_job_run_tv.tv_sec)
-+			  +(((double)time_last_job_run_tv.tv_usec)/1000000.0)
-+			  )
-+			);
-+		    memset(&time_last_job_run_tv,0,sizeof(struct timeval));
-+		    if( time_since_last_job < 60.0 )
-+		    {
-+			double delay = (60.0 - time_since_last_job) 
-+			             + (tv.tv_usec ? (((double)(1000000 - tv.tv_usec))/1000000.0) : 0);
-+			ts.tv_sec = delay ;
-+			drift = ts.tv_sec ;
-+			ts.tv_nsec = ( delay - (double)ts.tv_sec ) * 1000000000;
-+			Debug(DSCH,("DELAY: %lu %lu\n",ts.tv_sec,ts.tv_nsec));
-+			nanosleep(&ts,0L);
-+		    }
-+		}
-+ 
- 		/*
- 		 * Calculate how the current time differs from our virtual
- 		 * clock.  Classify the change into one of 4 cases.
-@@ -362,7 +395,7 @@
- 	int seconds_to_wait;
- 
- 	t1 = time(NULL) + GMToff;
--	seconds_to_wait = (int)(target * SECONDS_PER_MINUTE - t1) + 1;
-+	seconds_to_wait = (int)(target * SECONDS_PER_MINUTE - t1) + 1 + drift;
- 	Debug(DSCH, ("[%ld] Target time=%ld, sec-to-wait=%d\n",
- 	    (long)getpid(), (long)target*SECONDS_PER_MINUTE, seconds_to_wait))
- 
-@@ -399,6 +432,12 @@
- }
- 
- static void
-+sigusr1_handler(int x) {
-+    struct timezone tz={0,0}; /* UTC */
-+    gettimeofday(&time_last_job_run_tv,&tz);
-+}
-+
-+static void
- quit(int x) {
- 	(void) unlink(_PATH_CRON_PID);
- 	_exit(0);
---- vixie-cron-4.1/do_command.c.60_seconds	2006-01-11 15:16:47.000000000 -0500
-+++ vixie-cron-4.1/do_command.c	2006-01-11 18:57:44.000000000 -0500
-@@ -25,15 +25,38 @@
- 
- #include "cron.h"
- 
-+/* Allow the job user process the 'CAP_KILL' capability to signal the time of
-+   job execution to the main cron process - need capability includes:
-+*/
-+#include <sys/syscall.h>
-+#include <sys/capability.h>
-+#include <sys/prctl.h>
-+#ifndef SYS_capset
-+#ifndef __NR_capset
-+#error  __NR_capset and SYS_capset undefined
-+#else
-+#define SYS_capset __NR_capset
-+#endif
-+#endif
-+#ifndef SYS_capget
-+#ifndef __NR_capget
-+#error  __NR_capget and SYS_capget undefined
-+#else
-+#define SYS_capset __NR_capget
-+#endif
-+#endif
-+
- static void		child_process(entry *, user *);
- static int		safe_p(const char *, const char *);
-+static pid_t  crond_pid;
- 
- void
- do_command(entry *e, user *u) {
- 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
- 		      (long)getpid(), e->cmd, u->name,
- 		      (long)e->pwd->pw_uid, (long)e->pwd->pw_gid))
--
-+	    
-+	crond_pid = getpid();
- 	/* fork to become asynchronous -- parent process is done immediately,
- 	 * and continues to run the normal cron code, which means return to
- 	 * tick().  the child and grandchild don't leave this function, alive.
-@@ -67,6 +90,28 @@
- 	int children = 0; 
-         char **jobenv=0L;
- 
-+	struct __user_cap_header_struct caphead;
-+	struct __user_cap_data_struct cap;
-+
-+	/* Before we set the security context, allow the job user to inherit the CAP_KILL capability: */    
-+
-+	memset(&caphead, 0, sizeof(caphead));
-+	memset(&cap, 0, sizeof(cap));
-+	caphead.version = _LINUX_CAPABILITY_VERSION;
-+	caphead.pid = 0;
-+
-+	if ( syscall(SYS_capget, &caphead, &cap) < 0)
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot get process capabilities:", strerror(errno));
-+
-+	cap.inheritable |= CAP_KILL ;
-+	
-+	if ( syscall(SYS_capset, &caphead, &cap) < 0) 
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set process capabilities:", strerror(errno));
-+	
-+	if ( prctl(PR_SET_KEEPCAPS,1,0,0,0) < 0 )
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot prctl(PR_SET_KEEPCAPS..):", strerror(errno));
-+
-+
- 	/* Set up the Red Hat security context for both mail/minder and job processes:
-          */
- 	if ( cron_set_job_security_context( e, u, &jobenv ) != 0 )
-@@ -75,6 +120,17 @@
- 	    exit(ERROR_EXIT);
- 	}
- 
-+	/* Now we are the job user, running in user context with non-root capabilities.
-+	 * Add the CAP_KILL capability to our effective capability set:
-+	 */
-+	if ( syscall(SYS_capget, &caphead, &cap) < 0)
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot get process capabilities:", strerror(errno));
-+	
-+	cap.effective = cap.permitted ;
-+
-+	if ( syscall(SYS_capset, &caphead, &cap) < 0) 
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set process capabilities:", strerror(errno));
-+
- 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
- 
- #ifdef CAPITALIZE_FOR_PS
-@@ -230,8 +286,25 @@
- 				_exit(OK_EXIT);
- 			}
- # endif /*DEBUGGING*/
-+			/* tell crond main process we are running the job */
-+			if( kill(crond_pid, SIGUSR1) == -1 )
-+			    syslog(LOG_INFO, "CRON (%s) ERROR: kill failed: %s", e->pwd->pw_name, strerror(errno));
-+
-+			/* drop capabilities */
-+			cap.permitted = 0;
-+			cap.effective = 0;
-+			cap.inheritable=0;
-+			if( syscall(SYS_capset, &caphead, &cap) < 0 )
-+			    syslog(LOG_INFO, "CRON (%s) ERROR: capset (DROP) failed: %s", e->pwd->pw_name,
-+				   strerror(errno));
-+			if( prctl(PR_SET_KEEPCAPS,0,0,0,0) < 0 )
-+			    syslog(LOG_INFO, "CRON (%s) ERROR: prctl clear KEEPCAPS failed: %s", e->pwd->pw_name,
-+				   strerror(errno));
- 
-+			/*** RUN THE COMMAND ***/
-+			
- 			execle(shell, shell, "-c", e->cmd, (char *)0, jobenv);
-+			
- 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
- 			perror("execl");
- 			_exit(ERROR_EXIT);

vixie-cron-4.1-CAN-2005-1038-fix-race.patch

@@ -1,57 +0,0 @@
---- vixie-cron-4.1/crontab.c.CAN-2005-1038-fix-race	2005-07-11 15:23:53.071138000 -0400
-+++ vixie-cron-4.1/crontab.c	2005-07-11 17:36:33.841535000 -0400
-@@ -488,33 +488,39 @@
- 	(void)signal(SIGHUP, SIG_DFL);
- 	(void)signal(SIGINT, SIG_DFL);
- 	(void)signal(SIGQUIT, SIG_DFL);      
-+
- 	if (lstat(Filename, &statbuf) < 0) {
--		perror("fstat");
-+		perror("lstat");
- 		goto fatal;
- 	}
--	if (utimebuf.modtime == statbuf.st_mtime) {
--		fprintf(stderr, "%s: no changes made to crontab\n",
--			ProgramName);
--		goto remove;
--	}
- 
--	if (  (!S_ISREG(statbuf.st_mode))
--	    ||(S_ISLNK(statbuf.st_mode))
--	    ||(S_ISDIR(statbuf.st_mode))
--            ||(S_ISCHR(statbuf.st_mode))
--	    ||(S_ISBLK(statbuf.st_mode))
--            ||(S_ISFIFO(statbuf.st_mode))
--	    ||(S_ISSOCK(statbuf.st_mode))
--	    )
-+	if ( !S_ISREG(statbuf.st_mode) )
- 	{
- 	    fprintf(stderr, "%s: illegal crontab\n",
- 			ProgramName);
- 		goto remove;	    
- 	}
- 
-+	if (utimebuf.modtime == statbuf.st_mtime) {
-+		fprintf(stderr, "%s: no changes made to crontab\n",
-+			ProgramName);
-+		goto remove;
-+	}
-+
- 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
-         fclose(NewCrontab);
--	NewCrontab=fopen(Filename,"r+");
-+	if (swap_uids() < OK) {
-+	    perror("swapping uids");
-+	    goto remove;
-+	}
-+	if (!(NewCrontab = fopen(Filename, "r+"))) {
-+	    perror("cannot read new crontab");
-+	    goto remove;	    
-+	}
-+	if (swap_uids_back() < OK) {
-+	    perror("swapping uids back");
-+	    exit(ERROR_EXIT);
-+	}
- 	if( NewCrontab == 0L )
- 	{
- 	    perror("fopen");

vixie-cron-4.1-_0_rh_Makefile.patch

@@ -1,55 +0,0 @@
---- vixie-cron-4.1-rh/Makefile.rh-Makefile	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1-rh/Makefile	2004-07-22 11:05:43.000000000 -0400
-@@ -62,7 +62,8 @@
- LIBS		=
- #<<optimize or debug?>>
- #CDEBUG		=	-O
--CDEBUG		=	-g
-+#CDEBUG		=	-g
-+CDEBUG		=       $(RPM_OPT_FLAGS)
- #<<lint flags of choice?>>
- LINTFLAGS	=	-hbxa $(INCLUDE) $(DEBUGGING)
- #<<want to use a nonstandard CC?>>
-@@ -104,27 +105,30 @@
- 			|grep -v "constant argument to NOT" 2>&1
- 
- cron		:	$(CRON_OBJ)
--			$(CC) $(LDFLAGS) -o cron $(CRON_OBJ) $(LIBS)
-+			$(CC) $(LDFLAGS) -o cron -pie $(CRON_OBJ) $(LIBS)
- 
- crontab		:	$(CRONTAB_OBJ)
- 			$(CC) $(LDFLAGS) -o crontab $(CRONTAB_OBJ) $(LIBS)
- 
- install		:	all
--			$(INSTALL) -c -m  111 -o root -s cron    $(DESTSBIN)/
--			$(INSTALL) -c -m 4111 -o root -s crontab $(DESTBIN)/
-+			$(INSTALL) -c -m 755 cron    $(DESTSBIN)/crond
-+			$(INSTALL) -c -m 4755 crontab $(DESTBIN)/
- #			$(INSTALL) -c -m  111 -o root -g crontab -s cron $(DESTSBIN)/
- #			$(INSTALL) -c -m 2111 -o root -g crontab -s crontab $(DESTBIN)/
- 			sh putman.sh crontab.1 $(DESTMAN)
-+			chmod 644 $(DESTMAN)/man1/crontab.1
- 			sh putman.sh cron.8    $(DESTMAN)
-+			chmod 644 $(DESTMAN)/man8/cron.8
-+			ln -sf cron.8 $(DESTMAN)/man8/crond.8
- 			sh putman.sh crontab.5 $(DESTMAN)
-+			chmod 644 $(DESTMAN)/man5/crontab.5
- 
- distclean	:	clean
- 			rm -f *.orig *.rej *.BAK *.CKP *~ #*
- 			rm -f a.out core tags
- 
- clean		:
--			rm -f *.o
--			rm -f cron crontab
-+			rm -f *.o cron crontab a.out core tags *~ #*
- 
- tags		:;	ctags ${SOURCES}
- 
-@@ -133,3 +137,6 @@
- 
- $(CRON_OBJ)	:	cron.h config.h externs.h pathnames.h Makefile
- $(CRONTAB_OBJ)	:	cron.h config.h externs.h pathnames.h Makefile
-+
-+$(CRON_OBJ): %.o: %.c
-+	$(CC) $(CFLAGS) -fpie -c $<

vixie-cron-4.1-_10_manpages.patch

@@ -1,77 +0,0 @@
---- vixie-cron-4.1-rh/cron.8.manpages	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/cron.8	2004-07-22 12:26:36.000000000 -0400
-@@ -36,10 +36,11 @@
- starting it out of init.
- .PP
- .I Cron
--searches /var/cron/tabs for crontab files which are named after accounts in
-+searches /var/spool/cron for crontab files which are named after accounts in
- /etc/passwd; crontabs found are loaded into memory.
- .I Cron
--also searches for /etc/crontab which is in a different format (see
-+also searches for /etc/crontab and the files in the /etc/cron.d directory,
-+which are in a different format (see
- .IR crontab (5)).
- .I Cron
- then wakes up every minute, examining all stored crontabs, checking each
---- vixie-cron-4.1-rh/crontab.1.manpages	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/crontab.1	2004-07-22 12:20:10.000000000 -0400
-@@ -88,8 +88,8 @@
- crontab(5), cron(8)
- .SH FILES
- .nf
--/var/cron/cron.allow
--/var/cron/cron.deny
-+/etc/cron.allow
-+/etc/cron.deny
- .fi
- .SH STANDARDS
- The
---- vixie-cron-4.1-rh/crontab.5.manpages	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/crontab.5	2004-07-22 12:32:07.000000000 -0400
-@@ -86,8 +86,15 @@
- .I and
- when at least one of the two day fields (day of month, or day of week)
- match the current time (see ``Note'' below).
-+Note that this means that non-existant times, such as "missing hours"
-+during daylight savings conversion, will never match, causing jobs
-+scheduled during the "missing times" not to be run.  Similarly, times
-+that occur more than once (again, during daylight savings conversion)
-+will cause matching jobs to be run twice.
-+.PP
- .IR cron (8)
- examines cron entries once every minute.
-+.PP
- The time and date fields are:
- .IP
- .ta 1.5i
-@@ -101,7 +108,7 @@
- .br
- day of month	1-31
- .br
--month	0-12 (or names, see below)
-+month	1-12 (or names, see below)
- .br
- day of week	0-7 (0 or 7 is Sun, or use names)
- .br
-@@ -164,6 +171,9 @@
- 23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"
- 5 4 * * sun     echo "run at 5 after 4 every sunday"
- .fi
-+.SH FILES
-+/etc/crontab			System crontab file
-+
- .SH SEE ALSO
- cron(8), crontab(1)
- .SH EXTENSIONS
---- vixie-cron-4.1-rh/FEATURES.manpages	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/FEATURES	2004-07-22 12:27:54.000000000 -0400
-@@ -82,3 +82,8 @@
- 	act this way and do the more reasonable thing, which is (IMHO) to "or"
- 	the various field-matches together.  In that sense this cron may not
- 	be completely similar to some AT&T crons.
-+
-+--	If it exists, the /etc/cron.d/ directory is parsed like the cron
-+	spool directory, except that the files in it are not user-specific
-+	and are therefore read with /etc/crontab syntax (the user is
-+	specified explicitly in the 6th column).

vixie-cron-4.1-_11_with_selinux.patch

@@ -1,20 +0,0 @@
---- vixie-cron-4.1/Makefile.with-selinux	2004-07-22 13:01:52.000000000 -0400
-+++ vixie-cron-4.1/Makefile	2004-07-22 13:31:06.000000000 -0400
-@@ -59,7 +59,7 @@
- INCLUDE		=	-I.
- #INCLUDE	=
- #<<need getopt()>>
--LIBS		=
-+LIBS		= 	-lselinux
- #<<optimize or debug?>>
- #CDEBUG		=	-O
- #CDEBUG		=	-g
-@@ -69,7 +69,7 @@
- #<<want to use a nonstandard CC?>>
- CC		=	gcc -Wall -Wno-unused -Wno-comment
- #<<manifest defines>>
--DEFS		=
-+DEFS		=	-DWITH_SELINUX
- #(SGI IRIX systems need this)
- #DEFS		=	-D_BSD_SIGNALS -Dconst=
- #<<the name of the BSD-like install program>>

vixie-cron-4.1-_12_pam.patch

@@ -1,141 +0,0 @@
---- vixie-cron-4.1/do_command.c.pam	2004-07-26 10:50:32.294991000 -0400
-+++ vixie-cron-4.1/do_command.c	2004-07-26 14:27:09.975300000 -0400
-@@ -25,9 +25,47 @@
- 
- #include "cron.h"
- 
-+#ifdef WITH_PAM
-+static pam_handle_t *pamh = NULL;
-+static const struct pam_conv conv = {
-+	NULL
-+};
-+#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
-+	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
-+	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
-+	pam_end(pamh, retcode); exit(1); \
-+   }
-+#endif
-+
- static void		child_process(entry *, user *);
- static int		safe_p(const char *, const char *);
- 
-+/* Build up the job environment from the PAM environment plus the
-+   crontab environment */
-+static char ** build_env(char **cronenv)
-+{
-+        char **jobenv = cronenv;
-+#if defined(WITH_PAM)
-+        char **pamenv = pam_getenvlist(pamh);
-+        char *cronvar;
-+        int count = 0;
-+
-+        jobenv = env_copy(pamenv);
-+
-+        /* Now add the cron environment variables. Since env_set()
-+           overwrites existing variables, this will let cron's
-+           environment settings override pam's */
-+
-+        while ((cronvar = cronenv[count++])) {
-+                if (!(jobenv = env_set(jobenv, cronvar))) {
-+                        syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
-+                        return NULL;
-+                }
-+        }
-+#endif
-+    return jobenv;
-+}
-+
- void
- do_command(entry *e, user *u) {
- 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
-@@ -64,7 +102,11 @@
- child_process(entry *e, user *u) {
- 	int stdin_pipe[2], stdout_pipe[2];
- 	char *input_data, *usernm, *mailto;
--	int children = 0;
-+	int children = 0; 
-+#if defined(WITH_PAM)
-+	int		retcode = 0;
-+#endif
-+
- 
- 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
- 
-@@ -134,6 +176,17 @@
- 		*p = '\0';
- 	}
- 
-+#if defined(WITH_PAM)
-+	retcode = pam_start("crond", usernm, &conv, &pamh);
-+	PAM_FAIL_CHECK;
-+	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
-+	PAM_FAIL_CHECK;
-+	retcode = pam_open_session(pamh, PAM_SILENT);
-+	PAM_FAIL_CHECK;
-+	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
-+	PAM_FAIL_CHECK;
-+#endif
-+
- 	/* fork again, this time so we can exec the user's command.
- 	 */
- 	switch (fork()) {
-@@ -528,6 +581,12 @@
- 			Debug(DPROC, (", dumped core"))
- 		Debug(DPROC, ("\n"))
- 	}
-+
-+#if defined(WITH_PAM)
-+	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
-+	retcode = pam_close_session(pamh, PAM_SILENT);
-+	pam_end(pamh, retcode);
-+#endif
- }
- 
- static int
---- vixie-cron-4.1/cron.h.pam	2004-07-26 10:50:32.272016000 -0400
-+++ vixie-cron-4.1/cron.h	2004-07-26 10:51:37.555665000 -0400
-@@ -30,12 +30,17 @@
- 
- #define CRON_VERSION "V5.0"
- 
-+#include "config.h"
-+#include "externs.h"
-+
- #ifdef WITH_SELINUX
- #include <selinux/selinux.h>
- #endif
- 
--#include "config.h"
--#include "externs.h"
-+#ifdef WITH_PAM
-+#include <security/pam_appl.h>
-+#endif
-+
- #include "pathnames.h"
- #include "macros.h"
- #include "structs.h"
---- vixie-cron-4.1/cron.8.pam	2004-07-26 10:50:32.676609000 -0400
-+++ vixie-cron-4.1/cron.8	2004-07-26 15:46:43.399098000 -0400
-@@ -76,6 +76,12 @@
- .PP
- Time changes of more than 3 hours are considered to be corrections to
- the clock or timezone, and the new time is used immediately.
-+.SS PAM Access Control
-+On Red Hat systems, crond now supports access control with PAM - see 
-+.IR pam (8) .
-+A PAM configuration file for crond is installed in /etc/pam.d/crond .
-+crond loads the PAM environment from the pam_env module, but these
-+can be overriden by settings in the crontab file.
- .SH SIGNALS
- On receipt of a \s-2SIGHUP\s+2, the cron daemon will close and reopen its
- log file.  This is useful in scripts which rotate and age log files.  
-@@ -88,7 +94,8 @@
- In other words, it should be mode 0600.
- .SH "SEE ALSO"
- .IR crontab (1),
--.IR crontab (5)
-+.IR crontab (5),
-+.IR pam (8)
- .SH AUTHOR
- .nf
- Paul Vixie <vixie@isc.org>

vixie-cron-4.1-_13_with_pam.patch

@@ -1,20 +0,0 @@
---- vixie-cron-4.1/Makefile.with_pam	2004-07-26 10:50:32.765520000 -0400
-+++ vixie-cron-4.1/Makefile	2004-07-26 14:05:59.719827000 -0400
-@@ -59,7 +59,7 @@
- INCLUDE		=	-I.
- #INCLUDE	=
- #<<need getopt()>>
--LIBS		= 	-lselinux
-+LIBS		= 	-lselinux -lpam -lpam_misc
- #<<optimize or debug?>>
- #CDEBUG		=	-O
- #CDEBUG		=	-g
-@@ -69,7 +69,7 @@
- #<<want to use a nonstandard CC?>>
- CC		=	gcc -Wall -Wno-unused -Wno-comment
- #<<manifest defines>>
--DEFS		=	-DWITH_SELINUX
-+DEFS		=	-DWITH_SELINUX -DWITH_PAM
- #(SGI IRIX systems need this)
- #DEFS		=	-D_BSD_SIGNALS -Dconst=
- #<<the name of the BSD-like install program>>

vixie-cron-4.1-_14_pamd_crond.patch

@@ -1,35 +0,0 @@
-diff -Nru vixie-cron-4.1/crond.pam vixie-cron-4.1.pam/crond.pam
---- vixie-cron-4.1/crond.pam	1969-12-31 19:00:00.000000000 -0500
-+++ vixie-cron-4.1.pam/crond.pam	2004-07-26 13:42:16.662309000 -0400
-@@ -0,0 +1,12 @@
-+#
-+# The PAM configuration file for the cron daemon
-+#
-+#
-+auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
-+auth       required  pam_env.so
-+account    required  /lib/security/$ISA/pam_stack.so service=system-auth
-+session    required  /lib/security/$ISA/pam_stack.so service=system-auth
-+# Sets up user limits, please uncomment and read /etc/security/limits.conf
-+# to enable this functionality.
-+# session    required   pam_limits.so
-+#
-diff -Nru vixie-cron-4.1/Makefile vixie-cron-4.1.pam/Makefile
---- vixie-cron-4.1/Makefile	2004-07-26 14:05:59.719827000 -0400
-+++ vixie-cron-4.1.pam/Makefile	2004-07-26 15:17:04.121157000 -0400
-@@ -55,6 +55,7 @@
- DESTSBIN	=	$(DESTROOT)/sbin
- DESTBIN		=	$(DESTROOT)/bin
- DESTMAN		=	$(DESTROOT)/share/man
-+DESTETC		=	$(DESTROOT)/../etc
- #<<need bitstring.h>>
- INCLUDE		=	-I.
- #INCLUDE	=
-@@ -113,6 +114,7 @@
- install		:	all
- 			$(INSTALL) -c -m 755 cron    $(DESTSBIN)/crond
- 			$(INSTALL) -c -m 4755 crontab $(DESTBIN)/
-+			$(INSTALL) -c -m 0600 crond.pam $(DESTETC)/pam.d/crond
- #			$(INSTALL) -c -m  111 -o root -g crontab -s cron $(DESTSBIN)/
- #			$(INSTALL) -c -m 2111 -o root -g crontab -s crontab $(DESTBIN)/
- 			sh putman.sh crontab.1 $(DESTMAN)

vixie-cron-4.1-_15_system_crontab_user.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/database.c.system-crontab-user	2004-07-28 10:33:13.601263000 -0400
-+++ vixie-cron-4.1/database.c	2004-07-28 10:33:34.424419000 -0400
-@@ -133,7 +133,7 @@
- 		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
- 			continue;	/* XXX log? */
- 
--		process_crontab("root", "*system*", tabname,
-+		process_crontab("root", NULL, tabname,
- 				&crond_stat, &new_db, old_db);
- 	}
- 	closedir(dir);

vixie-cron-4.1-_16_crontab_selinux.patch

@@ -1,86 +0,0 @@
---- vixie-cron-4.1/crontab.c.crontab_selinux	2004-07-28 13:46:04.514451709 -0400
-+++ vixie-cron-4.1/crontab.c	2004-07-28 14:11:07.999614447 -0400
-@@ -31,6 +31,39 @@
- #define	MAIN_PROGRAM
- 
- #include "cron.h"
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/flask.h>
-+#include <selinux/av_permissions.h>
-+#include <selinux/context.h>
-+
-+static int checkAccess(int selaccess) {
-+	int status=-1;
-+	security_context_t user_context;
-+	if (is_selinux_enabled() == 0) 
-+		return 0;
-+	if( getprevcon(&user_context)==0 ) {
-+		struct av_decision avd;
-+		int retval = security_compute_av(user_context,
-+						 user_context,
-+						 SECCLASS_PASSWD,
-+						 selaccess,
-+						 &avd);
-+		
-+		if ((retval == 0) && 
-+		    ((selaccess & avd.allowed) == selaccess)) {
-+			status=0;
-+		}
-+		freecon(user_context);
-+	}
-+	
-+	if (status != 0 && security_getenforce()==0) 
-+		status=0;
-+	
-+	return status;
-+}
-+#endif
-+
- 
- #define NHEADER_LINES 0
- 
-@@ -155,6 +188,13 @@
- 					"must be privileged to use -u\n");
- 				exit(ERROR_EXIT);
- 			}
-+#ifdef WITH_SELINUX
-+			if (checkAccess(PASSWD__ROOTOK)!=0) {
-+				fprintf(stderr,
-+					"Access denied by SELinux, must be privileged to use -u\n");
-+				exit(ERROR_EXIT);
-+			}
-+#endif
- 			if (!(pw = getpwnam(optarg))) {
- 				fprintf(stderr, "%s:  user `%s' unknown\n",
- 					ProgramName, optarg);
---- vixie-cron-4.1/user.c.crontab_selinux	2004-07-28 13:46:04.480455523 -0400
-+++ vixie-cron-4.1/user.c	2004-07-28 14:02:19.777972399 -0400
-@@ -30,15 +30,16 @@
- #include <selinux/selinux.h>
- #include <selinux/flask.h>
- #include <selinux/av_permissions.h>
-+#include <selinux/get_context_list.h>
- #endif
- 
- #include "cron.h"
- 
- #ifdef WITH_SELINUX
--static	int get_security_context(char *name, 
-+static	int get_security_context(const char *name, 
- 				 int crontab_fd, 
- 				 security_context_t *rcontext, 
--				 char *tabname) {
-+				 const char *tabname) {
- 	security_context_t scontext;
- 	security_context_t  file_context=NULL;
- 	struct av_decision avd;
-@@ -147,7 +148,7 @@
- 
- #ifdef WITH_SELINUX
- 	if (is_selinux_enabled() > 0) {
--		char *sname=uname;
-+		const char *sname=uname;
- 		if (pw==NULL) {
- 			sname="system_u";
- 		}

vixie-cron-4.1-_17_pam-rootok.patch

@@ -1,10 +0,0 @@
---- vixie-cron-4.1/crond.pam.pam-rootok	2004-07-29 09:21:11.000000000 -0400
-+++ vixie-cron-4.1/crond.pam	2004-07-30 14:59:04.508666000 -0400
-@@ -2,6 +2,7 @@
- # The PAM configuration file for the cron daemon
- #
- #
-+auth	   sufficient /lib/security/$ISA/pam_rootok.so
- auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
- auth       required  pam_env.so
- account    required  /lib/security/$ISA/pam_stack.so service=system-auth

vixie-cron-4.1-_18_cron_log_facility.patch

@@ -1,10 +0,0 @@
---- vixie-cron-4.1/do_command.c.cron_log_facility	2004-08-01 16:12:31.982801000 -0400
-+++ vixie-cron-4.1/do_command.c	2004-08-01 16:12:32.290493000 -0400
-@@ -185,6 +185,7 @@
- 	PAM_FAIL_CHECK;
- 	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
- 	PAM_FAIL_CHECK;
-+	log_close(); /* PAM has now re-opened our log to auth.info ! */
- #endif
- 
- 	/* fork again, this time so we can exec the user's command.

vixie-cron-4.1-_19_crontab_stat_not_fstat.patch

@@ -1,27 +0,0 @@
---- vixie-cron-4.1/crontab.c.crontab_stat_not_fstat	2004-08-10 10:50:31.601288000 -0400
-+++ vixie-cron-4.1/crontab.c	2004-08-10 12:38:07.911595000 -0400
-@@ -502,8 +502,8 @@
- 	}
- 	(void)signal(SIGHUP, SIG_DFL);
- 	(void)signal(SIGINT, SIG_DFL);
--	(void)signal(SIGQUIT, SIG_DFL);
--	if (fstat(t, &statbuf) < 0) {
-+	(void)signal(SIGQUIT, SIG_DFL);      
-+	if (stat(Filename, &statbuf) < 0) {
- 		perror("fstat");
- 		goto fatal;
- 	}
-@@ -513,6 +513,13 @@
- 		goto remove;
- 	}
- 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
-+        fclose(NewCrontab);
-+	NewCrontab=fopen(Filename,"r+");
-+	if( NewCrontab == 0L )
-+	{
-+	    perror("fopen");
-+	    goto fatal;
-+	}
- 	switch (replace_cmd()) {
- 	case 0:
- 		break;

vixie-cron-4.1-_1_rh_pathnames.patch

@@ -1,56 +0,0 @@
---- vixie-cron-4.1-rh/pathnames.h.rh_pathnames	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1-rh/pathnames.h	2004-07-22 10:12:44.000000000 -0400
-@@ -35,7 +35,7 @@
- 			 * to; SPOOL_DIR, CRON_ALLOW, CRON_DENY, and LOG_FILE
- 			 * are all relative to this directory.
- 			 */
--#define CRONDIR		"/var/cron"
-+#define CRONDIR		"/var/spool"
- #endif
- 
- 			/* SPOOLDIR is where the crontabs live.
-@@ -46,13 +46,13 @@
- 			 * newer than they were last time around (or which
- 			 * didn't exist last time around...)
- 			 */
--#define SPOOL_DIR	"tabs"
-+#define SPOOL_DIR	"cron"
- 
- 			/* cron allow/deny file.  At least cron.deny must
- 			 * exist for ordinary users to run crontab.
- 			 */
--#define	CRON_ALLOW	"cron.allow"
--#define	CRON_DENY	"cron.deny"
-+#define	CRON_ALLOW	"/etc/cron.allow"
-+#define	CRON_DENY	"/etc/cron.deny"
- 
- 			/* undefining this turns off logging to a file.  If
- 			 * neither LOG_FILE or SYSLOG is defined, we don't log.
-@@ -60,8 +60,8 @@
- 			 * LOG_CRON is defined by <syslog.h>, LOG_FILE will not
- 			 * be used.
- 			 */
--#define LOG_FILE	"log"
--
-+/*#define LOG_FILE	"/var/log/cron"*/
-+#define SYSLOG
- 			/* where should the daemon stick its PID?
- 			 * PIDDIR must end in '/'.
- 			 */
-@@ -70,12 +70,15 @@
- #else
- # define PIDDIR "/etc/"
- #endif
--#define PIDFILE		"cron.pid"
-+#define PIDFILE		"crond.pid"
- #define _PATH_CRON_PID	PIDDIR PIDFILE
- 
- 			/* 4.3BSD-style crontab */
- #define SYSCRONTAB	"/etc/crontab"
- 
-+                        /* Red Hat crond crontab dir */ 
-+#define RH_CROND_DIR    "/etc/cron.d"
-+
- 			/* what editor to use if no EDITOR or VISUAL
- 			 * environment variable specified.
- 			 */

vixie-cron-4.1-_20_nickname_man.patch

@@ -1,33 +0,0 @@
---- vixie-cron-4.1/crontab.5.nickname_man	2004-08-10 13:25:05.286941000 -0400
-+++ vixie-cron-4.1/crontab.5	2004-08-10 15:31:39.817971000 -0400
-@@ -84,9 +84,9 @@
- .IR cron (8)
- when the minute, hour, and month of year fields match the current time,
- .I and
--when at least one of the two day fields (day of month, or day of week)
-+at least one of the two day fields (day of month, or day of week)
- match the current time (see ``Note'' below).
--Note that this means that non-existant times, such as "missing hours"
-+Note that this means that non-existent times, such as "missing hours"
- during daylight savings conversion, will never match, causing jobs
- scheduled during the "missing times" not to be run.  Similarly, times
- that occur more than once (again, during daylight savings conversion)
-@@ -194,6 +194,18 @@
- mailed to a person other than the crontab owner (SysV can't do this), or the
- feature can be turned off and no mail will be sent at all (SysV can't do this
- either).
-+.PP
-+These special time specification "nicknames" are supported, which replace
-+the 5 initial time and date fields, and are prefixed by the '@' character:
-+.nf
-+@reboot    :    Run once, at startup.
-+@yearly    :    Run once a year, ie.  "0 0 1 1 *".
-+@annually  :    Run once a year, ie.  "0 0 1 1 *".
-+@monthly   :    Run once a month, ie. "0 0 1 * *".
-+@weekly    :    Run once a week, ie.  "0 0 * * 0".
-+@daily     :    Run once a day, ie.   "0 0 * * *".
-+@hourly    :    Run once an hour, ie. "0 * * * *".
-+.fi
- .SH AUTHOR
- .nf
- Paul Vixie <vixie@isc.org>

vixie-cron-4.1-_21_-i_option.patch

@@ -1,86 +0,0 @@
---- vixie-cron-4.1/crontab.c-i_option	2004-08-10 16:13:37.331529000 -0400
-+++ vixie-cron-4.1/crontab.c	2004-08-10 16:24:14.132091000 -0400
-@@ -71,9 +71,9 @@
- 
- #if DEBUGGING
- static char	*Options[] = { "???", "list", "delete", "edit", "replace" };
--static char	*getoptargs = "u:lerx:";
-+static char	*getoptargs = "u:lerix:";
- #else
--static char	*getoptargs = "u:ler";
-+static char	*getoptargs = "u:leri";
- #endif
- 
- static	PID_T		Pid;
-@@ -81,6 +81,7 @@
- static	char		Filename[MAX_FNAME], TempFilename[MAX_FNAME];
- static	FILE		*NewCrontab;
- static	int		CheckErrorCount;
-+static  int             PromptOnDelete;
- static	enum opt_t	Option;
- static	struct passwd	*pw;
- static	void		list_cmd(void),
-@@ -101,6 +102,7 @@
- 	fprintf(stderr, "\t-e\t(edit user's crontab)\n");
- 	fprintf(stderr, "\t-l\t(list user's crontab)\n");
- 	fprintf(stderr, "\t-r\t(delete user's crontab)\n");
-+	fprintf(stderr, "\t-i\t(prompt before deleting user's crontab)\n");
- 	exit(ERROR_EXIT);
- }
- 
-@@ -174,6 +176,7 @@
- 	strcpy(RealUser, User);
- 	Filename[0] = '\0';
- 	Option = opt_unknown;
-+	PromptOnDelete = 0;
- 	while (-1 != (argch = getopt(argc, argv, getoptargs))) {
- 		switch (argch) {
- #if DEBUGGING
-@@ -219,6 +222,9 @@
- 				usage("only one operation permitted");
- 			Option = opt_edit;
- 			break;
-+		case 'i':
-+       		        PromptOnDelete = 1;
-+			break;
- 		default:
- 			usage("unrecognized option");
- 		}
-@@ -304,6 +310,14 @@
- static void
- delete_cmd(void) {
- 	char n[MAX_FNAME];
-+	if( PromptOnDelete == 1 )
-+	{
-+	    printf("crontab: really delete %s's crontab? ", User);
-+	    fflush(stdout);
-+	    fgets(n, MAX_FNAME-1, stdin);
-+	    if((n[0] != 'Y') && (n[0] != 'y'))
-+		exit(0);
-+	}
- 
- 	log_it(RealUser, Pid, "DELETE", User);
- 	if (!glue_strings(n, sizeof n, SPOOL_DIR, User, '/')) {
---- vixie-cron-4.1/crontab.1-i_option	2004-08-10 16:13:36.842019000 -0400
-+++ vixie-cron-4.1/crontab.1	2004-08-10 16:13:37.441419000 -0400
-@@ -31,7 +31,7 @@
- .B crontab
- .RB [ -u
- .IR user ]
--.RB [ -l " | " -r " | " -e ]
-+.RB [ -l " | " -r " | " -e ] [ -i ]
- .SH DESCRIPTION
- .I Crontab
- is the program used to install, deinstall or list the tables
-@@ -84,6 +84,11 @@
- option is used to edit the current crontab using the editor specified by
- the \s-1VISUAL\s+1 or \s-1EDITOR\s+1 environment variables.  After you exit
- from the editor, the modified crontab will be installed automatically.
-+.PP
-+The
-+.I -i
-+option modifies the -r option to prompt the user for a 'y/Y' response
-+before actually removing the crontab.
- .SH "SEE ALSO"
- crontab(5), cron(8)
- .SH FILES

vixie-cron-4.1-_22_no_0600_mode_enforce.patch

@@ -1,42 +0,0 @@
---- vixie-cron-4.1/cron.8.no_0600_mode_enforce	2004-08-11 16:40:19.538738000 -0400
-+++ vixie-cron-4.1/cron.8	2004-08-11 16:52:54.638882000 -0400
-@@ -90,8 +90,10 @@
- .SH CAVEATS
- In this version of
- .BR cron ,
--/etc/crontab must not be readable or writable by any user other than root.
--In other words, it should be mode 0600.
-+/etc/crontab must not be writable by any user other than root.
-+No crontab files may be links, or linked to by any other file.
-+No crontab files may be executable, or be writable by any user
-+other than their owner.
- .SH "SEE ALSO"
- .IR crontab (1),
- .IR crontab (5),
---- vixie-cron-4.1/crontab.5.no_0600_mode_enforce	2004-08-11 16:40:19.951325000 -0400
-+++ vixie-cron-4.1/crontab.5	2004-08-11 16:53:45.047423000 -0400
-@@ -206,6 +206,13 @@
- @daily     :    Run once a day, ie.   "0 0 * * *".
- @hourly    :    Run once an hour, ie. "0 * * * *".
- .fi
-+.SH CAVEATS
-+In this version of
-+.BR cron ,
-+/etc/crontab must not be writable by any user other than root.
-+No crontab files may be links, or linked to by any other file.
-+No crontab files may be executable, or be writable by any user
-+other than their owner.
- .SH AUTHOR
- .nf
- Paul Vixie <vixie@isc.org>
---- vixie-cron-4.1/database.c.no_0600_mode_enforce	2004-08-11 16:40:19.691585000 -0400
-+++ vixie-cron-4.1/database.c	2004-08-11 16:45:35.564396000 -0400
-@@ -261,7 +261,7 @@
- 		log_it(fname, getpid(), "NOT REGULAR", tabname);
- 		goto next_crontab;
- 	}
--	if ((statbuf->st_mode & 07777) != 0600) {
-+	if ((statbuf->st_mode & 07733) != 0600) {
- 		log_it(fname, getpid(), "BAD FILE MODE", tabname);
- 		goto next_crontab;
- 	}

vixie-cron-4.1-_23_freecon_segv.patch

@@ -1,22 +0,0 @@
---- vixie-cron-4.1/user.c.freecon_segv	2004-08-31 15:51:10.426657000 -0400
-+++ vixie-cron-4.1/user.c	2004-08-31 16:33:34.196915000 -0400
-@@ -103,7 +103,8 @@
- 		free_entry(e);
- 	}
- #ifdef WITH_SELINUX
--	freecon(u->scontext);
-+	if( u->scontext != NULL )
-+	    freecon(u->scontext);
- #endif	
- 	free(u);
- }
-@@ -159,7 +160,8 @@
- 			u = NULL;
- 			goto done;
- 		}
--	}
-+	}else
-+	    u->scontext = NULL;
- #endif
- 
- 	/* load the crontab

vixie-cron-4.1-_24_crontab_selinux_new.patch

@@ -1,55 +0,0 @@
---- vixie-cron-4.1/crontab.c.crontab_selinux_new	2004-09-17 11:42:45.484765000 -0400
-+++ vixie-cron-4.1/crontab.c	2004-09-17 11:35:53.078584000 -0400
-@@ -33,35 +33,7 @@
- #include "cron.h"
- #ifdef WITH_SELINUX
- #include <selinux/selinux.h>
--#include <selinux/flask.h>
- #include <selinux/av_permissions.h>
--#include <selinux/context.h>
--
--static int checkAccess(int selaccess) {
--	int status=-1;
--	security_context_t user_context;
--	if (is_selinux_enabled() == 0) 
--		return 0;
--	if( getprevcon(&user_context)==0 ) {
--		struct av_decision avd;
--		int retval = security_compute_av(user_context,
--						 user_context,
--						 SECCLASS_PASSWD,
--						 selaccess,
--						 &avd);
--		
--		if ((retval == 0) && 
--		    ((selaccess & avd.allowed) == selaccess)) {
--			status=0;
--		}
--		freecon(user_context);
--	}
--	
--	if (status != 0 && security_getenforce()==0) 
--		status=0;
--	
--	return status;
--}
- #endif
- 
- 
-@@ -192,10 +164,12 @@
- 				exit(ERROR_EXIT);
- 			}
- #ifdef WITH_SELINUX
--			if (checkAccess(PASSWD__ROOTOK)!=0) {
--				fprintf(stderr,
--					"Access denied by SELinux, must be privileged to use -u\n");
--				exit(ERROR_EXIT);
-+			if (is_selinux_enabled() > 0) {
-+				if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0) {
-+					fprintf(stderr,
-+						"Access denied by SELinux, must be privileged to use -u\n");
-+					exit(ERROR_EXIT);
-+				}
- 			}
- #endif
- 			if (!(pw = getpwnam(optarg))) {

vixie-cron-4.1-_25-allow-root-crontab.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/misc.c.allow-root-crontab	2004-09-29 10:40:43.447573000 -0400
-+++ vixie-cron-4.1/misc.c	2004-09-29 11:39:21.145949000 -0400
-@@ -451,6 +451,8 @@
- 	int	isallowed;
- 	char    buf[128];
- 
-+	if ( getuid() == 0 )
-+	    return TRUE;
- 	isallowed = FALSE;
- 	if ((fp = fopen(allow_file, "r")) != NULL) {
- 		isallowed = in_file(username, fp, FALSE);

vixie-cron-4.1-_26-saved-uids.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/misc.c.saved_uids	2004-09-29 11:42:33.000000000 -0400
-+++ vixie-cron-4.1/misc.c	2004-09-30 09:55:27.968181000 -0400
-@@ -696,7 +696,7 @@
- }
- 
- int swap_uids_back(void) {
--	return ((setegid(getgid()) || seteuid(getuid())) ? -1 : 0);
-+	return ((setegid(save_egid) || seteuid(save_euid)) ? -1 : 0);
- }
- 
- #else /*HAVE_SAVED_UIDS*/

vixie-cron-4.1-_27-no-strip-header-comments.patch

@@ -1,25 +0,0 @@
---- vixie-cron-4.1/crontab.c.no-strip-header-comments	2004-10-13 10:59:17.000000000 -0400
-+++ vixie-cron-4.1/crontab.c	2004-10-15 10:07:21.775111000 -0400
-@@ -381,10 +381,10 @@
- 
- 	Set_LineNum(1)
- 
--	/* ignore the top few comments since we probably put them there.
-+	/* ignore the top NHEADER_LINES comment lines since we put them there.
- 	 */
- 	x = 0;
--	while (EOF != (ch = get_char(f))) {
-+	while ((x < NHEADER_LINES) && (EOF != (ch = get_char(f)))) {
- 		if ('#' != ch) {
- 			putc(ch, NewCrontab);
- 			break;
-@@ -392,8 +392,7 @@
- 		while (EOF != (ch = get_char(f)))
- 			if (ch == '\n')
- 				break;
--		if (++x >= NHEADER_LINES)
--			break;
-+		++x;
- 	}
- 
- 	/* copy the rest of the crontab (if any) to the temp file.

vixie-cron-4.1-_28-fix_ppc.patch

@@ -1,22 +0,0 @@
---- vixie-cron-4.1/Makefile.fix_ppc	2004-12-03 17:08:36.425211000 -0500
-+++ vixie-cron-4.1/Makefile	2004-12-03 17:09:14.264335000 -0500
-@@ -77,7 +77,7 @@
- #INSTALL = installbsd
- INSTALL = install
- #<<any special load flags>>
--LDFLAGS		=
-+LDFLAGS		=	-g
- #################################### end configurable stuff
- 
- SHELL		=	/bin/sh
---- vixie-cron-4.1/crontab.c.fix_ppc	2004-12-03 17:08:37.138499000 -0500
-+++ vixie-cron-4.1/crontab.c	2004-12-03 17:10:38.077437000 -0500
-@@ -318,7 +318,7 @@
- edit_cmd(void) {
- 	char n[MAX_FNAME], q[MAX_TEMPSTR], *editor;
- 	FILE *f;
--	int ch, t, x;
-+	int ch='\0', t, x;
- 	struct stat statbuf;
- 	struct utimbuf utimebuf;
- 	WAIT_T waiter;

vixie-cron-4.1-_29-permit_any_crontab_option.patch

@@ -1,113 +0,0 @@
---- vixie-cron-4.1/cron.c.permit_any_crontab_option	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/cron.c	2005-01-11 13:17:00.944319000 -0500
-@@ -48,7 +48,7 @@
- usage(void) {
- 	const char **dflags;
- 
--	fprintf(stderr, "usage:  %s [-n] [-x [", ProgramName);
-+	fprintf(stderr, "usage:  %s [-n] [-p] [-x [", ProgramName);
- 	for (dflags = DebugFlagNames; *dflags; dflags++)
- 		fprintf(stderr, "%s%s", *dflags, dflags[1] ? "," : "]");
- 	fprintf(stderr, "]\n");
-@@ -434,7 +434,7 @@
- parse_args(int argc, char *argv[]) {
- 	int argch;
- 
--	while (-1 != (argch = getopt(argc, argv, "nx:"))) {
-+	while (-1 != (argch = getopt(argc, argv, "npx:"))) {
- 		switch (argch) {
- 		default:
- 			usage();
-@@ -445,6 +445,9 @@
- 		case 'n':
- 			NoFork = 1;
- 			break;
-+		case 'p':
-+		        PermitAnyCrontab=1;
-+			break;
- 		}
- 	}
- }
---- vixie-cron-4.1/database.c.permit_any_crontab_option	2005-01-11 12:47:58.363083000 -0500
-+++ vixie-cron-4.1/database.c	2005-01-11 12:47:58.494951000 -0500
-@@ -257,22 +257,26 @@
- 		log_it(fname, getpid(), "FSTAT FAILED", tabname);
- 		goto next_crontab;
- 	}
--	if (!S_ISREG(statbuf->st_mode)) {
--		log_it(fname, getpid(), "NOT REGULAR", tabname);
--		goto next_crontab;
--	}
--	if ((statbuf->st_mode & 07733) != 0600) {
--		log_it(fname, getpid(), "BAD FILE MODE", tabname);
--		goto next_crontab;
--	}
--	if (statbuf->st_uid != ROOT_UID && (pw == NULL ||
--	    statbuf->st_uid != pw->pw_uid || strcmp(uname, pw->pw_name) != 0)) {
--		log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
--		goto next_crontab;
--	}
--	if (statbuf->st_nlink != 1) {
--		log_it(fname, getpid(), "BAD LINK COUNT", tabname);
--		goto next_crontab;
-+
-+	if ( PermitAnyCrontab == 0 )
-+	{
-+	    if (!S_ISREG(statbuf->st_mode)) {
-+		    log_it(fname, getpid(), "NOT REGULAR", tabname);
-+		    goto next_crontab;
-+	    }
-+	    if ((statbuf->st_mode & 07533) != 0400) {
-+		    log_it(fname, getpid(), "BAD FILE MODE", tabname);
-+		    goto next_crontab;
-+	    }
-+	    if (statbuf->st_uid != ROOT_UID && (pw == NULL ||
-+		statbuf->st_uid != pw->pw_uid || strcmp(uname, pw->pw_name) != 0)) {
-+		    log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
-+		    goto next_crontab;
-+	    }
-+	    if (statbuf->st_nlink != 1) {
-+		    log_it(fname, getpid(), "BAD LINK COUNT", tabname);
-+		    goto next_crontab;
-+	    }
- 	}
- 
- 	Debug(DLOAD, ("\t%s:", fname))
---- vixie-cron-4.1/globals.h.permit_any_crontab_option	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/globals.h	2005-01-11 12:47:58.505940000 -0500
-@@ -63,6 +63,7 @@
- XTRN int	LineNumber INIT(0);
- XTRN time_t	StartTime INIT(0);
- XTRN int	NoFork INIT(0);
-+XTRN int        PermitAnyCrontab INIT(0);
- 
- #if DEBUGGING
- XTRN int	DebugFlags INIT(0);
---- vixie-cron-4.1/cron.8.permit_any_crontab_option	2005-01-11 12:47:58.341105000 -0500
-+++ vixie-cron-4.1/cron.8	2005-01-11 12:47:58.516929000 -0500
-@@ -28,6 +28,7 @@
- .RB [ \-l
- .IR load_avg ]
- .RB [ \-n ]
-+.RB [ \-p ]
- .SH DESCRIPTION
- .I Cron
- should be started from /etc/rc or /etc/rc.local.  It will return immediately,
-@@ -89,11 +90,12 @@
- .IR syslog (3).
- .SH CAVEATS
- In this version of
--.BR cron ,
--/etc/crontab must not be writable by any user other than root.
--No crontab files may be links, or linked to by any other file.
--No crontab files may be executable, or be writable by any user
--other than their owner.
-+.BR cron
-+, without the -p option,
-+/etc/crontab must not be writable by any user other than root,
-+no crontab files may be links, or linked to by any other file,
-+and no crontab files may be executable, or be writable by any
-+user other than their owner.
- .SH "SEE ALSO"
- .IR crontab (1),
- .IR crontab (5),

vixie-cron-4.1-_2_config.patch

@@ -1,32 +0,0 @@
---- vixie-cron-4.1/config.h.config	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/config.h	2004-07-22 14:06:03.000000000 -0400
-@@ -41,8 +41,9 @@
- 			 * (hint: MAILTO= was added for this reason).
- 			 */
- 
--#define MAILFMT "%s -FCronDaemon -odi -oem -oi -t" /*-*/
--			/* -Fx	 = Set full-name of sender
-+#define MAILFMT "%s -FCronDaemon -i -odi -oem -oi -t" /*-*/                        
-+                        /* -i    = don't terminate on "." by itself
-+			 * -Fx	 = Set full-name of sender
- 			 * -odi	 = Option Deliverymode Interactive
- 			 * -oem	 = Option Errors Mailedtosender
- 			 * -oi   = Ignore "." alone on a line
-@@ -53,7 +54,7 @@
- /* #define MAILFMT "%s -d %s"				/*-*/
- 			/* -d = undocumented but common flag: deliver locally?
- 			 */
--/* #define MAILARG "/bin/mail",mailto
-+/* #define MAILARG "/bin/mail",mailto                   /*-*/
- 
- /* #define MAILFMT "%s -mlrxto %s"			/*-*/
- /* #define MAILARG "/usr/mmdf/bin/submit",mailto	/*-*/
-@@ -78,7 +79,7 @@
- 			 * are both defined, then logging will go to both
- 			 * places.
- 			 */
--#define SYSLOG	 			/*-*/
-+#define SYSLOG	 			   
- 
- 			/* if you want cron to capitalize its name in ps
- 			 * when running a job.  Does not work on SYSV.

vixie-cron-4.1-_30-uninitialized.patch

@@ -1,33 +0,0 @@
---- vixie-cron-4.1/do_command.c.uninitialized	2005-01-11 12:36:55.551558000 -0500
-+++ vixie-cron-4.1/do_command.c	2005-01-11 12:41:10.325529000 -0500
-@@ -446,7 +446,7 @@
- 		int	ch = getc(in);
- 
- 		if (ch != EOF) {
--			FILE	*mail;
-+			FILE	*mail=0L;
- 			int	bytes = 1;
- 			int	status = 0;
- 
---- vixie-cron-4.1/pw_dup.c.uninitialized	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/pw_dup.c	2005-01-11 12:43:26.169549000 -0500
-@@ -47,7 +47,7 @@
- struct passwd *
- pw_dup(const struct passwd *pw) {
- 	char		*cp;
--	size_t		 nsize, psize, csize, gsize, dsize, ssize, total;
-+	size_t		 nsize=0, psize=0, csize=0, gsize=0, dsize=0, ssize=0, total=0;
- 	struct passwd	*newpw;
- 
- 	/* Allocate in one big chunk for easy freeing */
---- vixie-cron-4.1/misc.c.uninitialized	2005-01-11 12:36:55.706403000 -0500
-+++ vixie-cron-4.1/misc.c	2005-01-11 12:42:31.208565000 -0500
-@@ -274,7 +274,7 @@
- 	char buf[3*MAX_FNAME];
- 	const char *pidfile;
- 	char *ep;
--	long otherpid;
-+	long otherpid=-1;
- 	ssize_t num;
- 
- 	if (closeflag) {

vixie-cron-4.1-_31-allow_pam_access.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/do_command.c.allow_pam_access	2005-01-25 09:36:44.541828000 -0500
-+++ vixie-cron-4.1/do_command.c	2005-01-25 10:08:20.435602000 -0500
-@@ -179,6 +179,8 @@
- #if defined(WITH_PAM)
- 	retcode = pam_start("crond", usernm, &conv, &pamh);
- 	PAM_FAIL_CHECK;
-+	retcode = pam_set_item(pamh, PAM_TTY, "cron");
-+	PAM_FAIL_CHECK;
- 	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
- 	PAM_FAIL_CHECK;
- 	retcode = pam_open_session(pamh, PAM_SILENT);

vixie-cron-4.1-_32-no_mail_rcpt_safe_p.patch

@@ -1,37 +0,0 @@
---- vixie-cron-4.1/do_command.c.no_mail_rcpt_safe_p	2005-02-11 15:25:56.261994000 -0500
-+++ vixie-cron-4.1/do_command.c	2005-02-11 16:04:34.519972000 -0500
-@@ -478,7 +478,11 @@
- 			 * up the mail command and subjects and stuff...
- 			 */
- 
--			if (mailto && safe_p(usernm, mailto)) {
-+			if (mailto 
-+			    &&( (ValidateMailRcpts==0) || safe_p(usernm, mailto) )
-+                            /* Why validate the mail recipient name ? All mailers do this anyway... JVD */
-+			   )
-+			{ 
- 				char	**env;
- 				char	mailcmd[MAX_COMMAND];
- 				char	hostname[MAXHOSTNAMELEN];
---- vixie-cron-4.1/cron.c.no_mail_rcpt_safe_p	2005-02-11 15:25:56.157099000 -0500
-+++ vixie-cron-4.1/cron.c	2005-02-11 16:01:12.732961000 -0500
-@@ -95,6 +95,9 @@
- 		log_it("CRON", getpid(), "DEATH", "can't malloc");
- 		exit(1);
- 	}
-+	
-+	if ( getenv("CRON_VALIDATE_MAILRCPTS") != 0L )
-+	    ValidateMailRcpts=1;
- 
- 	/* if there are no debug flags turned on, fork as a daemon should.
- 	 */
---- vixie-cron-4.1/globals.h.no_mail_rcpt_safe_p	2005-02-11 15:25:56.184073000 -0500
-+++ vixie-cron-4.1/globals.h	2005-02-11 15:25:56.300955000 -0500
-@@ -64,6 +64,7 @@
- XTRN time_t	StartTime INIT(0);
- XTRN int	NoFork INIT(0);
- XTRN int        PermitAnyCrontab INIT(0);
-+XTRN int        ValidateMailRcpts INIT(0);
- 
- #if DEBUGGING
- XTRN int	DebugFlags INIT(0);

vixie-cron-4.1-_33-fix_selinux_segfault.patch

@@ -1,30 +0,0 @@
---- vixie-cron-4.1/user.c.fix_selinux_segfault	2005-03-15 08:34:08.143412000 -0500
-+++ vixie-cron-4.1/user.c	2005-03-15 08:40:22.616563000 -0500
-@@ -40,7 +40,7 @@
- 				 int crontab_fd, 
- 				 security_context_t *rcontext, 
- 				 const char *tabname) {
--	security_context_t scontext;
-+	security_context_t scontext=NULL;
- 	security_context_t  file_context=NULL;
- 	struct av_decision avd;
- 	int retval=0;
-@@ -51,6 +51,7 @@
- 			return -1;
- 		} else {
- 			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-+			return 0;
- 		}
- 	}
- 	
---- vixie-cron-4.1/do_command.c.fix_selinux_segfault	2005-03-15 08:34:08.720833000 -0500
-+++ vixie-cron-4.1/do_command.c	2005-03-15 08:41:23.167952000 -0500
-@@ -330,7 +330,7 @@
- # endif /*DEBUGGING*/
- 
- #ifdef WITH_SELINUX
--			if (is_selinux_enabled() >0 ) {
-+			if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
- 				if (setexeccon(u->scontext) < 0) {
- 					if (security_getenforce() > 0) {
- 						fprintf(stderr, 

vixie-cron-4.1-_34-pam_fail_close_session.patch

@@ -1,10 +0,0 @@
---- vixie-cron-4.1/do_command.c.pam_fail_close_session	2005-04-05 10:40:13.138078000 -0400
-+++ vixie-cron-4.1/do_command.c	2005-04-05 10:44:42.008938000 -0400
-@@ -33,6 +33,7 @@
- #define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
- 	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
- 	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
-+	pam_close_session(pamh, PAM_SILENT); \
- 	pam_end(pamh, retcode); exit(1); \
-    }
- #endif

vixie-cron-4.1-_35-crontab-job-control.patch

@@ -1,20 +0,0 @@
---- vixie-cron-4.1/crontab.c.job_control	2005-04-05 11:45:07.000000000 -0400
-+++ vixie-cron-4.1/crontab.c	2005-04-07 13:07:42.851421000 -0400
-@@ -463,7 +463,7 @@
- 
- 	/* parent */
- 	for (;;) {
--		xpid = waitpid(pid, &waiter, WUNTRACED);
-+		xpid = waitpid(pid, &waiter, 0);
- 		if (xpid == -1) {
- 			if (errno != EINTR)
- 				fprintf(stderr, "%s: waitpid() failed waiting for PID %ld from \"%s\": %s\n",
-@@ -472,8 +472,6 @@
- 			fprintf(stderr, "%s: wrong PID (%ld != %ld) from \"%s\"\n",
- 				ProgramName, (long)xpid, (long)pid, editor);
- 			goto fatal;
--		} else if (WIFSTOPPED(waiter)) {
--			kill(getpid(), WSTOPSIG(waiter));
- 		} else if (WIFEXITED(waiter) && WEXITSTATUS(waiter)) {
- 			fprintf(stderr, "%s: \"%s\" exited with status %d\n",
- 				ProgramName, editor, WEXITSTATUS(waiter));

vixie-cron-4.1-_36-pam_close_fork_fail.patch

@@ -1,14 +0,0 @@
---- vixie-cron-4.1/do_command.c.pam_close_fork_fail	2005-04-07 13:19:38.000000000 -0400
-+++ vixie-cron-4.1/do_command.c	2005-04-08 12:13:45.354702000 -0400
-@@ -196,6 +196,11 @@
- 	switch (fork()) {
- 	case -1:
- 		log_it("CRON", getpid(), "error", "can't fork");
-+#ifdef WITH_PAM
-+                pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
-+                pam_close_session(pamh, PAM_SILENT);
-+                pam_end(pamh, PAM_ABORT);
-+#endif
- 		exit(ERROR_EXIT);
- 		/*NOTREACHED*/
- 	case 0:

vixie-cron-4.1-_37-limits.patch

@@ -1,19 +0,0 @@
---- vixie-cron-4.1/macros.h.limits	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/macros.h	2005-04-14 18:11:35.475147000 -0400
-@@ -44,11 +44,11 @@
- #define STDERR		2	/*   stderr's? */
- #define ERROR_EXIT	1	/* exit() with this will scare the shell */
- #define	OK_EXIT		0	/* exit() with this is considered 'normal' */
--#define	MAX_FNAME	100	/* max length of internally generated fn */
--#define	MAX_COMMAND	1000	/* max length of internally generated cmd */
--#define	MAX_ENVSTR	1000	/* max length of envvar=value\0 strings */
--#define	MAX_TEMPSTR	100	/* obvious */
--#define	MAX_UNAME	33	/* max length of username, should be overkill */
-+#define	MAX_FNAME	PATH_MAX/* max length of internally generated fn */
-+#define	MAX_COMMAND	131072	/* max length of internally generated cmd (max sh cmd line length) */
-+#define	MAX_ENVSTR	131072	/* max length of envvar=value\0 strings */
-+#define	MAX_TEMPSTR	131072	/* obvious */
-+#define	MAX_UNAME	256	/* max length of username  */
- #define	ROOT_UID	0	/* don't change this, it really must be root */
- #define	ROOT_USER	"root"	/* ditto */
- 

vixie-cron-4.1-_38-CAN-2005-1038.patch

@@ -1,33 +0,0 @@
---- vixie-cron-4.1/crontab.c.CAN-2005-1038	2005-04-14 18:39:04.356618000 -0400
-+++ vixie-cron-4.1/crontab.c	2005-04-14 18:43:50.262425000 -0400
-@@ -488,7 +488,7 @@
- 	(void)signal(SIGHUP, SIG_DFL);
- 	(void)signal(SIGINT, SIG_DFL);
- 	(void)signal(SIGQUIT, SIG_DFL);      
--	if (stat(Filename, &statbuf) < 0) {
-+	if (lstat(Filename, &statbuf) < 0) {
- 		perror("fstat");
- 		goto fatal;
- 	}
-@@ -497,6 +497,21 @@
- 			ProgramName);
- 		goto remove;
- 	}
-+
-+	if (  (!S_ISREG(statbuf.st_mode))
-+	    ||(S_ISLNK(statbuf.st_mode))
-+	    ||(S_ISDIR(statbuf.st_mode))
-+            ||(S_ISCHR(statbuf.st_mode))
-+	    ||(S_ISBLK(statbuf.st_mode))
-+            ||(S_ISFIFO(statbuf.st_mode))
-+	    ||(S_ISSOCK(statbuf.st_mode))
-+	    )
-+	{
-+	    fprintf(stderr, "%s: illegal crontab\n",
-+			ProgramName);
-+		goto remove;	    
-+	}
-+
- 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
-         fclose(NewCrontab);
- 	NewCrontab=fopen(Filename,"r+");

vixie-cron-4.1-_3_selinux.patch

@@ -1,199 +0,0 @@
---- vixie-cron-4.1/user.c.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/user.c	2004-07-22 13:17:29.000000000 -0400
-@@ -26,8 +26,72 @@
- /* vix 26jan87 [log is in RCS file]
-  */
- 
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/flask.h>
-+#include <selinux/av_permissions.h>
-+#endif
-+
- #include "cron.h"
- 
-+#ifdef WITH_SELINUX
-+static	int get_security_context(char *name, 
-+				 int crontab_fd, 
-+				 security_context_t *rcontext, 
-+				 char *tabname) {
-+	security_context_t scontext;
-+	security_context_t  file_context=NULL;
-+	struct av_decision avd;
-+	int retval=0;
-+	*rcontext = NULL;
-+	if (get_default_context(name, NULL, &scontext)) {
-+		if (security_getenforce() > 0) {
-+			log_it(name, getpid(), "No SELinux security context",tabname);
-+			return -1;
-+		} else {
-+			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-+		}
-+	}
-+	
-+	if (fgetfilecon(crontab_fd, &file_context) < OK) {
-+		if (security_getenforce() > 0) {
-+			log_it(name, getpid(), "getfilecon FAILED", tabname);
-+			freecon(scontext);
-+			return -1;
-+		} else {
-+			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
-+			*rcontext=scontext;
-+			return 0;
-+		}
-+	}
-+    
-+	/*
-+	 * Since crontab files are not directly executed,
-+	 * crond must ensure that the crontab file has
-+	 * a context that is appropriate for the context of
-+	 * the user cron job.  It performs an entrypoint
-+	 * permission check for this purpose.
-+	 */
-+	retval = security_compute_av(scontext,
-+				     file_context,
-+				     SECCLASS_FILE,
-+				     FILE__ENTRYPOINT,
-+				     &avd);
-+	freecon(file_context);
-+	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
-+		if (security_getenforce() > 0) {
-+			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
-+			freecon(scontext);
-+			return -1;
-+		} else {
-+			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
-+		}
-+	}
-+	*rcontext=scontext;
-+	return 0;
-+}
-+#endif
-+
- void
- free_user(user *u) {
- 	entry *e, *ne;
-@@ -37,11 +101,14 @@
- 		ne = e->next;
- 		free_entry(e);
- 	}
-+#ifdef WITH_SELINUX
-+	freecon(u->scontext);
-+#endif	
- 	free(u);
- }
- 
- user *
--load_user(int crontab_fd, struct passwd	*pw, const char *name) {
-+load_user(int crontab_fd, struct passwd	*pw, const char *uname, const char *fname, const char *tabname) {
- 	char envstr[MAX_ENVSTR];
- 	FILE *file;
- 	user *u;
-@@ -60,7 +127,7 @@
- 	 */
- 	if ((u = (user *) malloc(sizeof(user))) == NULL)
- 		return (NULL);
--	if ((u->name = strdup(name)) == NULL) {
-+	if ((u->name = strdup(fname)) == NULL) {
- 		save_errno = errno;
- 		free(u);
- 		errno = save_errno;
-@@ -78,6 +145,22 @@
- 		return (NULL);
- 	}
- 
-+#ifdef WITH_SELINUX
-+	if (is_selinux_enabled() > 0) {
-+		char *sname=uname;
-+		if (pw==NULL) {
-+			sname="system_u";
-+		}
-+
-+		if (get_security_context(sname, crontab_fd, 
-+					 &u->scontext, tabname) != 0) {
-+			free_user(u);
-+			u = NULL;
-+			goto done;
-+		}
-+	}
-+#endif
-+
- 	/* load the crontab
- 	 */
- 	while ((status = load_env(envstr, file)) >= OK) {
---- vixie-cron-4.1/funcs.h.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/funcs.h	2004-07-22 13:19:35.000000000 -0400
-@@ -65,7 +65,7 @@
- 		**env_copy(char **),
- 		**env_set(char **, char *);
- 
--user		*load_user(int, struct passwd *, const char *),
-+user		*load_user(int, struct passwd *, const char *, const char *, const char *),
- 		*find_user(cron_db *, const char *);
- 
- entry		*load_entry(FILE *, void (*)(), struct passwd *, char **);
---- vixie-cron-4.1/structs.h.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/structs.h	2004-07-22 13:25:38.000000000 -0400
-@@ -50,6 +50,9 @@
- 	char		*name;
- 	time_t		mtime;		/* last modtime of crontab */
- 	entry		*crontab;	/* this person's crontab */
-+#ifdef WITH_SELINUX
-+        security_context_t scontext;    /* SELinux security context */
-+#endif
- } user;
- 
- typedef	struct _cron_db {
---- vixie-cron-4.1/do_command.c.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/do_command.c	2004-07-22 13:22:08.000000000 -0400
-@@ -265,6 +265,20 @@
- 				_exit(OK_EXIT);
- 			}
- # endif /*DEBUGGING*/
-+
-+#ifdef WITH_SELINUX
-+			if (is_selinux_enabled() >0 ) {
-+				if (setexeccon(u->scontext) < 0) {
-+					if (security_getenforce() > 0) {
-+						fprintf(stderr, 
-+							"Could not set exec context to %s for user  %s\n", 
-+							u->scontext,u->name);
-+						_exit(ERROR_EXIT);
-+					}
-+				}
-+			}
-+#endif
-+
- 			execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
- 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
- 			perror("execl");
---- vixie-cron-4.1/cron.h.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/cron.h	2004-07-22 13:58:10.000000000 -0400
-@@ -29,6 +29,11 @@
-  */
- 
- #define CRON_VERSION "V5.0"
-+
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
- #include "config.h"
- #include "externs.h"
- #include "pathnames.h"
-@@ -36,3 +41,4 @@
- #include "structs.h"
- #include "funcs.h"
- #include "globals.h"
-+
---- vixie-cron-4.1/database.c.selinux	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/database.c	2004-07-22 14:18:31.000000000 -0400
-@@ -245,7 +245,7 @@
- 		free_user(u);
- 		log_it(fname, getpid(), "RELOAD", tabname);
- 	}
--	u = load_user(crontab_fd, pw, fname);
-+	u = load_user(crontab_fd, pw, uname, fname, tabname);
- 	if (u != NULL) {
- 		u->mtime = statbuf->st_mtime;
- 		link_user(new_db, u);

vixie-cron-4.1-_42-getseuserbyname.patch

@@ -1,36 +0,0 @@
---- vixie-cron-4.1/user.c~	2005-10-14 14:55:17.000000000 -0400
-+++ vixie-cron-4.1/user.c	2005-10-14 15:15:07.000000000 -0400
-@@ -44,15 +44,26 @@
- 	security_context_t  file_context=NULL;
- 	struct av_decision avd;
- 	int retval=0;
-+	char *seuser=NULL;
-+	char *level=NULL;
- 	*rcontext = NULL;
--	if (get_default_context(name, NULL, &scontext)) {
--		if (security_getenforce() > 0) {
--			log_it(name, getpid(), "No SELinux security context",tabname);
--			return -1;
--		} else {
--			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
--			return 0;
-+
-+	if (getseuserbyname(name, &seuser, &level) == 0) {
-+		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
-+		free(seuser);
-+		free(level);
-+		if (retval) {
-+			if (security_getenforce() > 0) {
-+				log_it(name, getpid(), "No SELinux security context",tabname);
-+				return -1;
-+			} else {
-+				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-+				return 0;
-+			}
- 		}
-+	} else {
-+		log_it(name, getpid(), "getseusername FAILED", name);
-+		return (security_getenforce() > 0);
- 	}
- 	
- 	if (fgetfilecon(crontab_fd, &file_context) < OK) {

vixie-cron-4.1-_43-config_comments.patch

@@ -1,52 +0,0 @@
---- vixie-cron-4.1/config.h.config_comments	2005-10-18 13:35:03.099232000 -0400
-+++ vixie-cron-4.1/config.h	2005-10-18 13:38:45.465643000 -0400
-@@ -51,15 +51,15 @@
- 			 */
- #define MAILARG _PATH_SENDMAIL				/*-*/
- 
--/* #define MAILFMT "%s -d %s"				/*-*/
-+/* #define MAILFMT "%s -d %s"				-*/
- 			/* -d = undocumented but common flag: deliver locally?
- 			 */
--/* #define MAILARG "/bin/mail",mailto                   /*-*/
-+/* #define MAILARG "/bin/mail",mailto                   -*/
- 
--/* #define MAILFMT "%s -mlrxto %s"			/*-*/
--/* #define MAILARG "/usr/mmdf/bin/submit",mailto	/*-*/
-+/* #define MAILFMT "%s -mlrxto %s"			-*/
-+/* #define MAILARG "/usr/mmdf/bin/submit",mailto	-*/
- 
--/* #define MAIL_DATE				/*-*/
-+/* #define MAIL_DATE				-*/
- 			/* should we include an ersatz Date: header in
- 			 * generated mail?  if you are using sendmail
- 			 * as the mailer, it is better to let sendmail
-@@ -84,18 +84,18 @@
- 			/* if you want cron to capitalize its name in ps
- 			 * when running a job.  Does not work on SYSV.
- 			 */
--/*#define CAPITALIZE_FOR_PS		/*-*/
-+/*#define CAPITALIZE_FOR_PS		-*/
- 
- 			/* if you have a tm_gmtoff member in struct tm.
- 			 * If not, we will have to compute the value ourselves.
- 			 */
--/*#define HAVE_TM_GMTOFF		/*-*/
-+/*#define HAVE_TM_GMTOFF		-*/
- 
- 			/* if your OS supports a BSD-style login.conf file */
--/*#define LOGIN_CAP			/*-*/
-+/*#define LOGIN_CAP			-*/
- 
- 			/* if your OS supports BSD authentication */
--/*#define BSD_AUTH			/*-*/
-+/*#define BSD_AUTH			-*/
- 
- 			/* Define this to run crontab setgid instead of   
- 			 * setuid root.  Group access will be used to read
-@@ -103,4 +103,4 @@
- 			 * If this is not defined then crontab and at
- 			 * must be setuid root.
- 			 */
--/*#define CRON_GROUP	"crontab"	/*-*/
-+/*#define CRON_GROUP	"crontab"	-*/

vixie-cron-4.1-_44-build_env.patch

@@ -1,10 +0,0 @@
---- vixie-cron-4.1/do_command.c.build_env	2005-10-18 13:41:25.631317000 -0400
-+++ vixie-cron-4.1/do_command.c	2005-10-18 14:02:52.162067000 -0400
-@@ -188,6 +188,7 @@
- 	PAM_FAIL_CHECK;
- 	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
- 	PAM_FAIL_CHECK;
-+	build_env(e->envp);
- 	log_close(); /* PAM has now re-opened our log to auth.info ! */
- #endif
- 

vixie-cron-4.1-_44-delayed_database.patch

@@ -1,20 +0,0 @@
---- vixie-cron-4.1/cron.c.delay	2006-08-25 08:55:33.000000000 +0200
-+++ vixie-cron-4.1/cron.c	2006-08-25 13:30:51.000000000 +0200
-@@ -175,7 +175,8 @@
- 		 * clock.  Classify the change into one of 4 cases.
- 		 */
- 		timeDiff = timeRunning - virtualTime;
--
-+		
-+		load_database(&database);
- 		/* shortcut for the most common case */
- 		if (timeDiff == 1) {
- 			virtualTime = timeRunning;
-@@ -275,7 +276,6 @@
- 			got_sigchld = 0;
- 			sigchld_reaper();
- 		}
--		load_database(&database);
- 	}
- }
- 

vixie-cron-4.1-_45-warnings.patch

@@ -1,173 +0,0 @@
---- vixie-cron-4.1/env.c.warnings	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/env.c	2005-10-18 14:38:49.499570000 -0400
-@@ -48,8 +48,8 @@
- 	int count, i, save_errno;
- 	char **p;
- 
--	for (count = 0; envp[count] != NULL; count++)
--		NULL;
-+	for (count = 0; envp[count] != NULL; count++);
-+
- 	p = (char **) malloc((count+1) * sizeof(char *));  /* 1 for the NULL */
- 	if (p != NULL) {
- 		for (i = 0; i < count; i++)
---- vixie-cron-4.1/misc.c.warnings	2005-10-18 14:38:48.732338000 -0400
-+++ vixie-cron-4.1/misc.c	2005-10-18 14:38:49.520549000 -0400
-@@ -153,7 +153,7 @@
- 		for (test = DebugFlagNames, mask = 1;
- 		     *test != NULL && strcmp_until(*test, pc, ',');
- 		     test++, mask <<= 1)
--			NULL;
-+		    ;
- 
- 		if (!*test) {
- 			fprintf(stderr,
-@@ -255,9 +255,17 @@
- 	}
- 	if (grp != NULL) {
- 		if (sb.st_gid != grp->gr_gid)
--			chown(SPOOL_DIR, -1, grp->gr_gid);
-+		    if( chown(SPOOL_DIR, -1, grp->gr_gid) == -1 )
-+		    {
-+			fprintf(stderr,"chdir %s failed: %s\n", SPOOL_DIR, strerror(errno));
-+			exit(ERROR_EXIT);
-+		    }
- 		if (sb.st_mode != 01730)
--			chmod(SPOOL_DIR, 01730);
-+		    if( chmod(SPOOL_DIR, 01730) == -1 )
-+		    {
-+			fprintf(stderr,"chmod 01730 %s failed: %s\n", SPOOL_DIR, strerror(errno));
-+			exit(ERROR_EXIT);
-+		    }
- 	}
- }
- 
-@@ -275,7 +283,7 @@
- 	const char *pidfile;
- 	char *ep;
- 	long otherpid=-1;
--	ssize_t num;
-+	ssize_t num, len;
- 
- 	if (closeflag) {
- 		/* close stashed fd for child so we don't leak it. */
-@@ -324,8 +332,14 @@
- 
- 	sprintf(buf, "%ld\n", (long)getpid());
- 	(void) lseek(fd, (off_t)0, SEEK_SET);
--	num = write(fd, buf, strlen(buf));
--	(void) ftruncate(fd, num);
-+	len =  strlen(buf);
-+	if( (num = write(fd, buf, len)) != len )
-+	    log_it("CRON", getpid(), "write() failed:", strerror(errno));
-+	else
-+	{	    
-+	    if( ftruncate(fd, num) == -1 )
-+		log_it("CRON", getpid(), "ftruncate() failed:", strerror(errno));
-+	}
- 
- 	/* abandon fd even though the file is open. we need to keep
- 	 * it open and locked, but we don't need the handles elsewhere.
---- vixie-cron-4.1/do_command.c.warnings	2005-10-18 14:38:49.459610000 -0400
-+++ vixie-cron-4.1/do_command.c	2005-10-18 14:38:49.541528000 -0400
-@@ -137,8 +137,17 @@
- 
- 	/* create some pipes to talk to our future child
- 	 */
--	pipe(stdin_pipe);	/* child's stdin */
--	pipe(stdout_pipe);	/* child's stdout */
-+	if( pipe(stdin_pipe) == -1 )	/* child's stdin */
-+	{
-+	    log_it("CRON", getpid(), "pipe() failed:", strerror(errno));
-+	    return;
-+	}
-+
-+	if( pipe(stdout_pipe) == -1 )	/* child's stdout */
-+	{
-+	    log_it("CRON", getpid(), "pipe() failed:", strerror(errno));
-+	    return;
-+	}	
- 	
- 	/* since we are a forked process, we can diddle the command string
- 	 * we were passed -- nobody else is going to use it again, right?
-@@ -318,7 +327,11 @@
- 		setuid(e->pwd->pw_uid);	/* we aren't root after this... */
- 
- #endif /* LOGIN_CAP */
--		chdir(env_get("HOME", e->envp));
-+		if ( chdir(env_get("HOME", e->envp)) == -1 )
-+		{
-+		    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
-+		    _exit(ERROR_EXIT);
-+		}
- 
- 		/*
- 		 * Exec the command.
---- vixie-cron-4.1/pw_dup.c.warnings	2005-10-18 14:38:48.714356000 -0400
-+++ vixie-cron-4.1/pw_dup.c	2005-10-18 14:38:49.561508000 -0400
-@@ -47,7 +47,7 @@
- struct passwd *
- pw_dup(const struct passwd *pw) {
- 	char		*cp;
--	size_t		 nsize=0, psize=0, csize=0, gsize=0, dsize=0, ssize=0, total=0;
-+	size_t		 nsize=0, psize=0, gsize=0, dsize=0, ssize=0, total=0;
- 	struct passwd	*newpw;
- 
- 	/* Allocate in one big chunk for easy freeing */
---- vixie-cron-4.1/crontab.c.warnings	2005-10-18 14:38:49.322747000 -0400
-+++ vixie-cron-4.1/crontab.c	2005-10-18 14:40:57.490451000 -0400
-@@ -283,14 +283,14 @@
- 
- static void
- delete_cmd(void) {
--	char n[MAX_FNAME];
-+        char n[MAX_FNAME]="";
- 	if( PromptOnDelete == 1 )
- 	{
- 	    printf("crontab: really delete %s's crontab? ", User);
- 	    fflush(stdout);
--	    fgets(n, MAX_FNAME-1, stdin);
--	    if((n[0] != 'Y') && (n[0] != 'y'))
--		exit(0);
-+	    if( (fgets(n, MAX_FNAME-1, stdin)==0L)
-+	      ||((n[0] != 'Y') && (n[0] != 'y'))
-+	      )	exit(0);
- 	}
- 
- 	log_it(RealUser, Pid, "DELETE", User);
-@@ -534,7 +534,8 @@
- 			printf("Do you want to retry the same edit? ");
- 			fflush(stdout);
- 			q[0] = '\0';
--			(void) fgets(q, sizeof q, stdin);
-+			if( fgets(q, sizeof q, stdin) == 0L )
-+			    continue;
- 			switch (q[0]) {
- 			case 'y':
- 			case 'Y':
-@@ -575,7 +576,6 @@
- 	int error = 0;
- 	entry *e;
- 	uid_t file_owner;
--	time_t now = time(NULL);
- 	char **envp = env_init();
- 
- 	if (envp == NULL) {
-@@ -618,9 +618,15 @@
- 	Set_LineNum(1)
- 	while (EOF != (ch = get_char(NewCrontab)))
- 		putc(ch, tmp);
--	ftruncate(fileno(tmp), ftell(tmp));	/* XXX redundant with "w+"? */
-+	if( ftruncate(fileno(tmp), ftell(tmp)) == -1 )
-+	{
-+	    fprintf(stderr, "%s: error while writing new crontab to %s\n",
-+		    ProgramName, TempFilename);
-+	    fclose(tmp);
-+	    error = -2;
-+	    goto done;  
-+	}
- 	fflush(tmp);  rewind(tmp);
--
- 	if (ferror(tmp)) {
- 		fprintf(stderr, "%s: error while writing new crontab to %s\n",
- 			ProgramName, TempFilename);

vixie-cron-4.1-_46-audit.patch

@@ -1,49 +0,0 @@
-diff -ur vixie-cron-4.1.orig/Makefile vixie-cron-4.1/Makefile
---- vixie-cron-4.1.orig/Makefile	2005-10-27 13:33:56.000000000 -0400
-+++ vixie-cron-4.1/Makefile	2005-10-27 13:42:37.000000000 -0400
-@@ -60,7 +60,7 @@
- INCLUDE		=	-I.
- #INCLUDE	=
- #<<need getopt()>>
--LIBS		= 	-lselinux -lpam -lpam_misc
-+LIBS		= 	-lselinux -lpam -lpam_misc -laudit
- #<<optimize or debug?>>
- #CDEBUG		=	-O
- #CDEBUG		=	-g
-@@ -70,7 +70,7 @@
- #<<want to use a nonstandard CC?>>
- CC		=	gcc -Wall -Wno-unused -Wno-comment
- #<<manifest defines>>
--DEFS		=	-DWITH_SELINUX -DWITH_PAM
-+DEFS		=	-DWITH_SELINUX -DWITH_PAM -DWITH_AUDIT
- #(SGI IRIX systems need this)
- #DEFS		=	-D_BSD_SIGNALS -Dconst=
- #<<the name of the BSD-like install program>>
-diff -ur vixie-cron-4.1.orig/misc.c vixie-cron-4.1/misc.c
---- vixie-cron-4.1.orig/misc.c	2005-10-27 13:33:56.000000000 -0400
-+++ vixie-cron-4.1/misc.c	2005-10-27 13:41:31.000000000 -0400
-@@ -29,6 +29,9 @@
- 
- #include "cron.h"
- #include <limits.h>
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#endif
- 
- #if defined(SYSLOG) && defined(LOG_FILE)
- # undef LOG_FILE
-@@ -487,6 +490,14 @@
- 		    isallowed = TRUE;
- 		}
- 	}
-+#ifdef WITH_AUDIT
-+	if (isallowed == FALSE) {
-+		int audit_fd = audit_open();
-+		audit_log_user_message(audit_fd, AUDIT_USER_START, "cron deny",
-+			NULL, NULL, NULL, 0);
-+		close(audit_fd);
-+	}
-+#endif
- 	return (isallowed);
- }
- 

vixie-cron-4.1-_47-m_option.patch

@@ -1,99 +0,0 @@
---- vixie-cron-4.1/do_command.c.-m_option	2005-11-13 15:46:37.000000000 -0500
-+++ vixie-cron-4.1/do_command.c	2005-11-13 17:03:34.000000000 -0500
-@@ -508,16 +508,24 @@
- 				char	hostname[MAXHOSTNAMELEN];
- 
- 				gethostname(hostname, MAXHOSTNAMELEN);
--				if (strlens(MAILFMT, MAILARG, NULL) + 1
--				    >= sizeof mailcmd) {
--					fprintf(stderr, "mailcmd too long\n");
--					(void) _exit(ERROR_EXIT);
-+				
-+				if ( MailCmd[0] == '\0' )
-+				{
-+					if (strlens(MAILFMT, MAILARG, NULL) + 1
-+					    >= sizeof mailcmd) {
-+						fprintf(stderr, "mailcmd too long\n");
-+						(void) _exit(ERROR_EXIT);
-+					}
-+					(void)sprintf(mailcmd, MAILFMT, MAILARG);
-+				}else
-+				{
-+					strncpy( mailcmd, MailCmd, MAX_COMMAND );
- 				}
--				(void)sprintf(mailcmd, MAILFMT, MAILARG);
- 				if (!(mail = cron_popen(mailcmd, "w", e->pwd))) {
- 					perror(mailcmd);
- 					(void) _exit(ERROR_EXIT);
- 				}
-+				
- 				fprintf(mail, "From: root (Cron Daemon)\n");
- 				fprintf(mail, "To: %s\n", mailto);
- 				fprintf(mail, "Subject: Cron <%s@%s> %s\n",
---- vixie-cron-4.1/globals.h.-m_option	2005-11-13 15:46:37.000000000 -0500
-+++ vixie-cron-4.1/globals.h	2005-11-13 16:56:16.000000000 -0500
-@@ -65,6 +65,7 @@
- XTRN int	NoFork INIT(0);
- XTRN int        PermitAnyCrontab INIT(0);
- XTRN int        ValidateMailRcpts INIT(0);
-+XTRN char       MailCmd[MAX_COMMAND] INIT("");
- 
- #if DEBUGGING
- XTRN int	DebugFlags INIT(0);
---- vixie-cron-4.1/cron.8.-m_option	2005-11-13 15:46:37.000000000 -0500
-+++ vixie-cron-4.1/cron.8	2005-11-13 17:10:34.000000000 -0500
-@@ -29,6 +29,7 @@
- .IR load_avg ]
- .RB [ \-n ]
- .RB [ \-p ]
-+.RB [ \-m <mail command> ]
- .SH DESCRIPTION
- .I Cron
- should be started from /etc/rc or /etc/rc.local.  It will return immediately,
-@@ -63,6 +64,16 @@
- .IR Crontab (1)
- command updates the modtime of the spool directory whenever it changes a
- crontab.
-+.PP 
-+The
-+.B -m
-+option allows you to specify a shell command string to use for sending
-+cron mail output instead of 
-+.IR sendmail (8).
-+This command must accept a fully
-+formatted mail message (with headers) on stdin and send it as a mail
-+message to the recipients specified in the mail headers.
-+.PP 
- .SS Daylight Saving Time and other time changes
- Local time changes of less than three hours, such as those caused
- by the start or end of Daylight Saving Time, are handled specially.
---- vixie-cron-4.1/cron.c.-m_option	2005-11-13 15:46:37.000000000 -0500
-+++ vixie-cron-4.1/cron.c	2005-11-13 16:58:30.000000000 -0500
-@@ -48,7 +48,7 @@
- usage(void) {
- 	const char **dflags;
- 
--	fprintf(stderr, "usage:  %s [-n] [-p] [-x [", ProgramName);
-+	fprintf(stderr, "usage:  %s [-n] [-p] [-m <mail command>] [-x [", ProgramName);
- 	for (dflags = DebugFlagNames; *dflags; dflags++)
- 		fprintf(stderr, "%s%s", *dflags, dflags[1] ? "," : "]");
- 	fprintf(stderr, "]\n");
-@@ -437,7 +437,7 @@
- parse_args(int argc, char *argv[]) {
- 	int argch;
- 
--	while (-1 != (argch = getopt(argc, argv, "npx:"))) {
-+	while (-1 != (argch = getopt(argc, argv, "npx:m:"))) {
- 		switch (argch) {
- 		default:
- 			usage();
-@@ -451,6 +451,9 @@
- 		case 'p':
- 		        PermitAnyCrontab=1;
- 			break;
-+		case 'm':
-+			strncpy(MailCmd, optarg, MAX_COMMAND);
-+			break;
- 		}
- 	}
- }

vixie-cron-4.1-_48-security.patch

@@ -1,760 +0,0 @@
---- vixie-cron-4.1/popen.c.security	2006-01-10 13:56:39.000000000 -0500
-+++ vixie-cron-4.1/popen.c	2006-01-10 16:56:48.000000000 -0500
-@@ -91,33 +91,6 @@
- 		return (NULL);
- 		/* NOTREACHED */
- 	case 0:				/* child */
--		if (pw) {
--#ifdef LOGIN_CAP
--			if (setusercontext(0, pw, pw->pw_uid, LOGIN_SETALL) < 0) {
--				fprintf(stderr,
--				    "setusercontext failed for %s\n",
--				    pw->pw_name);
--				_exit(ERROR_EXIT);
--			}
--#else
--			if (setgid(pw->pw_gid) < 0 ||
--			    initgroups(pw->pw_name, pw->pw_gid) < 0) {
--				fprintf(stderr,
--				    "unable to set groups for %s\n",
--				    pw->pw_name);
--				_exit(1);
--			}
--#if (defined(BSD)) && (BSD >= 199103)
--			setlogin(pw->pw_name);
--#endif /* BSD */
--			if (setuid(pw->pw_uid)) {
--				fprintf(stderr,
--				    "unable to set uid for %s\n",
--				    pw->pw_name);
--				_exit(1);
--			}
--#endif /* LOGIN_CAP */
--		}
- 		if (*type == 'r') {
- 			if (pdes[1] != STDOUT) {
- 				dup2(pdes[1], STDOUT);
---- vixie-cron-4.1/do_command.c.security	2006-01-10 13:56:40.000000000 -0500
-+++ vixie-cron-4.1/do_command.c	2006-01-10 18:12:20.000000000 -0500
-@@ -25,48 +25,9 @@
- 
- #include "cron.h"
- 
--#ifdef WITH_PAM
--static pam_handle_t *pamh = NULL;
--static const struct pam_conv conv = {
--	NULL
--};
--#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
--	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
--	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
--	pam_close_session(pamh, PAM_SILENT); \
--	pam_end(pamh, retcode); exit(1); \
--   }
--#endif
--
- static void		child_process(entry *, user *);
- static int		safe_p(const char *, const char *);
- 
--/* Build up the job environment from the PAM environment plus the
--   crontab environment */
--static char ** build_env(char **cronenv)
--{
--        char **jobenv = cronenv;
--#if defined(WITH_PAM)
--        char **pamenv = pam_getenvlist(pamh);
--        char *cronvar;
--        int count = 0;
--
--        jobenv = env_copy(pamenv);
--
--        /* Now add the cron environment variables. Since env_set()
--           overwrites existing variables, this will let cron's
--           environment settings override pam's */
--
--        while ((cronvar = cronenv[count++])) {
--                if (!(jobenv = env_set(jobenv, cronvar))) {
--                        syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
--                        return NULL;
--                }
--        }
--#endif
--    return jobenv;
--}
--
- void
- do_command(entry *e, user *u) {
- 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
-@@ -104,10 +65,15 @@
- 	int stdin_pipe[2], stdout_pipe[2];
- 	char *input_data, *usernm, *mailto;
- 	int children = 0; 
--#if defined(WITH_PAM)
--	int		retcode = 0;
--#endif
-+        char **jobenv=0L;
- 
-+	/* Set up the Red Hat security context for both mail/minder and job processes:
-+         */
-+	if ( cron_set_job_security_context( e, u, &jobenv ) != 0 )
-+	{
-+	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set security context", e->pwd->pw_name);
-+	    exit(ERROR_EXIT);
-+	}
- 
- 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
- 
-@@ -126,7 +92,7 @@
- 	/* discover some useful and important environment settings
- 	 */
- 	usernm = e->pwd->pw_name;
--	mailto = env_get("MAILTO", e->envp);
-+	mailto = env_get("MAILTO", jobenv);
- 
- 	/* our parent is watching for our death by catching SIGCHLD.  we
- 	 * do not care to watch for our children's deaths this way -- we
-@@ -186,31 +152,13 @@
- 		*p = '\0';
- 	}
- 
--#if defined(WITH_PAM)
--	retcode = pam_start("crond", usernm, &conv, &pamh);
--	PAM_FAIL_CHECK;
--	retcode = pam_set_item(pamh, PAM_TTY, "cron");
--	PAM_FAIL_CHECK;
--	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
--	PAM_FAIL_CHECK;
--	retcode = pam_open_session(pamh, PAM_SILENT);
--	PAM_FAIL_CHECK;
--	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
--	PAM_FAIL_CHECK;
--	build_env(e->envp);
--	log_close(); /* PAM has now re-opened our log to auth.info ! */
--#endif
- 
- 	/* fork again, this time so we can exec the user's command.
- 	 */
- 	switch (fork()) {
- 	case -1:
- 		log_it("CRON", getpid(), "error", "can't fork");
--#ifdef WITH_PAM
--                pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
--                pam_close_session(pamh, PAM_SILENT);
--                pam_end(pamh, PAM_ABORT);
--#endif
-+		cron_close_security_session();
- 		exit(ERROR_EXIT);
- 		/*NOTREACHED*/
- 	case 0:
-@@ -266,78 +214,12 @@
- 		 */
- 		(void) signal(SIGCHLD, SIG_DFL);
- 
--		/* set our directory, uid and gid.  Set gid first, since once
--		 * we set uid, we've lost root privledges.
--		 */
--#ifdef LOGIN_CAP
--		{
--#ifdef BSD_AUTH
--			auth_session_t *as;
--#endif
--			login_cap_t *lc;
--			char **p;
--			extern char **environ;
--
--			if ((lc = login_getclass(e->pwd->pw_class)) == NULL) {
--				fprintf(stderr,
--				    "unable to get login class for %s\n",
--				    e->pwd->pw_name);
--				_exit(ERROR_EXIT);
--			}
--			if (setusercontext(lc, e->pwd, e->pwd->pw_uid, LOGIN_SETALL) < 0) {
--				fprintf(stderr,
--				    "setusercontext failed for %s\n",
--				    e->pwd->pw_name);
--				_exit(ERROR_EXIT);
--			}
--#ifdef BSD_AUTH
--			as = auth_open();
--			if (as == NULL || auth_setpwd(as, e->pwd) != 0) {
--				fprintf(stderr, "can't malloc\n");
--				_exit(ERROR_EXIT);
--			}
--			if (auth_approval(as, lc, usernm, "cron") <= 0) {
--				fprintf(stderr, "approval failed for %s\n",
--				    e->pwd->pw_name);
--				_exit(ERROR_EXIT);
--			}
--			auth_close(as);
--#endif /* BSD_AUTH */
--			login_close(lc);
--
--			/* If no PATH specified in crontab file but
--			 * we just added one via login.conf, add it to
--			 * the crontab environment.
--			 */
--			if (env_get("PATH", e->envp) == NULL && environ != NULL) {
--				for (p = environ; *p; p++) {
--					if (strncmp(*p, "PATH=", 5) == 0) {
--						e->envp = env_set(e->envp, *p);
--						break;
--					}
--				}
--			}
--		}
--#else
--		setgid(e->pwd->pw_gid);
--		initgroups(usernm, e->pwd->pw_gid);
--#if (defined(BSD)) && (BSD >= 199103)
--		setlogin(usernm);
--#endif /* BSD */
--		setuid(e->pwd->pw_uid);	/* we aren't root after this... */
--
--#endif /* LOGIN_CAP */
--		if ( chdir(env_get("HOME", e->envp)) == -1 )
--		{
--		    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
--		    _exit(ERROR_EXIT);
--		}
- 
- 		/*
- 		 * Exec the command.
- 		 */
- 		{
--			char	*shell = env_get("SHELL", e->envp);
-+			char	*shell = env_get("SHELL", jobenv);
- 
- # if DEBUGGING
- 			if (DebugFlags & DTEST) {
-@@ -349,20 +231,7 @@
- 			}
- # endif /*DEBUGGING*/
- 
--#ifdef WITH_SELINUX
--			if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
--				if (setexeccon(u->scontext) < 0) {
--					if (security_getenforce() > 0) {
--						fprintf(stderr, 
--							"Could not set exec context to %s for user  %s\n", 
--							u->scontext,u->name);
--						_exit(ERROR_EXIT);
--					}
--				}
--			}
--#endif
--
--			execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
-+			execle(shell, shell, "-c", e->cmd, (char *)0, jobenv);
- 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
- 			perror("execl");
- 			_exit(ERROR_EXIT);
-@@ -535,7 +404,7 @@
- 				fprintf(mail, "Date: %s\n",
- 					arpadate(&StartTime));
- #endif /*MAIL_DATE*/
--				for (env = e->envp;  *env;  env++)
-+				for (env = jobenv;  *env;  env++)
- 					fprintf(mail, "X-Cron-Env: <%s>\n",
- 						*env);
- 				fprintf(mail, "\n");
-@@ -616,12 +485,8 @@
- 			Debug(DPROC, (", dumped core"))
- 		Debug(DPROC, ("\n"))
- 	}
--
--#if defined(WITH_PAM)
--	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
--	retcode = pam_close_session(pamh, PAM_SILENT);
--	pam_end(pamh, retcode);
--#endif
-+	cron_close_security_session();
-+	env_free(jobenv);
- }
- 
- static int
---- vixie-cron-4.1/security.c.security	2006-01-10 18:04:21.000000000 -0500
-+++ vixie-cron-4.1/security.c	2006-01-10 17:35:33.000000000 -0500
-@@ -0,0 +1,278 @@
-+/* security.c 
-+ *
-+ * Implement Red Hat crond security context transitions
-+ *
-+ * Jason Vas Dias <jvdias@redhat.com> January 2006
-+ *
-+ * Copyright(C) Red Hat Inc., 2006
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
-+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+
-+#include "cron.h"
-+
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/flask.h>
-+#include <selinux/av_permissions.h>
-+#include <selinux/get_context_list.h>
-+#endif
-+
-+static char ** build_env(char **cronenv);
-+
-+int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
-+{
-+    if ( cron_open_security_session( e->pwd ) != 0 )
-+    {
-+	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
-+	       e->pwd->pw_name, strerror(errno)
-+	      );
-+	return -1;
-+    }
-+    
-+    if ( cron_change_user( e->pwd ) != 0 )
-+    {
-+	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
-+	       e->pwd->pw_name, strerror(errno)
-+	      );
-+	return -1;
-+    }
-+	
-+    if ( cron_change_selinux_context( u ) != 0 )
-+    {
-+        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
-+	       e->pwd->pw_name);
-+	return -1;
-+    }
-+
-+    *jobenv = build_env( e->envp );
-+
-+    if ( chdir(env_get("HOME", *jobenv)) == -1 )
-+    {
-+	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
-+	return -1;
-+    }
-+
-+    return 0;
-+}
-+
-+#ifdef WITH_PAM
-+static pam_handle_t *pamh = NULL;
-+static const struct pam_conv conv = {
-+    NULL
-+};
-+#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) {		\
-+	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode));	\
-+	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode));	\
-+	pam_close_session(pamh, PAM_SILENT);			\
-+	pam_end(pamh, retcode);					\
-+	return(retcode);					\
-+   }
-+#endif
-+
-+int cron_open_security_session( struct passwd *pw )
-+{
-+    int	retcode = 0;
-+
-+#if defined(WITH_PAM)
-+    retcode = pam_start("crond", pw->pw_name, &conv, &pamh);
-+    PAM_FAIL_CHECK;
-+    retcode = pam_set_item(pamh, PAM_TTY, "cron");
-+    PAM_FAIL_CHECK;
-+    retcode = pam_acct_mgmt(pamh, PAM_SILENT);
-+    PAM_FAIL_CHECK;
-+    retcode = pam_open_session(pamh, PAM_SILENT);
-+    PAM_FAIL_CHECK;
-+    retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
-+    PAM_FAIL_CHECK;
-+    log_close(); /* PAM has now re-opened our log to auth.info ! */
-+#endif
-+
-+    return retcode;
-+}
-+
-+void cron_close_security_session( void )
-+{
-+#if defined(WITH_PAM)
-+    pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
-+    pam_close_session(pamh, PAM_SILENT);
-+    pam_end(pamh, PAM_ABORT);
-+#endif
-+}
-+
-+int cron_change_user( struct passwd *pw )
-+{    	
-+    /* set our directory, uid and gid.  Set gid first, since once
-+     * we set uid, we've lost root privledges.
-+     */
-+    if ( setgid( pw->pw_gid ) != 0 )
-+    {
-+	log_it("CRON", getpid(), "setgid failed:", strerror(errno));
-+	return -1;
-+    }
-+
-+    if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
-+    {
-+	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
-+	return -1;	
-+    }
-+
-+    if ( setuid( pw->pw_uid ) != 0 )
-+    {
-+	log_it("CRON", getpid(), "setuid failed:", strerror(errno));
-+	return -1;
-+    }
-+    
-+    return 0;
-+}
-+
-+int cron_change_selinux_context( user *u )
-+{
-+#ifdef WITH_SELINUX
-+    if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
-+	if (setexeccon(u->scontext) < 0) {
-+	    if (security_getenforce() > 0) {
-+		syslog(LOG_INFO,
-+		       "CRON (%s) ERROR:"
-+		       "Could not set exec context to %s for user\n", 
-+		       u->name, u->scontext
-+		      );
-+		return -1;
-+	    }
-+	}
-+    }
-+#endif
-+    return 0;
-+}
-+
-+int get_security_context( const char *name, 
-+			  int crontab_fd, 
-+			  security_context_t *rcontext, 
-+			  const char *tabname) {
-+	security_context_t scontext=NULL;
-+	security_context_t  file_context=NULL;
-+	struct av_decision avd;
-+	int retval=0;
-+	char *seuser=NULL;
-+	char *level=NULL;
-+
-+	*rcontext = NULL;
-+
-+#ifdef WITH_SELINUX
-+
-+	if (is_selinux_enabled() <= 0) 
-+	    return 0;
-+
-+	if (getseuserbyname(name, &seuser, &level) == 0) {
-+		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
-+		free(seuser);
-+		free(level);
-+		if (retval) {
-+			if (security_getenforce() > 0) {
-+				log_it(name, getpid(), "No SELinux security context",tabname);
-+				return -1;
-+			} else {
-+				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-+				return 0;
-+			}
-+		}
-+	} else {
-+		log_it(name, getpid(), "getseusername FAILED", name);
-+		return (security_getenforce() > 0);
-+	}
-+	
-+	if (fgetfilecon(crontab_fd, &file_context) < OK) {
-+		if (security_getenforce() > 0) {
-+			log_it(name, getpid(), "getfilecon FAILED", tabname);
-+			freecon(scontext);
-+			return -1;
-+		} else {
-+			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
-+			*rcontext=scontext;
-+			return 0;
-+		}
-+	}
-+    
-+	/*
-+	 * Since crontab files are not directly executed,
-+	 * crond must ensure that the crontab file has
-+	 * a context that is appropriate for the context of
-+	 * the user cron job.  It performs an entrypoint
-+	 * permission check for this purpose.
-+	 */
-+	retval = security_compute_av(scontext,
-+				     file_context,
-+				     SECCLASS_FILE,
-+				     FILE__ENTRYPOINT,
-+				     &avd);
-+	freecon(file_context);
-+	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
-+		if (security_getenforce() > 0) {
-+			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
-+			freecon(scontext);
-+			return -1;
-+		} else {
-+			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
-+		}
-+	}
-+	*rcontext=scontext;
-+#endif
-+	return 0;
-+}
-+
-+void free_security_context( security_context_t *scontext )
-+{
-+#ifdef WITH_SELINUX
-+    if( *scontext != NULL )
-+    {
-+	freecon(*scontext);
-+	*scontext=0L;
-+    }	    
-+#endif	
-+}
-+
-+int crontab_security_access(void)
-+{
-+#ifdef WITH_SELINUX
-+    if (is_selinux_enabled() > 0)
-+	if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0)
-+	    return -1;
-+#endif
-+    return 0;
-+}
-+
-+/* Build up the job environment from the PAM environment plus the
-+   crontab environment */
-+static char ** build_env(char **cronenv)
-+{
-+    char **jobenv = cronenv;
-+
-+    char **pamenv = pam_getenvlist(pamh);
-+    char *cronvar;
-+    int count = 0;
-+
-+    jobenv = env_copy(pamenv);
-+
-+        /* Now add the cron environment variables. Since env_set()
-+           overwrites existing variables, this will let cron's
-+           environment settings override pam's */
-+
-+    while ((cronvar = cronenv[count++])) {
-+	if (!(jobenv = env_set(jobenv, cronvar))) {
-+	    syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
-+	    return NULL;
-+	}
-+    }
-+
-+    return jobenv;
-+}
---- vixie-cron-4.1/user.c.security	2006-01-10 13:56:40.000000000 -0500
-+++ vixie-cron-4.1/user.c	2006-01-10 17:35:14.000000000 -0500
-@@ -26,85 +26,8 @@
- /* vix 26jan87 [log is in RCS file]
-  */
- 
--#ifdef WITH_SELINUX
--#include <selinux/selinux.h>
--#include <selinux/flask.h>
--#include <selinux/av_permissions.h>
--#include <selinux/get_context_list.h>
--#endif
--
- #include "cron.h"
- 
--#ifdef WITH_SELINUX
--static	int get_security_context(const char *name, 
--				 int crontab_fd, 
--				 security_context_t *rcontext, 
--				 const char *tabname) {
--	security_context_t scontext=NULL;
--	security_context_t  file_context=NULL;
--	struct av_decision avd;
--	int retval=0;
--	char *seuser=NULL;
--	char *level=NULL;
--	*rcontext = NULL;
--
--	if (getseuserbyname(name, &seuser, &level) == 0) {
--		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
--		free(seuser);
--		free(level);
--		if (retval) {
--			if (security_getenforce() > 0) {
--				log_it(name, getpid(), "No SELinux security context",tabname);
--				return -1;
--			} else {
--				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
--				return 0;
--			}
--		}
--	} else {
--		log_it(name, getpid(), "getseusername FAILED", name);
--		return (security_getenforce() > 0);
--	}
--	
--	if (fgetfilecon(crontab_fd, &file_context) < OK) {
--		if (security_getenforce() > 0) {
--			log_it(name, getpid(), "getfilecon FAILED", tabname);
--			freecon(scontext);
--			return -1;
--		} else {
--			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
--			*rcontext=scontext;
--			return 0;
--		}
--	}
--    
--	/*
--	 * Since crontab files are not directly executed,
--	 * crond must ensure that the crontab file has
--	 * a context that is appropriate for the context of
--	 * the user cron job.  It performs an entrypoint
--	 * permission check for this purpose.
--	 */
--	retval = security_compute_av(scontext,
--				     file_context,
--				     SECCLASS_FILE,
--				     FILE__ENTRYPOINT,
--				     &avd);
--	freecon(file_context);
--	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
--		if (security_getenforce() > 0) {
--			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
--			freecon(scontext);
--			return -1;
--		} else {
--			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
--		}
--	}
--	*rcontext=scontext;
--	return 0;
--}
--#endif
--
- void
- free_user(user *u) {
- 	entry *e, *ne;
-@@ -115,10 +38,7 @@
- 		ne = e->next;
- 		free_entry(e);
- 	}
--#ifdef WITH_SELINUX
--	if( u->scontext != NULL )
--	    freecon(u->scontext);
--#endif	
-+	free_security_context(&(u->scontext));
- 	free(u);
- }
- 
-@@ -164,23 +84,14 @@
- 		return (NULL);
- 	}
- 
--#ifdef WITH_SELINUX
--	if (is_selinux_enabled() > 0) {
--		const char *sname=uname;
--		if (pw==NULL) {
--			sname="system_u";
--		}
--
--		if (get_security_context(sname, crontab_fd, 
--					 &u->scontext, tabname) != 0) {
--			free_user(u);
--			u = NULL;
--			goto done;
--		}
--	}else
--	    u->scontext = NULL;
--#endif
--
-+	if (get_security_context(pw == NULL ? "system_u" : uname, 
-+				 crontab_fd, 
-+				 &u->scontext, tabname) != 0) {
-+	    free_user(u);
-+	    u = NULL;
-+	    goto done;
-+	}
-+	
- 	/* load the crontab
- 	 */
- 	while ((status = load_env(envstr, file)) >= OK) {
---- vixie-cron-4.1/funcs.h.security	2006-01-10 13:56:39.000000000 -0500
-+++ vixie-cron-4.1/funcs.h	2006-01-10 17:35:00.000000000 -0500
-@@ -77,3 +77,25 @@
- #ifndef HAVE_TM_GMTOFF
- long		get_gmtoff(time_t *, struct tm *);
- #endif
-+
-+/* Red Hat security stuff (security.c): 
-+ */
-+int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
-+
-+int cron_open_security_session( struct passwd *pw );
-+
-+void cron_close_security_session( void );
-+
-+int cron_change_user( struct passwd *pw );
-+
-+int cron_change_selinux_context( user *u );
-+
-+int get_security_context(const char *name, 
-+			 int crontab_fd, 
-+			 security_context_t *rcontext, 
-+			 const char *tabname
-+                        );
-+
-+void free_security_context( security_context_t *scontext );
-+
-+int crontab_security_access(void);
---- vixie-cron-4.1/crontab.c.security	2006-01-10 13:56:40.000000000 -0500
-+++ vixie-cron-4.1/crontab.c	2006-01-10 17:26:58.000000000 -0500
-@@ -163,15 +163,14 @@
- 					"must be privileged to use -u\n");
- 				exit(ERROR_EXIT);
- 			}
--#ifdef WITH_SELINUX
--			if (is_selinux_enabled() > 0) {
--				if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0) {
--					fprintf(stderr,
--						"Access denied by SELinux, must be privileged to use -u\n");
--					exit(ERROR_EXIT);
--				}
-+			
-+			if( crontab_security_access() != 0 )
-+			{
-+			        fprintf(stderr,
-+				    "Access denied by SELinux, must be privileged to use -u\n");
-+			        exit(ERROR_EXIT);
- 			}
--#endif
-+
- 			if (!(pw = getpwnam(optarg))) {
- 				fprintf(stderr, "%s:  user `%s' unknown\n",
- 					ProgramName, optarg);
---- vixie-cron-4.1/Makefile.security	2006-01-10 13:56:40.000000000 -0500
-+++ vixie-cron-4.1/Makefile	2006-01-10 17:31:13.000000000 -0500
-@@ -88,14 +88,14 @@
- HEADERS		=	bitstring.h cron.h config.h pathnames.h externs.h \
- 			macros.h structs.h funcs.h globals.h
- SOURCES		=	cron.c crontab.c database.c do_command.c entry.c \
--			env.c job.c user.c popen.c misc.c pw_dup.c
-+			env.c job.c user.c popen.c misc.c pw_dup.c security.c
- SHAR_SOURCE	=	$(INFOS) $(MANPAGES) Makefile $(HEADERS) $(SOURCES)
- LINT_CRON	=	cron.c database.c user.c entry.c \
- 			misc.c job.c do_command.c env.c popen.c pw_dup.c
- LINT_CRONTAB	=	crontab.c misc.c entry.c env.c
- CRON_OBJ	=	cron.o database.o user.o entry.o job.o do_command.o \
--			misc.o env.o popen.o pw_dup.o
--CRONTAB_OBJ	=	crontab.o misc.o entry.o env.o pw_dup.o
-+			misc.o env.o popen.o pw_dup.o security.o
-+CRONTAB_OBJ	=	crontab.o misc.o entry.o env.o pw_dup.o security.o
- 
- all		:	cron crontab
- 

vixie-cron-4.1-_49-bz178436.patch

@@ -1,60 +0,0 @@
---- vixie-cron-4.1/security.c.bz178436	2006-01-26 14:26:55.000000000 -0500
-+++ vixie-cron-4.1/security.c	2006-01-26 14:34:23.000000000 -0500
-@@ -32,6 +32,16 @@
- 
- int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
- {
-+    time_t minutely_time = 0;
-+    if((e->flags & MIN_STAR)==MIN_STAR)
-+    {
-+	/* "minute-ly" job: Every minute for given hour/dow/month/dom. 
-+	 * Ensure that these jobs never run in the same minute:
-+	 */
-+	minutely_time = time(0);
-+	Debug(DSCH, ("Minute-ly job. Recording time %lu\n", minutely_time))
-+    }
-+
-     if ( cron_open_security_session( e->pwd ) != 0 )
-     {
- 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
-@@ -57,12 +67,32 @@
- 
-     *jobenv = build_env( e->envp );
- 
-+    log_close();
-+    openlog(ProgramName, LOG_PID, LOG_CRON);
-+
-     if ( chdir(env_get("HOME", *jobenv)) == -1 )
-     {
- 	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
- 	return -1;
-     }
- 
-+    time_t job_run_time = time(0L);
-+
-+    if( (minutely_time > 0)
-+	&&((job_run_time / 60) != (minutely_time / 60))
-+      )
-+    {/* if a per-minute job is delayed into the next minute 
-+      * (eg. by network authentication method timeouts), skip it.
-+      */
-+	struct tm tmS, tmN;
-+	localtime_r(&job_run_time, &tmN);
-+	localtime_r(&minutely_time,&tmS);
-+	syslog(LOG_ERR, 
-+	       "(%s) error: Job execution of per-minute job scheduled for "
-+	       "%.2u:%.2u delayed into subsequent minute %.2u:%.2u. Skipping job run.",
-+	       e->pwd->pw_name, tmS.tm_hour, tmS.tm_min, tmN.tm_hour, tmN.tm_min);
-+	return -1;
-+    }
-     return 0;
- }
- 
-@@ -96,6 +126,7 @@
-     retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
-     PAM_FAIL_CHECK;
-     log_close(); /* PAM has now re-opened our log to auth.info ! */
-+    openlog(ProgramName, LOG_PID, LOG_CRON);
- #endif
- 
-     return retcode;

vixie-cron-4.1-_4_vfork_sigchld.patch

@@ -1,44 +0,0 @@
---- vixie-cron-4.1-rh/do_command.c.vfork_sigchld	2004-07-21 18:40:22.000000000 -0400
-+++ vixie-cron-4.1-rh/do_command.c	2004-07-21 18:19:04.000000000 -0400
-@@ -136,13 +136,13 @@
- 
- 	/* fork again, this time so we can exec the user's command.
- 	 */
--	switch (vfork()) {
-+	switch (fork()) {
- 	case -1:
--		log_it("CRON", getpid(), "error", "can't vfork");
-+		log_it("CRON", getpid(), "error", "can't fork");
- 		exit(ERROR_EXIT);
- 		/*NOTREACHED*/
- 	case 0:
--		Debug(DPROC, ("[%ld] grandchild process vfork()'ed\n",
-+		Debug(DPROC, ("[%ld] grandchild process fork()'ed\n",
- 			      (long)getpid()))
- 
- 		/* write a log message.  we've waited this long to do it
-@@ -187,6 +187,13 @@
- 		}
- 		dup2(STDOUT, STDERR);
- 
-+		/* Our grandparent is watching for our parent's death by
-+		 * catching SIGCHLD. Meanwhile, our parent will use wait
-+		 * explicitly and so has disabled SIGCHLD. So now it's
-+		 * time to reset SIGCHLD handling.
-+		 */
-+		(void) signal(SIGCHLD, SIG_DFL);
-+
- 		/* set our directory, uid and gid.  Set gid first, since once
- 		 * we set uid, we've lost root privledges.
- 		 */
---- vixie-cron-4.1-rh/popen.c.vfork_sigchld	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/popen.c	2004-07-21 18:08:08.000000000 -0400
-@@ -84,7 +84,7 @@
- 			break;
- 	argv[MAX_ARGV-1] = NULL;
- 
--	switch (pid = vfork()) {
-+	switch (pid = fork()) {
- 	case -1:			/* error */
- 		(void)close(pdes[0]);
- 		(void)close(pdes[1]);

vixie-cron-4.1-_50-bz178931.patch

@@ -1,14 +0,0 @@
---- vixie-cron-4.1/crond.pam.bz178931	2006-01-26 14:26:55.000000000 -0500
-+++ vixie-cron-4.1/crond.pam	2006-01-26 14:33:04.000000000 -0500
-@@ -7,10 +7,5 @@
- auth       include    system-auth
- account    required   pam_access.so
- account    include    system-auth
--session    include    system-auth
- session    required   pam_loginuid.so
--# To enable PAM user limits for cron jobs, 
--# configure /etc/security/limits.conf and 
--# uncomment this line:
--# session  required   pam_limits.so
--#
-+session	   required   pam_limits.so

vixie-cron-4.1-_51-bz180145-mail_i18n.patch

@@ -1,138 +0,0 @@
---- vixie-cron-4.1/externs.h.mail_i18n	2004-07-21 09:31:55.000000000 -0400
-+++ vixie-cron-4.1/externs.h	2006-02-07 13:06:46.000000000 -0500
-@@ -61,6 +61,12 @@
- # include <bsd_auth.h>
- #endif /*BSD_AUTH*/
- 
-+/* include locale stuff for mailer "Content-Type": 
-+ */
-+#include <locale.h>
-+#include <nl_types.h>
-+#include <langinfo.h>
-+
- #define DIR_T	struct dirent
- #define WAIT_T	int
- #define SIG_T	sig_t
---- vixie-cron-4.1/cron.c.mail_i18n	2006-01-26 14:41:39.000000000 -0500
-+++ vixie-cron-4.1/cron.c	2006-02-07 13:10:42.000000000 -0500
-@@ -60,6 +60,7 @@
- 	struct sigaction sact;
- 	cron_db	database;
- 	int fd;
-+	char *cs;
- 
- 	ProgramName = argv[0];
- 
-@@ -99,6 +100,16 @@
- 	if ( getenv("CRON_VALIDATE_MAILRCPTS") != 0L )
- 	    ValidateMailRcpts=1;
- 
-+	/* Get the default locale character set for the mail 
-+	 * "Content-Type: ...; charset=" header
-+	 */
-+	setlocale(LC_ALL,""); /* set locale to system defaults or to
-+				 that specified by any  LC_* env vars */
-+	if ( ( cs = nl_langinfo( CODESET ) ) != 0L )
-+	    strncpy( cron_default_mail_charset, cs, MAX_ENVSTR );
-+	else
-+	    strcpy( cron_default_mail_charset, "US-ASCII" );
-+	
- 	/* if there are no debug flags turned on, fork as a daemon should.
- 	 */
- 	if (DebugFlags) {
---- vixie-cron-4.1/do_command.c.mail_i18n	2006-01-26 14:41:39.000000000 -0500
-+++ vixie-cron-4.1/do_command.c	2006-02-07 13:19:27.000000000 -0500
-@@ -375,6 +375,8 @@
- 				char	**env;
- 				char	mailcmd[MAX_COMMAND];
- 				char	hostname[MAXHOSTNAMELEN];
-+				char    *content_type = env_get("CONTENT_TYPE",jobenv),
-+				        *content_transfer_encoding = env_get("CONTENT_TRANSFER_ENCODING",jobenv);
- 
- 				gethostname(hostname, MAXHOSTNAMELEN);
- 				
-@@ -400,10 +402,40 @@
- 				fprintf(mail, "Subject: Cron <%s@%s> %s\n",
- 					usernm, first_word(hostname, "."),
- 					e->cmd);
-+
- #ifdef MAIL_DATE
- 				fprintf(mail, "Date: %s\n",
- 					arpadate(&StartTime));
- #endif /*MAIL_DATE*/
-+				if ( content_type == 0L )
-+				{   
-+					fprintf(mail, "Content-Type: text/plain; charset=%s\n",
-+						cron_default_mail_charset
-+					       );
-+				}else
-+				{       /* user specified Content-Type header. 
-+					 * disallow new-lines for security reasons 
-+					 * (else users could specify arbitrary mail headers!)
-+					 */
-+					char *nl=content_type;
-+					size_t ctlen = strlen(content_type);				    
-+					while(  (*nl != '\0') 
-+					     && ((nl=strchr(nl,'\n')) != 0L)
-+					     && (nl < (content_type+ctlen)) 
-+					     ) *nl = ' ';
-+					fprintf(mail,"Content-Type: %s\n", content_type);
-+				}
-+				if ( content_transfer_encoding != 0L )
-+				{
-+					char *nl=content_transfer_encoding;
-+					size_t ctlen = strlen(content_transfer_encoding);
-+					while(  (*nl != '\0') 
-+					     && ((nl=strchr(nl,'\n')) != 0L)
-+					     && (nl < (content_transfer_encoding+ctlen))
-+					     ) *nl = ' ';				
-+					fprintf(mail,"Content-Transfer-Encoding: %s\n", content_transfer_encoding);
-+				}
-+
- 				for (env = jobenv;  *env;  env++)
- 					fprintf(mail, "X-Cron-Env: <%s>\n",
- 						*env);
---- vixie-cron-4.1/crontab.5.mail_i18n	2006-01-26 14:41:39.000000000 -0500
-+++ vixie-cron-4.1/crontab.5	2006-02-07 13:34:42.000000000 -0500
-@@ -61,7 +61,7 @@
- .IR cron (8)
- daemon.
- SHELL is set to /bin/sh, and LOGNAME and HOME are set from the /etc/passwd 
--line of the crontab's owner.
-+line of the crontab\'s owner.
- HOME and SHELL may be overridden by settings in the crontab; LOGNAME may not.
- .PP
- (Another note: the LOGNAME variable is sometimes called USER on BSD systems...
-@@ -74,8 +74,18 @@
- sent to the user so named.  If MAILTO is defined but empty (MAILTO=""), no
- mail will be sent.  Otherwise mail is sent to the owner of the crontab.  This
- option is useful if you decide on /bin/mail instead of /usr/lib/sendmail as
--your mailer when you install cron -- /bin/mail doesn't do aliasing, and UUCP
--usually doesn't read its mail.
-+your mailer when you install cron -- /bin/mail doesn\'t do aliasing, and UUCP
-+usually doesn\'t read its mail.
-+.PP
-+By default, cron will send mail using the mail 'Content-Type:' header of 'text/plain' with the 'charset=' parameter set to the charmap / codeset of the locale in which 
-+.IR crond(8)
-+is started up - ie. either the default system locale, if no LC_* environment
-+variables are set, or the locale specified by the LC_* environment variables
-+( see 
-+.IR locale(7) ). 
-+You can use different character encodings for mailed cron job output by 
-+setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
-+to the correct values of the mail headers of those names.  
- .PP
- The format of a cron command is very much the V7 standard, with a number of
- upward-compatible extensions.  Each line has five time and date fields,
---- vixie-cron-4.1/globals.h.mail_i18n	2006-01-26 14:41:39.000000000 -0500
-+++ vixie-cron-4.1/globals.h	2006-02-07 12:46:34.000000000 -0500
-@@ -66,7 +66,8 @@
- XTRN int        PermitAnyCrontab INIT(0);
- XTRN int        ValidateMailRcpts INIT(0);
- XTRN char       MailCmd[MAX_COMMAND] INIT("");
--
-+XTRN char       cron_default_mail_charset[MAX_ENVSTR] INIT("");
-+ 
- #if DEBUGGING
- XTRN int	DebugFlags INIT(0);
- XTRN const char *DebugFlagNames[]

vixie-cron-4.1-_52-bz181439.patch

@@ -1,101 +0,0 @@
---- vixie-cron-4.1/security.c.bz181439	2006-02-14 16:16:49.000000000 -0500
-+++ vixie-cron-4.1/security.c	2006-02-14 16:16:54.000000000 -0500
-@@ -190,6 +190,7 @@
- 			  int crontab_fd, 
- 			  security_context_t *rcontext, 
- 			  const char *tabname) {
-+#ifdef WITH_SELINUX
- 	security_context_t scontext=NULL;
- 	security_context_t  file_context=NULL;
- 	struct av_decision avd;
-@@ -199,8 +200,6 @@
- 
- 	*rcontext = NULL;
- 
--#ifdef WITH_SELINUX
--
- 	if (is_selinux_enabled() <= 0) 
- 	    return 0;
- 
-@@ -286,14 +285,14 @@
-    crontab environment */
- static char ** build_env(char **cronenv)
- {
-+#ifdef WITH_PAM
-     char **jobenv = cronenv;
--
-     char **pamenv = pam_getenvlist(pamh);
-     char *cronvar;
-     int count = 0;
--
-     jobenv = env_copy(pamenv);
- 
-+
-         /* Now add the cron environment variables. Since env_set()
-            overwrites existing variables, this will let cron's
-            environment settings override pam's */
-@@ -304,6 +303,8 @@
- 	    return NULL;
- 	}
-     }
--
--    return jobenv;
-+    return jobenv;    
-+#else
-+    return env_copy(cronenv);
-+#endif
- }
---- vixie-cron-4.1/Makefile.bz181439	2006-02-14 16:16:49.000000000 -0500
-+++ vixie-cron-4.1/Makefile	2006-02-14 16:16:50.000000000 -0500
-@@ -60,7 +60,19 @@
- INCLUDE		=	-I.
- #INCLUDE	=
- #<<need getopt()>>
--LIBS		= 	-lselinux -lpam -lpam_misc -laudit
-+ifdef WITH_SELINUX
-+SELINUX_LIBS=-lselinux
-+SELINUX_DEFS=-DWITH_SELINUX
-+endif
-+ifdef WITH_PAM
-+PAM_LIBS=-lpam -lpam_misc
-+PAM_DEFS=-DWITH_PAM
-+endif
-+ifdef WITH_AUDIT
-+AUDIT_LIBS=-laudit
-+AUDIT_DEFS=-DWITH_AUDIT
-+endif
-+LIBS		=       $(SELINUX_LIBS) $(PAM_LIBS) $(AUDIT_LIBS)
- #<<optimize or debug?>>
- #CDEBUG		=	-O
- #CDEBUG		=	-g
-@@ -70,7 +82,7 @@
- #<<want to use a nonstandard CC?>>
- CC		=	gcc -Wall -Wno-unused -Wno-comment
- #<<manifest defines>>
--DEFS		=	-DWITH_SELINUX -DWITH_PAM -DWITH_AUDIT
-+DEFS		=	$(SELINUX_DEFS) $(PAM_DEFS) $(AUDIT_DEFS)
- #(SGI IRIX systems need this)
- #DEFS		=	-D_BSD_SIGNALS -Dconst=
- #<<the name of the BSD-like install program>>
---- vixie-cron-4.1/structs.h.bz181439	2006-02-14 16:16:49.000000000 -0500
-+++ vixie-cron-4.1/structs.h	2006-02-14 16:16:50.000000000 -0500
-@@ -44,6 +44,9 @@
- 			 *
- 			 * These are the crontabs.
- 			 */
-+#ifndef WITH_SELINUX
-+#define security_context_t unsigned
-+#endif
- 
- typedef	struct _user {
- 	struct _user	*next, *prev;	/* links */
-@@ -51,9 +54,7 @@
-         char            *tabname;       /* /etc/cron.d/ file name or NULL */
- 	time_t		mtime;		/* last modtime of crontab */
- 	entry		*crontab;	/* this person's crontab */
--#ifdef WITH_SELINUX
-         security_context_t scontext;    /* SELinux security context */
--#endif        
- } user;
- 
- typedef	struct _cron_db {

vixie-cron-4.1-_52-bz181439_2.patch

@@ -1,21 +0,0 @@
---- vixie-cron-4.1/security.c.bz181439p2	2006-08-30 08:31:44.000000000 +0200
-+++ vixie-cron-4.1/security.c	2006-08-30 08:31:44.000000000 +0200
-@@ -78,17 +78,15 @@
- 	return -1;
-     }	
- 
-+#if WITH_SELINUX
-     if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
-     {
-         syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
- 	       e->pwd->pw_name);
--#if WITH_SELINUX
- 	if ( file_context )
- 		freecon(file_context);
--#endif
- 	return -1;
-     }
--#if WITH_SELINUX
-     if ( file_context )
- 	freecon(file_context);
- #endif

vixie-cron-4.1-_53_bz199294_selinux_mls.patch

@@ -1,437 +0,0 @@
---- vixie-cron-4.1/crontab.c.selinux_mls	2006-07-20 22:05:13.000000000 -0400
-+++ vixie-cron-4.1/crontab.c	2006-07-20 22:05:13.000000000 -0400
-@@ -43,10 +43,19 @@
- 
- #if DEBUGGING
- static char	*Options[] = { "???", "list", "delete", "edit", "replace" };
-+#   ifdef WITH_SELINUX
-+static char	*getoptargs = "u:lerisx:";
-+#   else
- static char	*getoptargs = "u:lerix:";
-+#   endif
- #else
-+#   ifdef WITH_SELINUX
-+static char	*getoptargs = "u:leris";
-+#   else
- static char	*getoptargs = "u:leri";
-+#   endif
- #endif
-+static char     *selinux_context = 0;
- 
- static	PID_T		Pid;
- static	char		User[MAX_UNAME], RealUser[MAX_UNAME];
-@@ -75,6 +84,9 @@
- 	fprintf(stderr, "\t-l\t(list user's crontab)\n");
- 	fprintf(stderr, "\t-r\t(delete user's crontab)\n");
- 	fprintf(stderr, "\t-i\t(prompt before deleting user's crontab)\n");
-+#ifdef WITH_SELINUX
-+	fprintf(stderr, "\t-s\t(selinux context)\n");
-+#endif
- 	exit(ERROR_EXIT);
- }
- 
-@@ -198,6 +210,16 @@
- 		case 'i':
-        		        PromptOnDelete = 1;
- 			break;
-+#ifdef WITH_SELINUX
-+	        case 's':
-+		        if ( getprevcon( (security_context_t*)&(selinux_context) ) ) 
-+			{
-+				fprintf(stderr,
-+					"Cannot obtain SELinux process context\n");
-+				exit(ERROR_EXIT);
-+			}
-+			break;
-+#endif 
- 		default:
- 			usage("unrecognized option");
- 		}
-@@ -317,7 +339,7 @@
- edit_cmd(void) {
- 	char n[MAX_FNAME], q[MAX_TEMPSTR], *editor;
- 	FILE *f;
--	int ch='\0', t, x;
-+	int ch='\0', t;
- 	struct stat statbuf;
- 	struct utimbuf utimebuf;
- 	WAIT_T waiter;
-@@ -379,26 +401,25 @@
- 	}
- 
- 	Set_LineNum(1)
--
--	/* ignore the top NHEADER_LINES comment lines since we put them there.
-+	/* 
-+	 * NHEADER_LINES processing removed for clarity
-+	 * (NHEADER_LINES == 0 in all Red Hat crontabs)
- 	 */
--	x = 0;
--	while ((x < NHEADER_LINES) && (EOF != (ch = get_char(f)))) {
--		if ('#' != ch) {
--			putc(ch, NewCrontab);
--			break;
--		}
--		while (EOF != (ch = get_char(f)))
--			if (ch == '\n')
--				break;
--		++x;
--	}
--
-+	
- 	/* copy the rest of the crontab (if any) to the temp file.
- 	 */
- 	if (EOF != ch)
- 		while (EOF != (ch = get_char(f)))
- 			putc(ch, NewCrontab);
-+
-+#ifdef WITH_SELINUX
-+	if ( selinux_context )
-+	{
-+		fprintf(NewCrontab,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
-+		selinux_context = 0;
-+	}
-+#endif
-+
- 	fclose(f);
- 	if (fflush(NewCrontab) < OK) {
- 		perror(Filename);
-@@ -610,6 +631,10 @@
- 	 *fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
- 	 *fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
- 	 */
-+#ifdef WITH_SELINUX
-+	if ( selinux_context )
-+		fprintf(tmp,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
-+#endif
- 
- 	/* copy the crontab to the tmp
- 	 */
---- vixie-cron-4.1/funcs.h.selinux_mls	2006-07-20 22:05:13.000000000 -0400
-+++ vixie-cron-4.1/funcs.h	2006-07-20 22:05:13.000000000 -0400
-@@ -88,7 +88,9 @@
- 
- int cron_change_user( struct passwd *pw );
- 
--int cron_change_selinux_context( user *u );
-+int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **envp );
-+
-+int cron_change_selinux_context( user *, void *scontext, void *file_context );
- 
- int get_security_context(const char *name, 
- 			 int crontab_fd, 
---- vixie-cron-4.1/crontab.1.selinux_mls	2006-07-20 22:05:13.000000000 -0400
-+++ vixie-cron-4.1/crontab.1	2006-07-20 22:05:13.000000000 -0400
-@@ -32,6 +32,7 @@
- .RB [ -u
- .IR user ]
- .RB [ -l " | " -r " | " -e ] [ -i ]
-+.RB [ -s ]
- .SH DESCRIPTION
- .I Crontab
- is the program used to install, deinstall or list the tables
-@@ -89,6 +90,13 @@
- .I -i
- option modifies the -r option to prompt the user for a 'y/Y' response
- before actually removing the crontab.
-+.PP
-+The
-+.I -s
-+option will append the current SELinux security context string as an
-+SELINUX_ROLE_TYPE setting to the crontab file before editing / replacement
-+occurs - see the documentation of SELINUX_ROLE_TYPE in 
-+.IR crontab(5) .
- .SH "SEE ALSO"
- crontab(5), cron(8)
- .SH FILES
---- vixie-cron-4.1/crontab.5.selinux_mls	2006-07-20 22:05:13.000000000 -0400
-+++ vixie-cron-4.1/crontab.5	2006-07-20 22:05:13.000000000 -0400
-@@ -87,6 +87,19 @@
- setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
- to the correct values of the mail headers of those names.  
- .PP
-+The SELINUX_ROLE_TYPE environment variable provides support for multiple per-job 
-+SELinux security contexts in the same crontab.
-+By default, cron jobs execute with the default SELinux security context of the 
-+user that created the crontab file.
-+When using multiple security levels and roles, this may not be sufficient, because
-+the same user may be running in a different role or at a different security level.
-+You can set SELINUX_ROLE_TYPE to the SELinux security context string specifying
-+the SELinux security context in which you want the job to run, and crond will set 
-+the execution context of the or jobs to which the setting applies to the specified 
-+context.
-+See also the 
-+.IR crontab(1) -s option.
-+.PP
- The format of a cron command is very much the V7 standard, with a number of
- upward-compatible extensions.  Each line has five time and date fields,
- followed by a user name if this is the system crontab file,
---- vixie-cron-4.1/security.c.selinux_mls	2006-07-20 22:05:13.000000000 -0400
-+++ vixie-cron-4.1/security.c	2006-07-20 22:15:31.000000000 -0400
-@@ -49,23 +49,49 @@
- 	      );
- 	return -1;
-     }
--    
-+
-+    *jobenv = build_env( e->envp );
-+
-+#ifdef WITH_SELINUX
-+
-+    /* we must get the crontab context BEFORE changing user, else
-+     * we'll not be permitted to read the cron spool directory :-)
-+     */
-+
-+    security_context_t scontext=0, file_context=0; 
-+
-+    if ( cron_get_job_context(u, &scontext, &file_context, *jobenv) < OK )
-+    {
-+	syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
-+	       e->pwd->pw_name, strerror(errno)
-+	      );
-+	return -1;
-+    }
-+
-+#endif
-+
-     if ( cron_change_user( e->pwd ) != 0 )
-     {
- 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
- 	       e->pwd->pw_name, strerror(errno)
- 	      );
- 	return -1;
--    }
--	
--    if ( cron_change_selinux_context( u ) != 0 )
-+    }	
-+
-+    if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
-     {
-         syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
- 	       e->pwd->pw_name);
-+#if WITH_SELINUX
-+	if ( file_context )
-+		freecon(file_context);
-+#endif
- 	return -1;
-     }
--
--    *jobenv = build_env( e->envp );
-+#if WITH_SELINUX
-+    if ( file_context )
-+	freecon(file_context);
-+#endif
- 
-     log_close();
-     openlog(ProgramName, LOG_PID, LOG_CRON);
-@@ -167,23 +193,145 @@
-     return 0;
- }
- 
--int cron_change_selinux_context( user *u )
-+static int 
-+cron_authorize_context
-+( 
-+	security_context_t scontext,
-+	security_context_t file_context
-+)	
- {
- #ifdef WITH_SELINUX
--    if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
--	if (setexeccon(u->scontext) < 0) {
--	    if (security_getenforce() > 0) {
--		syslog(LOG_INFO,
--		       "CRON (%s) ERROR:"
--		       "Could not set exec context to %s for user\n", 
--		       u->name, u->scontext
--		      );
-+	struct av_decision avd;
-+	int retval;
-+	/*
-+	 * Since crontab files are not directly executed,
-+	 * crond must ensure that the crontab file has
-+	 * a context that is appropriate for the context of
-+	 * the user cron job.  It performs an entrypoint
-+	 * permission check for this purpose.
-+	 */
-+	retval = security_compute_av(scontext,
-+				     file_context,
-+				     SECCLASS_FILE,
-+				     FILE__ENTRYPOINT,
-+				     &avd);
-+
-+	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT))
-+		return 0;
-+#endif
-+	return 1;
-+}
-+
-+int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **jobenv )
-+{
-+#if WITH_SELINUX
-+	char *sroletype;
-+
-+	if ( is_selinux_enabled() <= 0 )
-+		return 0;
-+	if ( (file_contextp == 0) || (scontextp == 0L) )
- 		return -1;
--	    }
-+
-+	*((security_context_t*)scontextp) = u->scontext;
-+	*((void **)file_contextp) = 0L;
-+
-+	if ( (sroletype = env_get("SELINUX_ROLE_TYPE",jobenv)) != 0L )
-+	{
-+	        *((security_context_t*)scontextp) = (security_context_t) sroletype;
-+		
-+		char crontab[MAX_FNAME];
-+		if ( strcmp(u->name,"*system*") == 0 )
-+			strncpy(crontab, u->tabname, MAX_FNAME);
-+		else
-+			snprintf(crontab, MAX_FNAME, "%s/%s", CRONDIR, u->tabname);
-+
-+		if ( getfilecon( crontab, file_contextp ) == -1 )
-+		{		
-+			if ( security_getenforce() > 0 ) 
-+			{
-+				log_it(u->name, 
-+				       getpid(), "getfilecon FAILED for SELINUX_ROLE_TYPE", 
-+				       sroletype
-+				      );
-+				return -1;
-+			} else
-+			if ( access( crontab, F_OK ) == 0 )
-+				log_it(u->name,
-+				       getpid(), 
-+				       "getfilecon FAILED but SELinux in permissive mode, continuing "
-+				       "- SELINUX_ROLE_TYPE=", sroletype
-+				       );
-+		}		       
- 	}
--    }
- #endif
--    return 0;
-+	return 0;
-+}
-+
-+int cron_change_selinux_context( user *u, void *scontext, void *file_context )
-+{
-+#ifdef WITH_SELINUX
-+	if ( is_selinux_enabled() <= 0 )
-+		return 0;
-+
-+	if ( scontext == 0L )
-+	{
-+		if (security_getenforce() > 0) 
-+		{
-+			log_it( u->name, getpid(), 
-+				"NULL security context for user", 
-+				""
-+			      );
-+			return -1;
-+		}else
-+		{
-+			log_it( u->name, getpid(), 
-+				"NULL security context for user, "
-+				"but SELinux in permissive mode, continuing",
-+				""
-+				);
-+			return 0;
-+		}
-+	}
-+	
-+	if ( file_context )
-+	{		
-+		if ( ! cron_authorize_context( scontext, file_context ) )
-+		{
-+			if ( security_getenforce() > 0 ) 
-+			{
-+				syslog(LOG_ERR,
-+				       "CRON (%s) ERROR:"
-+				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user", 
-+				       u->name, (char*)scontext
-+				      );
-+				return -1;
-+			} else
-+			{
-+				syslog(LOG_INFO,
-+				       "CRON (%s) WARNING:"
-+				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user,"
-+				       " but SELinux in permissive mode, continuing", 
-+				       u->name, (char*)scontext
-+				      );
-+			}
-+		}
-+	} 
-+
-+	if ( setexeccon(scontext) < 0 ) 
-+	{
-+		if (security_getenforce() > 0) 
-+		{
-+			syslog(LOG_ERR,
-+			       "CRON (%s) ERROR:"
-+			       "Could not set exec context to %s for user", 
-+			       u->name, (char*)scontext
-+			      );
-+
-+			return -1;
-+		}
-+	}
-+#endif
-+	return 0;
- }
- 
- int get_security_context( const char *name, 
-@@ -192,8 +340,7 @@
- 			  const char *tabname) {
- #ifdef WITH_SELINUX
- 	security_context_t scontext=NULL;
--	security_context_t  file_context=NULL;
--	struct av_decision avd;
-+	security_context_t file_context=NULL;
- 	int retval=0;
- 	char *seuser=NULL;
- 	char *level=NULL;
-@@ -233,28 +380,24 @@
- 		}
- 	}
-     
--	/*
--	 * Since crontab files are not directly executed,
--	 * crond must ensure that the crontab file has
--	 * a context that is appropriate for the context of
--	 * the user cron job.  It performs an entrypoint
--	 * permission check for this purpose.
--	 */
--	retval = security_compute_av(scontext,
--				     file_context,
--				     SECCLASS_FILE,
--				     FILE__ENTRYPOINT,
--				     &avd);
--	freecon(file_context);
--	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
-+	if ( ! cron_authorize_context( scontext, file_context ) )
-+	{
-+		freecon(scontext);
-+		freecon(file_context);
- 		if (security_getenforce() > 0) {
--			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
--			freecon(scontext);
-+			log_it(name, getpid(), "Unauthorized SELinux context", tabname);
- 			return -1;
--		} else {
--			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
-+		} else
-+		{
-+			log_it(name, getpid(), 
-+			       "Unauthorized SELinux context, but SELinux in permissive mode, continuing",
-+			       tabname
-+			      );
-+			return  0;
- 		}
- 	}
-+	freecon(file_context);
-+
- 	*rcontext=scontext;
- #endif
- 	return 0;

vixie-cron-4.1-_54_bz198019_database_changes.patch

@@ -1,181 +0,0 @@
---- vixie-cron-4.1/database.c.bz198019	2006-07-20 21:42:01.000000000 -0400
-+++ vixie-cron-4.1/database.c	2006-07-20 21:46:51.000000000 -0400
-@@ -34,6 +34,12 @@
- 					const char *, struct stat *,
- 					cron_db *, cron_db *);
- 
-+static int not_a_crontab( DIR_T *dp ); 
-+/* return 1 if we should skip this file */
-+
-+static void max_mtime( char *dir_name, struct stat *max_st ); 
-+/* record max mtime of any file under dir_name in max_st */
-+
- void
- load_database(cron_db *old_db) {
- 	struct stat statbuf, syscron_stat, crond_stat;
-@@ -52,12 +58,20 @@
- 		log_it("CRON", getpid(), "STAT FAILED", SPOOL_DIR);
- 		(void) exit(ERROR_EXIT);
- 	}
-+	
-+	/* As pointed out in Red Hat bugzilla 198019, with modern Linux it
-+	 * is possible to modify a file without modifying the mtime of the
-+         * containing directory. Hence, we must check the mtime of each file:
-+         */
-+	max_mtime(SPOOL_DIR, &statbuf);
- 
- 	if (stat(RH_CROND_DIR, &crond_stat) < OK) {
- 		log_it("CRON", getpid(), "STAT FAILED", RH_CROND_DIR);
- 		(void) exit(ERROR_EXIT);
- 	}
- 
-+	max_mtime(RH_CROND_DIR, &crond_stat);
-+
- 	/* track system crontab file
- 	 */
- 	if (stat(SYSCRONTAB, &syscron_stat) < OK)
-@@ -97,40 +111,12 @@
- 	}
- 
- 	while (NULL != (dp = readdir(dir))) {
--		char	fname[MAXNAMLEN+1],
--			tabname[MAXNAMLEN+1];
--		size_t len;
--
--		/* avoid file names beginning with ".".  this is good
--		 * because we would otherwise waste two guaranteed calls
--		 * to getpwnam() for . and .., and there shouldn't be 
--		 * hidden files in here anyway
--		 */
--		if (dp->d_name[0] == '.')
--			continue;
--
--		/* ignore files starting with # and ending with ~ */
--		if (dp->d_name[0] == '#')
--			continue;
--		
--		len = strlen(dp->d_name);
--
--		if (len >= sizeof fname)
--			continue;	/* XXX log? */
--
--		if ((len > 0) && (dp->d_name[len - 1] == '~'))
--			continue;
-+		char   tabname[MAXNAMLEN+1];
- 
--		(void) strcpy(fname, dp->d_name);
--		
--		if ((len > 8) && (strncmp(fname + len - 8, ".rpmsave", 8) == 0))
--			continue;
--		if ((len > 8) && (strncmp(fname + len - 8, ".rpmorig", 8) == 0))
--			continue;
--		if ((len > 7) && (strncmp(fname + len - 7, ".rpmnew", 7) == 0))
-+		if ( not_a_crontab( dp ) )
- 			continue;
- 
--		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
-+		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, dp->d_name, '/'))
- 			continue;	/* XXX log? */
- 
- 		process_crontab("root", NULL, tabname,
-@@ -142,6 +128,7 @@
- 	 * efficiency.  however, we need to close it in every fork, and
- 	 * we fork a lot more often than the mtime of the dir changes.
- 	 */
-+
- 	if (!(dir = opendir(SPOOL_DIR))) {
- 		log_it("CRON", getpid(), "OPENDIR FAILED", SPOOL_DIR);
- 		(void) exit(ERROR_EXIT);
-@@ -150,20 +137,12 @@
- 	while (NULL != (dp = readdir(dir))) {
- 		char fname[MAXNAMLEN+1], tabname[MAXNAMLEN+1];
- 
--		/* avoid file names beginning with ".".  this is good
--		 * because we would otherwise waste two guaranteed calls
--		 * to getpwnam() for . and .., and also because user names
--		 * starting with a period are just too nasty to consider.
--		 */
--		if (dp->d_name[0] == '.')
-+		if ( not_a_crontab( dp ) )
- 			continue;
- 
--		if (strlen(dp->d_name) >= sizeof fname)
--			continue;	/* XXX log? */
--		(void) strcpy(fname, dp->d_name);
--		
--		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR,
--				  fname, '/'))
-+		strncpy(fname, dp->d_name, MAXNAMLEN);
-+
-+		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, fname, '/'))
- 			continue;	/* XXX log? */
- 
- 		process_crontab(fname, fname, tabname,
-@@ -322,3 +301,67 @@
- 		close(crontab_fd);
- 	}
- }
-+
-+static int not_a_crontab( DIR_T *dp )
-+{
-+	int len;
-+
-+	/* avoid file names beginning with ".".  this is good
-+	 * because we would otherwise waste two guaranteed calls
-+	 * to getpwnam() for . and .., and there shouldn't be 
-+	 * hidden files in here anyway
-+	 */
-+	if (dp->d_name[0] == '.')
-+		return(1);
-+
-+	/* ignore files starting with # and ending with ~ */
-+	if (dp->d_name[0] == '#')
-+		return(1);
-+
-+	len = strlen(dp->d_name);
-+
-+	if (len >= MAXNAMLEN)
-+		return(1);	/* XXX log? */
-+
-+	if ((len > 0) && (dp->d_name[len - 1] == '~'))
-+		return(1);
-+
-+	if ((len > 8) && (strncmp(dp->d_name + len - 8, ".rpmsave", 8) == 0))
-+		return(1);
-+	if ((len > 8) && (strncmp(dp->d_name + len - 8, ".rpmorig", 8) == 0))
-+		return(1);
-+	if ((len > 7) && (strncmp(dp->d_name + len - 7, ".rpmnew", 7) == 0))
-+		return(1);
-+
-+	return(0);
-+}
-+
-+static void max_mtime( char *dir_name, struct stat *max_st )
-+{
-+	DIR * dir;
-+	DIR_T *dp;
-+	struct stat st;
-+
-+	if (!(dir = opendir(dir_name))) {
-+		log_it("CRON", getpid(), "OPENDIR FAILED", dir_name);
-+		(void) exit(ERROR_EXIT);
-+	}
-+
-+	while (NULL != (dp = readdir(dir))) 
-+	{
-+		char tabname[MAXNAMLEN+1];
-+
-+		if ( not_a_crontab ( dp ) )
-+			continue;
-+
-+		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, dp->d_name, '/'))
-+			continue;	/* XXX log? */
-+
-+		if ( stat( tabname, &st ) < OK )
-+			continue;       /* XXX log? */
-+		
-+		if ( st.st_mtime > max_st->st_mtime )
-+			max_st->st_mtime = st.st_mtime;		
-+	}
-+	closedir(dir);
-+}

vixie-cron-4.1-_55-bz203746.patch

@@ -1,14 +0,0 @@
---- vixie-cron-4.1/do_command.c.rfc3834	2006-08-23 11:19:19.000000000 -0400
-+++ vixie-cron-4.1/do_command.c	2006-08-23 11:19:19.000000000 -0400
-@@ -436,6 +436,11 @@
- 					fprintf(mail,"Content-Transfer-Encoding: %s\n", content_transfer_encoding);
- 				}
- 
-+				/* The Auto-Submitted header is
-+				 * defined (and suggested by) RFC3834.
-+				 */
-+				fprintf(mail, "Auto-Submitted: auto-generated\n");
-+
- 				for (env = jobenv;  *env;  env++)
- 					fprintf(mail, "X-Cron-Env: <%s>\n",
- 						*env);

vixie-cron-4.1-_56-pam-session-system-auth.patch

@@ -1,8 +0,0 @@
---- vixie-cron-4.1/crond.pam.session-system-auth	2006-09-05 12:54:14.000000000 +0200
-+++ vixie-cron-4.1/crond.pam	2006-09-05 12:55:51.000000000 +0200
-@@ -8,4 +8,4 @@
- account    required   pam_access.so
- account    include    system-auth
- session    required   pam_loginuid.so
--session	   required   pam_limits.so
-+session    include    system-auth

vixie-cron-4.1-_5_sprintf_misc.patch

@@ -1,46 +0,0 @@
---- vixie-cron-4.1-rh/misc.c~	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/misc.c	2004-07-21 20:09:31.000000000 -0400
-@@ -472,18 +472,25 @@
- 	char *msg;
- 	TIME_T now = time((TIME_T) 0);
- 	struct tm *t = localtime(&now);
-+	int msg_size;
- #endif /*LOG_FILE*/
- 
- #if defined(LOG_FILE)
- 	/* we assume that MAX_TEMPSTR will hold the date, time, &punctuation.
- 	 */
--	msg = malloc(strlen(username)
-+	msg = malloc(msg_size =
-+		     ( strlen(username)
- 		     + strlen(event)
- 		     + strlen(detail)
--		     + MAX_TEMPSTR);
-+		     + MAX_TEMPSTR
-+		     )
-+	            );
- 	if (msg == NULL)
--		return;
--
-+	{   /* damn, out of mem and we did not test that before... */
-+	    fprintf(stderr, "%s: Run OUT OF MEMORY while %s\n",
-+		    ProgramName, __FUNCTION__);
-+	    return;
-+	}
- 	if (LogFD < OK) {
- 		LogFD = open(LOG_FILE, O_WRONLY|O_APPEND|O_CREAT, 0600);
- 		if (LogFD < OK) {
-@@ -495,11 +502,11 @@
- 		}
- 	}
- 
--	/* we have to sprintf() it because fprintf() doesn't always write
-+	/* we have to snprintf() it because fprintf() doesn't always write
- 	 * everything out in one chunk and this has to be atomically appended
- 	 * to the log file.
- 	 */
--	sprintf(msg, "%s (%02d/%02d-%02d:%02d:%02d-%d) %s (%s)\n",
-+	snprintf(msg, msg_size, "%s (%02d/%02d-%02d:%02d:%02d-%d) %s (%s)\n",
- 		username,
- 		t->tm_mon+1, t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec, pid,
- 		event, detail);

vixie-cron-4.1-_60-SELinux-contains-range.patch

@@ -1,423 +0,0 @@
---- vixie-cron-4.1/do_command.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
-+++ vixie-cron-4.1/do_command.c	2006-12-30 09:20:53.000000000 -0500
-@@ -238,6 +238,7 @@
- 		}
- 		break;
- 	default:
-+		cron_restore_default_security_context();
- 		/* parent process */
- 		break;
- 	}
---- vixie-cron-4.1/security.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
-+++ vixie-cron-4.1/security.c	2006-12-30 09:22:54.000000000 -0500
-@@ -23,6 +23,7 @@
- 
- #ifdef WITH_SELINUX
- #include <selinux/selinux.h>
-+#include <selinux/context.h>
- #include <selinux/flask.h>
- #include <selinux/av_permissions.h>
- #include <selinux/get_context_list.h>
-@@ -30,6 +31,15 @@
- 
- static char ** build_env(char **cronenv);
- 
-+#ifdef WITH_SELINUX
-+static int cron_change_selinux_range( user *u,
-+                                      security_context_t ucontext );
-+static int cron_get_job_range( user *u, security_context_t *ucontextp, char **jobenv );
-+#endif
-+
-+int cron_restore_default_security_context() {
-+	setexeccon(NULL);
-+}
- int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
- {
-     time_t minutely_time = 0;
-@@ -58,9 +68,9 @@
-      * we'll not be permitted to read the cron spool directory :-)
-      */
- 
--    security_context_t scontext=0, file_context=0; 
-+    security_context_t ucontext=0; 
- 
--    if ( cron_get_job_context(u, &scontext, &file_context, *jobenv) < OK )
-+    if ( cron_get_job_range(u, &ucontext, *jobenv) < OK )
-     {
- 	syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
- 	       e->pwd->pw_name, strerror(errno)
-@@ -68,38 +78,37 @@
- 	return -1;
-     }
- 
-+    if (cron_change_selinux_range(u, ucontext) != 0)
-+    {
-+        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
-+	       e->pwd->pw_name);
-+	if ( ucontext )
-+		freecon(ucontext);
-+	return -1;
-+    }
-+    if ( ucontext )
-+	freecon(ucontext);
- #endif
- 
--    if ( cron_change_user( e->pwd ) != 0 )
-+    if ( cron_start_security_session( e->pwd ) != 0 )
-     {
- 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
- 	       e->pwd->pw_name, strerror(errno)
- 	      );
- 	return -1;
--    }	
-+    }
- 
--#if WITH_SELINUX
--    if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
-+    if ( cron_change_user( e->pwd, env_get("HOME", *jobenv)) != 0 )
-     {
--        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
--	       e->pwd->pw_name);
--	if ( file_context )
--		freecon(file_context);
-+	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
-+	       e->pwd->pw_name, strerror(errno)
-+	      );
- 	return -1;
--    }
--    if ( file_context )
--	freecon(file_context);
--#endif
-+    }	
- 
-     log_close();
-     openlog(ProgramName, LOG_PID, LOG_CRON);
- 
--    if ( chdir(env_get("HOME", *jobenv)) == -1 )
--    {
--	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
--	return -1;
--    }
--
-     time_t job_run_time = time(0L);
- 
-     if( (minutely_time > 0)
-@@ -145,10 +154,20 @@
-     PAM_FAIL_CHECK;
-     retcode = pam_acct_mgmt(pamh, PAM_SILENT);
-     PAM_FAIL_CHECK;
--    retcode = pam_open_session(pamh, PAM_SILENT);
--    PAM_FAIL_CHECK;
-+#endif
-+
-+    return retcode;
-+}
-+
-+int cron_start_security_session( struct passwd *pw )
-+{
-+    int	retcode = 0;
-+
-+#if defined(WITH_PAM)
-     retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
-     PAM_FAIL_CHECK;
-+    retcode = pam_open_session(pamh, PAM_SILENT);
-+    PAM_FAIL_CHECK;
-     log_close(); /* PAM has now re-opened our log to auth.info ! */
-     openlog(ProgramName, LOG_PID, LOG_CRON);
- #endif
-@@ -165,7 +184,7 @@
- #endif
- }
- 
--int cron_change_user( struct passwd *pw )
-+int cron_change_user( struct passwd *pw, char *homedir )
- {    	
-     /* set our directory, uid and gid.  Set gid first, since once
-      * we set uid, we've lost root privledges.
-@@ -176,6 +195,13 @@
- 	return -1;
-     }
- 
-+    if ( chdir(homedir) == -1 )
-+    {
-+	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
-+	log_it("CRON", getpid(), homedir, strerror(errno));
-+	return -1;
-+    }
-+
-     if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
-     {
- 	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
-@@ -201,6 +227,7 @@
- #ifdef WITH_SELINUX
- 	struct av_decision avd;
- 	int retval;
-+        unsigned int bit = FILE__ENTRYPOINT;
- 	/*
- 	 * Since crontab files are not directly executed,
- 	 * crond must ensure that the crontab file has
-@@ -208,13 +235,35 @@
- 	 * the user cron job.  It performs an entrypoint
- 	 * permission check for this purpose.
- 	 */
--	retval = security_compute_av(scontext,
--				     file_context,
--				     SECCLASS_FILE,
--				     FILE__ENTRYPOINT,
--				     &avd);
-+	retval = security_compute_av(scontext, file_context,
-+				     SECCLASS_FILE, bit, &avd);
-+
-+	if (retval || ((bit & avd.allowed) != bit))
-+		return 0;
-+#endif
-+	return 1;
-+}
-+
-+static int 
-+cron_authorize_range
-+( 
-+	security_context_t scontext,
-+	security_context_t ucontext
-+)	
-+{
-+#ifdef WITH_SELINUX
-+	struct av_decision avd;
-+	int retval;
-+        unsigned int bit = CONTEXT__CONTAINS;
-+	/*
-+	 * Since crontab files are not directly executed,
-+	 * so crond must ensure that any user specified range
-+	 * falls within the seusers-specified range for that Linux user.
-+	 */
-+	retval = security_compute_av(scontext, ucontext,
-+				     SECCLASS_CONTEXT, bit, &avd);
- 
--	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT))
-+	if (retval || ((bit & avd.allowed) != bit))
- 		return 0;
- #endif
- 	return 1;
-@@ -265,6 +314,75 @@
- 	return 0;
- }
- 
-+#if WITH_SELINUX
-+/* always uses u->scontext as the default process context, then changes the
-+   level, and retuns it in ucontextp (or NULL otherwise) */
-+static int cron_get_job_range( user *u, security_context_t *ucontextp,
-+                               char **jobenv )
-+{
-+	char *range;
-+
-+	if ( is_selinux_enabled() <= 0 )
-+		return 0;
-+	if ( ucontextp == 0L )
-+		return -1;
-+
-+	*ucontextp = 0L;
-+
-+	if ( (range = env_get("MLS_LEVEL",jobenv)) != 0L )
-+	{
-+                context_t ccon;
-+
-+                if (!(ccon = context_new(u->scontext)))
-+                {
-+			log_it(u->name, 
-+                               getpid(), "context_new FAILED for MLS_LEVEL", 
-+                               range);
-+                        return -1;
-+                }                  
-+
-+                if (context_range_set(ccon, range))
-+                {
-+                        log_it(u->name, 
-+                               getpid(), "context_range_set FAILED for MLS_LEVEL", 
-+                               range);
-+                        return -1;
-+                }
-+
-+                if (!(*ucontextp = context_str(ccon)))
-+                {
-+                        log_it(u->name, 
-+                               getpid(), "context_str FAILED for MLS_LEVEL", 
-+                               range);
-+                        return -1;
-+                }
-+
-+                if (!(*ucontextp = strdup(*ucontextp)))
-+                {
-+                        log_it(u->name, 
-+                               getpid(), "strdup FAILED for MLS_LEVEL", 
-+                               range);
-+                        return -1;
-+                }
-+
-+                context_free(ccon);
-+	}
-+        else if (!u->scontext)
-+        { /* cron_change_selinux_range() deals with this */
-+                return 0;
-+        }
-+        else if (!(*ucontextp = strdup(u->scontext)))
-+        {
-+                log_it(u->name, 
-+                       getpid(), "strdup FAILED for MLS_LEVEL", 
-+                       range);
-+                return -1;
-+        }
-+
-+	return 0;
-+}
-+#endif
-+
- int cron_change_selinux_context( user *u, void *scontext, void *file_context )
- {
- #ifdef WITH_SELINUX
-@@ -332,6 +450,84 @@
- 	return 0;
- }
- 
-+#ifdef WITH_SELINUX
-+static int cron_change_selinux_range( user *u,
-+                                      security_context_t ucontext )
-+{
-+	if ( is_selinux_enabled() <= 0 )
-+		return 0;
-+
-+	if ( u->scontext == 0L )
-+	{
-+		if (security_getenforce() > 0) 
-+		{
-+			log_it( u->name, getpid(), 
-+				"NULL security context for user", 
-+				""
-+			      );
-+			return -1;
-+		}else
-+		{
-+			log_it( u->name, getpid(), 
-+				"NULL security context for user, "
-+				"but SELinux in permissive mode, continuing",
-+				""
-+				);
-+			return 0;
-+		}
-+	}
-+
-+	if ( strcmp(u->scontext, ucontext) )
-+	{		
-+                if ( ! cron_authorize_range( u->scontext, ucontext ))
-+		{
-+			if ( security_getenforce() > 0 ) 
-+			{
-+				syslog(LOG_ERR,
-+				       "CRON (%s) ERROR:"
-+				       "Unauthorized range %s in MLS_LEVEL for user %s ", 
-+				       u->name, (char*)ucontext, u->scontext
-+				      );
-+				return -1;
-+			} else
-+			{
-+				syslog(LOG_INFO,
-+				       "CRON (%s) WARNING:"
-+				       "Unauthorized range %s in MLS_LEVEL for user %s,"
-+				       " but SELinux in permissive mode, continuing", 
-+				       u->name, (char*)ucontext, u->scontext
-+				      );
-+			}
-+		}
-+	} 
-+
-+	if ( setexeccon(ucontext) < 0 ) 
-+	{
-+		if (security_getenforce() > 0) 
-+		{
-+			syslog(LOG_ERR,
-+			       "CRON (%s) ERROR:"
-+			       "Could not set exec context to %s for user", 
-+			       u->name, (char*)ucontext
-+			      );
-+
-+			return -1;
-+		} else
-+		{
-+			syslog(LOG_ERR,
-+			       "CRON (%s) ERROR:"
-+			       "Could not set exec context to %s for user, "
-+                               " but SELinux in permissive mode, continuing", 
-+			       u->name, (char*)ucontext
-+			      );
-+
-+			return 0;
-+		}
-+	}
-+	return 0;
-+}
-+#endif
-+
- int get_security_context( const char *name, 
- 			  int crontab_fd, 
- 			  security_context_t *rcontext, 
-@@ -449,3 +645,4 @@
-     return env_copy(cronenv);
- #endif
- }
-+
---- vixie-cron-4.1/crontab.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
-+++ vixie-cron-4.1/crontab.c	2006-12-30 09:20:53.000000000 -0500
-@@ -33,6 +33,7 @@
- #include "cron.h"
- #ifdef WITH_SELINUX
- #include <selinux/selinux.h>
-+#include <selinux/context.h>
- #include <selinux/av_permissions.h>
- #endif
- 
-@@ -415,8 +416,25 @@
- #ifdef WITH_SELINUX
- 	if ( selinux_context )
- 	{
--		fprintf(NewCrontab,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
--		selinux_context = 0;
-+                context_t ccon = NULL;
-+                char *level = NULL;
-+
-+                if (!(ccon = context_new(selinux_context)))
-+                {
-+                        fprintf(stderr, "context_new failed\n");
-+                        goto fatal;
-+                }
-+                
-+                if (!(level = context_range_get(ccon)))
-+                {
-+                        fprintf(stderr, "context_range failed\n");
-+                        goto fatal;
-+                }
-+                
-+		fprintf(NewCrontab,"MLS_LEVEL=%s\n", level);
-+                context_free(ccon);
-+		freecon(selinux_context);
-+                selinux_context = NULL;
- 	}
- #endif
- 
---- vixie-cron-4.1/funcs.h.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
-+++ vixie-cron-4.1/funcs.h	2006-12-30 09:20:53.000000000 -0500
-@@ -80,13 +80,15 @@
- 
- /* Red Hat security stuff (security.c): 
-  */
-+int cron_restore_default_security_context( void );
-+
- int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
- 
- int cron_open_security_session( struct passwd *pw );
- 
- void cron_close_security_session( void );
- 
--int cron_change_user( struct passwd *pw );
-+int cron_change_user( struct passwd *pw, char *homedir );
- 
- int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **envp );
- 

vixie-cron-4.1-_61symlink.patch

@@ -1,57 +0,0 @@
---- vixie-cron-4.1/cron.c.orig	2007-01-08 14:08:50.000000000 +0000
-+++ vixie-cron-4.1/cron.c	2007-01-08 14:08:43.000000000 +0000
-@@ -33,7 +33,7 @@ static	void	usage(void),
- 		run_reboot_jobs(cron_db *),
- 		find_jobs(int, cron_db *, int, int),
- 		set_time(int),
--		cron_sleep(int),
-+		cron_sleep(int, cron_db *),
- 		sigchld_handler(int),
- 		sighup_handler(int),
- 		sigchld_reaper(void),
-@@ -154,7 +154,7 @@ main(int argc, char *argv[]) {
- 
- 		/* ... wait for the time (in minutes) to change ... */
- 		do {
--			cron_sleep(timeRunning + 1);
-+			cron_sleep(timeRunning + 1, &database);
- 			set_time(FALSE);
- 		} while (clockTime == timeRunning);
- 		timeRunning = clockTime;
-@@ -258,6 +258,7 @@ main(int argc, char *argv[]) {
- 		/* Check to see if we received a signal while running jobs. */
- 		if (got_sighup) {
- 			got_sighup = 0;
-+			database.mtime = (time_t) 0;
- 			log_close();
- 		}
- 		if (got_sigchld) {
-@@ -357,7 +358,7 @@ set_time(int initialize) {
-  * Try to just hit the next minute.
-  */
- static void
--cron_sleep(int target) {
-+cron_sleep(int target, cron_db *db) {
- 	time_t t1, t2;
- 	int seconds_to_wait;
- 
-@@ -376,6 +377,7 @@ cron_sleep(int target) {
- 		 */
- 		if (got_sighup) {
- 			got_sighup = 0;
-+			db->mtime = (time_t) 0;
- 			log_close();
- 		}
- 		if (got_sigchld) {
-
---- vixie-cron-4.1/database.c.symlinks	2007-01-28 17:12:24.000000000 +0000
-+++ vixie-cron-4.1/database.c	2007-01-28 17:12:34.000000000 +0000
-@@ -354,7 +354,7 @@ static void max_mtime( char *dir_name, s
- 		if ( not_a_crontab ( dp ) )
- 			continue;
- 
--		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, dp->d_name, '/'))
-+		if (!glue_strings(tabname, sizeof tabname, dir_name, dp->d_name, '/'))
- 			continue;	/* XXX log? */
- 
- 		if ( stat( tabname, &st ) < OK )

vixie-cron-4.1-_62newyear.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/misc.c.plus	2007-01-22 11:33:10.000000000 +0100
-+++ vixie-cron-4.1/misc.c	2007-01-22 11:34:23.000000000 +0100
-@@ -773,7 +773,7 @@
- 	if (local->tm_year < gmt.tm_year)
- 		offset -= 24 * 3600;
- 	else if (local->tm_year > gmt.tm_year)
--		offset -= 24 * 3600;
-+		offset += 24 * 3600;
- 	else if (local->tm_yday < gmt.tm_yday)
- 		offset -= 24 * 3600;
- 	else if (local->tm_yday > gmt.tm_yday)

vixie-cron-4.1-_63newavc.patch

@@ -1,32 +0,0 @@
---- vixie-cron-4.1/security.c.audit	2007-02-06 13:37:11.000000000 -0500
-+++ vixie-cron-4.1/security.c	2007-02-06 13:41:15.000000000 -0500
-@@ -29,6 +29,12 @@
- #include <selinux/get_context_list.h>
- #endif
- 
-+#ifdef WITH_AUDIT
-+#include <libaudit.h>
-+#define _GNU_SOURCE
-+#include <stdio.h>
-+#endif
-+
- static char ** build_env(char **cronenv);
- 
- #ifdef WITH_SELINUX
-@@ -483,6 +489,15 @@
- 		{
- 			if ( security_getenforce() > 0 ) 
- 			{
-+#ifdef WITH_AUDIT
-+				char *msg = NULL;
-+				if (asprintf(&msg, "cron: Unauthorized MLS range acct=%s new_scontext=%s old_scontext=%s",  u->name, (char*)ucontext, u->scontext) >= 0) {
-+					int audit_fd = audit_open();
-+					audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, msg, NULL, NULL, NULL, 0);
-+					close(audit_fd);
-+				}
-+				free(msg);
-+#endif
- 				syslog(LOG_ERR,
- 				       "CRON (%s) ERROR:"
- 				       "Unauthorized range %s in MLS_LEVEL for user %s ", 
-

vixie-cron-4.1-_6_rh_crond.patch

@@ -1,97 +0,0 @@
---- vixie-cron-4.1-rh/database.c.rh_crond	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/database.c	2004-07-22 09:47:20.000000000 -0400
-@@ -36,7 +36,7 @@
- 
- void
- load_database(cron_db *old_db) {
--	struct stat statbuf, syscron_stat;
-+	struct stat statbuf, syscron_stat, crond_stat;
- 	cron_db new_db;
- 	DIR_T *dp;
- 	DIR *dir;
-@@ -53,6 +53,11 @@
- 		(void) exit(ERROR_EXIT);
- 	}
- 
-+	if (stat(RH_CROND_DIR, &crond_stat) < OK) {
-+		log_it("CRON", getpid(), "STAT FAILED", RH_CROND_DIR);
-+		(void) exit(ERROR_EXIT);
-+	}
-+
- 	/* track system crontab file
- 	 */
- 	if (stat(SYSCRONTAB, &syscron_stat) < OK)
-@@ -65,7 +70,9 @@
- 	 * so is guaranteed to be different than the stat() mtime the first
- 	 * time this function is called.
- 	 */
--	if (old_db->mtime == TMAX(statbuf.st_mtime, syscron_stat.st_mtime)) {
-+	if (old_db->mtime == TMAX(crond_stat.st_mtime,
-+				  TMAX(statbuf.st_mtime, syscron_stat.st_mtime))
-+	   ){
- 		Debug(DLOAD, ("[%ld] spool dir mtime unch, no load needed.\n",
- 			      (long)getpid()))
- 		return;
-@@ -76,13 +83,61 @@
- 	 * actually changed.  Whatever is left in the old database when
- 	 * we're done is chaff -- crontabs that disappeared.
- 	 */
--	new_db.mtime = TMAX(statbuf.st_mtime, syscron_stat.st_mtime);
-+	new_db.mtime = TMAX(crond_stat.st_mtime,
-+			    TMAX(statbuf.st_mtime, syscron_stat.st_mtime));
- 	new_db.head = new_db.tail = NULL;
- 
- 	if (syscron_stat.st_mtime)
- 		process_crontab("root", NULL, SYSCRONTAB, &syscron_stat,
- 				&new_db, old_db);
- 
-+	if (!(dir = opendir(RH_CROND_DIR))) {
-+		log_it("CRON", getpid(), "OPENDIR FAILED", RH_CROND_DIR);
-+		(void) exit(ERROR_EXIT);
-+	}
-+
-+	while (NULL != (dp = readdir(dir))) {
-+		char	fname[MAXNAMLEN+1],
-+			tabname[MAXNAMLEN+1];
-+		size_t len;
-+
-+		/* avoid file names beginning with ".".  this is good
-+		 * because we would otherwise waste two guaranteed calls
-+		 * to getpwnam() for . and .., and there shouldn't be 
-+		 * hidden files in here anyway
-+		 */
-+		if (dp->d_name[0] == '.')
-+			continue;
-+
-+		/* ignore files starting with # and ending with ~ */
-+		if (dp->d_name[0] == '#')
-+			continue;
-+		
-+		len = strlen(dp->d_name);
-+
-+		if (len >= sizeof fname)
-+			continue;	/* XXX log? */
-+
-+		if ((len > 0) && (dp->d_name[len - 1] == '~'))
-+			continue;
-+
-+		(void) strcpy(fname, dp->d_name);
-+		
-+		if ((len > 8) && (strncmp(fname + len - 8, ".rpmsave", 8) == 0))
-+			continue;
-+		if ((len > 8) && (strncmp(fname + len - 8, ".rpmorig", 8) == 0))
-+			continue;
-+		if ((len > 7) && (strncmp(fname + len - 7, ".rpmnew", 7) == 0))
-+			continue;
-+
-+		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
-+			continue;	/* XXX log? */
-+
-+		process_crontab("root", "*system*", tabname,
-+				&crond_stat, &new_db, old_db);
-+	}
-+	closedir(dir);
-+
- 	/* we used to keep this dir open all the time, for the sake of
- 	 * efficiency.  however, we need to close it in every fork, and
- 	 * we fork a lot more often than the mtime of the dir changes.

vixie-cron-4.1-_7_crontab-stdin.patch

@@ -1,14 +0,0 @@
---- vixie-cron-4.1-rh/crontab.c.crontab-stdin	2004-07-21 10:16:43.000000000 -0400
-+++ vixie-cron-4.1-rh/crontab.c	2004-07-22 10:56:45.000000000 -0400
-@@ -83,6 +83,11 @@
- #if defined(BSD)
- 	setlinebuf(stderr);
- #endif
-+	char *n="-";			/*set the n string to - so we have a valid string to use*/ 
-+		 			/*should we desire to make changes to behavior later.*/
-+	if(argv[1] == NULL){ 		/* change behavior to allow crontab to take stdin with no '-'*/
-+		argv[1] =n;
-+	}
- 	parse_args(argc, argv);		/* sets many globals, opens a file */
- 	set_cron_cwd();
- 	if (!allowed(RealUser, CRON_ALLOW, CRON_DENY)) {

vixie-cron-4.1-_8_root-allowed.patch

@@ -1,32 +0,0 @@
---- vixie-cron-4.1-rh/misc.c.root-allowed	2004-07-21 20:09:31.000000000 -0400
-+++ vixie-cron-4.1-rh/misc.c	2004-07-22 11:43:10.000000000 -0400
-@@ -449,16 +449,27 @@
- allowed(const char *username, const char *allow_file, const char *deny_file) {
- 	FILE	*fp;
- 	int	isallowed;
-+	char    buf[128];
- 
--	if (strcmp(username, ROOT_USER) == 0)
--		return (TRUE);
- 	isallowed = FALSE;
- 	if ((fp = fopen(allow_file, "r")) != NULL) {
- 		isallowed = in_file(username, fp, FALSE);
- 		fclose(fp);
-+		if( ( getuid() == 0 ) && (!isallowed) )
-+		{
-+		    snprintf(buf,sizeof(buf),"root used -u for user %s not in cron.allow",username);
-+		    log_it("crontab",getpid(),"warning",buf);
-+		    isallowed = TRUE;
-+		}
- 	} else if ((fp = fopen(deny_file, "r")) != NULL) {
- 		isallowed = !in_file(username, fp, FALSE);
- 		fclose(fp);
-+		if( ( getuid() == 0 ) && (!isallowed) )
-+		{
-+		    snprintf(buf,sizeof(buf),"root used -u for user %s in cron.deny",username);
-+		    log_it("crontab",getpid(),"warning",buf);
-+		    isallowed = TRUE;
-+		}
- 	}
- 	return (isallowed);
- }

vixie-cron-4.1-_9_no-header.patch

@@ -1,25 +0,0 @@
---- vixie-cron-4.1-rh/crontab.c.no-header	2004-07-22 10:56:45.000000000 -0400
-+++ vixie-cron-4.1-rh/crontab.c	2004-07-22 11:47:29.000000000 -0400
-@@ -32,7 +32,7 @@
- 
- #include "cron.h"
- 
--#define NHEADER_LINES 3
-+#define NHEADER_LINES 0
- 
- enum opt_t	{ opt_unknown, opt_list, opt_delete, opt_edit, opt_replace };
- 
-@@ -554,9 +554,10 @@
- 	 *
- 	 * VERY IMPORTANT: make sure NHEADER_LINES agrees with this code.
- 	 */
--	fprintf(tmp, "# DO NOT EDIT THIS FILE - edit the master and reinstall.\n");
--	fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
--	fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
-+	/*fprintf(tmp, "# DO NOT EDIT THIS FILE - edit the master and reinstall.\n");
-+	 *fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
-+	 *fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
-+	 */
- 
- 	/* copy the crontab to the tmp
- 	 */

vixie-cron-4.1-bz178836.patch

@@ -1,35 +0,0 @@
---- vixie-cron-4.1/crontab.c.fast	2006-10-24 14:01:04.000000000 +0200
-+++ vixie-cron-4.1/crontab.c	2006-10-24 14:04:55.000000000 +0200
-@@ -363,13 +363,6 @@
- 		}
- 	}
- 
--	if (fstat(fileno(f), &statbuf) < 0) {
--		perror("fstat");
--		goto fatal;
--	}
--	utimebuf.actime = statbuf.st_atime;
--	utimebuf.modtime = statbuf.st_mtime;
--
- 	/* Turn off signals. */
- 	(void)signal(SIGHUP, SIG_IGN);
- 	(void)signal(SIGINT, SIG_IGN);
-@@ -425,6 +418,9 @@
- 		perror(Filename);
- 		exit(ERROR_EXIT);
- 	}
-+	/* Set it to 1970 */
-+	utimebuf.actime = 0;
-+	utimebuf.modtime = 0;
- 	utime(Filename, &utimebuf);
-  again:
- 	rewind(NewCrontab);
-@@ -521,7 +517,7 @@
- 		goto remove;	    
- 	}
- 
--	if (utimebuf.modtime == statbuf.st_mtime) {
-+	if (statbuf.st_mtime == 0) {
- 		fprintf(stderr, "%s: no changes made to crontab\n",
- 			ProgramName);
- 		goto remove;

vixie-cron-4.1-bz220376.patch

@@ -1,49 +0,0 @@
---- vixie-cron-4.1/misc.c.myska	2007-04-12 13:20:23.000000000 +0200
-+++ vixie-cron-4.1/misc.c	2007-04-12 15:38:50.000000000 +0200
-@@ -214,7 +214,7 @@
- #ifdef CRON_GROUP
- 	grp = getgrnam(CRON_GROUP);
- #endif
--	/* first check for CRONDIR ("/var/cron" or some such)
-+	/* first check for CRONDIR ("/var/spool" or some such)
- 	 */
- 	if (stat(CRONDIR, &sb) < OK && errno == ENOENT) {
- 		perror(CRONDIR);
-@@ -270,6 +270,37 @@
- 			exit(ERROR_EXIT);
- 		    }
- 	}
-+	/* now check the RH_CROND_DIR */
-+	if (stat(RH_CROND_DIR, &sb) < OK && errno == ENOENT) {
-+        perror(RH_CROND_DIR);
-+        if (OK == mkdir(RH_CROND_DIR, 0700)) {
-+            fprintf(stderr, "%s: created\n", RH_CROND_DIR);
-+            stat(RH_CROND_DIR, &sb);
-+        } else {
-+            fprintf(stderr, "%s: ", RH_CROND_DIR);
-+            perror("mkdir");
-+            exit(ERROR_EXIT);
-+        }
-+    }
-+    if (!S_ISDIR(sb.st_mode)) {
-+        fprintf(stderr, "'%s' is not a directory, bailing out.\n",
-+            RH_CROND_DIR);
-+        exit(ERROR_EXIT);
-+    }
-+    if (grp != NULL) {
-+        if (sb.st_gid != grp->gr_gid)
-+            if( chown(RH_CROND_DIR, -1, grp->gr_gid) == -1 )
-+            {
-+            fprintf(stderr,"chdir %s failed: %s\n", RH_CROND_DIR, strerror(errno));
-+            exit(ERROR_EXIT);
-+            }
-+        if (sb.st_mode != 01730)
-+            if( chmod(RH_CROND_DIR, 01730) == -1 )
-+            {
-+            fprintf(stderr,"chmod 01730 %s failed: %s\n", RH_CROND_DIR, strerror(errno));
-+            exit(ERROR_EXIT);
-+            }
-+    }
- }
- 
- /* acquire_daemonlock() - write our PID into /etc/cron.pid, unless

vixie-cron-4.1-getseuserbyname.patch

@@ -1,36 +0,0 @@
---- vixie-cron-4.1/user.c~	2005-10-14 14:55:17.000000000 -0400
-+++ vixie-cron-4.1/user.c	2005-10-14 15:15:07.000000000 -0400
-@@ -44,15 +44,26 @@
- 	security_context_t  file_context=NULL;
- 	struct av_decision avd;
- 	int retval=0;
-+	char *seuser=NULL;
-+	char *level=NULL;
- 	*rcontext = NULL;
--	if (get_default_context(name, NULL, &scontext)) {
--		if (security_getenforce() > 0) {
--			log_it(name, getpid(), "No SELinux security context",tabname);
--			return -1;
--		} else {
--			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
--			return 0;
-+
-+	if (getseuserbyname(name, &seuser, &level) == 0) {
-+		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
-+		free(seuser);
-+		free(level);
-+		if (retval) {
-+			if (security_getenforce() > 0) {
-+				log_it(name, getpid(), "No SELinux security context",tabname);
-+				return -1;
-+			} else {
-+				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-+				return 0;
-+			}
- 		}
-+	} else {
-+		log_it(name, getpid(), "getseusername FAILED", name);
-+		return (security_getenforce() > 0);
- 	}
- 	
- 	if (fgetfilecon(crontab_fd, &file_context) < OK) {

vixie-cron-4.1-hardlink.patch

@@ -1,11 +0,0 @@
---- vixie-cron-4.1/database.c.link	2007-03-27 17:59:59.000000000 +0200
-+++ vixie-cron-4.1/database.c	2007-04-10 22:40:37.000000000 +0200
-@@ -256,7 +256,7 @@
- 		    log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
- 		    goto next_crontab;
- 	    }
--	    if (statbuf->st_nlink != 1) {
-+	    if (pw && statbuf->st_nlink != 1) {
- 		    log_it(fname, getpid(), "BAD LINK COUNT", tabname);
- 		    goto next_crontab;
- 	    }

vixie-cron-4.1-loginuid.patch

@@ -1,26 +0,0 @@
---- vixie-cron-4.1/crond.pam.loginuid	2005-06-17 11:15:07.732769000 -0400
-+++ vixie-cron-4.1/crond.pam	2005-06-17 11:07:23.000000000 -0400
-@@ -2,12 +2,15 @@
- # The PAM configuration file for the cron daemon
- #
- #
--auth	   sufficient /lib/security/$ISA/pam_rootok.so
--auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
--auth       required  pam_env.so
--account    required  /lib/security/$ISA/pam_stack.so service=system-auth
--session    required  /lib/security/$ISA/pam_stack.so service=system-auth
--# Sets up user limits, please uncomment and read /etc/security/limits.conf
--# to enable this functionality.
--# session    required   pam_limits.so
-+auth	   sufficient pam_rootok.so
-+auth       required   pam_env.so
-+auth       include    system-auth
-+account    required   pam_access.so
-+account    include    system-auth
-+session    include    system-auth
-+session    required   pam_loginuid.so
-+# To enable PAM user limits for cron jobs, 
-+# configure /etc/security/limits.conf and 
-+# uncomment this line:
-+# session  required   pam_limits.so
- #

vixie-cron-4.1-man-page-typo.patch

@@ -1,35 +0,0 @@
---- vixie-cron-4.1/cron.8.typo	2006-08-23 11:16:25.000000000 +0200
-+++ vixie-cron-4.1/cron.8	2006-08-23 11:40:13.000000000 +0200
-@@ -19,7 +19,7 @@
- .\"
- .\" $Id: cron.8,v 1.8 2004/01/23 19:03:32 vixie Exp $
- .\" 
--.TH CRON 8 "10 January 1996""
-+.TH CRON "8" "10 January 1996" "Linux Programmer's Manual"
- .UC 4
- .SH NAME
- cron \- daemon to execute scheduled commands (ISC Cron V4.1)
-@@ -32,10 +32,10 @@
- .RB [ \-m <mail command> ]
- .SH DESCRIPTION
- .I Cron
--should be started from /etc/rc or /etc/rc.local.  It will return immediately,
--so you don't need to start it with '&'.  The \-n option changes this default
--behavior causing it to run in the foreground.  This can be useful when 
--starting it out of init.
-+should be started from /etc/rc.d/rc or /etc/rc.d/rc.local.  It will return 
-+immediately, so you don't need to start it with '&'.  The \-n option changes 
-+this default behavior causing it to run in the foreground.  This can be 
-+useful when starting it out of init.
- .PP
- .I Cron
- searches /var/spool/cron for crontab files which are named after accounts in
-@@ -91,7 +91,7 @@
- .SS PAM Access Control
- On Red Hat systems, crond now supports access control with PAM - see 
- .IR pam (8) .
--A PAM configuration file for crond is installed in /etc/pam.d/crond .
-+A PAM configuration file for crond is installed in /etc/pam.d/crond.
- crond loads the PAM environment from the pam_env module, but these
- can be overriden by settings in the crontab file.
- .SH SIGNALS

vixie-cron-4.1-mancrond.patch

@@ -1,22 +0,0 @@
---- vixie-cron-4.1/crontab.5.mancrond	2007-03-27 17:59:59.000000000 +0200
-+++ vixie-cron-4.1/crontab.5	2007-04-12 18:16:06.000000000 +0200
-@@ -196,7 +196,18 @@
- 0 22 * * 1-5    mail -s "It's 10pm" joe%Joe,%%Where are your kids?%                                                           
- 23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"                                                      
- 5 4 * * sun     echo "run at 5 after 4 every sunday"                                                                          
--.fi     
-+.fi
-+.SH Jobs in /etc/cron.d/
-+The jobs in cron.d are system jobs, which are used usually for more than
-+one user. That's the reason why is name of the user needed. MAILTO on the first line
-+is optional.
-+.SH EXAMPLE FOR JOB IN /etc/cron.d/job
-+.nf
-+#login as root
-+#create job with preferred editor (e.g. vim)
-+MAILTO=root
-+* * * * * root touch /tmp/file
-+.fi
- .SH SELinux with multi level security (MLS)
- In crontab is important specified security level by \fIcrontab\ -s\fR or specifying 
- the required level on the first line of the crontab. Each level is specified 

vixie-cron-4.1-manual.patch

@@ -1,467 +0,0 @@
---- vixie-cron-4.1/cron.8.manual	2007-01-17 11:13:28.000000000 +0100
-+++ vixie-cron-4.1/cron.8	2007-01-17 11:13:28.000000000 +0100
-@@ -19,31 +19,40 @@
- .\"
- .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
- .\" 
--.TH CRON "8" "10 January 1996" "Linux Programmer's Manual"
-+.TH CRON "8" "10 January 2007" "Linux Programmer's Manual"
- .UC 4
- .SH NAME
- cron \- daemon to execute scheduled commands (ISC Cron V4.1)
- .SH SYNOPSIS
- .B cron
--.RB [ \-l
--.IR load_avg ]
--.RB [ \-n ]
--.RB [ \-p ]
--.RB [ \-m <mail command> ]
-+.RB [ -n " | " -p " | " -m \fP\fI<mail command>\fP\fB ]
-+.br
-+.B cron
-+.B -x 
-+.RB [ext,sch,proc,pars,load,misc,test,bit]
-+.br
- .SH DESCRIPTION
- .I Cron
--should be started from /etc/rc.d/rc or /etc/rc.d/rc.local.  It will return 
--immediately, so you don't need to start it with '&'.  The \-n option changes 
--this default behavior causing it to run in the foreground.  This can be 
--useful when starting it out of init.
-+should be started from 
-+.I /etc/rc.d/init.d 
-+or 
-+.I /etc/init.d
-+. It will return immediately, so you don't need to start it with '&'. 
- .PP
- .I Cron
--searches /var/spool/cron for crontab files which are named after accounts in
--/etc/passwd; crontabs found are loaded into memory.
-+searches 
-+.I /var/spool/cron 
-+for crontab files which are named after accounts in
-+.I/etc/passwd; 
-+crontabs found are loaded into memory.
- .I Cron
--also searches for /etc/crontab and the files in the /etc/cron.d directory,
--which are in a different format (see
--.IR crontab (5)).
-+also searches for 
-+.I /etc/crontab 
-+and the files in the 
-+.I/etc/cron.d 
-+directory, which are in a different format (see
-+.BR crontab (5)
-+).
- .I Cron
- then wakes up every minute, examining all stored crontabs, checking each
- command to see if it should be run in the current minute.  When executing
-@@ -61,19 +70,10 @@
- changed.  Thus
- .I cron
- need not be restarted whenever a crontab file is modified.  Note that the
--.IR Crontab (1)
-+.BR crontab (1)
- command updates the modtime of the spool directory whenever it changes a
- crontab.
- .PP 
--The
--.B -m
--option allows you to specify a shell command string to use for sending
--cron mail output instead of 
--.IR sendmail (8).
--This command must accept a fully
--formatted mail message (with headers) on stdin and send it as a mail
--message to the recipients specified in the mail headers.
--.PP 
- .SS Daylight Saving Time and other time changes
- Local time changes of less than three hours, such as those caused
- by the start or end of Daylight Saving Time, are handled specially.
-@@ -94,6 +94,24 @@
- A PAM configuration file for crond is installed in /etc/pam.d/crond.
- crond loads the PAM environment from the pam_env module, but these
- can be overriden by settings in the crontab file.
-+.SH "OPTIONS"                                                                                                                 
-+.TP                                                                                                                           
-+.B "\-m"                                                                                                                      
-+This option allows you to specify a shell command string to use for sending cron mail                                         
-+output instead of                                                                                                             
-+.BR sendmail (8).                                                                                                             
-+This command must accept a fully formatted mail message (with headers) on stdin and send it                                   
-+as a mail message to the recipients specified in the mail headers.
-+.TP                                                                                                                           
-+.B "\-n"                                                                                                                      
-+This option changes default behavior causing it to run crond in the foreground.  This can be                                  
-+useful when starting it out of init.
-+.TP
-+.B "\-p"
-+Cron permit any crontab, which user set.
-+.TP
-+.B "\-x"
-+With this option is possible to set debug flags.
- .SH SIGNALS
- On receipt of a \s-2SIGHUP\s+2, the cron daemon will close and reopen its
- log file.  This is useful in scripts which rotate and age log files.  
-@@ -102,8 +120,9 @@
- .SH CAVEATS
- In this version of
- .BR cron
--, without the -p option,
--/etc/crontab must not be writable by any user other than root,
-+, without the \fB-p\fP option,
-+.I /etc/crontab 
-+must not be writable by any user other than root,
- no crontab files may be links, or linked to by any other file,
- and no crontab files may be executable, or be writable by any
- user other than their owner.
---- vixie-cron-4.1/crontab.1.manual	2007-01-17 11:13:28.000000000 +0100
-+++ vixie-cron-4.1/crontab.1	2007-01-22 10:03:36.000000000 +0100
-@@ -19,7 +19,7 @@
- .\"
- .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
- .\"
--.TH CRONTAB 1 "29 December 1993"
-+.TH CRONTAB 1 "16 Januar 2007"
- .UC 4
- .SH NAME
- crontab \- maintain crontab files for individual users (ISC Cron V4.1)
-@@ -31,15 +31,18 @@
- .B crontab
- .RB [ -u
- .IR user ]
--.RB [ -l " | " -r " | " -e ] [ -i ]
-+.RB [ -l " | " -r " | " -e ]\ [ -i ]
- .RB [ -s ]
- .SH DESCRIPTION
- .I Crontab
- is the program used to install, deinstall or list the tables
- used to drive the
--.IR cron (8)
--daemon in ISC Cron.  Each user can have their own crontab, and though
--these are files in /var, they are not intended to be edited directly.
-+.BR cron (8)
-+daemon in ISC Cron.  Each user can have their own crontab, and though these are files in 
-+.I /var/spool/
-+, they are not intended to be edited directly. For SELinux in mls mode can be even 
-+more crontabs - for each range. For more see
-+.BR selinux (8).
- .PP
- If the
- .I cron.allow
-@@ -48,55 +51,52 @@
- .I cron.allow
- file does not exist but the
- .I cron.deny
--file does exist, then you must \fBnot\fR be listed in the
-+file does exist, then you must \fInot\fR be listed in the
- .I cron.deny
- file in order to use this command.  If neither of these files exists,
- only the super user will be allowed to use this command.
- .PP
--If the
--.I -u
--option is given, it specifies the name of the user whose crontab is to be
--tweaked.  If this option is not given,
-+.SH "OPTIONS"
-+.TP
-+.B "\-u"
-+It specifies the name of the user whose crontab is to be tweaked.  If this option 
-+is not given,
- .I crontab
- examines "your" crontab, i.e., the crontab of the person executing the
- command.  Note that
--.IR su (8)
-+.BR su (8)
- can confuse
- .I crontab
- and that if you are running inside of
--.IR su (8)
-+.BR su (8)
- you should always use the
--.I -u
-+.B -u
- option for safety's sake.
--.PP
- The first form of this command is used to install a new crontab from some
--named file or standard input if the pseudo-filename ``-'' is given.
--.PP
--The
--.I -l
--option causes the current crontab to be displayed on standard output.
--.PP
--The
--.I -r
--option causes the current crontab to be removed.
--.PP
--The
--.I -e
--option is used to edit the current crontab using the editor specified by
-+named file or standard input if the pseudo-filename "-" is given.
-+.TP
-+.B "\-l"
-+The current crontab will be displayed on standard output.
-+.TP
-+.B "\-r"
-+The current crontab will be be removed.
-+.TP
-+.B "\-e"
-+This option is used to edit the current crontab using the editor specified by
- the \s-1VISUAL\s+1 or \s-1EDITOR\s+1 environment variables.  After you exit
- from the editor, the modified crontab will be installed automatically.
--.PP
--The
--.I -i
--option modifies the -r option to prompt the user for a 'y/Y' response
-+.TP
-+.B "\-i"
-+This option modifies the 
-+.B "\-r"
-+option to prompt the user for a 'y/Y' response
- before actually removing the crontab.
--.PP
--The
--.I -s
--option will append the current SELinux security context string as an
--SELINUX_ROLE_TYPE setting to the crontab file before editing / replacement
--occurs - see the documentation of SELINUX_ROLE_TYPE in 
--.IR crontab(5) .
-+.TP
-+.B "\-s"
-+It will append the current SELinux security context string as an
-+MLS_LEVEL setting to the crontab file before editing / replacement
-+occurs - see the documentation of MLS_LEVEL in 
-+.BR crontab(5)\.
- .SH "SEE ALSO"
- crontab(5), cron(8)
- .SH FILES
---- vixie-cron-4.1/crontab.5.manual	2007-01-17 11:13:28.000000000 +0100
-+++ vixie-cron-4.1/crontab.5	2007-01-22 10:02:17.000000000 +0100
-@@ -19,7 +19,7 @@
- .\"
- .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
- .\" 
--.TH CRONTAB 5 "24 January 1994"
-+.TH CRONTAB 5 "16 January 2007"
- .UC 4
- .SH NAME
- crontab \- tables for driving cron (ISC Cron V4.1)
-@@ -27,12 +27,12 @@
- A
- .I crontab
- file contains instructions to the
--.IR cron (8)
--daemon of the general form: ``run this command at this time on this date''.
-+.BR cron (8)
-+daemon of the general form: "run this command at this time on this date".
- Each user has their own crontab, and commands in any given crontab will be
- executed as the user who owns the crontab.  Uucp and News will usually have
- their own crontabs, eliminating the need for explicitly running
--.IR su (1)
-+.BR su (1)
- as part of a cron command.
- .PP
- Blank lines and leading spaces and tabs are ignored.  Lines whose first
-@@ -58,7 +58,7 @@
- .PP
- Several environment variables are set up
- automatically by the
--.IR cron (8)
-+.BR cron (8)
- daemon.
- SHELL is set to /bin/sh, and LOGNAME and HOME are set from the /etc/passwd 
- line of the crontab\'s owner.
-@@ -68,9 +68,9 @@
- on these systems, USER will be set also.)
- .PP
- In addition to LOGNAME, HOME, and SHELL,
--.IR cron (8)
-+.BR cron (8)
- will look at MAILTO if it has any reason to send mail as a result of running
--commands in ``this'' crontab.  If MAILTO is defined (and non-empty), mail is
-+commands in "this" crontab.  If MAILTO is defined (and non-empty), mail is
- sent to the user so named.  If MAILTO is defined but empty (MAILTO=""), no
- mail will be sent.  Otherwise mail is sent to the owner of the crontab.  This
- option is useful if you decide on /bin/mail instead of /usr/lib/sendmail as
-@@ -78,44 +78,47 @@
- usually doesn\'t read its mail.
- .PP
- By default, cron will send mail using the mail 'Content-Type:' header of 'text/plain' with the 'charset=' parameter set to the charmap / codeset of the locale in which 
--.IR crond(8)
-+.BR crond (8)
- is started up - ie. either the default system locale, if no LC_* environment
- variables are set, or the locale specified by the LC_* environment variables
--( see 
--.IR locale(7) ). 
-+(see 
-+.BR locale (7)).
- You can use different character encodings for mailed cron job output by 
- setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
- to the correct values of the mail headers of those names.  
- .PP
--The SELINUX_ROLE_TYPE environment variable provides support for multiple per-job 
-+The MLS_LEVEL environment variable provides support for multiple per-job 
- SELinux security contexts in the same crontab.
- By default, cron jobs execute with the default SELinux security context of the 
- user that created the crontab file.
- When using multiple security levels and roles, this may not be sufficient, because
- the same user may be running in a different role or at a different security level.
--You can set SELINUX_ROLE_TYPE to the SELinux security context string specifying
-+For more about roles and SELinux MLS/MCS see 
-+.BR selinux (8) 
-+and undermentioned crontab example.
-+You can set MLS_LEVEL to the SELinux security context string specifying
- the SELinux security context in which you want the job to run, and crond will set 
- the execution context of the or jobs to which the setting applies to the specified 
- context.
- See also the 
--.IR crontab(1) -s option.
-+.BR crontab(1)\ -s\ option.
- .PP
- The format of a cron command is very much the V7 standard, with a number of
- upward-compatible extensions.  Each line has five time and date fields,
- followed by a user name if this is the system crontab file,
- followed by a command.  Commands are executed by
--.IR cron (8)
-+.BR cron (8)
- when the minute, hour, and month of year fields match the current time,
- .I and
- at least one of the two day fields (day of month, or day of week)
--match the current time (see ``Note'' below).
-+match the current time (see "Note" below).
- Note that this means that non-existent times, such as "missing hours"
- during daylight savings conversion, will never match, causing jobs
- scheduled during the "missing times" not to be run.  Similarly, times
- that occur more than once (again, during daylight savings conversion)
- will cause matching jobs to be run twice.
- .PP
--.IR cron (8)
-+.BR cron (8)
- examines cron entries once every minute.
- .PP
- The time and date fields are:
-@@ -136,30 +139,30 @@
- day of week	0-7 (0 or 7 is Sun, or use names)
- .br
- .PP
--A field may be an asterisk (*), which always stands for ``first\-last''.
-+A field may be an asterisk (*), which always stands for "first\-last".
- .PP
- Ranges of numbers are allowed.  Ranges are two numbers separated
- with a hyphen.  The specified range is inclusive.  For example,
--8-11 for an ``hours'' entry specifies execution at hours 8, 9, 10
-+8-11 for an "hours" entry specifies execution at hours 8, 9, 10
- and 11.
- .PP
- Lists are allowed.  A list is a set of numbers (or ranges)
--separated by commas.  Examples: ``1,2,5,9'', ``0-4,8-12''.
-+separated by commas.  Examples: "1,2,5,9", "0-4,8-12".
- .PP
- Step values can be used in conjunction with ranges.  Following
--a range with ``/<number>'' specifies skips of the number's value
--through the range.  For example, ``0-23/2'' can be used in the hours
-+a range with "<number>" specifies skips of the number's value
-+through the range.  For example, "0-23/2" can be used in the hours
- field to specify command execution every other hour (the alternative
--in the V7 standard is ``0,2,4,6,8,10,12,14,16,18,20,22'').  Steps are
--also permitted after an asterisk, so if you want to say ``every two
--hours'', just use ``*/2''.
-+in the V7 standard is "0,2,4,6,8,10,12,14,16,18,20,22").  Steps are
-+also permitted after an asterisk, so if you want to say "every two
-+hours", just use "*/2".
- .PP
--Names can also be used for the ``month'' and ``day of week''
-+Names can also be used for the "month" and "day of week"
- fields.  Use the first three letters of the particular
- day or month (case doesn't matter).  Ranges or
- lists of names are not allowed.
- .PP
--The ``sixth'' field (the rest of the line) specifies the command to be
-+The "sixth" field (the rest of the line) specifies the command to be
- run.
- The entire command portion of the line, up to a newline or %
- character, will be executed by /bin/sh or by the shell
-@@ -175,30 +178,52 @@
- .I either
- field matches the current time.  For example,
- .br
--``30 4 1,15 * 5''
-+"30 4 1,15 * 5"
- would cause a command to be run at 4:30 am on the 1st and 15th of each
- month, plus every Friday.
--.SH EXAMPLE CRON FILE
-+.SH EXAMPLE CRON FILE                                                                                                         
-+.nf                                                                                                                           
-+# use /bin/sh to run commands, no matter what /etc/passwd says                                                                
-+SHELL=/bin/sh                                                                                                                 
-+# mail any output to `paul', no matter whose crontab this is                                                                  
-+MAILTO=paul                                                                                                                   
-+#                                                                                                                             
-+# run five minutes after midnight, every day                                                                                  
-+5 0 * * *       $HOME/bin/daily.job >> $HOME/tmp/out 2>&1                                                                     
-+# run at 2:15pm on the first of every month -- output mailed to paul                                                          
-+15 14 1 * *     $HOME/bin/monthly                                                                                             
-+# run at 10 pm on weekdays, annoy Joe                                                                                         
-+0 22 * * 1-5    mail -s "It's 10pm" joe%Joe,%%Where are your kids?%                                                           
-+23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"                                                      
-+5 4 * * sun     echo "run at 5 after 4 every sunday"                                                                          
-+.fi     
-+.SH SELinux with multi level security (MLS)
-+In crontab is important specified security level by \fIcrontab\ -s\fR or specifying 
-+the required level on the first line of the crontab. Each level is specified 
-+in \fI/etc/selinux/targeted/seusers\fR. For using crontab in MLS mode is really important:
-+.br 
-+- check/change actual role, 
-+.br
-+- set correct \fIrole for directory\fR, which is used for input/output.
-+.SH EXAMPLE FOR SELINUX MLS
- .nf
--# use /bin/sh to run commands, no matter what /etc/passwd says
--SHELL=/bin/sh
--# mail any output to `paul', no matter whose crontab this is
--MAILTO=paul
--#
--# run five minutes after midnight, every day
--5 0 * * *       $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
--# run at 2:15pm on the first of every month -- output mailed to paul
--15 14 1 * *     $HOME/bin/monthly
--# run at 10 pm on weekdays, annoy Joe
--0 22 * * 1-5	mail -s "It's 10pm" joe%Joe,%%Where are your kids?%
--23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"
--5 4 * * sun     echo "run at 5 after 4 every sunday"
-+# login as root
-+newrole -r sysadm_r
-+mkdir /tmp/SystemHigh
-+chcon -l SystemHigh /tmp/SystemHigh
-+crontab -e
-+# write in crontab file
-+MLS_LEVEL=SystemHigh
-+0-59 * * * * id -Z > /tmp/SystemHigh/crontest
-+Now if I log in as a normal user it can't work, because /tmp/SystemHigh is
-+higher than my level.
- .fi
- .SH FILES
--/etc/crontab			System crontab file
--
--.SH SEE ALSO
--cron(8), crontab(1)
-+.I /etc/crontab
-+system crontab file
-+.SH "SEE ALSO"
-+.BR cron (8), 
-+.BR crontab (1)
- .SH EXTENSIONS
- When specifying day of week, both day 0 and day 7 will be considered Sunday.
- BSD and ATT seem to disagree about this.
-@@ -231,8 +256,10 @@
- .fi
- .SH CAVEATS
- In this version of
--.BR cron ,
--/etc/crontab must not be writable by any user other than root.
-+.I cron
-+,
-+.I /etc/crontab 
-+must not be writable by any user other than root.
- No crontab files may be links, or linked to by any other file.
- No crontab files may be executable, or be writable by any user
- other than their owner.

vixie-cron-4.1-resetcontext.patch

@@ -1,36 +0,0 @@
---- vixie-cron-4.1/do_command.c~	2006-10-23 11:52:21.000000000 -0400
-+++ vixie-cron-4.1/do_command.c	2006-10-23 12:01:14.000000000 -0400
-@@ -238,6 +238,7 @@
- 		}
- 		break;
- 	default:
-+		cron_clear_job_security_context();
- 		/* parent process */
- 		break;
- 	}
---- vixie-cron-4.1/funcs.h~	2006-10-23 11:52:21.000000000 -0400
-+++ vixie-cron-4.1/funcs.h	2006-10-23 12:02:36.000000000 -0400
-@@ -82,6 +82,8 @@
-  */
- int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
- 
-+void cron_clear_job_security_context(void);
-+
- int cron_open_security_session( struct passwd *pw );
- 
- void cron_close_security_session( void );
---- vixie-cron-4.1/security.c~	2006-10-23 11:52:21.000000000 -0400
-+++ vixie-cron-4.1/security.c	2006-10-23 12:06:29.000000000 -0400
-@@ -30,6 +30,12 @@
- 
- static char ** build_env(char **cronenv);
- 
-+void cron_clear_job_security_context(void) {
-+#if WITH_SELINUX
-+	setexeccon(NULL);
-+#endif
-+}
-+
- int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
- {
-     time_t minutely_time = 0;

vixie-cron.init

@@ -1,95 +0,0 @@
-#! /bin/bash
-#
-# crond          Start/Stop the cron clock daemon.
-#
-# chkconfig: 2345 90 60
-# description: cron is a standard UNIX program that runs user-specified \
-#              programs at periodic scheduled times. vixie cron adds a \
-#              number of features to the basic UNIX cron, including better \
-#              security and more powerful configuration options.
-# processname: crond
-# config: /etc/crontab
-# pidfile: /var/run/crond.pid
-
-# Source function library.
-. /etc/init.d/functions
-. /etc/sysconfig/crond
-t=${CRON_VALIDATE_MAILRCPTS:-UNSET}
-[ "$t" != "UNSET" ] && export CRON_VALIDATE_MAILRCPTS="$t"
- 
-# See how we were called.
-  
-prog="crond"
-
-start() {
-	echo -n $"Starting $prog: "	
-        if [ -e /var/lock/subsys/crond ]; then
-	    if [ -e /var/run/crond.pid ] && [ -e /proc/`cat /var/run/crond.pid` ]; then
-		echo -n $"cannot start crond: crond is already running.";
-		failure $"cannot start crond: crond already running.";
-		echo
-		return 1
-	    fi
-	fi
-	daemon crond $CRONDARGS
-	RETVAL=$?
-	echo
-	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/crond;
-	return $RETVAL
-}
-
-stop() {
-	echo -n $"Stopping $prog: "
-        if [ ! -e /var/lock/subsys/crond ]; then
-	    echo -n $"cannot stop crond: crond is not running."
-	    failure $"cannot stop crond: crond is not running."
-	    echo
-	    return 1;
-	fi
-	killproc crond
-	RETVAL=$?
-	echo
-        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/crond;
-	return $RETVAL
-}	
-
-rhstatus() {
-	status crond
-}	
-
-restart() {
-  	stop
-	start
-}	
-
-reload() {
-	echo -n $"Reloading cron daemon configuration: "
-	killproc crond -HUP
-	RETVAL=$?
-	echo
-	return $RETVAL
-}	
-
-case "$1" in
-  start)
-  	start
-	;;
-  stop)
-  	stop
-	;;
-  restart)
-  	restart
-	;;
-  reload)
-  	reload
-	;;
-  status)
-  	rhstatus
-	;;
-  condrestart)
-  	[ -f /var/lock/subsys/crond ] && restart || :
-	;;
-  *)
-	echo $"Usage: $0 {start|stop|status|reload|restart|condrestart}"
-	exit 1
-esac

vixie-cron.spec

@@ -1,809 +0,0 @@
-%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}
-%define WITH_SELINUX 1
-%endif
-%if %{?WITH_PAM:0}%{!?WITH_PAM:1}
-%define WITH_PAM 1
-%endif
-%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1}
-%define WITH_AUDIT 1
-%endif
-Summary: The Vixie cron daemon for executing specified programs at set times
-Name: vixie-cron
-Version: 4.1
-Release: 82%{?dist}
-Epoch: 4
-License: BSD
-Group: System Environment/Base
-Source0: ftp://ftp.isc.org/isc/cron/vixie-cron-%{version}.tar.gz
-Source1: vixie-cron.init
-Source2: crond.sysconfig
-Patch0:  vixie-cron-4.1-_0_rh_Makefile.patch
-Patch1:  vixie-cron-4.1-_1_rh_pathnames.patch
-Patch2:  vixie-cron-4.1-_2_config.patch
-Patch3:  vixie-cron-4.1-_3_selinux.patch
-Patch4:  vixie-cron-4.1-_4_vfork_sigchld.patch
-Patch5:  vixie-cron-4.1-_5_sprintf_misc.patch
-Patch6:  vixie-cron-4.1-_6_rh_crond.patch
-Patch7:  vixie-cron-4.1-_7_crontab-stdin.patch
-Patch8:  vixie-cron-4.1-_8_root-allowed.patch
-Patch9:  vixie-cron-4.1-_9_no-header.patch
-Patch10: vixie-cron-4.1-_10_manpages.patch
-Patch11: vixie-cron-4.1-_11_with_selinux.patch
-Patch12: vixie-cron-4.1-_12_pam.patch
-Patch13: vixie-cron-4.1-_13_with_pam.patch
-Patch14: vixie-cron-4.1-_14_pamd_crond.patch
-Patch15: vixie-cron-4.1-_15_system_crontab_user.patch
-Patch16: vixie-cron-4.1-_16_crontab_selinux.patch
-Patch17: vixie-cron-4.1-_17_pam-rootok.patch
-Patch18: vixie-cron-4.1-_18_cron_log_facility.patch
-Patch19: vixie-cron-4.1-_19_crontab_stat_not_fstat.patch
-Patch20: vixie-cron-4.1-_20_nickname_man.patch
-Patch21: vixie-cron-4.1-_21_-i_option.patch
-Patch22: vixie-cron-4.1-_22_no_0600_mode_enforce.patch
-Patch23: vixie-cron-4.1-_23_freecon_segv.patch
-Patch24: vixie-cron-4.1-_24_crontab_selinux_new.patch
-Patch25: vixie-cron-4.1-_25-allow-root-crontab.patch
-Patch26: vixie-cron-4.1-_26-saved-uids.patch
-Patch27: vixie-cron-4.1-_27-no-strip-header-comments.patch
-Patch28: vixie-cron-4.1-_28-fix_ppc.patch
-Patch29: vixie-cron-4.1-_29-permit_any_crontab_option.patch
-Patch30: vixie-cron-4.1-_30-uninitialized.patch
-Patch31: vixie-cron-4.1-_31-allow_pam_access.patch
-Patch32: vixie-cron-4.1-_32-no_mail_rcpt_safe_p.patch
-Patch33: vixie-cron-4.1-_33-fix_selinux_segfault.patch
-Patch34: vixie-cron-4.1-_34-pam_fail_close_session.patch
-Patch35: vixie-cron-4.1-_35-crontab-job-control.patch
-Patch36: vixie-cron-4.1-_36-pam_close_fork_fail.patch
-Patch37: vixie-cron-4.1-_37-limits.patch
-Patch38: vixie-cron-4.1-_38-CAN-2005-1038.patch
-Patch39: vixie-cron-4.1-loginuid.patch
-Patch40: vixie_cron-4.1-162887.patch
-Patch41: vixie-cron-4.1-CAN-2005-1038-fix-race.patch
-Patch42: vixie-cron-4.1-_42-getseuserbyname.patch
-Patch43: vixie-cron-4.1-_43-config_comments.patch
-Patch44: vixie-cron-4.1-_44-build_env.patch
-Patch45: vixie-cron-4.1-_45-warnings.patch
-Patch46: vixie-cron-4.1-_46-audit.patch
-Patch47: vixie-cron-4.1-_47-m_option.patch
-Patch48: vixie-cron-4.1-_48-security.patch
-Patch49: vixie-cron-4.1-_49-bz178436.patch
-Patch50: vixie-cron-4.1-_50-bz178931.patch
-Patch51: vixie-cron-4.1-_51-bz180145-mail_i18n.patch
-Patch52: vixie-cron-4.1-_52-bz181439.patch
-Patch53: vixie-cron-4.1-_53_bz199294_selinux_mls.patch
-Patch54: vixie-cron-4.1-_54_bz198019_database_changes.patch
-Patch55: vixie-cron-4.1-man-page-typo.patch
-Patch56: vixie-cron-4.1-_55-bz203746.patch
-Patch57: vixie-cron-4.1-_44-delayed_database.patch 
-Patch58: vixie-cron-4.1-_52-bz181439_2.patch
-Patch59: vixie-cron-4.1-_56-pam-session-system-auth.patch
-Patch60: vixie-cron-4.1-bz178836.patch
-Patch61: vixie-cron-4.1-_60-SELinux-contains-range.patch
-Patch62: vixie-cron-4.1-_61symlink.patch
-Patch63: vixie-cron-4.1-manual.patch
-Patch64: vixie-cron-4.1-_62newyear.patch
-Patch65: vixie-cron-4.1-_63newavc.patch
-Patch66: vixie-cron-4.1-bz220376.patch
-Patch67: vixie-cron-4.1-hardlink.patch
-Patch68: vixie-cron-4.1-mancrond.patch
-
-Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-Requires: syslog, bash >= 2.0
-Conflicts: sysklogd < 1.4.1
-%if %{WITH_SELINUX}
-Requires: libselinux >= 2.0.0
-Buildrequires: libselinux-devel >= 2.0.0
-%endif
-%if %{WITH_PAM}
-Requires: pam >= 0.99.6.2
-Buildrequires: pam-devel >= 0.99.6.2
-%endif
-%if %{WITH_AUDIT}
-Requires: audit-libs >= 1.4.1
-Buildrequires: audit-libs >= 1.4.1
-Buildrequires: audit-libs-devel >= 1.4.1
-%endif
-
-Requires(post): /sbin/chkconfig coreutils
-Requires(postun): /sbin/chkconfig
-Requires(postun): /sbin/service 
-Requires(preun): /sbin/chkconfig 
-Requires(preun): /sbin/service
-
-%description
-The vixie-cron package contains the Vixie version of cron.  Cron is a
-standard UNIX daemon that runs specified programs at scheduled times.
-Vixie cron adds better security and more powerful configuration
-options to the standard version of cron.
-
-%prep
-%setup -q
-%patch0 -p1 -b .rh_Makefile
-%patch1 -p1 -b .rh_pathnames
-%patch2 -p1 -b .config
-%patch3 -p1 -b .selinux
-%patch4 -p1 -b .vfork_sigchld
-%patch5 -p1 -b .sprintf_misc
-%patch6 -p1 -b .rh_crond
-%patch7 -p1 -b .crontab-stdin
-%patch8 -p1 -b .root-allowed
-%patch9 -p1 -b .no-header
-%patch10 -p1 -b .manpages
-#%if %{WITH_SELINUX}
-#SELinux
-# Enables SELinux support
-%patch11 -p1 -b .with_selinux
-#%endif
-%patch12 -p1 -b .pam
-#%if %{WITH_PAM}
-%patch13 -p1 -b .with_pam
-%patch14 -p1 -b .pamd_crond
-%patch15 -p1 -b .system_crontab_user
-#%endif
-%patch16 -p1 -b .crontab_selinux
-%patch17 -p1 -b .pam-rootok
-%patch18 -p1 -b .cron_log_facility
-%patch19 -p1 -b .crontab_stat_not_fstat
-%patch20 -p1 -b .nickname_man
-%patch21 -p1 -b .-i_option
-%patch22 -p1 -b .no_0600_mode_enforce
-#%if %{WITH_SELINUX}
-%patch23 -p1 -b .freecon_segv
-%patch24 -p1 -b .selinux_crontab_new
-#%endif
-%patch25 -p1 -b .allow-root-crontab
-%patch26 -p1 -b .saved_uids
-%patch27 -p1 -b .no-strip-header-comments
-%patch28 -p1 -b .fix_ppc
-%patch29 -p1 -b .permit_any_crontab_option
-%patch30 -p1 -b .uninitialized
-%patch31 -p1 -b .allow_pam_access
-%patch32 -p1 -b .no_mail_rcpt_safe_p
-%patch33 -p1 -b .fix_selinux_segfault
-%patch34 -p1 -b .pam_fail_close_session
-%patch35 -p1 -b .job_control
-%patch36 -p1 -b .pam_close_fork_fail
-%patch37 -p1 -b .limits
-%patch38 -p1 -b .CAN-2005-1038
-%patch39 -p1 -b .loginuid
-%patch40 -p1 -b .162887
-%patch41 -p1 -b .CAN-2005-1038-fix-race
-%patch42 -p1 -b .getseuserbyname
-%patch43 -p1 -b .config_comments
-%patch44 -p1 -b .build_env
-%patch45 -p1 -b .warnings
-%patch46 -p1 -b .audit_deny
-%patch47 -p1 -b .-m_option
-%patch48 -p1 -b .security
-%patch49 -p1 -b .bz178436
-%patch50 -p1 -b .bz178931
-%patch51 -p1 -b .mail_i18n
-%patch52 -p1 -b .bz181439
-%patch53 -p1 -b .selinux_mls
-%patch54 -p1 -b .bz198019
-%patch55 -p1 -b .man-page-typo
-%patch56 -p1 -b .bz203746
-%patch57 -p1 -b .delayed_database
-%patch58 -p1 -b .bz181439_2
-%patch59 -p1 -b .pam-session-system-auth
-%patch60 -p1 -b .bz178836
-%patch61 -p1 -b .selinux-contains-range
-%patch62 -p1 -b ._61symlink.patch
-%patch63 -p1 -b .manual
-%patch64 -p1 -b ._62newyear
-%patch65 -p1 -b ._63newavc
-#%patch66 -p1 -b .bz220376
-%patch67 -p1 -b .hardlink
-%patch68 -p1 -b .mancrond
-
-%build
-# RPM_OPT_FLAGS are better here, because we don't have configure for set up variables ;-)
-make %{?_smp_mflags} RPM_OPT_FLAGS="$RPM_OPT_FLAGS -g -DLINT -Dlint" \
-%if %{WITH_SELINUX}
-WITH_SELINUX=1 \
-%endif
-%if %{WITH_PAM}
-WITH_PAM=1 \
-%endif
-%if %{WITH_AUDIT}
-WITH_AUDIT=1 \
-%endif
-;
-
-%install
-rm -rf $RPM_BUILD_ROOT
-mkdir -p $RPM_BUILD_ROOT/%{_bindir}
-mkdir -p $RPM_BUILD_ROOT/%{_sbindir}
-mkdir -p $RPM_BUILD_ROOT/%{_mandir}/man{1,5,8}
-mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
-mkdir -p $RPM_BUILD_ROOT/etc/pam.d
-make install DESTDIR=$RPM_BUILD_ROOT DESTMAN=$RPM_BUILD_ROOT%{_mandir}
-mkdir -pm700 $RPM_BUILD_ROOT/var/spool/cron
-mkdir -pm755 $RPM_BUILD_ROOT/etc/cron.d
-install -pm755 %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/crond
-mkdir -p $RPM_BUILD_ROOT/etc/sysconfig/
-cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/crond
-%if ! %{WITH_PAM}
-	rm -rf $RPM_BUILD_ROOT/etc/pam.d
-%endif
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%post
-/sbin/chkconfig --add crond
-[ ! -f /etc/cron.allow ] && [ ! -f /etc/cron.deny ] && touch /etc/cron.deny ||:;
- 
-%preun
-if [ $1 = 0 ]; then
-	/sbin/service crond stop >/dev/null 2>&1 || :
-	/sbin/chkconfig --del crond
-fi
-
-%postun
-if [ "$1" -ge "1" ]; then
-	/sbin/service crond condrestart >/dev/null 2>&1
-fi
-
-%triggerpostun -- vixie-cron < 3.0.1-56
-/sbin/chkconfig --del crond
-/sbin/chkconfig --add crond
-
-%files
-%defattr(-,root,root,-)
-%{_sbindir}/crond
-%attr(6755,root,root) %{_bindir}/crontab
-%{_mandir}/man8/crond.*
-%{_mandir}/man8/cron.*
-%{_mandir}/man5/crontab.*
-%{_mandir}/man1/crontab.*
-%attr(700,root,root) %dir /var/spool/cron
-%attr(700,root,root) %dir /etc/cron.d
-%attr(755,root,root) /etc/rc.d/init.d/crond
-%if %{WITH_PAM}   
-	%attr(0644,root,root) %config(noreplace) /etc/pam.d/crond
-%endif
-%config(noreplace) /etc/sysconfig/crond
-
-%changelog
-* Thu Apr 12 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-82
-- removed bz220376.patch
-- change in manual - using jobs in cron.d
-- Resolves: rhbz#235932, rhbz#235998
-
-* Tue Apr 10 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-81
-- hard link from /etc/crontab cause stop running jobs
-- rhbz#235880
-
-* Thu Apr  5 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-80
-- jobs from RH_CROND_DIR wasn't "sometimes" run
-- rhbz#220376
-
-* Thu Mar 07 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-79
-- merge review
-
-* Mon Mar 05 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-76
-- rhbz#226529 merge review
-
-* Wed Feb 28 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-75
-- rhbz#226529 merge review
-
-* Wed Feb  7 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-74
-- rhbz#223894
-
-* Mon Jan 29 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-73
-- symlinks again - change in symlinks.patch
-- rhbz#225078
-
-* Mon Jan 22 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-72
-- change in manual
-- rhbz#223532
-- rhbz#223662, rhbz#222464
-
-* Tue Jan 16 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-70
-- change in manual
-
-* Fri Jan 10 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-69
-- patch from bz - Cron does not detect changed symlink
-- rhbz#221856
-
-* Thu Dec 14 2006 Dan Walsh <dwalsh@redhat.com> - 4:4.1-68
-- Patch to run vixie-cron with mls correctly
-
-* Tue Oct 24 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-67
-- setexeccon in SELinux - patch from dwalsh
-- (#178836) - patch from bugzilla for "quick" editing crontab -e
-
-* Tue Sep 05 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-64
-- include system-auth for session in crond.pam, it now avoids
-  using pam_unix if the process is crond
-
-* Wed Aug 30 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-63
-- fix problem with selinux (#181439)
-
-* Mon Aug 28 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-61
-- changes in spec file (#204230)
-
-* Fri Aug 25 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-60
-- patch from Jose Plans fixed: Job delayed after using crontab -e
-
-* Fri Aug 25 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-59
-- small changes in man-page cron
-- (#203746) RFC3834, patch from James Ralston
-
-* Thu Jul 20 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-58
-- fix bug 199294: support for LSPP multiple per-job SELinux contexts
-- fix bug 198019: make database.c correct if crontab mtime changes 
-	while spool dir mtime does not.
-
-* Fri Jul 14 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-56.FC6
-- fix bug 198893 - change permissions of cron spool directories to 0700
-
-* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 4:4.1-55.FC6.1
-- rebuild
-
-* Tue May 30 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-55.FC6
-- fix bug 191823: fix missing BuildRequires: audit-libs-devel
-
-* Wed Feb 15 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-54.FC5
-- fix bug 181702: Requires:audit-libs, not Requires:audit
-
-* Tue Feb 14 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-52.FC5
-- fix bug 181439: enable easier selection of optional 'WITH_*'
-  compilation features
-
-* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 4:4.1-51.FC5.1
-- bump again for double-long bug on ppc(64)
-
-* Tue Feb 07 2006 Jason Vas Dias<jvdias@redhat.com> - 4.1-51.FC5
-- fix bug 180145: provide support for mail in non-ascii charsets
-
-* Thu Jan 26 2006 Jason Vas Dias<jvdias@redhat.com> - 4.1-50.FC5
-- fix bug 178436: prevent per-minute jobs being delayed into next minute
-- fix bug 178931: remove pam_unix and pam_krb5 from pam session stack
-
-* Tue Jan 10 2006 Jason Vas Dias<jvdias@redhat.com>
-- fix bug 177476: make minder/mailer process run as job user 
-  with user context; re-organize PAM and SELinux code 
- 
-* Thu Dec 15 2005 Jason Vas Dias<jvdias@redhat.com>
-- fix bug 172885: Replace Requires:sysklogd with Requires:syslog
-
-* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
-- rebuilt
-
-* Sun Nov 13 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-41.FC5
-- patches for IBM LSPP testing:
-- Steve Grubb's patch to emit audit log message on crontab denial
-- Use of sendmail unacceptable for LSPP: provide -m <mail command> option
-
-* Tue Oct 18 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-40.FC5
-- *** NOTE : please do not modify vixie-cron without contacting ***
-  *** the package maintainer (me at the moment).				***
-  *** Or at least test it first!								***
-- fix bug 170830: it was not the pam_stack change - the setuid
-  mode of crontab was dropped for some reason.
-- apply Dan's new getseuserbyname patch
-- somehow build_env() invocation was dropped - use pam_env settings.
-
-* Fri Oct 14 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-39-FC5
-- fix bug 170830: the last PAM change disabled all cron jobs.
-  backing out the new PAM configuration file until I've had a
-  chance to test it with replacement of pam_stack.so.
-
-* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> - 4.1-38.FC5
-- use include instead of pam_stack in pam config
-
-* Sat Aug 13 2005 Dan Walsh <dwalsh@redhat.com>  - 4.1-37.FC5
-- Change checkPasswdAccess to selinux_check_passwd_access for new selinux api
-
-* Mon Jul 11 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-36.FC4
-- fix bug 162887: allow multiple /etc/cron.d crontabs for *system* user
-- further fix for bug 154920 / CAN-2005-1038 ( crontab -e ):
-	invoke editor and copy operation as non-root user
-   
-* Fri Jun 17 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-FC4.34
-- fix bug 160811: FC3 version compared >= FC4 version
-- fix bug 159216: add pam_loginuid support for new audit system
-
-* Thu Apr 14 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-33_FC4
-- fix bug 154922 / CAN-2005-1038: check that new crontab is 
-	regular file after editor session ends.
-- fix bug 154575: use PATH_MAX (4096) as max filename length; also make 
-	limits on command line and env.var. lengths sensible (131072).
-
-* Fri Apr 08 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-32_FC4
-- do pam_close_session and pam_setcred(pamh, PAM_DELETE_CRED)
-- if fork fails
-
-* Thu Apr 07 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-30_FC4
-- fix bug 154065: crontab's job control broken: by 
--	xpid = waitpid(pid,&waiter,WUNTRACED);... 
--	if( WIFSTOPPED(waiter) )... kill(getpid(),WSTOPSIG(waiter));
-- crontab should not kill itself with SIGSTOP if its child
-- gets SIGSTOP; hence it does not need the waitpid WUNTRACED flag.
- 
-* Tue Apr 05 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-28_FC4
-- Required for EAL Audit certification: 
-- If pam_setcred should fail, the pam_session could fail to be
-- closed, leaving autofs user directories still mounted.
-
-* Tue Mar 15 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-26_FC4
-- fix bug 151145: segfault if cronjob runs without any SELinux user 
-- security context (eg. in a broken chroot environment)
-
-* Fri Feb 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-24_FC4
-- Add an /etc/sysconfig/crond file for containing CRONDARGS and
-- settings like CRON_VALIDATE_MAILRCPTS .
-
-* Fri Feb 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-24_FC4
-- Fix bug 147636 - disable silly mail recipient name checking 
-- (do_command.c's safe_p()) by default . Can be enabled by 
-- presence of CRON_VALIDATE_MAILRCPTS variable in crond's 
-- environment - also '_'s in MAILTOs are allowed.
-
-* Tue Jan 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-22
-- Fix bug 146073 - allow the 'pam_access' module to be used with
-- cron - set 'PAM_TTY' item to 'cron' .
-
-* Wed Dec 20 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-21
-- fix bug 142953 : allow read-only crontabs + provide -p 
-- 'permit all crontabs' option to disable mode checking. 
-
-* Wed Dec 20 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-21
-- fixed all uninitialized variable warnings
-
-* Fri Dec 03 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-20
-- Fix for ppc -m32 RPM_OPT_FLAGS compilation options
-- (bug 141760)
-
-* Fri Oct 15 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-19
-- crontab -e should only strip NHEADER_LINES comments 
-- (NHEADER_LINES==0), not at least one header comment line.
-- (bug 135845)
-
-* Sat Oct 09 2004 Florian La Roche <laroche@redhat.com> - 4.1-18
-- no need to make user installed crontabs readable
-
-* Thu Sep 30 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-17
-- Users not allowed to use 'crontab mycrontab', while
-- 'crontab < mycrontab' allowed; this is because misc.c's
-- swap_uids_back() was not using save_euid / save_egid .
-- Thanks to Mads Martin Joergensen <mmj@suse.de> for pointing this out.
-
-* Wed Sep 29 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-16
-- Just found out in testing that if neither /etc/cron.{deny,allow}
-- exist, root is unable to use crontab - I'm sure root could before,
-- but is in any case meant to be able to. Allowing root to use crontab.
-
-* Wed Sep 29 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-14
-- Fix for bug 130102 got dropped somehow from latest CVS.
-- This is now restored - in post, if neither /etc/cron.{deny,allow}
-- exist, touch /etc/cron.deny, to allow all users to use crontab,
-- as was previous default vixie-cron behaviour.
-
-* Fri Sep 17 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-12
-- Merged Dan's patch with vixie-cron-4.1-11 which was not 
-- latest version according to new CVS ?!?!
-
-* Fri Sep 17 2004 Dan Walsh <dwalsh@redhat.com>  - 4.1-12
-- Updated SELinux patch to use checkPasswdAccess
-
-* Tue Aug 31 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-11
-- Fixed SIGSEGV in free_user when !is_selinux_enabled() and crontab
-- has no valid jobs (bug 131390).
-
-* Wed Aug 18 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.10
-- Fixed bug 130102: Restored default behaviour if neither 
-- /etc/cron.deny nor /etc/cron.allow exist - 'touch /etc/cron.deny'
-- in post
-
-* Wed Aug 11 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.9
-- Removed 0600 mode enforcement as per Florian La Roche's request
-
-* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
-- Allowed editors such as 'gedit' which do not modify original
-- file, but which rename(2) a temp file to original, to be used
-- by crontab -e (bug 129170).
-
-* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
-- Added '-i' option to crontab to prompt the user before deleting
-- crontab with '-r'.
-
-* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
-- Added documentation for '@' nicknames to crontab.5
-- (bugs 107542, 89899). Also removed 'second when' (bug 59802). 
-
-* Sun Aug 1  2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.7
-- fixed bug 128924: 'cron' log facility not being used
-
-* Fri Jul 30 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.6
-- Added PAM 'auth sufficient pam_rootok.so' to /etc/pam.d/crond
-- (fixes bug 128843) - on dwalsh's advice.
-
-* Thu Jul 29 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-5
-- Added Buildrequires: pam-devel
-
-* Wed Jul 28 2004 Dan Walsh <dwalsh@redhat.com> - 4.1-4
-- Fix crontab to do SELinux checkaccess
-
-* Wed Jul 28 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-3
-- Fixed bug 128701: cron fails to parse user 6th field in
-- system crontabs (patch15)
-
-* Tue Jul 27 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-2
-- Changed 'Requires' dependency from 'pam-devel' to 'pam'.
-
-* Mon Jul 26 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
-- Added PAM access control support.
-
-* Thu Jul 22 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
-- Changed post-install to change mode of existing crontabs to
-- 0600 to allow run by new ISC cron 4.1 
-
-* Thu Jul 22 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
-- Upgraded to ISC cron 4.1
-
-* Thu Jul  1 2004 Jens Petersen <petersen@redhat.com> - 3.0.1-94
-- add vixie-cron-3.0.1-cron-descriptors-125110.patch to close std descriptors
-  when forking (Bernd Schmidt, 121280)
-- add vixie-cron-3.0.1-no-crontab-header-89809.patch to not prepend header to
-  crontab files (Damian Menscher, 103899)
-- fix use of RETVAL in init.d script (Enrico Scholz, 97784)
-- add safer malloc call to vixie-cron-3.0.1-sprintf.patch 
-- add cron-3.0.1-crontab-syntax-error-114386.patch to fix looping on crontab
-  syntax error (Miloslav Trmac, 89937)
-
-* Fri Jun 25 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-93
-- Add fixes from NSA 
-
-* Tue Jun 22 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-92
-- Add fixes from NSA 
-
-* Tue Jun 15 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-91
-- Change patch to check SElinux properly, go back to using fname instead of uname
-
-* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Fri Jun 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-89
-- Fix patch
-
-* Fri Jun 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-88
-- Add patch to allow it to run in permissive mode.
-
-* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Wed Feb 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-86
-- Add security_getenforce check.
-
-* Mon Jan 26 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-85
-- Fix call to is_selinux_enabled()
-
-* Mon Dec 8 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-84
-- change daemon flag to 1
-
-* Wed Dec 3 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-83
-- Add daemon to make sure child is clean
-
-* Fri Nov  7 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-82
-- add vixie-cron-3.0.1-pie.patch to build crond as pie (#108414)
-  [Ulrich Drepper]
-- require libselinux and buildrequire libselinux-devel
-
-* Thu Oct 30 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-81.sel
-- turn on selinux
-
-* Tue Sep 30 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-80
-- add vixie-cron-3.0.1-vfork-105616.patch to use fork instead of vfork
-  (#105616) [report and patch from ian@caliban.org]
-- update vixie-cron-3.0.1-redhat.patch not to change DESTMAN redundantly
-  (it is overrriden in the spec file anyway)
-
-* Fri Sep 5 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-79
-- turn off selinux
-
-* Fri Sep 5 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-78.sel
-- turn on selinux
-
-* Tue Jul 29 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-77
-- Patch to run on SELinux
-
-* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
-- rebuilt
-
-* Wed Mar 19 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-75
-- add vixie-cron-3.0.1-root_-u-85879.patch from Valdis Kletnieks to allow
-  root to run "crontab -u <user>" even for users that aren't allowed to
-
-* Wed Feb 19 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-74
-- fix preun script typo (#75137) [reported by Peter Bieringer]
-
-* Tue Feb 11 2003 Bill Nottingham <notting@redhat.com> 3.0.1-73
-- don't set SIGCHLD to SIG_IGN and then try and wait... (#84046)
-
-* Fri Feb  7 2003 Nalin Dahyabhai <nalin@redhat.com> 3.0.1-72
-- adjust cron.d patch so that it ignores file with names that begin with '#'
-  or end with '~', '.rpmorig', '.rpmsave', or '.rpmnew'
-- merge hunk of buffer overflow patch into the cron.d patch
-
-* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
-- rebuilt
-
-* Wed Dec 11 2002 Tim Powers <timp@redhat.com> 3.0.1-70
-- rebuild on all arches
-
-* Sat Jul 20 2002 Akira TAGOH <tagoh@redhat.com> 3.0.1-69
-- vixie-cron-3.0.1-nonstrip.patch: applied to fix the stripped binary issue.
-
-* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Mon Jun 10 2002 Bill Huang <bhuang@redhat.com>
-- Fix preun bugs.(#55340)
-- Fix fprintf bugs.(#65209)
-
-* Thu May 23 2002 Tim Powers <timp@redhat.com>
-- automated rebuild
-
-* Mon Apr 15 2002 Bill Huang <bhuang@redhat.com>
-- Fixed #62963.
-
-* Thu Apr 04 2002 James McDermott <jmcdermo@redhat.com>
-- Alter behavior of crontab to take stdin as the default
-  behavior if no options are specified. 
-
-* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
-- Bump release + rebuild.
-
-* Thu Mar  8 2001 Bill Nottingham <notting@redhat.com>
-- add patch from Alan Eldridge <alane@geeksrus.net> to
-  fix double execution of jobs (#29868)
-
-* Mon Feb 11 2001 Bill Nottingham <notting@redhat.com>
-- fix buffer overflow in crontab
-
-* Wed Feb  7 2001 Trond Eivind Glomsrød <teg@redhat.com>
-- fix usage string in initscript (#26533)
-
-* Tue Feb  6 2001 Bill Nottingham <notting@redhat.com>
-- fix build with new glibc (#25931)
-
-* Tue Jan 23 2001 Bill Nottingham <notting@redhat.com>
-- change i18n mechanism
-
-* Fri Jan 19 2001 Bill Nottingham <notting@redhat.com>
-- log as 'crond', not 'CROND' (#19410)
-- account for shifts in system clock (#23230, patch from <pererik@onedial.se>)
-- i18n-ize initscript
-
-* Thu Aug 24 2000 Than Ngo <than@redhat.com>
-- fix to set startup position correct at update
-
-* Wed Aug 24 2000 Than Ngo <than@redhat.com>
-- add /sbin/service to Prereq
-- call /sbin/service instead service
-- fix startup position (Bug #13353)
-
-* Mon Aug  7 2000 Bill Nottingham <notting@redhat.com>
-- fix crond logging patch (dan@doom.cmc.msu.ru)
-- log via syslog (suggestion from jos@xos.nl)
-- put system crontab location in crontab(5) (#14842)
-
-* Fri Jul 28 2000 Bill Nottingham <notting@redhat.com>
-- fix condrestart
-
-* Fri Jul 21 2000 Bill Nottingham <notting@redhat.com>
-- fix reload bug (#14065)
-
-* Fri Jul 14 2000 Bill Nottingham <notting@redhat.com>
-- move initscript back
-
-* Thu Jul 13 2000 Prospector <bugzilla@redhat.com>
-- automatic rebuild
-
-* Thu Jul  6 2000 Bill Nottingham <notting@redhat.com>
-- prereq /etc/init.d
-
-* Mon Jul  3 2000 Bill Nottingham <notting@redhat.com>
-- fix post; we do condrestart in postun
-
-* Thu Jun 29 2000 Bill Nottingham <notting@redhat.com>
-- oops, fix init script
-
-* Tue Jun 27 2000 Bill Nottingham <notting@redhat.com>
-- require new initscripts, not prereq
-
-* Mon Jun 26 2000 Bill Nottingham <notting@redhat.com>
-- initscript hacks
-
-* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
-- tweak logrotate config
-
-* Sun Jun 11 2000 Bill Nottingham <notting@redhat.com>
-- rebuild in new env.
-- FHS fixes
-- don't ship chkconfig links
-
-* Fri Mar 31 2000 Bill Nottingham <notting@redhat.com>
-- fix non-root builds (#10490)
-
-* Sun Mar 26 2000 Florian La Roche <Florian.LaRoche@redhat.com>
-- do not remove log files
-
-* Thu Feb  3 2000 Bill Nottingham <notting@redhat.com>
-- handle compressed man pages
-
-* Fri Sep 10 1999 Bill Nottingham <notting@redhat.com>
-- chkconfig --del in preun, not postun
-
-* Wed Aug 25 1999 Bill Nottingham <notting@redhat.com>
-- fix buffer overflow
-
-* Mon Aug 16 1999 Bill Nottingham <notting@redhat.com>
-- initscript munging
-
-* Fri Jul 30 1999 Michael K. Johnson <johnsonm@redhat.com>
-- dayofmonth and month can't be 0
-
-* Thu Jun  3 1999 Jeff Johnson <jbj@redhat.com>
-- in cron.log use "kill -HUP pid" not killall to preserve errors (#2241).
-
-* Wed Apr 14 1999 Michael K. Johnson <johnsonm@redhat.com>
-- add note to man page about DST conversion causing strangeness
-- documented cron.d patch
-
-* Tue Apr 13 1999 Michael K. Johnson <johnsonm@redhat.com>
-- improved cron.d patch
-
-* Mon Apr 12 1999 Erik Troan <ewt@redhat.com>
-- added cron.d patch
-
-* Tue Mar 23 1999 Bill Nottingham <notting@redhat.com>
-- logrotate changes
-
-* Tue Mar 23 1999 Preston Brown <pbrown@redhat.com>
-- clean up log files on deinstallation
-
-* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com> 
-- auto rebuild in the new build environment (release 28)
-
-* Wed Dec 30 1998 Cristian Gafton <gafton@redhat.com>
-- build for glibc 2.1
-
-* Wed Jun 10 1998 Prospector System <bugs@redhat.com>
-- translations modified for de
-
-* Wed Jun 10 1998 Jeff Johnson <jbj@redhat.com>
-- reset SIGCHLD before grandchild execle (problem #732)
-
-* Sat May 02 1998 Cristian Gafton <gafton@redhat.com>
-- enhanced initscript
-
-* Mon Apr 27 1998 Prospector System <bugs@redhat.com>
-- translations modified for de, fr, tr
-
-* Thu Dec 11 1997 Cristian Gafton <gafton@redhat.com>
-- added a patch to get rid of the dangerous sprintf() calls
-- added BuildRoot and Prereq: /sbin/chkconfig
-
-* Sun Nov 09 1997 Michael K. Johnson <johnsonm@redhat.com>
-- fixed cron/crond dichotomy in init file.
-
-* Wed Oct 29 1997 Donnie Barnes <djb@redhat.com>
-- fixed bad init symlinks
-
-* Thu Oct 23 1997 Erik Troan <ewt@redhat.com>
-- force it to use SIGCHLD instead of defunct SIGCLD
-
-* Mon Oct 20 1997 Erik Troan <ewt@redhat.com>
-- updated for chkconfig
-- added status, restart options to init script
-
-* Tue Jun 17 1997 Erik Troan <ewt@redhat.com>
-- built against glibc
-
-* Wed Feb 19 1997 Erik Troan <ewt@redhat.com>
-- Switch conditional from "axp" to "alpha" 
-

vixie_cron-4.1-162887.patch

@@ -1,95 +0,0 @@
---- vixie-cron-4.1/structs.h.162887	2005-07-11 14:10:09.243826000 -0400
-+++ vixie-cron-4.1/structs.h	2005-07-11 13:33:59.348326000 -0400
-@@ -48,11 +48,12 @@
- typedef	struct _user {
- 	struct _user	*next, *prev;	/* links */
- 	char		*name;
-+        char            *tabname;       /* /etc/cron.d/ file name or NULL */
- 	time_t		mtime;		/* last modtime of crontab */
- 	entry		*crontab;	/* this person's crontab */
- #ifdef WITH_SELINUX
-         security_context_t scontext;    /* SELinux security context */
--#endif
-+#endif        
- } user;
- 
- typedef	struct _cron_db {
---- vixie-cron-4.1/funcs.h.162887	2005-07-11 14:10:09.234835000 -0400
-+++ vixie-cron-4.1/funcs.h	2005-07-11 13:40:43.401868000 -0400
-@@ -66,7 +66,7 @@
- 		**env_set(char **, char *);
- 
- user		*load_user(int, struct passwd *, const char *, const char *, const char *),
--		*find_user(cron_db *, const char *);
-+		*find_user(cron_db *, const char *, const char *);
- 
- entry		*load_entry(FILE *, void (*)(), struct passwd *, char **);
- 
---- vixie-cron-4.1/user.c.162887	2005-07-11 14:10:11.115952000 -0400
-+++ vixie-cron-4.1/user.c	2005-07-11 14:06:25.297996000 -0400
-@@ -99,6 +99,7 @@
- 	entry *e, *ne;
- 
- 	free(u->name);
-+	free(u->tabname);
- 	for (e = u->crontab;  e != NULL;  e = ne) {
- 		ne = e->next;
- 		free_entry(e);
-@@ -130,12 +131,16 @@
- 	 */
- 	if ((u = (user *) malloc(sizeof(user))) == NULL)
- 		return (NULL);
--	if ((u->name = strdup(fname)) == NULL) {
-+
-+	if ( ((u->name = strdup(fname)) == NULL) 
-+           ||((u->tabname = strdup(tabname)) == NULL)
-+           ){
- 		save_errno = errno;
- 		free(u);
- 		errno = save_errno;
- 		return (NULL);
- 	}
-+	
- 	u->crontab = NULL;
- 
- 	/* init environment.  this will be copied/augmented for each entry.
---- vixie-cron-4.1/database.c.162887	2005-07-11 14:10:10.769299000 -0400
-+++ vixie-cron-4.1/database.c	2005-07-11 13:44:49.568455000 -0400
-@@ -218,12 +218,15 @@
- }
- 
- user *
--find_user(cron_db *db, const char *name) {
-+find_user(cron_db *db, const char *name, const char *tabname) {
- 	user *u;
- 
- 	for (u = db->head;  u != NULL;  u = u->next)
--		if (strcmp(u->name, name) == 0)
--			break;
-+	    if (  (strcmp(u->name, name) == 0) 
-+		&&(   (tabname == NULL) 
-+		   || ( strcmp(tabname, u->tabname) == 0 )
-+		  )
-+	       ) break;
- 	return (u);
- }
- 
-@@ -234,6 +237,7 @@
- 	struct passwd *pw = NULL;
- 	int crontab_fd = OK - 1;
- 	user *u;
-+	int crond_crontab = (fname == NULL) && (strcmp(tabname, SYSCRONTAB) != 0);
- 
- 	if (fname == NULL) {
- 		/* must be set to something for logging purposes.
-@@ -280,7 +284,9 @@
- 	}
- 
- 	Debug(DLOAD, ("\t%s:", fname))
--	u = find_user(old_db, fname);
-+
-+	u = find_user(old_db, fname, crond_crontab ? tabname : NULL );
-+
- 	if (u != NULL) {
- 		/* if crontab has not changed since we last read it
- 		 * in, then we can just use our existing entry.