dist-git conversion

.gitignore

@@ -1 +1 @@
-vixie-cron-4.3.tar.gz
+vixie-cron-4.1.tar.gz

crond.sysconfig

@@ -0,0 +1,9 @@
+# Settings for the CRON daemon.
+# CRONDARGS= :  any extra command-line startup arguments for crond
+# CRON_VALIDATE_MAILRCPTS=1:a non-empty value of this variable will
+#                           enable vixie-cron-4.1's validation of 
+#                           mail recipient names, which would then be
+#                           restricted to contain only the chars
+#                           from this tr(1) set : [@!:%-_.,:alnum:]
+#                           otherwise mailing is not attempted.
+CRONDARGS=

dead.package

@@ -1 +0,0 @@
-Renamed to cronie.

sources

@@ -0,0 +1 @@
+84dc41e24852e497c21578446e5d9832  vixie-cron-4.1.tar.gz

vixie-cron-4.1-60_seconds.patch

@@ -0,0 +1,214 @@
+--- vixie-cron-4.1/cron.c.60_seconds	2006-01-11 15:16:47.000000000 -0500
++++ vixie-cron-4.1/cron.c	2006-01-11 20:02:08.000000000 -0500
+@@ -37,12 +37,14 @@
+ 		sigchld_handler(int),
+ 		sighup_handler(int),
+ 		sigchld_reaper(void),
++                sigusr1_handler(int),
+ 		quit(int),
+ 		parse_args(int c, char *v[]);
+ 
+ static	volatile sig_atomic_t	got_sighup, got_sigchld;
+-static	int			timeRunning, virtualTime, clockTime;
++static	int			timeRunning, virtualTime, clockTime, drift;
+ static	long			GMToff;
++static  struct timeval          time_last_job_run_tv={0,0};
+ 
+ static void
+ usage(void) {
+@@ -86,6 +88,8 @@
+ 	sact.sa_handler = quit;
+ 	(void) sigaction(SIGINT, &sact, NULL);
+ 	(void) sigaction(SIGTERM, &sact, NULL);
++	sact.sa_handler = sigusr1_handler;
++	(void) sigaction(SIGUSR1, &sact, NULL);
+ 
+ 	acquire_daemonlock(0);
+ 	set_cron_uid();
+@@ -137,6 +141,7 @@
+ 	set_time(TRUE);
+ 	run_reboot_jobs(&database);
+ 	timeRunning = virtualTime = clockTime;
++	drift = 0;
+ 
+ 	/*
+ 	 * Too many clocks, not enough time (Al. Einstein)
+@@ -151,6 +156,9 @@
+ 	while (TRUE) {
+ 		int timeDiff;
+ 		enum timejump wakeupKind;
++		struct timeval tv;
++		struct timezone tz={0,0};
++		struct timespec ts;
+ 
+ 		/* ... wait for the time (in minutes) to change ... */
+ 		do {
+@@ -159,6 +167,31 @@
+ 		} while (clockTime == timeRunning);
+ 		timeRunning = clockTime;
+ 
++		/* Ensure at least 60 seconds have elapsed between successive job runs.
++                 */
++		drift = 0;
++		if ( time_last_job_run_tv.tv_sec > 0 )
++		{
++		    gettimeofday(&tv,&tz);
++		    double time_since_last_job = 
++			( (((double)tv.tv_sec) + (((double)tv.tv_usec)/1000000.0))
++			 -( ((double)time_last_job_run_tv.tv_sec)
++			  +(((double)time_last_job_run_tv.tv_usec)/1000000.0)
++			  )
++			);
++		    memset(&time_last_job_run_tv,0,sizeof(struct timeval));
++		    if( time_since_last_job < 60.0 )
++		    {
++			double delay = (60.0 - time_since_last_job) 
++			             + (tv.tv_usec ? (((double)(1000000 - tv.tv_usec))/1000000.0) : 0);
++			ts.tv_sec = delay ;
++			drift = ts.tv_sec ;
++			ts.tv_nsec = ( delay - (double)ts.tv_sec ) * 1000000000;
++			Debug(DSCH,("DELAY: %lu %lu\n",ts.tv_sec,ts.tv_nsec));
++			nanosleep(&ts,0L);
++		    }
++		}
++ 
+ 		/*
+ 		 * Calculate how the current time differs from our virtual
+ 		 * clock.  Classify the change into one of 4 cases.
+@@ -362,7 +395,7 @@
+ 	int seconds_to_wait;
+ 
+ 	t1 = time(NULL) + GMToff;
+-	seconds_to_wait = (int)(target * SECONDS_PER_MINUTE - t1) + 1;
++	seconds_to_wait = (int)(target * SECONDS_PER_MINUTE - t1) + 1 + drift;
+ 	Debug(DSCH, ("[%ld] Target time=%ld, sec-to-wait=%d\n",
+ 	    (long)getpid(), (long)target*SECONDS_PER_MINUTE, seconds_to_wait))
+ 
+@@ -399,6 +432,12 @@
+ }
+ 
+ static void
++sigusr1_handler(int x) {
++    struct timezone tz={0,0}; /* UTC */
++    gettimeofday(&time_last_job_run_tv,&tz);
++}
++
++static void
+ quit(int x) {
+ 	(void) unlink(_PATH_CRON_PID);
+ 	_exit(0);
+--- vixie-cron-4.1/do_command.c.60_seconds	2006-01-11 15:16:47.000000000 -0500
++++ vixie-cron-4.1/do_command.c	2006-01-11 18:57:44.000000000 -0500
+@@ -25,15 +25,38 @@
+ 
+ #include "cron.h"
+ 
++/* Allow the job user process the 'CAP_KILL' capability to signal the time of
++   job execution to the main cron process - need capability includes:
++*/
++#include <sys/syscall.h>
++#include <sys/capability.h>
++#include <sys/prctl.h>
++#ifndef SYS_capset
++#ifndef __NR_capset
++#error  __NR_capset and SYS_capset undefined
++#else
++#define SYS_capset __NR_capset
++#endif
++#endif
++#ifndef SYS_capget
++#ifndef __NR_capget
++#error  __NR_capget and SYS_capget undefined
++#else
++#define SYS_capset __NR_capget
++#endif
++#endif
++
+ static void		child_process(entry *, user *);
+ static int		safe_p(const char *, const char *);
++static pid_t  crond_pid;
+ 
+ void
+ do_command(entry *e, user *u) {
+ 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
+ 		      (long)getpid(), e->cmd, u->name,
+ 		      (long)e->pwd->pw_uid, (long)e->pwd->pw_gid))
+-
++	    
++	crond_pid = getpid();
+ 	/* fork to become asynchronous -- parent process is done immediately,
+ 	 * and continues to run the normal cron code, which means return to
+ 	 * tick().  the child and grandchild don't leave this function, alive.
+@@ -67,6 +90,28 @@
+ 	int children = 0; 
+         char **jobenv=0L;
+ 
++	struct __user_cap_header_struct caphead;
++	struct __user_cap_data_struct cap;
++
++	/* Before we set the security context, allow the job user to inherit the CAP_KILL capability: */    
++
++	memset(&caphead, 0, sizeof(caphead));
++	memset(&cap, 0, sizeof(cap));
++	caphead.version = _LINUX_CAPABILITY_VERSION;
++	caphead.pid = 0;
++
++	if ( syscall(SYS_capget, &caphead, &cap) < 0)
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot get process capabilities:", strerror(errno));
++
++	cap.inheritable |= CAP_KILL ;
++	
++	if ( syscall(SYS_capset, &caphead, &cap) < 0) 
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set process capabilities:", strerror(errno));
++	
++	if ( prctl(PR_SET_KEEPCAPS,1,0,0,0) < 0 )
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot prctl(PR_SET_KEEPCAPS..):", strerror(errno));
++
++
+ 	/* Set up the Red Hat security context for both mail/minder and job processes:
+          */
+ 	if ( cron_set_job_security_context( e, u, &jobenv ) != 0 )
+@@ -75,6 +120,17 @@
+ 	    exit(ERROR_EXIT);
+ 	}
+ 
++	/* Now we are the job user, running in user context with non-root capabilities.
++	 * Add the CAP_KILL capability to our effective capability set:
++	 */
++	if ( syscall(SYS_capget, &caphead, &cap) < 0)
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot get process capabilities:", strerror(errno));
++	
++	cap.effective = cap.permitted ;
++
++	if ( syscall(SYS_capset, &caphead, &cap) < 0) 
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set process capabilities:", strerror(errno));
++
+ 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
+ 
+ #ifdef CAPITALIZE_FOR_PS
+@@ -230,8 +286,25 @@
+ 				_exit(OK_EXIT);
+ 			}
+ # endif /*DEBUGGING*/
++			/* tell crond main process we are running the job */
++			if( kill(crond_pid, SIGUSR1) == -1 )
++			    syslog(LOG_INFO, "CRON (%s) ERROR: kill failed: %s", e->pwd->pw_name, strerror(errno));
++
++			/* drop capabilities */
++			cap.permitted = 0;
++			cap.effective = 0;
++			cap.inheritable=0;
++			if( syscall(SYS_capset, &caphead, &cap) < 0 )
++			    syslog(LOG_INFO, "CRON (%s) ERROR: capset (DROP) failed: %s", e->pwd->pw_name,
++				   strerror(errno));
++			if( prctl(PR_SET_KEEPCAPS,0,0,0,0) < 0 )
++			    syslog(LOG_INFO, "CRON (%s) ERROR: prctl clear KEEPCAPS failed: %s", e->pwd->pw_name,
++				   strerror(errno));
+ 
++			/*** RUN THE COMMAND ***/
++			
+ 			execle(shell, shell, "-c", e->cmd, (char *)0, jobenv);
++			
+ 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
+ 			perror("execl");
+ 			_exit(ERROR_EXIT);

vixie-cron-4.1-CAN-2005-1038-fix-race.patch

@@ -0,0 +1,57 @@
+--- vixie-cron-4.1/crontab.c.CAN-2005-1038-fix-race	2005-07-11 15:23:53.071138000 -0400
++++ vixie-cron-4.1/crontab.c	2005-07-11 17:36:33.841535000 -0400
+@@ -488,33 +488,39 @@
+ 	(void)signal(SIGHUP, SIG_DFL);
+ 	(void)signal(SIGINT, SIG_DFL);
+ 	(void)signal(SIGQUIT, SIG_DFL);      
++
+ 	if (lstat(Filename, &statbuf) < 0) {
+-		perror("fstat");
++		perror("lstat");
+ 		goto fatal;
+ 	}
+-	if (utimebuf.modtime == statbuf.st_mtime) {
+-		fprintf(stderr, "%s: no changes made to crontab\n",
+-			ProgramName);
+-		goto remove;
+-	}
+ 
+-	if (  (!S_ISREG(statbuf.st_mode))
+-	    ||(S_ISLNK(statbuf.st_mode))
+-	    ||(S_ISDIR(statbuf.st_mode))
+-            ||(S_ISCHR(statbuf.st_mode))
+-	    ||(S_ISBLK(statbuf.st_mode))
+-            ||(S_ISFIFO(statbuf.st_mode))
+-	    ||(S_ISSOCK(statbuf.st_mode))
+-	    )
++	if ( !S_ISREG(statbuf.st_mode) )
+ 	{
+ 	    fprintf(stderr, "%s: illegal crontab\n",
+ 			ProgramName);
+ 		goto remove;	    
+ 	}
+ 
++	if (utimebuf.modtime == statbuf.st_mtime) {
++		fprintf(stderr, "%s: no changes made to crontab\n",
++			ProgramName);
++		goto remove;
++	}
++
+ 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
+         fclose(NewCrontab);
+-	NewCrontab=fopen(Filename,"r+");
++	if (swap_uids() < OK) {
++	    perror("swapping uids");
++	    goto remove;
++	}
++	if (!(NewCrontab = fopen(Filename, "r+"))) {
++	    perror("cannot read new crontab");
++	    goto remove;	    
++	}
++	if (swap_uids_back() < OK) {
++	    perror("swapping uids back");
++	    exit(ERROR_EXIT);
++	}
+ 	if( NewCrontab == 0L )
+ 	{
+ 	    perror("fopen");

vixie-cron-4.1-_0_rh_Makefile.patch

@@ -0,0 +1,55 @@
+--- vixie-cron-4.1-rh/Makefile.rh-Makefile	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1-rh/Makefile	2004-07-22 11:05:43.000000000 -0400
+@@ -62,7 +62,8 @@
+ LIBS		=
+ #<<optimize or debug?>>
+ #CDEBUG		=	-O
+-CDEBUG		=	-g
++#CDEBUG		=	-g
++CDEBUG		=       $(RPM_OPT_FLAGS)
+ #<<lint flags of choice?>>
+ LINTFLAGS	=	-hbxa $(INCLUDE) $(DEBUGGING)
+ #<<want to use a nonstandard CC?>>
+@@ -104,27 +105,30 @@
+ 			|grep -v "constant argument to NOT" 2>&1
+ 
+ cron		:	$(CRON_OBJ)
+-			$(CC) $(LDFLAGS) -o cron $(CRON_OBJ) $(LIBS)
++			$(CC) $(LDFLAGS) -o cron -pie $(CRON_OBJ) $(LIBS)
+ 
+ crontab		:	$(CRONTAB_OBJ)
+ 			$(CC) $(LDFLAGS) -o crontab $(CRONTAB_OBJ) $(LIBS)
+ 
+ install		:	all
+-			$(INSTALL) -c -m  111 -o root -s cron    $(DESTSBIN)/
+-			$(INSTALL) -c -m 4111 -o root -s crontab $(DESTBIN)/
++			$(INSTALL) -c -m 755 cron    $(DESTSBIN)/crond
++			$(INSTALL) -c -m 4755 crontab $(DESTBIN)/
+ #			$(INSTALL) -c -m  111 -o root -g crontab -s cron $(DESTSBIN)/
+ #			$(INSTALL) -c -m 2111 -o root -g crontab -s crontab $(DESTBIN)/
+ 			sh putman.sh crontab.1 $(DESTMAN)
++			chmod 644 $(DESTMAN)/man1/crontab.1
+ 			sh putman.sh cron.8    $(DESTMAN)
++			chmod 644 $(DESTMAN)/man8/cron.8
++			ln -sf cron.8 $(DESTMAN)/man8/crond.8
+ 			sh putman.sh crontab.5 $(DESTMAN)
++			chmod 644 $(DESTMAN)/man5/crontab.5
+ 
+ distclean	:	clean
+ 			rm -f *.orig *.rej *.BAK *.CKP *~ #*
+ 			rm -f a.out core tags
+ 
+ clean		:
+-			rm -f *.o
+-			rm -f cron crontab
++			rm -f *.o cron crontab a.out core tags *~ #*
+ 
+ tags		:;	ctags ${SOURCES}
+ 
+@@ -133,3 +137,6 @@
+ 
+ $(CRON_OBJ)	:	cron.h config.h externs.h pathnames.h Makefile
+ $(CRONTAB_OBJ)	:	cron.h config.h externs.h pathnames.h Makefile
++
++$(CRON_OBJ): %.o: %.c
++	$(CC) $(CFLAGS) -fpie -c $<

vixie-cron-4.1-_10_manpages.patch

@@ -0,0 +1,77 @@
+--- vixie-cron-4.1-rh/cron.8.manpages	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/cron.8	2004-07-22 12:26:36.000000000 -0400
+@@ -36,10 +36,11 @@
+ starting it out of init.
+ .PP
+ .I Cron
+-searches /var/cron/tabs for crontab files which are named after accounts in
++searches /var/spool/cron for crontab files which are named after accounts in
+ /etc/passwd; crontabs found are loaded into memory.
+ .I Cron
+-also searches for /etc/crontab which is in a different format (see
++also searches for /etc/crontab and the files in the /etc/cron.d directory,
++which are in a different format (see
+ .IR crontab (5)).
+ .I Cron
+ then wakes up every minute, examining all stored crontabs, checking each
+--- vixie-cron-4.1-rh/crontab.1.manpages	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/crontab.1	2004-07-22 12:20:10.000000000 -0400
+@@ -88,8 +88,8 @@
+ crontab(5), cron(8)
+ .SH FILES
+ .nf
+-/var/cron/cron.allow
+-/var/cron/cron.deny
++/etc/cron.allow
++/etc/cron.deny
+ .fi
+ .SH STANDARDS
+ The
+--- vixie-cron-4.1-rh/crontab.5.manpages	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/crontab.5	2004-07-22 12:32:07.000000000 -0400
+@@ -86,8 +86,15 @@
+ .I and
+ when at least one of the two day fields (day of month, or day of week)
+ match the current time (see ``Note'' below).
++Note that this means that non-existant times, such as "missing hours"
++during daylight savings conversion, will never match, causing jobs
++scheduled during the "missing times" not to be run.  Similarly, times
++that occur more than once (again, during daylight savings conversion)
++will cause matching jobs to be run twice.
++.PP
+ .IR cron (8)
+ examines cron entries once every minute.
++.PP
+ The time and date fields are:
+ .IP
+ .ta 1.5i
+@@ -101,7 +108,7 @@
+ .br
+ day of month	1-31
+ .br
+-month	0-12 (or names, see below)
++month	1-12 (or names, see below)
+ .br
+ day of week	0-7 (0 or 7 is Sun, or use names)
+ .br
+@@ -164,6 +171,9 @@
+ 23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"
+ 5 4 * * sun     echo "run at 5 after 4 every sunday"
+ .fi
++.SH FILES
++/etc/crontab			System crontab file
++
+ .SH SEE ALSO
+ cron(8), crontab(1)
+ .SH EXTENSIONS
+--- vixie-cron-4.1-rh/FEATURES.manpages	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/FEATURES	2004-07-22 12:27:54.000000000 -0400
+@@ -82,3 +82,8 @@
+ 	act this way and do the more reasonable thing, which is (IMHO) to "or"
+ 	the various field-matches together.  In that sense this cron may not
+ 	be completely similar to some AT&T crons.
++
++--	If it exists, the /etc/cron.d/ directory is parsed like the cron
++	spool directory, except that the files in it are not user-specific
++	and are therefore read with /etc/crontab syntax (the user is
++	specified explicitly in the 6th column).

vixie-cron-4.1-_11_with_selinux.patch

@@ -0,0 +1,20 @@
+--- vixie-cron-4.1/Makefile.with-selinux	2004-07-22 13:01:52.000000000 -0400
++++ vixie-cron-4.1/Makefile	2004-07-22 13:31:06.000000000 -0400
+@@ -59,7 +59,7 @@
+ INCLUDE		=	-I.
+ #INCLUDE	=
+ #<<need getopt()>>
+-LIBS		=
++LIBS		= 	-lselinux
+ #<<optimize or debug?>>
+ #CDEBUG		=	-O
+ #CDEBUG		=	-g
+@@ -69,7 +69,7 @@
+ #<<want to use a nonstandard CC?>>
+ CC		=	gcc -Wall -Wno-unused -Wno-comment
+ #<<manifest defines>>
+-DEFS		=
++DEFS		=	-DWITH_SELINUX
+ #(SGI IRIX systems need this)
+ #DEFS		=	-D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>

vixie-cron-4.1-_12_pam.patch

@@ -0,0 +1,141 @@
+--- vixie-cron-4.1/do_command.c.pam	2004-07-26 10:50:32.294991000 -0400
++++ vixie-cron-4.1/do_command.c	2004-07-26 14:27:09.975300000 -0400
+@@ -25,9 +25,47 @@
+ 
+ #include "cron.h"
+ 
++#ifdef WITH_PAM
++static pam_handle_t *pamh = NULL;
++static const struct pam_conv conv = {
++	NULL
++};
++#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
++	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
++	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
++	pam_end(pamh, retcode); exit(1); \
++   }
++#endif
++
+ static void		child_process(entry *, user *);
+ static int		safe_p(const char *, const char *);
+ 
++/* Build up the job environment from the PAM environment plus the
++   crontab environment */
++static char ** build_env(char **cronenv)
++{
++        char **jobenv = cronenv;
++#if defined(WITH_PAM)
++        char **pamenv = pam_getenvlist(pamh);
++        char *cronvar;
++        int count = 0;
++
++        jobenv = env_copy(pamenv);
++
++        /* Now add the cron environment variables. Since env_set()
++           overwrites existing variables, this will let cron's
++           environment settings override pam's */
++
++        while ((cronvar = cronenv[count++])) {
++                if (!(jobenv = env_set(jobenv, cronvar))) {
++                        syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
++                        return NULL;
++                }
++        }
++#endif
++    return jobenv;
++}
++
+ void
+ do_command(entry *e, user *u) {
+ 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
+@@ -64,7 +102,11 @@
+ child_process(entry *e, user *u) {
+ 	int stdin_pipe[2], stdout_pipe[2];
+ 	char *input_data, *usernm, *mailto;
+-	int children = 0;
++	int children = 0; 
++#if defined(WITH_PAM)
++	int		retcode = 0;
++#endif
++
+ 
+ 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
+ 
+@@ -134,6 +176,17 @@
+ 		*p = '\0';
+ 	}
+ 
++#if defined(WITH_PAM)
++	retcode = pam_start("crond", usernm, &conv, &pamh);
++	PAM_FAIL_CHECK;
++	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
++	PAM_FAIL_CHECK;
++	retcode = pam_open_session(pamh, PAM_SILENT);
++	PAM_FAIL_CHECK;
++	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
++	PAM_FAIL_CHECK;
++#endif
++
+ 	/* fork again, this time so we can exec the user's command.
+ 	 */
+ 	switch (fork()) {
+@@ -528,6 +581,12 @@
+ 			Debug(DPROC, (", dumped core"))
+ 		Debug(DPROC, ("\n"))
+ 	}
++
++#if defined(WITH_PAM)
++	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
++	retcode = pam_close_session(pamh, PAM_SILENT);
++	pam_end(pamh, retcode);
++#endif
+ }
+ 
+ static int
+--- vixie-cron-4.1/cron.h.pam	2004-07-26 10:50:32.272016000 -0400
++++ vixie-cron-4.1/cron.h	2004-07-26 10:51:37.555665000 -0400
+@@ -30,12 +30,17 @@
+ 
+ #define CRON_VERSION "V5.0"
+ 
++#include "config.h"
++#include "externs.h"
++
+ #ifdef WITH_SELINUX
+ #include <selinux/selinux.h>
+ #endif
+ 
+-#include "config.h"
+-#include "externs.h"
++#ifdef WITH_PAM
++#include <security/pam_appl.h>
++#endif
++
+ #include "pathnames.h"
+ #include "macros.h"
+ #include "structs.h"
+--- vixie-cron-4.1/cron.8.pam	2004-07-26 10:50:32.676609000 -0400
++++ vixie-cron-4.1/cron.8	2004-07-26 15:46:43.399098000 -0400
+@@ -76,6 +76,12 @@
+ .PP
+ Time changes of more than 3 hours are considered to be corrections to
+ the clock or timezone, and the new time is used immediately.
++.SS PAM Access Control
++On Red Hat systems, crond now supports access control with PAM - see 
++.IR pam (8) .
++A PAM configuration file for crond is installed in /etc/pam.d/crond .
++crond loads the PAM environment from the pam_env module, but these
++can be overriden by settings in the crontab file.
+ .SH SIGNALS
+ On receipt of a \s-2SIGHUP\s+2, the cron daemon will close and reopen its
+ log file.  This is useful in scripts which rotate and age log files.  
+@@ -88,7 +94,8 @@
+ In other words, it should be mode 0600.
+ .SH "SEE ALSO"
+ .IR crontab (1),
+-.IR crontab (5)
++.IR crontab (5),
++.IR pam (8)
+ .SH AUTHOR
+ .nf
+ Paul Vixie <vixie@isc.org>

vixie-cron-4.1-_13_with_pam.patch

@@ -0,0 +1,20 @@
+--- vixie-cron-4.1/Makefile.with_pam	2004-07-26 10:50:32.765520000 -0400
++++ vixie-cron-4.1/Makefile	2004-07-26 14:05:59.719827000 -0400
+@@ -59,7 +59,7 @@
+ INCLUDE		=	-I.
+ #INCLUDE	=
+ #<<need getopt()>>
+-LIBS		= 	-lselinux
++LIBS		= 	-lselinux -lpam -lpam_misc
+ #<<optimize or debug?>>
+ #CDEBUG		=	-O
+ #CDEBUG		=	-g
+@@ -69,7 +69,7 @@
+ #<<want to use a nonstandard CC?>>
+ CC		=	gcc -Wall -Wno-unused -Wno-comment
+ #<<manifest defines>>
+-DEFS		=	-DWITH_SELINUX
++DEFS		=	-DWITH_SELINUX -DWITH_PAM
+ #(SGI IRIX systems need this)
+ #DEFS		=	-D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>

vixie-cron-4.1-_14_pamd_crond.patch

@@ -0,0 +1,35 @@
+diff -Nru vixie-cron-4.1/crond.pam vixie-cron-4.1.pam/crond.pam
+--- vixie-cron-4.1/crond.pam	1969-12-31 19:00:00.000000000 -0500
++++ vixie-cron-4.1.pam/crond.pam	2004-07-26 13:42:16.662309000 -0400
+@@ -0,0 +1,12 @@
++#
++# The PAM configuration file for the cron daemon
++#
++#
++auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
++auth       required  pam_env.so
++account    required  /lib/security/$ISA/pam_stack.so service=system-auth
++session    required  /lib/security/$ISA/pam_stack.so service=system-auth
++# Sets up user limits, please uncomment and read /etc/security/limits.conf
++# to enable this functionality.
++# session    required   pam_limits.so
++#
+diff -Nru vixie-cron-4.1/Makefile vixie-cron-4.1.pam/Makefile
+--- vixie-cron-4.1/Makefile	2004-07-26 14:05:59.719827000 -0400
++++ vixie-cron-4.1.pam/Makefile	2004-07-26 15:17:04.121157000 -0400
+@@ -55,6 +55,7 @@
+ DESTSBIN	=	$(DESTROOT)/sbin
+ DESTBIN		=	$(DESTROOT)/bin
+ DESTMAN		=	$(DESTROOT)/share/man
++DESTETC		=	$(DESTROOT)/../etc
+ #<<need bitstring.h>>
+ INCLUDE		=	-I.
+ #INCLUDE	=
+@@ -113,6 +114,7 @@
+ install		:	all
+ 			$(INSTALL) -c -m 755 cron    $(DESTSBIN)/crond
+ 			$(INSTALL) -c -m 4755 crontab $(DESTBIN)/
++			$(INSTALL) -c -m 0600 crond.pam $(DESTETC)/pam.d/crond
+ #			$(INSTALL) -c -m  111 -o root -g crontab -s cron $(DESTSBIN)/
+ #			$(INSTALL) -c -m 2111 -o root -g crontab -s crontab $(DESTBIN)/
+ 			sh putman.sh crontab.1 $(DESTMAN)

vixie-cron-4.1-_15_system_crontab_user.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/database.c.system-crontab-user	2004-07-28 10:33:13.601263000 -0400
++++ vixie-cron-4.1/database.c	2004-07-28 10:33:34.424419000 -0400
+@@ -133,7 +133,7 @@
+ 		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
+ 			continue;	/* XXX log? */
+ 
+-		process_crontab("root", "*system*", tabname,
++		process_crontab("root", NULL, tabname,
+ 				&crond_stat, &new_db, old_db);
+ 	}
+ 	closedir(dir);

vixie-cron-4.1-_16_crontab_selinux.patch

@@ -0,0 +1,86 @@
+--- vixie-cron-4.1/crontab.c.crontab_selinux	2004-07-28 13:46:04.514451709 -0400
++++ vixie-cron-4.1/crontab.c	2004-07-28 14:11:07.999614447 -0400
+@@ -31,6 +31,39 @@
+ #define	MAIN_PROGRAM
+ 
+ #include "cron.h"
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/flask.h>
++#include <selinux/av_permissions.h>
++#include <selinux/context.h>
++
++static int checkAccess(int selaccess) {
++	int status=-1;
++	security_context_t user_context;
++	if (is_selinux_enabled() == 0) 
++		return 0;
++	if( getprevcon(&user_context)==0 ) {
++		struct av_decision avd;
++		int retval = security_compute_av(user_context,
++						 user_context,
++						 SECCLASS_PASSWD,
++						 selaccess,
++						 &avd);
++		
++		if ((retval == 0) && 
++		    ((selaccess & avd.allowed) == selaccess)) {
++			status=0;
++		}
++		freecon(user_context);
++	}
++	
++	if (status != 0 && security_getenforce()==0) 
++		status=0;
++	
++	return status;
++}
++#endif
++
+ 
+ #define NHEADER_LINES 0
+ 
+@@ -155,6 +188,13 @@
+ 					"must be privileged to use -u\n");
+ 				exit(ERROR_EXIT);
+ 			}
++#ifdef WITH_SELINUX
++			if (checkAccess(PASSWD__ROOTOK)!=0) {
++				fprintf(stderr,
++					"Access denied by SELinux, must be privileged to use -u\n");
++				exit(ERROR_EXIT);
++			}
++#endif
+ 			if (!(pw = getpwnam(optarg))) {
+ 				fprintf(stderr, "%s:  user `%s' unknown\n",
+ 					ProgramName, optarg);
+--- vixie-cron-4.1/user.c.crontab_selinux	2004-07-28 13:46:04.480455523 -0400
++++ vixie-cron-4.1/user.c	2004-07-28 14:02:19.777972399 -0400
+@@ -30,15 +30,16 @@
+ #include <selinux/selinux.h>
+ #include <selinux/flask.h>
+ #include <selinux/av_permissions.h>
++#include <selinux/get_context_list.h>
+ #endif
+ 
+ #include "cron.h"
+ 
+ #ifdef WITH_SELINUX
+-static	int get_security_context(char *name, 
++static	int get_security_context(const char *name, 
+ 				 int crontab_fd, 
+ 				 security_context_t *rcontext, 
+-				 char *tabname) {
++				 const char *tabname) {
+ 	security_context_t scontext;
+ 	security_context_t  file_context=NULL;
+ 	struct av_decision avd;
+@@ -147,7 +148,7 @@
+ 
+ #ifdef WITH_SELINUX
+ 	if (is_selinux_enabled() > 0) {
+-		char *sname=uname;
++		const char *sname=uname;
+ 		if (pw==NULL) {
+ 			sname="system_u";
+ 		}

vixie-cron-4.1-_17_pam-rootok.patch

@@ -0,0 +1,10 @@
+--- vixie-cron-4.1/crond.pam.pam-rootok	2004-07-29 09:21:11.000000000 -0400
++++ vixie-cron-4.1/crond.pam	2004-07-30 14:59:04.508666000 -0400
+@@ -2,6 +2,7 @@
+ # The PAM configuration file for the cron daemon
+ #
+ #
++auth	   sufficient /lib/security/$ISA/pam_rootok.so
+ auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
+ auth       required  pam_env.so
+ account    required  /lib/security/$ISA/pam_stack.so service=system-auth

vixie-cron-4.1-_18_cron_log_facility.patch

@@ -0,0 +1,10 @@
+--- vixie-cron-4.1/do_command.c.cron_log_facility	2004-08-01 16:12:31.982801000 -0400
++++ vixie-cron-4.1/do_command.c	2004-08-01 16:12:32.290493000 -0400
+@@ -185,6 +185,7 @@
+ 	PAM_FAIL_CHECK;
+ 	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+ 	PAM_FAIL_CHECK;
++	log_close(); /* PAM has now re-opened our log to auth.info ! */
+ #endif
+ 
+ 	/* fork again, this time so we can exec the user's command.

vixie-cron-4.1-_19_crontab_stat_not_fstat.patch

@@ -0,0 +1,27 @@
+--- vixie-cron-4.1/crontab.c.crontab_stat_not_fstat	2004-08-10 10:50:31.601288000 -0400
++++ vixie-cron-4.1/crontab.c	2004-08-10 12:38:07.911595000 -0400
+@@ -502,8 +502,8 @@
+ 	}
+ 	(void)signal(SIGHUP, SIG_DFL);
+ 	(void)signal(SIGINT, SIG_DFL);
+-	(void)signal(SIGQUIT, SIG_DFL);
+-	if (fstat(t, &statbuf) < 0) {
++	(void)signal(SIGQUIT, SIG_DFL);      
++	if (stat(Filename, &statbuf) < 0) {
+ 		perror("fstat");
+ 		goto fatal;
+ 	}
+@@ -513,6 +513,13 @@
+ 		goto remove;
+ 	}
+ 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
++        fclose(NewCrontab);
++	NewCrontab=fopen(Filename,"r+");
++	if( NewCrontab == 0L )
++	{
++	    perror("fopen");
++	    goto fatal;
++	}
+ 	switch (replace_cmd()) {
+ 	case 0:
+ 		break;

vixie-cron-4.1-_1_rh_pathnames.patch

@@ -0,0 +1,56 @@
+--- vixie-cron-4.1-rh/pathnames.h.rh_pathnames	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1-rh/pathnames.h	2004-07-22 10:12:44.000000000 -0400
+@@ -35,7 +35,7 @@
+ 			 * to; SPOOL_DIR, CRON_ALLOW, CRON_DENY, and LOG_FILE
+ 			 * are all relative to this directory.
+ 			 */
+-#define CRONDIR		"/var/cron"
++#define CRONDIR		"/var/spool"
+ #endif
+ 
+ 			/* SPOOLDIR is where the crontabs live.
+@@ -46,13 +46,13 @@
+ 			 * newer than they were last time around (or which
+ 			 * didn't exist last time around...)
+ 			 */
+-#define SPOOL_DIR	"tabs"
++#define SPOOL_DIR	"cron"
+ 
+ 			/* cron allow/deny file.  At least cron.deny must
+ 			 * exist for ordinary users to run crontab.
+ 			 */
+-#define	CRON_ALLOW	"cron.allow"
+-#define	CRON_DENY	"cron.deny"
++#define	CRON_ALLOW	"/etc/cron.allow"
++#define	CRON_DENY	"/etc/cron.deny"
+ 
+ 			/* undefining this turns off logging to a file.  If
+ 			 * neither LOG_FILE or SYSLOG is defined, we don't log.
+@@ -60,8 +60,8 @@
+ 			 * LOG_CRON is defined by <syslog.h>, LOG_FILE will not
+ 			 * be used.
+ 			 */
+-#define LOG_FILE	"log"
+-
++/*#define LOG_FILE	"/var/log/cron"*/
++#define SYSLOG
+ 			/* where should the daemon stick its PID?
+ 			 * PIDDIR must end in '/'.
+ 			 */
+@@ -70,12 +70,15 @@
+ #else
+ # define PIDDIR "/etc/"
+ #endif
+-#define PIDFILE		"cron.pid"
++#define PIDFILE		"crond.pid"
+ #define _PATH_CRON_PID	PIDDIR PIDFILE
+ 
+ 			/* 4.3BSD-style crontab */
+ #define SYSCRONTAB	"/etc/crontab"
+ 
++                        /* Red Hat crond crontab dir */ 
++#define RH_CROND_DIR    "/etc/cron.d"
++
+ 			/* what editor to use if no EDITOR or VISUAL
+ 			 * environment variable specified.
+ 			 */

vixie-cron-4.1-_20_nickname_man.patch

@@ -0,0 +1,33 @@
+--- vixie-cron-4.1/crontab.5.nickname_man	2004-08-10 13:25:05.286941000 -0400
++++ vixie-cron-4.1/crontab.5	2004-08-10 15:31:39.817971000 -0400
+@@ -84,9 +84,9 @@
+ .IR cron (8)
+ when the minute, hour, and month of year fields match the current time,
+ .I and
+-when at least one of the two day fields (day of month, or day of week)
++at least one of the two day fields (day of month, or day of week)
+ match the current time (see ``Note'' below).
+-Note that this means that non-existant times, such as "missing hours"
++Note that this means that non-existent times, such as "missing hours"
+ during daylight savings conversion, will never match, causing jobs
+ scheduled during the "missing times" not to be run.  Similarly, times
+ that occur more than once (again, during daylight savings conversion)
+@@ -194,6 +194,18 @@
+ mailed to a person other than the crontab owner (SysV can't do this), or the
+ feature can be turned off and no mail will be sent at all (SysV can't do this
+ either).
++.PP
++These special time specification "nicknames" are supported, which replace
++the 5 initial time and date fields, and are prefixed by the '@' character:
++.nf
++@reboot    :    Run once, at startup.
++@yearly    :    Run once a year, ie.  "0 0 1 1 *".
++@annually  :    Run once a year, ie.  "0 0 1 1 *".
++@monthly   :    Run once a month, ie. "0 0 1 * *".
++@weekly    :    Run once a week, ie.  "0 0 * * 0".
++@daily     :    Run once a day, ie.   "0 0 * * *".
++@hourly    :    Run once an hour, ie. "0 * * * *".
++.fi
+ .SH AUTHOR
+ .nf
+ Paul Vixie <vixie@isc.org>

vixie-cron-4.1-_21_-i_option.patch

@@ -0,0 +1,86 @@
+--- vixie-cron-4.1/crontab.c-i_option	2004-08-10 16:13:37.331529000 -0400
++++ vixie-cron-4.1/crontab.c	2004-08-10 16:24:14.132091000 -0400
+@@ -71,9 +71,9 @@
+ 
+ #if DEBUGGING
+ static char	*Options[] = { "???", "list", "delete", "edit", "replace" };
+-static char	*getoptargs = "u:lerx:";
++static char	*getoptargs = "u:lerix:";
+ #else
+-static char	*getoptargs = "u:ler";
++static char	*getoptargs = "u:leri";
+ #endif
+ 
+ static	PID_T		Pid;
+@@ -81,6 +81,7 @@
+ static	char		Filename[MAX_FNAME], TempFilename[MAX_FNAME];
+ static	FILE		*NewCrontab;
+ static	int		CheckErrorCount;
++static  int             PromptOnDelete;
+ static	enum opt_t	Option;
+ static	struct passwd	*pw;
+ static	void		list_cmd(void),
+@@ -101,6 +102,7 @@
+ 	fprintf(stderr, "\t-e\t(edit user's crontab)\n");
+ 	fprintf(stderr, "\t-l\t(list user's crontab)\n");
+ 	fprintf(stderr, "\t-r\t(delete user's crontab)\n");
++	fprintf(stderr, "\t-i\t(prompt before deleting user's crontab)\n");
+ 	exit(ERROR_EXIT);
+ }
+ 
+@@ -174,6 +176,7 @@
+ 	strcpy(RealUser, User);
+ 	Filename[0] = '\0';
+ 	Option = opt_unknown;
++	PromptOnDelete = 0;
+ 	while (-1 != (argch = getopt(argc, argv, getoptargs))) {
+ 		switch (argch) {
+ #if DEBUGGING
+@@ -219,6 +222,9 @@
+ 				usage("only one operation permitted");
+ 			Option = opt_edit;
+ 			break;
++		case 'i':
++       		        PromptOnDelete = 1;
++			break;
+ 		default:
+ 			usage("unrecognized option");
+ 		}
+@@ -304,6 +310,14 @@
+ static void
+ delete_cmd(void) {
+ 	char n[MAX_FNAME];
++	if( PromptOnDelete == 1 )
++	{
++	    printf("crontab: really delete %s's crontab? ", User);
++	    fflush(stdout);
++	    fgets(n, MAX_FNAME-1, stdin);
++	    if((n[0] != 'Y') && (n[0] != 'y'))
++		exit(0);
++	}
+ 
+ 	log_it(RealUser, Pid, "DELETE", User);
+ 	if (!glue_strings(n, sizeof n, SPOOL_DIR, User, '/')) {
+--- vixie-cron-4.1/crontab.1-i_option	2004-08-10 16:13:36.842019000 -0400
++++ vixie-cron-4.1/crontab.1	2004-08-10 16:13:37.441419000 -0400
+@@ -31,7 +31,7 @@
+ .B crontab
+ .RB [ -u
+ .IR user ]
+-.RB [ -l " | " -r " | " -e ]
++.RB [ -l " | " -r " | " -e ] [ -i ]
+ .SH DESCRIPTION
+ .I Crontab
+ is the program used to install, deinstall or list the tables
+@@ -84,6 +84,11 @@
+ option is used to edit the current crontab using the editor specified by
+ the \s-1VISUAL\s+1 or \s-1EDITOR\s+1 environment variables.  After you exit
+ from the editor, the modified crontab will be installed automatically.
++.PP
++The
++.I -i
++option modifies the -r option to prompt the user for a 'y/Y' response
++before actually removing the crontab.
+ .SH "SEE ALSO"
+ crontab(5), cron(8)
+ .SH FILES

vixie-cron-4.1-_22_no_0600_mode_enforce.patch

@@ -0,0 +1,42 @@
+--- vixie-cron-4.1/cron.8.no_0600_mode_enforce	2004-08-11 16:40:19.538738000 -0400
++++ vixie-cron-4.1/cron.8	2004-08-11 16:52:54.638882000 -0400
+@@ -90,8 +90,10 @@
+ .SH CAVEATS
+ In this version of
+ .BR cron ,
+-/etc/crontab must not be readable or writable by any user other than root.
+-In other words, it should be mode 0600.
++/etc/crontab must not be writable by any user other than root.
++No crontab files may be links, or linked to by any other file.
++No crontab files may be executable, or be writable by any user
++other than their owner.
+ .SH "SEE ALSO"
+ .IR crontab (1),
+ .IR crontab (5),
+--- vixie-cron-4.1/crontab.5.no_0600_mode_enforce	2004-08-11 16:40:19.951325000 -0400
++++ vixie-cron-4.1/crontab.5	2004-08-11 16:53:45.047423000 -0400
+@@ -206,6 +206,13 @@
+ @daily     :    Run once a day, ie.   "0 0 * * *".
+ @hourly    :    Run once an hour, ie. "0 * * * *".
+ .fi
++.SH CAVEATS
++In this version of
++.BR cron ,
++/etc/crontab must not be writable by any user other than root.
++No crontab files may be links, or linked to by any other file.
++No crontab files may be executable, or be writable by any user
++other than their owner.
+ .SH AUTHOR
+ .nf
+ Paul Vixie <vixie@isc.org>
+--- vixie-cron-4.1/database.c.no_0600_mode_enforce	2004-08-11 16:40:19.691585000 -0400
++++ vixie-cron-4.1/database.c	2004-08-11 16:45:35.564396000 -0400
+@@ -261,7 +261,7 @@
+ 		log_it(fname, getpid(), "NOT REGULAR", tabname);
+ 		goto next_crontab;
+ 	}
+-	if ((statbuf->st_mode & 07777) != 0600) {
++	if ((statbuf->st_mode & 07733) != 0600) {
+ 		log_it(fname, getpid(), "BAD FILE MODE", tabname);
+ 		goto next_crontab;
+ 	}

vixie-cron-4.1-_23_freecon_segv.patch

@@ -0,0 +1,22 @@
+--- vixie-cron-4.1/user.c.freecon_segv	2004-08-31 15:51:10.426657000 -0400
++++ vixie-cron-4.1/user.c	2004-08-31 16:33:34.196915000 -0400
+@@ -103,7 +103,8 @@
+ 		free_entry(e);
+ 	}
+ #ifdef WITH_SELINUX
+-	freecon(u->scontext);
++	if( u->scontext != NULL )
++	    freecon(u->scontext);
+ #endif	
+ 	free(u);
+ }
+@@ -159,7 +160,8 @@
+ 			u = NULL;
+ 			goto done;
+ 		}
+-	}
++	}else
++	    u->scontext = NULL;
+ #endif
+ 
+ 	/* load the crontab

vixie-cron-4.1-_24_crontab_selinux_new.patch

@@ -0,0 +1,55 @@
+--- vixie-cron-4.1/crontab.c.crontab_selinux_new	2004-09-17 11:42:45.484765000 -0400
++++ vixie-cron-4.1/crontab.c	2004-09-17 11:35:53.078584000 -0400
+@@ -33,35 +33,7 @@
+ #include "cron.h"
+ #ifdef WITH_SELINUX
+ #include <selinux/selinux.h>
+-#include <selinux/flask.h>
+ #include <selinux/av_permissions.h>
+-#include <selinux/context.h>
+-
+-static int checkAccess(int selaccess) {
+-	int status=-1;
+-	security_context_t user_context;
+-	if (is_selinux_enabled() == 0) 
+-		return 0;
+-	if( getprevcon(&user_context)==0 ) {
+-		struct av_decision avd;
+-		int retval = security_compute_av(user_context,
+-						 user_context,
+-						 SECCLASS_PASSWD,
+-						 selaccess,
+-						 &avd);
+-		
+-		if ((retval == 0) && 
+-		    ((selaccess & avd.allowed) == selaccess)) {
+-			status=0;
+-		}
+-		freecon(user_context);
+-	}
+-	
+-	if (status != 0 && security_getenforce()==0) 
+-		status=0;
+-	
+-	return status;
+-}
+ #endif
+ 
+ 
+@@ -192,10 +164,12 @@
+ 				exit(ERROR_EXIT);
+ 			}
+ #ifdef WITH_SELINUX
+-			if (checkAccess(PASSWD__ROOTOK)!=0) {
+-				fprintf(stderr,
+-					"Access denied by SELinux, must be privileged to use -u\n");
+-				exit(ERROR_EXIT);
++			if (is_selinux_enabled() > 0) {
++				if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0) {
++					fprintf(stderr,
++						"Access denied by SELinux, must be privileged to use -u\n");
++					exit(ERROR_EXIT);
++				}
+ 			}
+ #endif
+ 			if (!(pw = getpwnam(optarg))) {

vixie-cron-4.1-_25-allow-root-crontab.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/misc.c.allow-root-crontab	2004-09-29 10:40:43.447573000 -0400
++++ vixie-cron-4.1/misc.c	2004-09-29 11:39:21.145949000 -0400
+@@ -451,6 +451,8 @@
+ 	int	isallowed;
+ 	char    buf[128];
+ 
++	if ( getuid() == 0 )
++	    return TRUE;
+ 	isallowed = FALSE;
+ 	if ((fp = fopen(allow_file, "r")) != NULL) {
+ 		isallowed = in_file(username, fp, FALSE);

vixie-cron-4.1-_26-saved-uids.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/misc.c.saved_uids	2004-09-29 11:42:33.000000000 -0400
++++ vixie-cron-4.1/misc.c	2004-09-30 09:55:27.968181000 -0400
+@@ -696,7 +696,7 @@
+ }
+ 
+ int swap_uids_back(void) {
+-	return ((setegid(getgid()) || seteuid(getuid())) ? -1 : 0);
++	return ((setegid(save_egid) || seteuid(save_euid)) ? -1 : 0);
+ }
+ 
+ #else /*HAVE_SAVED_UIDS*/

vixie-cron-4.1-_27-no-strip-header-comments.patch

@@ -0,0 +1,25 @@
+--- vixie-cron-4.1/crontab.c.no-strip-header-comments	2004-10-13 10:59:17.000000000 -0400
++++ vixie-cron-4.1/crontab.c	2004-10-15 10:07:21.775111000 -0400
+@@ -381,10 +381,10 @@
+ 
+ 	Set_LineNum(1)
+ 
+-	/* ignore the top few comments since we probably put them there.
++	/* ignore the top NHEADER_LINES comment lines since we put them there.
+ 	 */
+ 	x = 0;
+-	while (EOF != (ch = get_char(f))) {
++	while ((x < NHEADER_LINES) && (EOF != (ch = get_char(f)))) {
+ 		if ('#' != ch) {
+ 			putc(ch, NewCrontab);
+ 			break;
+@@ -392,8 +392,7 @@
+ 		while (EOF != (ch = get_char(f)))
+ 			if (ch == '\n')
+ 				break;
+-		if (++x >= NHEADER_LINES)
+-			break;
++		++x;
+ 	}
+ 
+ 	/* copy the rest of the crontab (if any) to the temp file.

vixie-cron-4.1-_28-fix_ppc.patch

@@ -0,0 +1,22 @@
+--- vixie-cron-4.1/Makefile.fix_ppc	2004-12-03 17:08:36.425211000 -0500
++++ vixie-cron-4.1/Makefile	2004-12-03 17:09:14.264335000 -0500
+@@ -77,7 +77,7 @@
+ #INSTALL = installbsd
+ INSTALL = install
+ #<<any special load flags>>
+-LDFLAGS		=
++LDFLAGS		=	-g
+ #################################### end configurable stuff
+ 
+ SHELL		=	/bin/sh
+--- vixie-cron-4.1/crontab.c.fix_ppc	2004-12-03 17:08:37.138499000 -0500
++++ vixie-cron-4.1/crontab.c	2004-12-03 17:10:38.077437000 -0500
+@@ -318,7 +318,7 @@
+ edit_cmd(void) {
+ 	char n[MAX_FNAME], q[MAX_TEMPSTR], *editor;
+ 	FILE *f;
+-	int ch, t, x;
++	int ch='\0', t, x;
+ 	struct stat statbuf;
+ 	struct utimbuf utimebuf;
+ 	WAIT_T waiter;

vixie-cron-4.1-_29-permit_any_crontab_option.patch

@@ -0,0 +1,113 @@
+--- vixie-cron-4.1/cron.c.permit_any_crontab_option	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/cron.c	2005-01-11 13:17:00.944319000 -0500
+@@ -48,7 +48,7 @@
+ usage(void) {
+ 	const char **dflags;
+ 
+-	fprintf(stderr, "usage:  %s [-n] [-x [", ProgramName);
++	fprintf(stderr, "usage:  %s [-n] [-p] [-x [", ProgramName);
+ 	for (dflags = DebugFlagNames; *dflags; dflags++)
+ 		fprintf(stderr, "%s%s", *dflags, dflags[1] ? "," : "]");
+ 	fprintf(stderr, "]\n");
+@@ -434,7 +434,7 @@
+ parse_args(int argc, char *argv[]) {
+ 	int argch;
+ 
+-	while (-1 != (argch = getopt(argc, argv, "nx:"))) {
++	while (-1 != (argch = getopt(argc, argv, "npx:"))) {
+ 		switch (argch) {
+ 		default:
+ 			usage();
+@@ -445,6 +445,9 @@
+ 		case 'n':
+ 			NoFork = 1;
+ 			break;
++		case 'p':
++		        PermitAnyCrontab=1;
++			break;
+ 		}
+ 	}
+ }
+--- vixie-cron-4.1/database.c.permit_any_crontab_option	2005-01-11 12:47:58.363083000 -0500
++++ vixie-cron-4.1/database.c	2005-01-11 12:47:58.494951000 -0500
+@@ -257,22 +257,26 @@
+ 		log_it(fname, getpid(), "FSTAT FAILED", tabname);
+ 		goto next_crontab;
+ 	}
+-	if (!S_ISREG(statbuf->st_mode)) {
+-		log_it(fname, getpid(), "NOT REGULAR", tabname);
+-		goto next_crontab;
+-	}
+-	if ((statbuf->st_mode & 07733) != 0600) {
+-		log_it(fname, getpid(), "BAD FILE MODE", tabname);
+-		goto next_crontab;
+-	}
+-	if (statbuf->st_uid != ROOT_UID && (pw == NULL ||
+-	    statbuf->st_uid != pw->pw_uid || strcmp(uname, pw->pw_name) != 0)) {
+-		log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
+-		goto next_crontab;
+-	}
+-	if (statbuf->st_nlink != 1) {
+-		log_it(fname, getpid(), "BAD LINK COUNT", tabname);
+-		goto next_crontab;
++
++	if ( PermitAnyCrontab == 0 )
++	{
++	    if (!S_ISREG(statbuf->st_mode)) {
++		    log_it(fname, getpid(), "NOT REGULAR", tabname);
++		    goto next_crontab;
++	    }
++	    if ((statbuf->st_mode & 07533) != 0400) {
++		    log_it(fname, getpid(), "BAD FILE MODE", tabname);
++		    goto next_crontab;
++	    }
++	    if (statbuf->st_uid != ROOT_UID && (pw == NULL ||
++		statbuf->st_uid != pw->pw_uid || strcmp(uname, pw->pw_name) != 0)) {
++		    log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
++		    goto next_crontab;
++	    }
++	    if (statbuf->st_nlink != 1) {
++		    log_it(fname, getpid(), "BAD LINK COUNT", tabname);
++		    goto next_crontab;
++	    }
+ 	}
+ 
+ 	Debug(DLOAD, ("\t%s:", fname))
+--- vixie-cron-4.1/globals.h.permit_any_crontab_option	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/globals.h	2005-01-11 12:47:58.505940000 -0500
+@@ -63,6 +63,7 @@
+ XTRN int	LineNumber INIT(0);
+ XTRN time_t	StartTime INIT(0);
+ XTRN int	NoFork INIT(0);
++XTRN int        PermitAnyCrontab INIT(0);
+ 
+ #if DEBUGGING
+ XTRN int	DebugFlags INIT(0);
+--- vixie-cron-4.1/cron.8.permit_any_crontab_option	2005-01-11 12:47:58.341105000 -0500
++++ vixie-cron-4.1/cron.8	2005-01-11 12:47:58.516929000 -0500
+@@ -28,6 +28,7 @@
+ .RB [ \-l
+ .IR load_avg ]
+ .RB [ \-n ]
++.RB [ \-p ]
+ .SH DESCRIPTION
+ .I Cron
+ should be started from /etc/rc or /etc/rc.local.  It will return immediately,
+@@ -89,11 +90,12 @@
+ .IR syslog (3).
+ .SH CAVEATS
+ In this version of
+-.BR cron ,
+-/etc/crontab must not be writable by any user other than root.
+-No crontab files may be links, or linked to by any other file.
+-No crontab files may be executable, or be writable by any user
+-other than their owner.
++.BR cron
++, without the -p option,
++/etc/crontab must not be writable by any user other than root,
++no crontab files may be links, or linked to by any other file,
++and no crontab files may be executable, or be writable by any
++user other than their owner.
+ .SH "SEE ALSO"
+ .IR crontab (1),
+ .IR crontab (5),

vixie-cron-4.1-_2_config.patch

@@ -0,0 +1,32 @@
+--- vixie-cron-4.1/config.h.config	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/config.h	2004-07-22 14:06:03.000000000 -0400
+@@ -41,8 +41,9 @@
+ 			 * (hint: MAILTO= was added for this reason).
+ 			 */
+ 
+-#define MAILFMT "%s -FCronDaemon -odi -oem -oi -t" /*-*/
+-			/* -Fx	 = Set full-name of sender
++#define MAILFMT "%s -FCronDaemon -i -odi -oem -oi -t" /*-*/                        
++                        /* -i    = don't terminate on "." by itself
++			 * -Fx	 = Set full-name of sender
+ 			 * -odi	 = Option Deliverymode Interactive
+ 			 * -oem	 = Option Errors Mailedtosender
+ 			 * -oi   = Ignore "." alone on a line
+@@ -53,7 +54,7 @@
+ /* #define MAILFMT "%s -d %s"				/*-*/
+ 			/* -d = undocumented but common flag: deliver locally?
+ 			 */
+-/* #define MAILARG "/bin/mail",mailto
++/* #define MAILARG "/bin/mail",mailto                   /*-*/
+ 
+ /* #define MAILFMT "%s -mlrxto %s"			/*-*/
+ /* #define MAILARG "/usr/mmdf/bin/submit",mailto	/*-*/
+@@ -78,7 +79,7 @@
+ 			 * are both defined, then logging will go to both
+ 			 * places.
+ 			 */
+-#define SYSLOG	 			/*-*/
++#define SYSLOG	 			   
+ 
+ 			/* if you want cron to capitalize its name in ps
+ 			 * when running a job.  Does not work on SYSV.

vixie-cron-4.1-_30-uninitialized.patch

@@ -0,0 +1,33 @@
+--- vixie-cron-4.1/do_command.c.uninitialized	2005-01-11 12:36:55.551558000 -0500
++++ vixie-cron-4.1/do_command.c	2005-01-11 12:41:10.325529000 -0500
+@@ -446,7 +446,7 @@
+ 		int	ch = getc(in);
+ 
+ 		if (ch != EOF) {
+-			FILE	*mail;
++			FILE	*mail=0L;
+ 			int	bytes = 1;
+ 			int	status = 0;
+ 
+--- vixie-cron-4.1/pw_dup.c.uninitialized	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/pw_dup.c	2005-01-11 12:43:26.169549000 -0500
+@@ -47,7 +47,7 @@
+ struct passwd *
+ pw_dup(const struct passwd *pw) {
+ 	char		*cp;
+-	size_t		 nsize, psize, csize, gsize, dsize, ssize, total;
++	size_t		 nsize=0, psize=0, csize=0, gsize=0, dsize=0, ssize=0, total=0;
+ 	struct passwd	*newpw;
+ 
+ 	/* Allocate in one big chunk for easy freeing */
+--- vixie-cron-4.1/misc.c.uninitialized	2005-01-11 12:36:55.706403000 -0500
++++ vixie-cron-4.1/misc.c	2005-01-11 12:42:31.208565000 -0500
+@@ -274,7 +274,7 @@
+ 	char buf[3*MAX_FNAME];
+ 	const char *pidfile;
+ 	char *ep;
+-	long otherpid;
++	long otherpid=-1;
+ 	ssize_t num;
+ 
+ 	if (closeflag) {

vixie-cron-4.1-_31-allow_pam_access.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/do_command.c.allow_pam_access	2005-01-25 09:36:44.541828000 -0500
++++ vixie-cron-4.1/do_command.c	2005-01-25 10:08:20.435602000 -0500
+@@ -179,6 +179,8 @@
+ #if defined(WITH_PAM)
+ 	retcode = pam_start("crond", usernm, &conv, &pamh);
+ 	PAM_FAIL_CHECK;
++	retcode = pam_set_item(pamh, PAM_TTY, "cron");
++	PAM_FAIL_CHECK;
+ 	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
+ 	PAM_FAIL_CHECK;
+ 	retcode = pam_open_session(pamh, PAM_SILENT);

vixie-cron-4.1-_32-no_mail_rcpt_safe_p.patch

@@ -0,0 +1,37 @@
+--- vixie-cron-4.1/do_command.c.no_mail_rcpt_safe_p	2005-02-11 15:25:56.261994000 -0500
++++ vixie-cron-4.1/do_command.c	2005-02-11 16:04:34.519972000 -0500
+@@ -478,7 +478,11 @@
+ 			 * up the mail command and subjects and stuff...
+ 			 */
+ 
+-			if (mailto && safe_p(usernm, mailto)) {
++			if (mailto 
++			    &&( (ValidateMailRcpts==0) || safe_p(usernm, mailto) )
++                            /* Why validate the mail recipient name ? All mailers do this anyway... JVD */
++			   )
++			{ 
+ 				char	**env;
+ 				char	mailcmd[MAX_COMMAND];
+ 				char	hostname[MAXHOSTNAMELEN];
+--- vixie-cron-4.1/cron.c.no_mail_rcpt_safe_p	2005-02-11 15:25:56.157099000 -0500
++++ vixie-cron-4.1/cron.c	2005-02-11 16:01:12.732961000 -0500
+@@ -95,6 +95,9 @@
+ 		log_it("CRON", getpid(), "DEATH", "can't malloc");
+ 		exit(1);
+ 	}
++	
++	if ( getenv("CRON_VALIDATE_MAILRCPTS") != 0L )
++	    ValidateMailRcpts=1;
+ 
+ 	/* if there are no debug flags turned on, fork as a daemon should.
+ 	 */
+--- vixie-cron-4.1/globals.h.no_mail_rcpt_safe_p	2005-02-11 15:25:56.184073000 -0500
++++ vixie-cron-4.1/globals.h	2005-02-11 15:25:56.300955000 -0500
+@@ -64,6 +64,7 @@
+ XTRN time_t	StartTime INIT(0);
+ XTRN int	NoFork INIT(0);
+ XTRN int        PermitAnyCrontab INIT(0);
++XTRN int        ValidateMailRcpts INIT(0);
+ 
+ #if DEBUGGING
+ XTRN int	DebugFlags INIT(0);

vixie-cron-4.1-_33-fix_selinux_segfault.patch

@@ -0,0 +1,30 @@
+--- vixie-cron-4.1/user.c.fix_selinux_segfault	2005-03-15 08:34:08.143412000 -0500
++++ vixie-cron-4.1/user.c	2005-03-15 08:40:22.616563000 -0500
+@@ -40,7 +40,7 @@
+ 				 int crontab_fd, 
+ 				 security_context_t *rcontext, 
+ 				 const char *tabname) {
+-	security_context_t scontext;
++	security_context_t scontext=NULL;
+ 	security_context_t  file_context=NULL;
+ 	struct av_decision avd;
+ 	int retval=0;
+@@ -51,6 +51,7 @@
+ 			return -1;
+ 		} else {
+ 			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
++			return 0;
+ 		}
+ 	}
+ 	
+--- vixie-cron-4.1/do_command.c.fix_selinux_segfault	2005-03-15 08:34:08.720833000 -0500
++++ vixie-cron-4.1/do_command.c	2005-03-15 08:41:23.167952000 -0500
+@@ -330,7 +330,7 @@
+ # endif /*DEBUGGING*/
+ 
+ #ifdef WITH_SELINUX
+-			if (is_selinux_enabled() >0 ) {
++			if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
+ 				if (setexeccon(u->scontext) < 0) {
+ 					if (security_getenforce() > 0) {
+ 						fprintf(stderr, 

vixie-cron-4.1-_34-pam_fail_close_session.patch

@@ -0,0 +1,10 @@
+--- vixie-cron-4.1/do_command.c.pam_fail_close_session	2005-04-05 10:40:13.138078000 -0400
++++ vixie-cron-4.1/do_command.c	2005-04-05 10:44:42.008938000 -0400
+@@ -33,6 +33,7 @@
+ #define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
+ 	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
+ 	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
++	pam_close_session(pamh, PAM_SILENT); \
+ 	pam_end(pamh, retcode); exit(1); \
+    }
+ #endif

vixie-cron-4.1-_35-crontab-job-control.patch

@@ -0,0 +1,20 @@
+--- vixie-cron-4.1/crontab.c.job_control	2005-04-05 11:45:07.000000000 -0400
++++ vixie-cron-4.1/crontab.c	2005-04-07 13:07:42.851421000 -0400
+@@ -463,7 +463,7 @@
+ 
+ 	/* parent */
+ 	for (;;) {
+-		xpid = waitpid(pid, &waiter, WUNTRACED);
++		xpid = waitpid(pid, &waiter, 0);
+ 		if (xpid == -1) {
+ 			if (errno != EINTR)
+ 				fprintf(stderr, "%s: waitpid() failed waiting for PID %ld from \"%s\": %s\n",
+@@ -472,8 +472,6 @@
+ 			fprintf(stderr, "%s: wrong PID (%ld != %ld) from \"%s\"\n",
+ 				ProgramName, (long)xpid, (long)pid, editor);
+ 			goto fatal;
+-		} else if (WIFSTOPPED(waiter)) {
+-			kill(getpid(), WSTOPSIG(waiter));
+ 		} else if (WIFEXITED(waiter) && WEXITSTATUS(waiter)) {
+ 			fprintf(stderr, "%s: \"%s\" exited with status %d\n",
+ 				ProgramName, editor, WEXITSTATUS(waiter));

vixie-cron-4.1-_36-pam_close_fork_fail.patch

@@ -0,0 +1,14 @@
+--- vixie-cron-4.1/do_command.c.pam_close_fork_fail	2005-04-07 13:19:38.000000000 -0400
++++ vixie-cron-4.1/do_command.c	2005-04-08 12:13:45.354702000 -0400
+@@ -196,6 +196,11 @@
+ 	switch (fork()) {
+ 	case -1:
+ 		log_it("CRON", getpid(), "error", "can't fork");
++#ifdef WITH_PAM
++                pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
++                pam_close_session(pamh, PAM_SILENT);
++                pam_end(pamh, PAM_ABORT);
++#endif
+ 		exit(ERROR_EXIT);
+ 		/*NOTREACHED*/
+ 	case 0:

vixie-cron-4.1-_37-limits.patch

@@ -0,0 +1,19 @@
+--- vixie-cron-4.1/macros.h.limits	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/macros.h	2005-04-14 18:11:35.475147000 -0400
+@@ -44,11 +44,11 @@
+ #define STDERR		2	/*   stderr's? */
+ #define ERROR_EXIT	1	/* exit() with this will scare the shell */
+ #define	OK_EXIT		0	/* exit() with this is considered 'normal' */
+-#define	MAX_FNAME	100	/* max length of internally generated fn */
+-#define	MAX_COMMAND	1000	/* max length of internally generated cmd */
+-#define	MAX_ENVSTR	1000	/* max length of envvar=value\0 strings */
+-#define	MAX_TEMPSTR	100	/* obvious */
+-#define	MAX_UNAME	33	/* max length of username, should be overkill */
++#define	MAX_FNAME	PATH_MAX/* max length of internally generated fn */
++#define	MAX_COMMAND	131072	/* max length of internally generated cmd (max sh cmd line length) */
++#define	MAX_ENVSTR	131072	/* max length of envvar=value\0 strings */
++#define	MAX_TEMPSTR	131072	/* obvious */
++#define	MAX_UNAME	256	/* max length of username  */
+ #define	ROOT_UID	0	/* don't change this, it really must be root */
+ #define	ROOT_USER	"root"	/* ditto */
+ 

vixie-cron-4.1-_38-CAN-2005-1038.patch

@@ -0,0 +1,33 @@
+--- vixie-cron-4.1/crontab.c.CAN-2005-1038	2005-04-14 18:39:04.356618000 -0400
++++ vixie-cron-4.1/crontab.c	2005-04-14 18:43:50.262425000 -0400
+@@ -488,7 +488,7 @@
+ 	(void)signal(SIGHUP, SIG_DFL);
+ 	(void)signal(SIGINT, SIG_DFL);
+ 	(void)signal(SIGQUIT, SIG_DFL);      
+-	if (stat(Filename, &statbuf) < 0) {
++	if (lstat(Filename, &statbuf) < 0) {
+ 		perror("fstat");
+ 		goto fatal;
+ 	}
+@@ -497,6 +497,21 @@
+ 			ProgramName);
+ 		goto remove;
+ 	}
++
++	if (  (!S_ISREG(statbuf.st_mode))
++	    ||(S_ISLNK(statbuf.st_mode))
++	    ||(S_ISDIR(statbuf.st_mode))
++            ||(S_ISCHR(statbuf.st_mode))
++	    ||(S_ISBLK(statbuf.st_mode))
++            ||(S_ISFIFO(statbuf.st_mode))
++	    ||(S_ISSOCK(statbuf.st_mode))
++	    )
++	{
++	    fprintf(stderr, "%s: illegal crontab\n",
++			ProgramName);
++		goto remove;	    
++	}
++
+ 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
+         fclose(NewCrontab);
+ 	NewCrontab=fopen(Filename,"r+");

vixie-cron-4.1-_3_selinux.patch

@@ -0,0 +1,199 @@
+--- vixie-cron-4.1/user.c.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/user.c	2004-07-22 13:17:29.000000000 -0400
+@@ -26,8 +26,72 @@
+ /* vix 26jan87 [log is in RCS file]
+  */
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/flask.h>
++#include <selinux/av_permissions.h>
++#endif
++
+ #include "cron.h"
+ 
++#ifdef WITH_SELINUX
++static	int get_security_context(char *name, 
++				 int crontab_fd, 
++				 security_context_t *rcontext, 
++				 char *tabname) {
++	security_context_t scontext;
++	security_context_t  file_context=NULL;
++	struct av_decision avd;
++	int retval=0;
++	*rcontext = NULL;
++	if (get_default_context(name, NULL, &scontext)) {
++		if (security_getenforce() > 0) {
++			log_it(name, getpid(), "No SELinux security context",tabname);
++			return -1;
++		} else {
++			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
++		}
++	}
++	
++	if (fgetfilecon(crontab_fd, &file_context) < OK) {
++		if (security_getenforce() > 0) {
++			log_it(name, getpid(), "getfilecon FAILED", tabname);
++			freecon(scontext);
++			return -1;
++		} else {
++			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
++			*rcontext=scontext;
++			return 0;
++		}
++	}
++    
++	/*
++	 * Since crontab files are not directly executed,
++	 * crond must ensure that the crontab file has
++	 * a context that is appropriate for the context of
++	 * the user cron job.  It performs an entrypoint
++	 * permission check for this purpose.
++	 */
++	retval = security_compute_av(scontext,
++				     file_context,
++				     SECCLASS_FILE,
++				     FILE__ENTRYPOINT,
++				     &avd);
++	freecon(file_context);
++	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
++		if (security_getenforce() > 0) {
++			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
++			freecon(scontext);
++			return -1;
++		} else {
++			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
++		}
++	}
++	*rcontext=scontext;
++	return 0;
++}
++#endif
++
+ void
+ free_user(user *u) {
+ 	entry *e, *ne;
+@@ -37,11 +101,14 @@
+ 		ne = e->next;
+ 		free_entry(e);
+ 	}
++#ifdef WITH_SELINUX
++	freecon(u->scontext);
++#endif	
+ 	free(u);
+ }
+ 
+ user *
+-load_user(int crontab_fd, struct passwd	*pw, const char *name) {
++load_user(int crontab_fd, struct passwd	*pw, const char *uname, const char *fname, const char *tabname) {
+ 	char envstr[MAX_ENVSTR];
+ 	FILE *file;
+ 	user *u;
+@@ -60,7 +127,7 @@
+ 	 */
+ 	if ((u = (user *) malloc(sizeof(user))) == NULL)
+ 		return (NULL);
+-	if ((u->name = strdup(name)) == NULL) {
++	if ((u->name = strdup(fname)) == NULL) {
+ 		save_errno = errno;
+ 		free(u);
+ 		errno = save_errno;
+@@ -78,6 +145,22 @@
+ 		return (NULL);
+ 	}
+ 
++#ifdef WITH_SELINUX
++	if (is_selinux_enabled() > 0) {
++		char *sname=uname;
++		if (pw==NULL) {
++			sname="system_u";
++		}
++
++		if (get_security_context(sname, crontab_fd, 
++					 &u->scontext, tabname) != 0) {
++			free_user(u);
++			u = NULL;
++			goto done;
++		}
++	}
++#endif
++
+ 	/* load the crontab
+ 	 */
+ 	while ((status = load_env(envstr, file)) >= OK) {
+--- vixie-cron-4.1/funcs.h.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/funcs.h	2004-07-22 13:19:35.000000000 -0400
+@@ -65,7 +65,7 @@
+ 		**env_copy(char **),
+ 		**env_set(char **, char *);
+ 
+-user		*load_user(int, struct passwd *, const char *),
++user		*load_user(int, struct passwd *, const char *, const char *, const char *),
+ 		*find_user(cron_db *, const char *);
+ 
+ entry		*load_entry(FILE *, void (*)(), struct passwd *, char **);
+--- vixie-cron-4.1/structs.h.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/structs.h	2004-07-22 13:25:38.000000000 -0400
+@@ -50,6 +50,9 @@
+ 	char		*name;
+ 	time_t		mtime;		/* last modtime of crontab */
+ 	entry		*crontab;	/* this person's crontab */
++#ifdef WITH_SELINUX
++        security_context_t scontext;    /* SELinux security context */
++#endif
+ } user;
+ 
+ typedef	struct _cron_db {
+--- vixie-cron-4.1/do_command.c.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/do_command.c	2004-07-22 13:22:08.000000000 -0400
+@@ -265,6 +265,20 @@
+ 				_exit(OK_EXIT);
+ 			}
+ # endif /*DEBUGGING*/
++
++#ifdef WITH_SELINUX
++			if (is_selinux_enabled() >0 ) {
++				if (setexeccon(u->scontext) < 0) {
++					if (security_getenforce() > 0) {
++						fprintf(stderr, 
++							"Could not set exec context to %s for user  %s\n", 
++							u->scontext,u->name);
++						_exit(ERROR_EXIT);
++					}
++				}
++			}
++#endif
++
+ 			execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
+ 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
+ 			perror("execl");
+--- vixie-cron-4.1/cron.h.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/cron.h	2004-07-22 13:58:10.000000000 -0400
+@@ -29,6 +29,11 @@
+  */
+ 
+ #define CRON_VERSION "V5.0"
++
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ #include "config.h"
+ #include "externs.h"
+ #include "pathnames.h"
+@@ -36,3 +41,4 @@
+ #include "structs.h"
+ #include "funcs.h"
+ #include "globals.h"
++
+--- vixie-cron-4.1/database.c.selinux	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/database.c	2004-07-22 14:18:31.000000000 -0400
+@@ -245,7 +245,7 @@
+ 		free_user(u);
+ 		log_it(fname, getpid(), "RELOAD", tabname);
+ 	}
+-	u = load_user(crontab_fd, pw, fname);
++	u = load_user(crontab_fd, pw, uname, fname, tabname);
+ 	if (u != NULL) {
+ 		u->mtime = statbuf->st_mtime;
+ 		link_user(new_db, u);

vixie-cron-4.1-_42-getseuserbyname.patch

@@ -0,0 +1,36 @@
+--- vixie-cron-4.1/user.c~	2005-10-14 14:55:17.000000000 -0400
++++ vixie-cron-4.1/user.c	2005-10-14 15:15:07.000000000 -0400
+@@ -44,15 +44,26 @@
+ 	security_context_t  file_context=NULL;
+ 	struct av_decision avd;
+ 	int retval=0;
++	char *seuser=NULL;
++	char *level=NULL;
+ 	*rcontext = NULL;
+-	if (get_default_context(name, NULL, &scontext)) {
+-		if (security_getenforce() > 0) {
+-			log_it(name, getpid(), "No SELinux security context",tabname);
+-			return -1;
+-		} else {
+-			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
+-			return 0;
++
++	if (getseuserbyname(name, &seuser, &level) == 0) {
++		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
++		free(seuser);
++		free(level);
++		if (retval) {
++			if (security_getenforce() > 0) {
++				log_it(name, getpid(), "No SELinux security context",tabname);
++				return -1;
++			} else {
++				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
++				return 0;
++			}
+ 		}
++	} else {
++		log_it(name, getpid(), "getseusername FAILED", name);
++		return (security_getenforce() > 0);
+ 	}
+ 	
+ 	if (fgetfilecon(crontab_fd, &file_context) < OK) {

vixie-cron-4.1-_43-config_comments.patch

@@ -0,0 +1,52 @@
+--- vixie-cron-4.1/config.h.config_comments	2005-10-18 13:35:03.099232000 -0400
++++ vixie-cron-4.1/config.h	2005-10-18 13:38:45.465643000 -0400
+@@ -51,15 +51,15 @@
+ 			 */
+ #define MAILARG _PATH_SENDMAIL				/*-*/
+ 
+-/* #define MAILFMT "%s -d %s"				/*-*/
++/* #define MAILFMT "%s -d %s"				-*/
+ 			/* -d = undocumented but common flag: deliver locally?
+ 			 */
+-/* #define MAILARG "/bin/mail",mailto                   /*-*/
++/* #define MAILARG "/bin/mail",mailto                   -*/
+ 
+-/* #define MAILFMT "%s -mlrxto %s"			/*-*/
+-/* #define MAILARG "/usr/mmdf/bin/submit",mailto	/*-*/
++/* #define MAILFMT "%s -mlrxto %s"			-*/
++/* #define MAILARG "/usr/mmdf/bin/submit",mailto	-*/
+ 
+-/* #define MAIL_DATE				/*-*/
++/* #define MAIL_DATE				-*/
+ 			/* should we include an ersatz Date: header in
+ 			 * generated mail?  if you are using sendmail
+ 			 * as the mailer, it is better to let sendmail
+@@ -84,18 +84,18 @@
+ 			/* if you want cron to capitalize its name in ps
+ 			 * when running a job.  Does not work on SYSV.
+ 			 */
+-/*#define CAPITALIZE_FOR_PS		/*-*/
++/*#define CAPITALIZE_FOR_PS		-*/
+ 
+ 			/* if you have a tm_gmtoff member in struct tm.
+ 			 * If not, we will have to compute the value ourselves.
+ 			 */
+-/*#define HAVE_TM_GMTOFF		/*-*/
++/*#define HAVE_TM_GMTOFF		-*/
+ 
+ 			/* if your OS supports a BSD-style login.conf file */
+-/*#define LOGIN_CAP			/*-*/
++/*#define LOGIN_CAP			-*/
+ 
+ 			/* if your OS supports BSD authentication */
+-/*#define BSD_AUTH			/*-*/
++/*#define BSD_AUTH			-*/
+ 
+ 			/* Define this to run crontab setgid instead of   
+ 			 * setuid root.  Group access will be used to read
+@@ -103,4 +103,4 @@
+ 			 * If this is not defined then crontab and at
+ 			 * must be setuid root.
+ 			 */
+-/*#define CRON_GROUP	"crontab"	/*-*/
++/*#define CRON_GROUP	"crontab"	-*/

vixie-cron-4.1-_44-build_env.patch

@@ -0,0 +1,10 @@
+--- vixie-cron-4.1/do_command.c.build_env	2005-10-18 13:41:25.631317000 -0400
++++ vixie-cron-4.1/do_command.c	2005-10-18 14:02:52.162067000 -0400
+@@ -188,6 +188,7 @@
+ 	PAM_FAIL_CHECK;
+ 	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+ 	PAM_FAIL_CHECK;
++	build_env(e->envp);
+ 	log_close(); /* PAM has now re-opened our log to auth.info ! */
+ #endif
+ 

vixie-cron-4.1-_44-delayed_database.patch

@@ -0,0 +1,20 @@
+--- vixie-cron-4.1/cron.c.delay	2006-08-25 08:55:33.000000000 +0200
++++ vixie-cron-4.1/cron.c	2006-08-25 13:30:51.000000000 +0200
+@@ -175,7 +175,8 @@
+ 		 * clock.  Classify the change into one of 4 cases.
+ 		 */
+ 		timeDiff = timeRunning - virtualTime;
+-
++		
++		load_database(&database);
+ 		/* shortcut for the most common case */
+ 		if (timeDiff == 1) {
+ 			virtualTime = timeRunning;
+@@ -275,7 +276,6 @@
+ 			got_sigchld = 0;
+ 			sigchld_reaper();
+ 		}
+-		load_database(&database);
+ 	}
+ }
+ 

vixie-cron-4.1-_45-warnings.patch

@@ -0,0 +1,173 @@
+--- vixie-cron-4.1/env.c.warnings	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/env.c	2005-10-18 14:38:49.499570000 -0400
+@@ -48,8 +48,8 @@
+ 	int count, i, save_errno;
+ 	char **p;
+ 
+-	for (count = 0; envp[count] != NULL; count++)
+-		NULL;
++	for (count = 0; envp[count] != NULL; count++);
++
+ 	p = (char **) malloc((count+1) * sizeof(char *));  /* 1 for the NULL */
+ 	if (p != NULL) {
+ 		for (i = 0; i < count; i++)
+--- vixie-cron-4.1/misc.c.warnings	2005-10-18 14:38:48.732338000 -0400
++++ vixie-cron-4.1/misc.c	2005-10-18 14:38:49.520549000 -0400
+@@ -153,7 +153,7 @@
+ 		for (test = DebugFlagNames, mask = 1;
+ 		     *test != NULL && strcmp_until(*test, pc, ',');
+ 		     test++, mask <<= 1)
+-			NULL;
++		    ;
+ 
+ 		if (!*test) {
+ 			fprintf(stderr,
+@@ -255,9 +255,17 @@
+ 	}
+ 	if (grp != NULL) {
+ 		if (sb.st_gid != grp->gr_gid)
+-			chown(SPOOL_DIR, -1, grp->gr_gid);
++		    if( chown(SPOOL_DIR, -1, grp->gr_gid) == -1 )
++		    {
++			fprintf(stderr,"chdir %s failed: %s\n", SPOOL_DIR, strerror(errno));
++			exit(ERROR_EXIT);
++		    }
+ 		if (sb.st_mode != 01730)
+-			chmod(SPOOL_DIR, 01730);
++		    if( chmod(SPOOL_DIR, 01730) == -1 )
++		    {
++			fprintf(stderr,"chmod 01730 %s failed: %s\n", SPOOL_DIR, strerror(errno));
++			exit(ERROR_EXIT);
++		    }
+ 	}
+ }
+ 
+@@ -275,7 +283,7 @@
+ 	const char *pidfile;
+ 	char *ep;
+ 	long otherpid=-1;
+-	ssize_t num;
++	ssize_t num, len;
+ 
+ 	if (closeflag) {
+ 		/* close stashed fd for child so we don't leak it. */
+@@ -324,8 +332,14 @@
+ 
+ 	sprintf(buf, "%ld\n", (long)getpid());
+ 	(void) lseek(fd, (off_t)0, SEEK_SET);
+-	num = write(fd, buf, strlen(buf));
+-	(void) ftruncate(fd, num);
++	len =  strlen(buf);
++	if( (num = write(fd, buf, len)) != len )
++	    log_it("CRON", getpid(), "write() failed:", strerror(errno));
++	else
++	{	    
++	    if( ftruncate(fd, num) == -1 )
++		log_it("CRON", getpid(), "ftruncate() failed:", strerror(errno));
++	}
+ 
+ 	/* abandon fd even though the file is open. we need to keep
+ 	 * it open and locked, but we don't need the handles elsewhere.
+--- vixie-cron-4.1/do_command.c.warnings	2005-10-18 14:38:49.459610000 -0400
++++ vixie-cron-4.1/do_command.c	2005-10-18 14:38:49.541528000 -0400
+@@ -137,8 +137,17 @@
+ 
+ 	/* create some pipes to talk to our future child
+ 	 */
+-	pipe(stdin_pipe);	/* child's stdin */
+-	pipe(stdout_pipe);	/* child's stdout */
++	if( pipe(stdin_pipe) == -1 )	/* child's stdin */
++	{
++	    log_it("CRON", getpid(), "pipe() failed:", strerror(errno));
++	    return;
++	}
++
++	if( pipe(stdout_pipe) == -1 )	/* child's stdout */
++	{
++	    log_it("CRON", getpid(), "pipe() failed:", strerror(errno));
++	    return;
++	}	
+ 	
+ 	/* since we are a forked process, we can diddle the command string
+ 	 * we were passed -- nobody else is going to use it again, right?
+@@ -318,7 +327,11 @@
+ 		setuid(e->pwd->pw_uid);	/* we aren't root after this... */
+ 
+ #endif /* LOGIN_CAP */
+-		chdir(env_get("HOME", e->envp));
++		if ( chdir(env_get("HOME", e->envp)) == -1 )
++		{
++		    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
++		    _exit(ERROR_EXIT);
++		}
+ 
+ 		/*
+ 		 * Exec the command.
+--- vixie-cron-4.1/pw_dup.c.warnings	2005-10-18 14:38:48.714356000 -0400
++++ vixie-cron-4.1/pw_dup.c	2005-10-18 14:38:49.561508000 -0400
+@@ -47,7 +47,7 @@
+ struct passwd *
+ pw_dup(const struct passwd *pw) {
+ 	char		*cp;
+-	size_t		 nsize=0, psize=0, csize=0, gsize=0, dsize=0, ssize=0, total=0;
++	size_t		 nsize=0, psize=0, gsize=0, dsize=0, ssize=0, total=0;
+ 	struct passwd	*newpw;
+ 
+ 	/* Allocate in one big chunk for easy freeing */
+--- vixie-cron-4.1/crontab.c.warnings	2005-10-18 14:38:49.322747000 -0400
++++ vixie-cron-4.1/crontab.c	2005-10-18 14:40:57.490451000 -0400
+@@ -283,14 +283,14 @@
+ 
+ static void
+ delete_cmd(void) {
+-	char n[MAX_FNAME];
++        char n[MAX_FNAME]="";
+ 	if( PromptOnDelete == 1 )
+ 	{
+ 	    printf("crontab: really delete %s's crontab? ", User);
+ 	    fflush(stdout);
+-	    fgets(n, MAX_FNAME-1, stdin);
+-	    if((n[0] != 'Y') && (n[0] != 'y'))
+-		exit(0);
++	    if( (fgets(n, MAX_FNAME-1, stdin)==0L)
++	      ||((n[0] != 'Y') && (n[0] != 'y'))
++	      )	exit(0);
+ 	}
+ 
+ 	log_it(RealUser, Pid, "DELETE", User);
+@@ -534,7 +534,8 @@
+ 			printf("Do you want to retry the same edit? ");
+ 			fflush(stdout);
+ 			q[0] = '\0';
+-			(void) fgets(q, sizeof q, stdin);
++			if( fgets(q, sizeof q, stdin) == 0L )
++			    continue;
+ 			switch (q[0]) {
+ 			case 'y':
+ 			case 'Y':
+@@ -575,7 +576,6 @@
+ 	int error = 0;
+ 	entry *e;
+ 	uid_t file_owner;
+-	time_t now = time(NULL);
+ 	char **envp = env_init();
+ 
+ 	if (envp == NULL) {
+@@ -618,9 +618,15 @@
+ 	Set_LineNum(1)
+ 	while (EOF != (ch = get_char(NewCrontab)))
+ 		putc(ch, tmp);
+-	ftruncate(fileno(tmp), ftell(tmp));	/* XXX redundant with "w+"? */
++	if( ftruncate(fileno(tmp), ftell(tmp)) == -1 )
++	{
++	    fprintf(stderr, "%s: error while writing new crontab to %s\n",
++		    ProgramName, TempFilename);
++	    fclose(tmp);
++	    error = -2;
++	    goto done;  
++	}
+ 	fflush(tmp);  rewind(tmp);
+-
+ 	if (ferror(tmp)) {
+ 		fprintf(stderr, "%s: error while writing new crontab to %s\n",
+ 			ProgramName, TempFilename);

vixie-cron-4.1-_46-audit.patch

@@ -0,0 +1,49 @@
+diff -ur vixie-cron-4.1.orig/Makefile vixie-cron-4.1/Makefile
+--- vixie-cron-4.1.orig/Makefile	2005-10-27 13:33:56.000000000 -0400
++++ vixie-cron-4.1/Makefile	2005-10-27 13:42:37.000000000 -0400
+@@ -60,7 +60,7 @@
+ INCLUDE		=	-I.
+ #INCLUDE	=
+ #<<need getopt()>>
+-LIBS		= 	-lselinux -lpam -lpam_misc
++LIBS		= 	-lselinux -lpam -lpam_misc -laudit
+ #<<optimize or debug?>>
+ #CDEBUG		=	-O
+ #CDEBUG		=	-g
+@@ -70,7 +70,7 @@
+ #<<want to use a nonstandard CC?>>
+ CC		=	gcc -Wall -Wno-unused -Wno-comment
+ #<<manifest defines>>
+-DEFS		=	-DWITH_SELINUX -DWITH_PAM
++DEFS		=	-DWITH_SELINUX -DWITH_PAM -DWITH_AUDIT
+ #(SGI IRIX systems need this)
+ #DEFS		=	-D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>
+diff -ur vixie-cron-4.1.orig/misc.c vixie-cron-4.1/misc.c
+--- vixie-cron-4.1.orig/misc.c	2005-10-27 13:33:56.000000000 -0400
++++ vixie-cron-4.1/misc.c	2005-10-27 13:41:31.000000000 -0400
+@@ -29,6 +29,9 @@
+ 
+ #include "cron.h"
+ #include <limits.h>
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#endif
+ 
+ #if defined(SYSLOG) && defined(LOG_FILE)
+ # undef LOG_FILE
+@@ -487,6 +490,14 @@
+ 		    isallowed = TRUE;
+ 		}
+ 	}
++#ifdef WITH_AUDIT
++	if (isallowed == FALSE) {
++		int audit_fd = audit_open();
++		audit_log_user_message(audit_fd, AUDIT_USER_START, "cron deny",
++			NULL, NULL, NULL, 0);
++		close(audit_fd);
++	}
++#endif
+ 	return (isallowed);
+ }
+ 

vixie-cron-4.1-_47-m_option.patch

@@ -0,0 +1,99 @@
+--- vixie-cron-4.1/do_command.c.-m_option	2005-11-13 15:46:37.000000000 -0500
++++ vixie-cron-4.1/do_command.c	2005-11-13 17:03:34.000000000 -0500
+@@ -508,16 +508,24 @@
+ 				char	hostname[MAXHOSTNAMELEN];
+ 
+ 				gethostname(hostname, MAXHOSTNAMELEN);
+-				if (strlens(MAILFMT, MAILARG, NULL) + 1
+-				    >= sizeof mailcmd) {
+-					fprintf(stderr, "mailcmd too long\n");
+-					(void) _exit(ERROR_EXIT);
++				
++				if ( MailCmd[0] == '\0' )
++				{
++					if (strlens(MAILFMT, MAILARG, NULL) + 1
++					    >= sizeof mailcmd) {
++						fprintf(stderr, "mailcmd too long\n");
++						(void) _exit(ERROR_EXIT);
++					}
++					(void)sprintf(mailcmd, MAILFMT, MAILARG);
++				}else
++				{
++					strncpy( mailcmd, MailCmd, MAX_COMMAND );
+ 				}
+-				(void)sprintf(mailcmd, MAILFMT, MAILARG);
+ 				if (!(mail = cron_popen(mailcmd, "w", e->pwd))) {
+ 					perror(mailcmd);
+ 					(void) _exit(ERROR_EXIT);
+ 				}
++				
+ 				fprintf(mail, "From: root (Cron Daemon)\n");
+ 				fprintf(mail, "To: %s\n", mailto);
+ 				fprintf(mail, "Subject: Cron <%s@%s> %s\n",
+--- vixie-cron-4.1/globals.h.-m_option	2005-11-13 15:46:37.000000000 -0500
++++ vixie-cron-4.1/globals.h	2005-11-13 16:56:16.000000000 -0500
+@@ -65,6 +65,7 @@
+ XTRN int	NoFork INIT(0);
+ XTRN int        PermitAnyCrontab INIT(0);
+ XTRN int        ValidateMailRcpts INIT(0);
++XTRN char       MailCmd[MAX_COMMAND] INIT("");
+ 
+ #if DEBUGGING
+ XTRN int	DebugFlags INIT(0);
+--- vixie-cron-4.1/cron.8.-m_option	2005-11-13 15:46:37.000000000 -0500
++++ vixie-cron-4.1/cron.8	2005-11-13 17:10:34.000000000 -0500
+@@ -29,6 +29,7 @@
+ .IR load_avg ]
+ .RB [ \-n ]
+ .RB [ \-p ]
++.RB [ \-m <mail command> ]
+ .SH DESCRIPTION
+ .I Cron
+ should be started from /etc/rc or /etc/rc.local.  It will return immediately,
+@@ -63,6 +64,16 @@
+ .IR Crontab (1)
+ command updates the modtime of the spool directory whenever it changes a
+ crontab.
++.PP 
++The
++.B -m
++option allows you to specify a shell command string to use for sending
++cron mail output instead of 
++.IR sendmail (8).
++This command must accept a fully
++formatted mail message (with headers) on stdin and send it as a mail
++message to the recipients specified in the mail headers.
++.PP 
+ .SS Daylight Saving Time and other time changes
+ Local time changes of less than three hours, such as those caused
+ by the start or end of Daylight Saving Time, are handled specially.
+--- vixie-cron-4.1/cron.c.-m_option	2005-11-13 15:46:37.000000000 -0500
++++ vixie-cron-4.1/cron.c	2005-11-13 16:58:30.000000000 -0500
+@@ -48,7 +48,7 @@
+ usage(void) {
+ 	const char **dflags;
+ 
+-	fprintf(stderr, "usage:  %s [-n] [-p] [-x [", ProgramName);
++	fprintf(stderr, "usage:  %s [-n] [-p] [-m <mail command>] [-x [", ProgramName);
+ 	for (dflags = DebugFlagNames; *dflags; dflags++)
+ 		fprintf(stderr, "%s%s", *dflags, dflags[1] ? "," : "]");
+ 	fprintf(stderr, "]\n");
+@@ -437,7 +437,7 @@
+ parse_args(int argc, char *argv[]) {
+ 	int argch;
+ 
+-	while (-1 != (argch = getopt(argc, argv, "npx:"))) {
++	while (-1 != (argch = getopt(argc, argv, "npx:m:"))) {
+ 		switch (argch) {
+ 		default:
+ 			usage();
+@@ -451,6 +451,9 @@
+ 		case 'p':
+ 		        PermitAnyCrontab=1;
+ 			break;
++		case 'm':
++			strncpy(MailCmd, optarg, MAX_COMMAND);
++			break;
+ 		}
+ 	}
+ }

vixie-cron-4.1-_48-security.patch

@@ -0,0 +1,760 @@
+--- vixie-cron-4.1/popen.c.security	2006-01-10 13:56:39.000000000 -0500
++++ vixie-cron-4.1/popen.c	2006-01-10 16:56:48.000000000 -0500
+@@ -91,33 +91,6 @@
+ 		return (NULL);
+ 		/* NOTREACHED */
+ 	case 0:				/* child */
+-		if (pw) {
+-#ifdef LOGIN_CAP
+-			if (setusercontext(0, pw, pw->pw_uid, LOGIN_SETALL) < 0) {
+-				fprintf(stderr,
+-				    "setusercontext failed for %s\n",
+-				    pw->pw_name);
+-				_exit(ERROR_EXIT);
+-			}
+-#else
+-			if (setgid(pw->pw_gid) < 0 ||
+-			    initgroups(pw->pw_name, pw->pw_gid) < 0) {
+-				fprintf(stderr,
+-				    "unable to set groups for %s\n",
+-				    pw->pw_name);
+-				_exit(1);
+-			}
+-#if (defined(BSD)) && (BSD >= 199103)
+-			setlogin(pw->pw_name);
+-#endif /* BSD */
+-			if (setuid(pw->pw_uid)) {
+-				fprintf(stderr,
+-				    "unable to set uid for %s\n",
+-				    pw->pw_name);
+-				_exit(1);
+-			}
+-#endif /* LOGIN_CAP */
+-		}
+ 		if (*type == 'r') {
+ 			if (pdes[1] != STDOUT) {
+ 				dup2(pdes[1], STDOUT);
+--- vixie-cron-4.1/do_command.c.security	2006-01-10 13:56:40.000000000 -0500
++++ vixie-cron-4.1/do_command.c	2006-01-10 18:12:20.000000000 -0500
+@@ -25,48 +25,9 @@
+ 
+ #include "cron.h"
+ 
+-#ifdef WITH_PAM
+-static pam_handle_t *pamh = NULL;
+-static const struct pam_conv conv = {
+-	NULL
+-};
+-#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
+-	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
+-	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
+-	pam_close_session(pamh, PAM_SILENT); \
+-	pam_end(pamh, retcode); exit(1); \
+-   }
+-#endif
+-
+ static void		child_process(entry *, user *);
+ static int		safe_p(const char *, const char *);
+ 
+-/* Build up the job environment from the PAM environment plus the
+-   crontab environment */
+-static char ** build_env(char **cronenv)
+-{
+-        char **jobenv = cronenv;
+-#if defined(WITH_PAM)
+-        char **pamenv = pam_getenvlist(pamh);
+-        char *cronvar;
+-        int count = 0;
+-
+-        jobenv = env_copy(pamenv);
+-
+-        /* Now add the cron environment variables. Since env_set()
+-           overwrites existing variables, this will let cron's
+-           environment settings override pam's */
+-
+-        while ((cronvar = cronenv[count++])) {
+-                if (!(jobenv = env_set(jobenv, cronvar))) {
+-                        syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
+-                        return NULL;
+-                }
+-        }
+-#endif
+-    return jobenv;
+-}
+-
+ void
+ do_command(entry *e, user *u) {
+ 	Debug(DPROC, ("[%ld] do_command(%s, (%s,%ld,%ld))\n",
+@@ -104,10 +65,15 @@
+ 	int stdin_pipe[2], stdout_pipe[2];
+ 	char *input_data, *usernm, *mailto;
+ 	int children = 0; 
+-#if defined(WITH_PAM)
+-	int		retcode = 0;
+-#endif
++        char **jobenv=0L;
+ 
++	/* Set up the Red Hat security context for both mail/minder and job processes:
++         */
++	if ( cron_set_job_security_context( e, u, &jobenv ) != 0 )
++	{
++	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set security context", e->pwd->pw_name);
++	    exit(ERROR_EXIT);
++	}
+ 
+ 	Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
+ 
+@@ -126,7 +92,7 @@
+ 	/* discover some useful and important environment settings
+ 	 */
+ 	usernm = e->pwd->pw_name;
+-	mailto = env_get("MAILTO", e->envp);
++	mailto = env_get("MAILTO", jobenv);
+ 
+ 	/* our parent is watching for our death by catching SIGCHLD.  we
+ 	 * do not care to watch for our children's deaths this way -- we
+@@ -186,31 +152,13 @@
+ 		*p = '\0';
+ 	}
+ 
+-#if defined(WITH_PAM)
+-	retcode = pam_start("crond", usernm, &conv, &pamh);
+-	PAM_FAIL_CHECK;
+-	retcode = pam_set_item(pamh, PAM_TTY, "cron");
+-	PAM_FAIL_CHECK;
+-	retcode = pam_acct_mgmt(pamh, PAM_SILENT);
+-	PAM_FAIL_CHECK;
+-	retcode = pam_open_session(pamh, PAM_SILENT);
+-	PAM_FAIL_CHECK;
+-	retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+-	PAM_FAIL_CHECK;
+-	build_env(e->envp);
+-	log_close(); /* PAM has now re-opened our log to auth.info ! */
+-#endif
+ 
+ 	/* fork again, this time so we can exec the user's command.
+ 	 */
+ 	switch (fork()) {
+ 	case -1:
+ 		log_it("CRON", getpid(), "error", "can't fork");
+-#ifdef WITH_PAM
+-                pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
+-                pam_close_session(pamh, PAM_SILENT);
+-                pam_end(pamh, PAM_ABORT);
+-#endif
++		cron_close_security_session();
+ 		exit(ERROR_EXIT);
+ 		/*NOTREACHED*/
+ 	case 0:
+@@ -266,78 +214,12 @@
+ 		 */
+ 		(void) signal(SIGCHLD, SIG_DFL);
+ 
+-		/* set our directory, uid and gid.  Set gid first, since once
+-		 * we set uid, we've lost root privledges.
+-		 */
+-#ifdef LOGIN_CAP
+-		{
+-#ifdef BSD_AUTH
+-			auth_session_t *as;
+-#endif
+-			login_cap_t *lc;
+-			char **p;
+-			extern char **environ;
+-
+-			if ((lc = login_getclass(e->pwd->pw_class)) == NULL) {
+-				fprintf(stderr,
+-				    "unable to get login class for %s\n",
+-				    e->pwd->pw_name);
+-				_exit(ERROR_EXIT);
+-			}
+-			if (setusercontext(lc, e->pwd, e->pwd->pw_uid, LOGIN_SETALL) < 0) {
+-				fprintf(stderr,
+-				    "setusercontext failed for %s\n",
+-				    e->pwd->pw_name);
+-				_exit(ERROR_EXIT);
+-			}
+-#ifdef BSD_AUTH
+-			as = auth_open();
+-			if (as == NULL || auth_setpwd(as, e->pwd) != 0) {
+-				fprintf(stderr, "can't malloc\n");
+-				_exit(ERROR_EXIT);
+-			}
+-			if (auth_approval(as, lc, usernm, "cron") <= 0) {
+-				fprintf(stderr, "approval failed for %s\n",
+-				    e->pwd->pw_name);
+-				_exit(ERROR_EXIT);
+-			}
+-			auth_close(as);
+-#endif /* BSD_AUTH */
+-			login_close(lc);
+-
+-			/* If no PATH specified in crontab file but
+-			 * we just added one via login.conf, add it to
+-			 * the crontab environment.
+-			 */
+-			if (env_get("PATH", e->envp) == NULL && environ != NULL) {
+-				for (p = environ; *p; p++) {
+-					if (strncmp(*p, "PATH=", 5) == 0) {
+-						e->envp = env_set(e->envp, *p);
+-						break;
+-					}
+-				}
+-			}
+-		}
+-#else
+-		setgid(e->pwd->pw_gid);
+-		initgroups(usernm, e->pwd->pw_gid);
+-#if (defined(BSD)) && (BSD >= 199103)
+-		setlogin(usernm);
+-#endif /* BSD */
+-		setuid(e->pwd->pw_uid);	/* we aren't root after this... */
+-
+-#endif /* LOGIN_CAP */
+-		if ( chdir(env_get("HOME", e->envp)) == -1 )
+-		{
+-		    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
+-		    _exit(ERROR_EXIT);
+-		}
+ 
+ 		/*
+ 		 * Exec the command.
+ 		 */
+ 		{
+-			char	*shell = env_get("SHELL", e->envp);
++			char	*shell = env_get("SHELL", jobenv);
+ 
+ # if DEBUGGING
+ 			if (DebugFlags & DTEST) {
+@@ -349,20 +231,7 @@
+ 			}
+ # endif /*DEBUGGING*/
+ 
+-#ifdef WITH_SELINUX
+-			if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
+-				if (setexeccon(u->scontext) < 0) {
+-					if (security_getenforce() > 0) {
+-						fprintf(stderr, 
+-							"Could not set exec context to %s for user  %s\n", 
+-							u->scontext,u->name);
+-						_exit(ERROR_EXIT);
+-					}
+-				}
+-			}
+-#endif
+-
+-			execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
++			execle(shell, shell, "-c", e->cmd, (char *)0, jobenv);
+ 			fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
+ 			perror("execl");
+ 			_exit(ERROR_EXIT);
+@@ -535,7 +404,7 @@
+ 				fprintf(mail, "Date: %s\n",
+ 					arpadate(&StartTime));
+ #endif /*MAIL_DATE*/
+-				for (env = e->envp;  *env;  env++)
++				for (env = jobenv;  *env;  env++)
+ 					fprintf(mail, "X-Cron-Env: <%s>\n",
+ 						*env);
+ 				fprintf(mail, "\n");
+@@ -616,12 +485,8 @@
+ 			Debug(DPROC, (", dumped core"))
+ 		Debug(DPROC, ("\n"))
+ 	}
+-
+-#if defined(WITH_PAM)
+-	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
+-	retcode = pam_close_session(pamh, PAM_SILENT);
+-	pam_end(pamh, retcode);
+-#endif
++	cron_close_security_session();
++	env_free(jobenv);
+ }
+ 
+ static int
+--- vixie-cron-4.1/security.c.security	2006-01-10 18:04:21.000000000 -0500
++++ vixie-cron-4.1/security.c	2006-01-10 17:35:33.000000000 -0500
+@@ -0,0 +1,278 @@
++/* security.c 
++ *
++ * Implement Red Hat crond security context transitions
++ *
++ * Jason Vas Dias <jvdias@redhat.com> January 2006
++ *
++ * Copyright(C) Red Hat Inc., 2006
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include "cron.h"
++
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/flask.h>
++#include <selinux/av_permissions.h>
++#include <selinux/get_context_list.h>
++#endif
++
++static char ** build_env(char **cronenv);
++
++int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
++{
++    if ( cron_open_security_session( e->pwd ) != 0 )
++    {
++	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
++	       e->pwd->pw_name, strerror(errno)
++	      );
++	return -1;
++    }
++    
++    if ( cron_change_user( e->pwd ) != 0 )
++    {
++	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
++	       e->pwd->pw_name, strerror(errno)
++	      );
++	return -1;
++    }
++	
++    if ( cron_change_selinux_context( u ) != 0 )
++    {
++        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
++	       e->pwd->pw_name);
++	return -1;
++    }
++
++    *jobenv = build_env( e->envp );
++
++    if ( chdir(env_get("HOME", *jobenv)) == -1 )
++    {
++	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
++	return -1;
++    }
++
++    return 0;
++}
++
++#ifdef WITH_PAM
++static pam_handle_t *pamh = NULL;
++static const struct pam_conv conv = {
++    NULL
++};
++#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) {		\
++	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode));	\
++	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode));	\
++	pam_close_session(pamh, PAM_SILENT);			\
++	pam_end(pamh, retcode);					\
++	return(retcode);					\
++   }
++#endif
++
++int cron_open_security_session( struct passwd *pw )
++{
++    int	retcode = 0;
++
++#if defined(WITH_PAM)
++    retcode = pam_start("crond", pw->pw_name, &conv, &pamh);
++    PAM_FAIL_CHECK;
++    retcode = pam_set_item(pamh, PAM_TTY, "cron");
++    PAM_FAIL_CHECK;
++    retcode = pam_acct_mgmt(pamh, PAM_SILENT);
++    PAM_FAIL_CHECK;
++    retcode = pam_open_session(pamh, PAM_SILENT);
++    PAM_FAIL_CHECK;
++    retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
++    PAM_FAIL_CHECK;
++    log_close(); /* PAM has now re-opened our log to auth.info ! */
++#endif
++
++    return retcode;
++}
++
++void cron_close_security_session( void )
++{
++#if defined(WITH_PAM)
++    pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
++    pam_close_session(pamh, PAM_SILENT);
++    pam_end(pamh, PAM_ABORT);
++#endif
++}
++
++int cron_change_user( struct passwd *pw )
++{    	
++    /* set our directory, uid and gid.  Set gid first, since once
++     * we set uid, we've lost root privledges.
++     */
++    if ( setgid( pw->pw_gid ) != 0 )
++    {
++	log_it("CRON", getpid(), "setgid failed:", strerror(errno));
++	return -1;
++    }
++
++    if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
++    {
++	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
++	return -1;	
++    }
++
++    if ( setuid( pw->pw_uid ) != 0 )
++    {
++	log_it("CRON", getpid(), "setuid failed:", strerror(errno));
++	return -1;
++    }
++    
++    return 0;
++}
++
++int cron_change_selinux_context( user *u )
++{
++#ifdef WITH_SELINUX
++    if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
++	if (setexeccon(u->scontext) < 0) {
++	    if (security_getenforce() > 0) {
++		syslog(LOG_INFO,
++		       "CRON (%s) ERROR:"
++		       "Could not set exec context to %s for user\n", 
++		       u->name, u->scontext
++		      );
++		return -1;
++	    }
++	}
++    }
++#endif
++    return 0;
++}
++
++int get_security_context( const char *name, 
++			  int crontab_fd, 
++			  security_context_t *rcontext, 
++			  const char *tabname) {
++	security_context_t scontext=NULL;
++	security_context_t  file_context=NULL;
++	struct av_decision avd;
++	int retval=0;
++	char *seuser=NULL;
++	char *level=NULL;
++
++	*rcontext = NULL;
++
++#ifdef WITH_SELINUX
++
++	if (is_selinux_enabled() <= 0) 
++	    return 0;
++
++	if (getseuserbyname(name, &seuser, &level) == 0) {
++		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
++		free(seuser);
++		free(level);
++		if (retval) {
++			if (security_getenforce() > 0) {
++				log_it(name, getpid(), "No SELinux security context",tabname);
++				return -1;
++			} else {
++				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
++				return 0;
++			}
++		}
++	} else {
++		log_it(name, getpid(), "getseusername FAILED", name);
++		return (security_getenforce() > 0);
++	}
++	
++	if (fgetfilecon(crontab_fd, &file_context) < OK) {
++		if (security_getenforce() > 0) {
++			log_it(name, getpid(), "getfilecon FAILED", tabname);
++			freecon(scontext);
++			return -1;
++		} else {
++			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
++			*rcontext=scontext;
++			return 0;
++		}
++	}
++    
++	/*
++	 * Since crontab files are not directly executed,
++	 * crond must ensure that the crontab file has
++	 * a context that is appropriate for the context of
++	 * the user cron job.  It performs an entrypoint
++	 * permission check for this purpose.
++	 */
++	retval = security_compute_av(scontext,
++				     file_context,
++				     SECCLASS_FILE,
++				     FILE__ENTRYPOINT,
++				     &avd);
++	freecon(file_context);
++	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
++		if (security_getenforce() > 0) {
++			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
++			freecon(scontext);
++			return -1;
++		} else {
++			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
++		}
++	}
++	*rcontext=scontext;
++#endif
++	return 0;
++}
++
++void free_security_context( security_context_t *scontext )
++{
++#ifdef WITH_SELINUX
++    if( *scontext != NULL )
++    {
++	freecon(*scontext);
++	*scontext=0L;
++    }	    
++#endif	
++}
++
++int crontab_security_access(void)
++{
++#ifdef WITH_SELINUX
++    if (is_selinux_enabled() > 0)
++	if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0)
++	    return -1;
++#endif
++    return 0;
++}
++
++/* Build up the job environment from the PAM environment plus the
++   crontab environment */
++static char ** build_env(char **cronenv)
++{
++    char **jobenv = cronenv;
++
++    char **pamenv = pam_getenvlist(pamh);
++    char *cronvar;
++    int count = 0;
++
++    jobenv = env_copy(pamenv);
++
++        /* Now add the cron environment variables. Since env_set()
++           overwrites existing variables, this will let cron's
++           environment settings override pam's */
++
++    while ((cronvar = cronenv[count++])) {
++	if (!(jobenv = env_set(jobenv, cronvar))) {
++	    syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
++	    return NULL;
++	}
++    }
++
++    return jobenv;
++}
+--- vixie-cron-4.1/user.c.security	2006-01-10 13:56:40.000000000 -0500
++++ vixie-cron-4.1/user.c	2006-01-10 17:35:14.000000000 -0500
+@@ -26,85 +26,8 @@
+ /* vix 26jan87 [log is in RCS file]
+  */
+ 
+-#ifdef WITH_SELINUX
+-#include <selinux/selinux.h>
+-#include <selinux/flask.h>
+-#include <selinux/av_permissions.h>
+-#include <selinux/get_context_list.h>
+-#endif
+-
+ #include "cron.h"
+ 
+-#ifdef WITH_SELINUX
+-static	int get_security_context(const char *name, 
+-				 int crontab_fd, 
+-				 security_context_t *rcontext, 
+-				 const char *tabname) {
+-	security_context_t scontext=NULL;
+-	security_context_t  file_context=NULL;
+-	struct av_decision avd;
+-	int retval=0;
+-	char *seuser=NULL;
+-	char *level=NULL;
+-	*rcontext = NULL;
+-
+-	if (getseuserbyname(name, &seuser, &level) == 0) {
+-		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
+-		free(seuser);
+-		free(level);
+-		if (retval) {
+-			if (security_getenforce() > 0) {
+-				log_it(name, getpid(), "No SELinux security context",tabname);
+-				return -1;
+-			} else {
+-				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
+-				return 0;
+-			}
+-		}
+-	} else {
+-		log_it(name, getpid(), "getseusername FAILED", name);
+-		return (security_getenforce() > 0);
+-	}
+-	
+-	if (fgetfilecon(crontab_fd, &file_context) < OK) {
+-		if (security_getenforce() > 0) {
+-			log_it(name, getpid(), "getfilecon FAILED", tabname);
+-			freecon(scontext);
+-			return -1;
+-		} else {
+-			log_it(name, getpid(), "getfilecon FAILED but SELinux in permissive mode, continuing", tabname);
+-			*rcontext=scontext;
+-			return 0;
+-		}
+-	}
+-    
+-	/*
+-	 * Since crontab files are not directly executed,
+-	 * crond must ensure that the crontab file has
+-	 * a context that is appropriate for the context of
+-	 * the user cron job.  It performs an entrypoint
+-	 * permission check for this purpose.
+-	 */
+-	retval = security_compute_av(scontext,
+-				     file_context,
+-				     SECCLASS_FILE,
+-				     FILE__ENTRYPOINT,
+-				     &avd);
+-	freecon(file_context);
+-	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
+-		if (security_getenforce() > 0) {
+-			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
+-			freecon(scontext);
+-			return -1;
+-		} else {
+-			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
+-		}
+-	}
+-	*rcontext=scontext;
+-	return 0;
+-}
+-#endif
+-
+ void
+ free_user(user *u) {
+ 	entry *e, *ne;
+@@ -115,10 +38,7 @@
+ 		ne = e->next;
+ 		free_entry(e);
+ 	}
+-#ifdef WITH_SELINUX
+-	if( u->scontext != NULL )
+-	    freecon(u->scontext);
+-#endif	
++	free_security_context(&(u->scontext));
+ 	free(u);
+ }
+ 
+@@ -164,23 +84,14 @@
+ 		return (NULL);
+ 	}
+ 
+-#ifdef WITH_SELINUX
+-	if (is_selinux_enabled() > 0) {
+-		const char *sname=uname;
+-		if (pw==NULL) {
+-			sname="system_u";
+-		}
+-
+-		if (get_security_context(sname, crontab_fd, 
+-					 &u->scontext, tabname) != 0) {
+-			free_user(u);
+-			u = NULL;
+-			goto done;
+-		}
+-	}else
+-	    u->scontext = NULL;
+-#endif
+-
++	if (get_security_context(pw == NULL ? "system_u" : uname, 
++				 crontab_fd, 
++				 &u->scontext, tabname) != 0) {
++	    free_user(u);
++	    u = NULL;
++	    goto done;
++	}
++	
+ 	/* load the crontab
+ 	 */
+ 	while ((status = load_env(envstr, file)) >= OK) {
+--- vixie-cron-4.1/funcs.h.security	2006-01-10 13:56:39.000000000 -0500
++++ vixie-cron-4.1/funcs.h	2006-01-10 17:35:00.000000000 -0500
+@@ -77,3 +77,25 @@
+ #ifndef HAVE_TM_GMTOFF
+ long		get_gmtoff(time_t *, struct tm *);
+ #endif
++
++/* Red Hat security stuff (security.c): 
++ */
++int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
++
++int cron_open_security_session( struct passwd *pw );
++
++void cron_close_security_session( void );
++
++int cron_change_user( struct passwd *pw );
++
++int cron_change_selinux_context( user *u );
++
++int get_security_context(const char *name, 
++			 int crontab_fd, 
++			 security_context_t *rcontext, 
++			 const char *tabname
++                        );
++
++void free_security_context( security_context_t *scontext );
++
++int crontab_security_access(void);
+--- vixie-cron-4.1/crontab.c.security	2006-01-10 13:56:40.000000000 -0500
++++ vixie-cron-4.1/crontab.c	2006-01-10 17:26:58.000000000 -0500
+@@ -163,15 +163,14 @@
+ 					"must be privileged to use -u\n");
+ 				exit(ERROR_EXIT);
+ 			}
+-#ifdef WITH_SELINUX
+-			if (is_selinux_enabled() > 0) {
+-				if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0) {
+-					fprintf(stderr,
+-						"Access denied by SELinux, must be privileged to use -u\n");
+-					exit(ERROR_EXIT);
+-				}
++			
++			if( crontab_security_access() != 0 )
++			{
++			        fprintf(stderr,
++				    "Access denied by SELinux, must be privileged to use -u\n");
++			        exit(ERROR_EXIT);
+ 			}
+-#endif
++
+ 			if (!(pw = getpwnam(optarg))) {
+ 				fprintf(stderr, "%s:  user `%s' unknown\n",
+ 					ProgramName, optarg);
+--- vixie-cron-4.1/Makefile.security	2006-01-10 13:56:40.000000000 -0500
++++ vixie-cron-4.1/Makefile	2006-01-10 17:31:13.000000000 -0500
+@@ -88,14 +88,14 @@
+ HEADERS		=	bitstring.h cron.h config.h pathnames.h externs.h \
+ 			macros.h structs.h funcs.h globals.h
+ SOURCES		=	cron.c crontab.c database.c do_command.c entry.c \
+-			env.c job.c user.c popen.c misc.c pw_dup.c
++			env.c job.c user.c popen.c misc.c pw_dup.c security.c
+ SHAR_SOURCE	=	$(INFOS) $(MANPAGES) Makefile $(HEADERS) $(SOURCES)
+ LINT_CRON	=	cron.c database.c user.c entry.c \
+ 			misc.c job.c do_command.c env.c popen.c pw_dup.c
+ LINT_CRONTAB	=	crontab.c misc.c entry.c env.c
+ CRON_OBJ	=	cron.o database.o user.o entry.o job.o do_command.o \
+-			misc.o env.o popen.o pw_dup.o
+-CRONTAB_OBJ	=	crontab.o misc.o entry.o env.o pw_dup.o
++			misc.o env.o popen.o pw_dup.o security.o
++CRONTAB_OBJ	=	crontab.o misc.o entry.o env.o pw_dup.o security.o
+ 
+ all		:	cron crontab
+ 

vixie-cron-4.1-_49-bz178436.patch

@@ -0,0 +1,60 @@
+--- vixie-cron-4.1/security.c.bz178436	2006-01-26 14:26:55.000000000 -0500
++++ vixie-cron-4.1/security.c	2006-01-26 14:34:23.000000000 -0500
+@@ -32,6 +32,16 @@
+ 
+ int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
+ {
++    time_t minutely_time = 0;
++    if((e->flags & MIN_STAR)==MIN_STAR)
++    {
++	/* "minute-ly" job: Every minute for given hour/dow/month/dom. 
++	 * Ensure that these jobs never run in the same minute:
++	 */
++	minutely_time = time(0);
++	Debug(DSCH, ("Minute-ly job. Recording time %lu\n", minutely_time))
++    }
++
+     if ( cron_open_security_session( e->pwd ) != 0 )
+     {
+ 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+@@ -57,12 +67,32 @@
+ 
+     *jobenv = build_env( e->envp );
+ 
++    log_close();
++    openlog(ProgramName, LOG_PID, LOG_CRON);
++
+     if ( chdir(env_get("HOME", *jobenv)) == -1 )
+     {
+ 	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
+ 	return -1;
+     }
+ 
++    time_t job_run_time = time(0L);
++
++    if( (minutely_time > 0)
++	&&((job_run_time / 60) != (minutely_time / 60))
++      )
++    {/* if a per-minute job is delayed into the next minute 
++      * (eg. by network authentication method timeouts), skip it.
++      */
++	struct tm tmS, tmN;
++	localtime_r(&job_run_time, &tmN);
++	localtime_r(&minutely_time,&tmS);
++	syslog(LOG_ERR, 
++	       "(%s) error: Job execution of per-minute job scheduled for "
++	       "%.2u:%.2u delayed into subsequent minute %.2u:%.2u. Skipping job run.",
++	       e->pwd->pw_name, tmS.tm_hour, tmS.tm_min, tmN.tm_hour, tmN.tm_min);
++	return -1;
++    }
+     return 0;
+ }
+ 
+@@ -96,6 +126,7 @@
+     retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+     PAM_FAIL_CHECK;
+     log_close(); /* PAM has now re-opened our log to auth.info ! */
++    openlog(ProgramName, LOG_PID, LOG_CRON);
+ #endif
+ 
+     return retcode;

vixie-cron-4.1-_4_vfork_sigchld.patch

@@ -0,0 +1,44 @@
+--- vixie-cron-4.1-rh/do_command.c.vfork_sigchld	2004-07-21 18:40:22.000000000 -0400
++++ vixie-cron-4.1-rh/do_command.c	2004-07-21 18:19:04.000000000 -0400
+@@ -136,13 +136,13 @@
+ 
+ 	/* fork again, this time so we can exec the user's command.
+ 	 */
+-	switch (vfork()) {
++	switch (fork()) {
+ 	case -1:
+-		log_it("CRON", getpid(), "error", "can't vfork");
++		log_it("CRON", getpid(), "error", "can't fork");
+ 		exit(ERROR_EXIT);
+ 		/*NOTREACHED*/
+ 	case 0:
+-		Debug(DPROC, ("[%ld] grandchild process vfork()'ed\n",
++		Debug(DPROC, ("[%ld] grandchild process fork()'ed\n",
+ 			      (long)getpid()))
+ 
+ 		/* write a log message.  we've waited this long to do it
+@@ -187,6 +187,13 @@
+ 		}
+ 		dup2(STDOUT, STDERR);
+ 
++		/* Our grandparent is watching for our parent's death by
++		 * catching SIGCHLD. Meanwhile, our parent will use wait
++		 * explicitly and so has disabled SIGCHLD. So now it's
++		 * time to reset SIGCHLD handling.
++		 */
++		(void) signal(SIGCHLD, SIG_DFL);
++
+ 		/* set our directory, uid and gid.  Set gid first, since once
+ 		 * we set uid, we've lost root privledges.
+ 		 */
+--- vixie-cron-4.1-rh/popen.c.vfork_sigchld	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/popen.c	2004-07-21 18:08:08.000000000 -0400
+@@ -84,7 +84,7 @@
+ 			break;
+ 	argv[MAX_ARGV-1] = NULL;
+ 
+-	switch (pid = vfork()) {
++	switch (pid = fork()) {
+ 	case -1:			/* error */
+ 		(void)close(pdes[0]);
+ 		(void)close(pdes[1]);

vixie-cron-4.1-_50-bz178931.patch

@@ -0,0 +1,14 @@
+--- vixie-cron-4.1/crond.pam.bz178931	2006-01-26 14:26:55.000000000 -0500
++++ vixie-cron-4.1/crond.pam	2006-01-26 14:33:04.000000000 -0500
+@@ -7,10 +7,5 @@
+ auth       include    system-auth
+ account    required   pam_access.so
+ account    include    system-auth
+-session    include    system-auth
+ session    required   pam_loginuid.so
+-# To enable PAM user limits for cron jobs, 
+-# configure /etc/security/limits.conf and 
+-# uncomment this line:
+-# session  required   pam_limits.so
+-#
++session	   required   pam_limits.so

vixie-cron-4.1-_51-bz180145-mail_i18n.patch

@@ -0,0 +1,138 @@
+--- vixie-cron-4.1/externs.h.mail_i18n	2004-07-21 09:31:55.000000000 -0400
++++ vixie-cron-4.1/externs.h	2006-02-07 13:06:46.000000000 -0500
+@@ -61,6 +61,12 @@
+ # include <bsd_auth.h>
+ #endif /*BSD_AUTH*/
+ 
++/* include locale stuff for mailer "Content-Type": 
++ */
++#include <locale.h>
++#include <nl_types.h>
++#include <langinfo.h>
++
+ #define DIR_T	struct dirent
+ #define WAIT_T	int
+ #define SIG_T	sig_t
+--- vixie-cron-4.1/cron.c.mail_i18n	2006-01-26 14:41:39.000000000 -0500
++++ vixie-cron-4.1/cron.c	2006-02-07 13:10:42.000000000 -0500
+@@ -60,6 +60,7 @@
+ 	struct sigaction sact;
+ 	cron_db	database;
+ 	int fd;
++	char *cs;
+ 
+ 	ProgramName = argv[0];
+ 
+@@ -99,6 +100,16 @@
+ 	if ( getenv("CRON_VALIDATE_MAILRCPTS") != 0L )
+ 	    ValidateMailRcpts=1;
+ 
++	/* Get the default locale character set for the mail 
++	 * "Content-Type: ...; charset=" header
++	 */
++	setlocale(LC_ALL,""); /* set locale to system defaults or to
++				 that specified by any  LC_* env vars */
++	if ( ( cs = nl_langinfo( CODESET ) ) != 0L )
++	    strncpy( cron_default_mail_charset, cs, MAX_ENVSTR );
++	else
++	    strcpy( cron_default_mail_charset, "US-ASCII" );
++	
+ 	/* if there are no debug flags turned on, fork as a daemon should.
+ 	 */
+ 	if (DebugFlags) {
+--- vixie-cron-4.1/do_command.c.mail_i18n	2006-01-26 14:41:39.000000000 -0500
++++ vixie-cron-4.1/do_command.c	2006-02-07 13:19:27.000000000 -0500
+@@ -375,6 +375,8 @@
+ 				char	**env;
+ 				char	mailcmd[MAX_COMMAND];
+ 				char	hostname[MAXHOSTNAMELEN];
++				char    *content_type = env_get("CONTENT_TYPE",jobenv),
++				        *content_transfer_encoding = env_get("CONTENT_TRANSFER_ENCODING",jobenv);
+ 
+ 				gethostname(hostname, MAXHOSTNAMELEN);
+ 				
+@@ -400,10 +402,40 @@
+ 				fprintf(mail, "Subject: Cron <%s@%s> %s\n",
+ 					usernm, first_word(hostname, "."),
+ 					e->cmd);
++
+ #ifdef MAIL_DATE
+ 				fprintf(mail, "Date: %s\n",
+ 					arpadate(&StartTime));
+ #endif /*MAIL_DATE*/
++				if ( content_type == 0L )
++				{   
++					fprintf(mail, "Content-Type: text/plain; charset=%s\n",
++						cron_default_mail_charset
++					       );
++				}else
++				{       /* user specified Content-Type header. 
++					 * disallow new-lines for security reasons 
++					 * (else users could specify arbitrary mail headers!)
++					 */
++					char *nl=content_type;
++					size_t ctlen = strlen(content_type);				    
++					while(  (*nl != '\0') 
++					     && ((nl=strchr(nl,'\n')) != 0L)
++					     && (nl < (content_type+ctlen)) 
++					     ) *nl = ' ';
++					fprintf(mail,"Content-Type: %s\n", content_type);
++				}
++				if ( content_transfer_encoding != 0L )
++				{
++					char *nl=content_transfer_encoding;
++					size_t ctlen = strlen(content_transfer_encoding);
++					while(  (*nl != '\0') 
++					     && ((nl=strchr(nl,'\n')) != 0L)
++					     && (nl < (content_transfer_encoding+ctlen))
++					     ) *nl = ' ';				
++					fprintf(mail,"Content-Transfer-Encoding: %s\n", content_transfer_encoding);
++				}
++
+ 				for (env = jobenv;  *env;  env++)
+ 					fprintf(mail, "X-Cron-Env: <%s>\n",
+ 						*env);
+--- vixie-cron-4.1/crontab.5.mail_i18n	2006-01-26 14:41:39.000000000 -0500
++++ vixie-cron-4.1/crontab.5	2006-02-07 13:34:42.000000000 -0500
+@@ -61,7 +61,7 @@
+ .IR cron (8)
+ daemon.
+ SHELL is set to /bin/sh, and LOGNAME and HOME are set from the /etc/passwd 
+-line of the crontab's owner.
++line of the crontab\'s owner.
+ HOME and SHELL may be overridden by settings in the crontab; LOGNAME may not.
+ .PP
+ (Another note: the LOGNAME variable is sometimes called USER on BSD systems...
+@@ -74,8 +74,18 @@
+ sent to the user so named.  If MAILTO is defined but empty (MAILTO=""), no
+ mail will be sent.  Otherwise mail is sent to the owner of the crontab.  This
+ option is useful if you decide on /bin/mail instead of /usr/lib/sendmail as
+-your mailer when you install cron -- /bin/mail doesn't do aliasing, and UUCP
+-usually doesn't read its mail.
++your mailer when you install cron -- /bin/mail doesn\'t do aliasing, and UUCP
++usually doesn\'t read its mail.
++.PP
++By default, cron will send mail using the mail 'Content-Type:' header of 'text/plain' with the 'charset=' parameter set to the charmap / codeset of the locale in which 
++.IR crond(8)
++is started up - ie. either the default system locale, if no LC_* environment
++variables are set, or the locale specified by the LC_* environment variables
++( see 
++.IR locale(7) ). 
++You can use different character encodings for mailed cron job output by 
++setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
++to the correct values of the mail headers of those names.  
+ .PP
+ The format of a cron command is very much the V7 standard, with a number of
+ upward-compatible extensions.  Each line has five time and date fields,
+--- vixie-cron-4.1/globals.h.mail_i18n	2006-01-26 14:41:39.000000000 -0500
++++ vixie-cron-4.1/globals.h	2006-02-07 12:46:34.000000000 -0500
+@@ -66,7 +66,8 @@
+ XTRN int        PermitAnyCrontab INIT(0);
+ XTRN int        ValidateMailRcpts INIT(0);
+ XTRN char       MailCmd[MAX_COMMAND] INIT("");
+-
++XTRN char       cron_default_mail_charset[MAX_ENVSTR] INIT("");
++ 
+ #if DEBUGGING
+ XTRN int	DebugFlags INIT(0);
+ XTRN const char *DebugFlagNames[]

vixie-cron-4.1-_52-bz181439.patch

@@ -0,0 +1,101 @@
+--- vixie-cron-4.1/security.c.bz181439	2006-02-14 16:16:49.000000000 -0500
++++ vixie-cron-4.1/security.c	2006-02-14 16:16:54.000000000 -0500
+@@ -190,6 +190,7 @@
+ 			  int crontab_fd, 
+ 			  security_context_t *rcontext, 
+ 			  const char *tabname) {
++#ifdef WITH_SELINUX
+ 	security_context_t scontext=NULL;
+ 	security_context_t  file_context=NULL;
+ 	struct av_decision avd;
+@@ -199,8 +200,6 @@
+ 
+ 	*rcontext = NULL;
+ 
+-#ifdef WITH_SELINUX
+-
+ 	if (is_selinux_enabled() <= 0) 
+ 	    return 0;
+ 
+@@ -286,14 +285,14 @@
+    crontab environment */
+ static char ** build_env(char **cronenv)
+ {
++#ifdef WITH_PAM
+     char **jobenv = cronenv;
+-
+     char **pamenv = pam_getenvlist(pamh);
+     char *cronvar;
+     int count = 0;
+-
+     jobenv = env_copy(pamenv);
+ 
++
+         /* Now add the cron environment variables. Since env_set()
+            overwrites existing variables, this will let cron's
+            environment settings override pam's */
+@@ -304,6 +303,8 @@
+ 	    return NULL;
+ 	}
+     }
+-
+-    return jobenv;
++    return jobenv;    
++#else
++    return env_copy(cronenv);
++#endif
+ }
+--- vixie-cron-4.1/Makefile.bz181439	2006-02-14 16:16:49.000000000 -0500
++++ vixie-cron-4.1/Makefile	2006-02-14 16:16:50.000000000 -0500
+@@ -60,7 +60,19 @@
+ INCLUDE		=	-I.
+ #INCLUDE	=
+ #<<need getopt()>>
+-LIBS		= 	-lselinux -lpam -lpam_misc -laudit
++ifdef WITH_SELINUX
++SELINUX_LIBS=-lselinux
++SELINUX_DEFS=-DWITH_SELINUX
++endif
++ifdef WITH_PAM
++PAM_LIBS=-lpam -lpam_misc
++PAM_DEFS=-DWITH_PAM
++endif
++ifdef WITH_AUDIT
++AUDIT_LIBS=-laudit
++AUDIT_DEFS=-DWITH_AUDIT
++endif
++LIBS		=       $(SELINUX_LIBS) $(PAM_LIBS) $(AUDIT_LIBS)
+ #<<optimize or debug?>>
+ #CDEBUG		=	-O
+ #CDEBUG		=	-g
+@@ -70,7 +82,7 @@
+ #<<want to use a nonstandard CC?>>
+ CC		=	gcc -Wall -Wno-unused -Wno-comment
+ #<<manifest defines>>
+-DEFS		=	-DWITH_SELINUX -DWITH_PAM -DWITH_AUDIT
++DEFS		=	$(SELINUX_DEFS) $(PAM_DEFS) $(AUDIT_DEFS)
+ #(SGI IRIX systems need this)
+ #DEFS		=	-D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>
+--- vixie-cron-4.1/structs.h.bz181439	2006-02-14 16:16:49.000000000 -0500
++++ vixie-cron-4.1/structs.h	2006-02-14 16:16:50.000000000 -0500
+@@ -44,6 +44,9 @@
+ 			 *
+ 			 * These are the crontabs.
+ 			 */
++#ifndef WITH_SELINUX
++#define security_context_t unsigned
++#endif
+ 
+ typedef	struct _user {
+ 	struct _user	*next, *prev;	/* links */
+@@ -51,9 +54,7 @@
+         char            *tabname;       /* /etc/cron.d/ file name or NULL */
+ 	time_t		mtime;		/* last modtime of crontab */
+ 	entry		*crontab;	/* this person's crontab */
+-#ifdef WITH_SELINUX
+         security_context_t scontext;    /* SELinux security context */
+-#endif        
+ } user;
+ 
+ typedef	struct _cron_db {

vixie-cron-4.1-_52-bz181439_2.patch

@@ -0,0 +1,21 @@
+--- vixie-cron-4.1/security.c.bz181439p2	2006-08-30 08:31:44.000000000 +0200
++++ vixie-cron-4.1/security.c	2006-08-30 08:31:44.000000000 +0200
+@@ -78,17 +78,15 @@
+ 	return -1;
+     }	
+ 
++#if WITH_SELINUX
+     if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
+     {
+         syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
+ 	       e->pwd->pw_name);
+-#if WITH_SELINUX
+ 	if ( file_context )
+ 		freecon(file_context);
+-#endif
+ 	return -1;
+     }
+-#if WITH_SELINUX
+     if ( file_context )
+ 	freecon(file_context);
+ #endif

vixie-cron-4.1-_53_bz199294_selinux_mls.patch

@@ -0,0 +1,437 @@
+--- vixie-cron-4.1/crontab.c.selinux_mls	2006-07-20 22:05:13.000000000 -0400
++++ vixie-cron-4.1/crontab.c	2006-07-20 22:05:13.000000000 -0400
+@@ -43,10 +43,19 @@
+ 
+ #if DEBUGGING
+ static char	*Options[] = { "???", "list", "delete", "edit", "replace" };
++#   ifdef WITH_SELINUX
++static char	*getoptargs = "u:lerisx:";
++#   else
+ static char	*getoptargs = "u:lerix:";
++#   endif
+ #else
++#   ifdef WITH_SELINUX
++static char	*getoptargs = "u:leris";
++#   else
+ static char	*getoptargs = "u:leri";
++#   endif
+ #endif
++static char     *selinux_context = 0;
+ 
+ static	PID_T		Pid;
+ static	char		User[MAX_UNAME], RealUser[MAX_UNAME];
+@@ -75,6 +84,9 @@
+ 	fprintf(stderr, "\t-l\t(list user's crontab)\n");
+ 	fprintf(stderr, "\t-r\t(delete user's crontab)\n");
+ 	fprintf(stderr, "\t-i\t(prompt before deleting user's crontab)\n");
++#ifdef WITH_SELINUX
++	fprintf(stderr, "\t-s\t(selinux context)\n");
++#endif
+ 	exit(ERROR_EXIT);
+ }
+ 
+@@ -198,6 +210,16 @@
+ 		case 'i':
+        		        PromptOnDelete = 1;
+ 			break;
++#ifdef WITH_SELINUX
++	        case 's':
++		        if ( getprevcon( (security_context_t*)&(selinux_context) ) ) 
++			{
++				fprintf(stderr,
++					"Cannot obtain SELinux process context\n");
++				exit(ERROR_EXIT);
++			}
++			break;
++#endif 
+ 		default:
+ 			usage("unrecognized option");
+ 		}
+@@ -317,7 +339,7 @@
+ edit_cmd(void) {
+ 	char n[MAX_FNAME], q[MAX_TEMPSTR], *editor;
+ 	FILE *f;
+-	int ch='\0', t, x;
++	int ch='\0', t;
+ 	struct stat statbuf;
+ 	struct utimbuf utimebuf;
+ 	WAIT_T waiter;
+@@ -379,26 +401,25 @@
+ 	}
+ 
+ 	Set_LineNum(1)
+-
+-	/* ignore the top NHEADER_LINES comment lines since we put them there.
++	/* 
++	 * NHEADER_LINES processing removed for clarity
++	 * (NHEADER_LINES == 0 in all Red Hat crontabs)
+ 	 */
+-	x = 0;
+-	while ((x < NHEADER_LINES) && (EOF != (ch = get_char(f)))) {
+-		if ('#' != ch) {
+-			putc(ch, NewCrontab);
+-			break;
+-		}
+-		while (EOF != (ch = get_char(f)))
+-			if (ch == '\n')
+-				break;
+-		++x;
+-	}
+-
++	
+ 	/* copy the rest of the crontab (if any) to the temp file.
+ 	 */
+ 	if (EOF != ch)
+ 		while (EOF != (ch = get_char(f)))
+ 			putc(ch, NewCrontab);
++
++#ifdef WITH_SELINUX
++	if ( selinux_context )
++	{
++		fprintf(NewCrontab,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
++		selinux_context = 0;
++	}
++#endif
++
+ 	fclose(f);
+ 	if (fflush(NewCrontab) < OK) {
+ 		perror(Filename);
+@@ -610,6 +631,10 @@
+ 	 *fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
+ 	 *fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
+ 	 */
++#ifdef WITH_SELINUX
++	if ( selinux_context )
++		fprintf(tmp,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
++#endif
+ 
+ 	/* copy the crontab to the tmp
+ 	 */
+--- vixie-cron-4.1/funcs.h.selinux_mls	2006-07-20 22:05:13.000000000 -0400
++++ vixie-cron-4.1/funcs.h	2006-07-20 22:05:13.000000000 -0400
+@@ -88,7 +88,9 @@
+ 
+ int cron_change_user( struct passwd *pw );
+ 
+-int cron_change_selinux_context( user *u );
++int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **envp );
++
++int cron_change_selinux_context( user *, void *scontext, void *file_context );
+ 
+ int get_security_context(const char *name, 
+ 			 int crontab_fd, 
+--- vixie-cron-4.1/crontab.1.selinux_mls	2006-07-20 22:05:13.000000000 -0400
++++ vixie-cron-4.1/crontab.1	2006-07-20 22:05:13.000000000 -0400
+@@ -32,6 +32,7 @@
+ .RB [ -u
+ .IR user ]
+ .RB [ -l " | " -r " | " -e ] [ -i ]
++.RB [ -s ]
+ .SH DESCRIPTION
+ .I Crontab
+ is the program used to install, deinstall or list the tables
+@@ -89,6 +90,13 @@
+ .I -i
+ option modifies the -r option to prompt the user for a 'y/Y' response
+ before actually removing the crontab.
++.PP
++The
++.I -s
++option will append the current SELinux security context string as an
++SELINUX_ROLE_TYPE setting to the crontab file before editing / replacement
++occurs - see the documentation of SELINUX_ROLE_TYPE in 
++.IR crontab(5) .
+ .SH "SEE ALSO"
+ crontab(5), cron(8)
+ .SH FILES
+--- vixie-cron-4.1/crontab.5.selinux_mls	2006-07-20 22:05:13.000000000 -0400
++++ vixie-cron-4.1/crontab.5	2006-07-20 22:05:13.000000000 -0400
+@@ -87,6 +87,19 @@
+ setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
+ to the correct values of the mail headers of those names.  
+ .PP
++The SELINUX_ROLE_TYPE environment variable provides support for multiple per-job 
++SELinux security contexts in the same crontab.
++By default, cron jobs execute with the default SELinux security context of the 
++user that created the crontab file.
++When using multiple security levels and roles, this may not be sufficient, because
++the same user may be running in a different role or at a different security level.
++You can set SELINUX_ROLE_TYPE to the SELinux security context string specifying
++the SELinux security context in which you want the job to run, and crond will set 
++the execution context of the or jobs to which the setting applies to the specified 
++context.
++See also the 
++.IR crontab(1) -s option.
++.PP
+ The format of a cron command is very much the V7 standard, with a number of
+ upward-compatible extensions.  Each line has five time and date fields,
+ followed by a user name if this is the system crontab file,
+--- vixie-cron-4.1/security.c.selinux_mls	2006-07-20 22:05:13.000000000 -0400
++++ vixie-cron-4.1/security.c	2006-07-20 22:15:31.000000000 -0400
+@@ -49,23 +49,49 @@
+ 	      );
+ 	return -1;
+     }
+-    
++
++    *jobenv = build_env( e->envp );
++
++#ifdef WITH_SELINUX
++
++    /* we must get the crontab context BEFORE changing user, else
++     * we'll not be permitted to read the cron spool directory :-)
++     */
++
++    security_context_t scontext=0, file_context=0; 
++
++    if ( cron_get_job_context(u, &scontext, &file_context, *jobenv) < OK )
++    {
++	syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
++	       e->pwd->pw_name, strerror(errno)
++	      );
++	return -1;
++    }
++
++#endif
++
+     if ( cron_change_user( e->pwd ) != 0 )
+     {
+ 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+ 	       e->pwd->pw_name, strerror(errno)
+ 	      );
+ 	return -1;
+-    }
+-	
+-    if ( cron_change_selinux_context( u ) != 0 )
++    }	
++
++    if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
+     {
+         syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
+ 	       e->pwd->pw_name);
++#if WITH_SELINUX
++	if ( file_context )
++		freecon(file_context);
++#endif
+ 	return -1;
+     }
+-
+-    *jobenv = build_env( e->envp );
++#if WITH_SELINUX
++    if ( file_context )
++	freecon(file_context);
++#endif
+ 
+     log_close();
+     openlog(ProgramName, LOG_PID, LOG_CRON);
+@@ -167,23 +193,145 @@
+     return 0;
+ }
+ 
+-int cron_change_selinux_context( user *u )
++static int 
++cron_authorize_context
++( 
++	security_context_t scontext,
++	security_context_t file_context
++)	
+ {
+ #ifdef WITH_SELINUX
+-    if ((is_selinux_enabled() >0) && (u->scontext != 0L)) {
+-	if (setexeccon(u->scontext) < 0) {
+-	    if (security_getenforce() > 0) {
+-		syslog(LOG_INFO,
+-		       "CRON (%s) ERROR:"
+-		       "Could not set exec context to %s for user\n", 
+-		       u->name, u->scontext
+-		      );
++	struct av_decision avd;
++	int retval;
++	/*
++	 * Since crontab files are not directly executed,
++	 * crond must ensure that the crontab file has
++	 * a context that is appropriate for the context of
++	 * the user cron job.  It performs an entrypoint
++	 * permission check for this purpose.
++	 */
++	retval = security_compute_av(scontext,
++				     file_context,
++				     SECCLASS_FILE,
++				     FILE__ENTRYPOINT,
++				     &avd);
++
++	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT))
++		return 0;
++#endif
++	return 1;
++}
++
++int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **jobenv )
++{
++#if WITH_SELINUX
++	char *sroletype;
++
++	if ( is_selinux_enabled() <= 0 )
++		return 0;
++	if ( (file_contextp == 0) || (scontextp == 0L) )
+ 		return -1;
+-	    }
++
++	*((security_context_t*)scontextp) = u->scontext;
++	*((void **)file_contextp) = 0L;
++
++	if ( (sroletype = env_get("SELINUX_ROLE_TYPE",jobenv)) != 0L )
++	{
++	        *((security_context_t*)scontextp) = (security_context_t) sroletype;
++		
++		char crontab[MAX_FNAME];
++		if ( strcmp(u->name,"*system*") == 0 )
++			strncpy(crontab, u->tabname, MAX_FNAME);
++		else
++			snprintf(crontab, MAX_FNAME, "%s/%s", CRONDIR, u->tabname);
++
++		if ( getfilecon( crontab, file_contextp ) == -1 )
++		{		
++			if ( security_getenforce() > 0 ) 
++			{
++				log_it(u->name, 
++				       getpid(), "getfilecon FAILED for SELINUX_ROLE_TYPE", 
++				       sroletype
++				      );
++				return -1;
++			} else
++			if ( access( crontab, F_OK ) == 0 )
++				log_it(u->name,
++				       getpid(), 
++				       "getfilecon FAILED but SELinux in permissive mode, continuing "
++				       "- SELINUX_ROLE_TYPE=", sroletype
++				       );
++		}		       
+ 	}
+-    }
+ #endif
+-    return 0;
++	return 0;
++}
++
++int cron_change_selinux_context( user *u, void *scontext, void *file_context )
++{
++#ifdef WITH_SELINUX
++	if ( is_selinux_enabled() <= 0 )
++		return 0;
++
++	if ( scontext == 0L )
++	{
++		if (security_getenforce() > 0) 
++		{
++			log_it( u->name, getpid(), 
++				"NULL security context for user", 
++				""
++			      );
++			return -1;
++		}else
++		{
++			log_it( u->name, getpid(), 
++				"NULL security context for user, "
++				"but SELinux in permissive mode, continuing",
++				""
++				);
++			return 0;
++		}
++	}
++	
++	if ( file_context )
++	{		
++		if ( ! cron_authorize_context( scontext, file_context ) )
++		{
++			if ( security_getenforce() > 0 ) 
++			{
++				syslog(LOG_ERR,
++				       "CRON (%s) ERROR:"
++				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user", 
++				       u->name, (char*)scontext
++				      );
++				return -1;
++			} else
++			{
++				syslog(LOG_INFO,
++				       "CRON (%s) WARNING:"
++				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user,"
++				       " but SELinux in permissive mode, continuing", 
++				       u->name, (char*)scontext
++				      );
++			}
++		}
++	} 
++
++	if ( setexeccon(scontext) < 0 ) 
++	{
++		if (security_getenforce() > 0) 
++		{
++			syslog(LOG_ERR,
++			       "CRON (%s) ERROR:"
++			       "Could not set exec context to %s for user", 
++			       u->name, (char*)scontext
++			      );
++
++			return -1;
++		}
++	}
++#endif
++	return 0;
+ }
+ 
+ int get_security_context( const char *name, 
+@@ -192,8 +340,7 @@
+ 			  const char *tabname) {
+ #ifdef WITH_SELINUX
+ 	security_context_t scontext=NULL;
+-	security_context_t  file_context=NULL;
+-	struct av_decision avd;
++	security_context_t file_context=NULL;
+ 	int retval=0;
+ 	char *seuser=NULL;
+ 	char *level=NULL;
+@@ -233,28 +380,24 @@
+ 		}
+ 	}
+     
+-	/*
+-	 * Since crontab files are not directly executed,
+-	 * crond must ensure that the crontab file has
+-	 * a context that is appropriate for the context of
+-	 * the user cron job.  It performs an entrypoint
+-	 * permission check for this purpose.
+-	 */
+-	retval = security_compute_av(scontext,
+-				     file_context,
+-				     SECCLASS_FILE,
+-				     FILE__ENTRYPOINT,
+-				     &avd);
+-	freecon(file_context);
+-	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
++	if ( ! cron_authorize_context( scontext, file_context ) )
++	{
++		freecon(scontext);
++		freecon(file_context);
+ 		if (security_getenforce() > 0) {
+-			log_it(name, getpid(), "ENTRYPOINT FAILED", tabname);
+-			freecon(scontext);
++			log_it(name, getpid(), "Unauthorized SELinux context", tabname);
+ 			return -1;
+-		} else {
+-			log_it(name, getpid(), "ENTRYPOINT FAILED but SELinux in permissive mode, continuing", tabname);
++		} else
++		{
++			log_it(name, getpid(), 
++			       "Unauthorized SELinux context, but SELinux in permissive mode, continuing",
++			       tabname
++			      );
++			return  0;
+ 		}
+ 	}
++	freecon(file_context);
++
+ 	*rcontext=scontext;
+ #endif
+ 	return 0;

vixie-cron-4.1-_54_bz198019_database_changes.patch

@@ -0,0 +1,181 @@
+--- vixie-cron-4.1/database.c.bz198019	2006-07-20 21:42:01.000000000 -0400
++++ vixie-cron-4.1/database.c	2006-07-20 21:46:51.000000000 -0400
+@@ -34,6 +34,12 @@
+ 					const char *, struct stat *,
+ 					cron_db *, cron_db *);
+ 
++static int not_a_crontab( DIR_T *dp ); 
++/* return 1 if we should skip this file */
++
++static void max_mtime( char *dir_name, struct stat *max_st ); 
++/* record max mtime of any file under dir_name in max_st */
++
+ void
+ load_database(cron_db *old_db) {
+ 	struct stat statbuf, syscron_stat, crond_stat;
+@@ -52,12 +58,20 @@
+ 		log_it("CRON", getpid(), "STAT FAILED", SPOOL_DIR);
+ 		(void) exit(ERROR_EXIT);
+ 	}
++	
++	/* As pointed out in Red Hat bugzilla 198019, with modern Linux it
++	 * is possible to modify a file without modifying the mtime of the
++         * containing directory. Hence, we must check the mtime of each file:
++         */
++	max_mtime(SPOOL_DIR, &statbuf);
+ 
+ 	if (stat(RH_CROND_DIR, &crond_stat) < OK) {
+ 		log_it("CRON", getpid(), "STAT FAILED", RH_CROND_DIR);
+ 		(void) exit(ERROR_EXIT);
+ 	}
+ 
++	max_mtime(RH_CROND_DIR, &crond_stat);
++
+ 	/* track system crontab file
+ 	 */
+ 	if (stat(SYSCRONTAB, &syscron_stat) < OK)
+@@ -97,40 +111,12 @@
+ 	}
+ 
+ 	while (NULL != (dp = readdir(dir))) {
+-		char	fname[MAXNAMLEN+1],
+-			tabname[MAXNAMLEN+1];
+-		size_t len;
+-
+-		/* avoid file names beginning with ".".  this is good
+-		 * because we would otherwise waste two guaranteed calls
+-		 * to getpwnam() for . and .., and there shouldn't be 
+-		 * hidden files in here anyway
+-		 */
+-		if (dp->d_name[0] == '.')
+-			continue;
+-
+-		/* ignore files starting with # and ending with ~ */
+-		if (dp->d_name[0] == '#')
+-			continue;
+-		
+-		len = strlen(dp->d_name);
+-
+-		if (len >= sizeof fname)
+-			continue;	/* XXX log? */
+-
+-		if ((len > 0) && (dp->d_name[len - 1] == '~'))
+-			continue;
++		char   tabname[MAXNAMLEN+1];
+ 
+-		(void) strcpy(fname, dp->d_name);
+-		
+-		if ((len > 8) && (strncmp(fname + len - 8, ".rpmsave", 8) == 0))
+-			continue;
+-		if ((len > 8) && (strncmp(fname + len - 8, ".rpmorig", 8) == 0))
+-			continue;
+-		if ((len > 7) && (strncmp(fname + len - 7, ".rpmnew", 7) == 0))
++		if ( not_a_crontab( dp ) )
+ 			continue;
+ 
+-		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
++		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, dp->d_name, '/'))
+ 			continue;	/* XXX log? */
+ 
+ 		process_crontab("root", NULL, tabname,
+@@ -142,6 +128,7 @@
+ 	 * efficiency.  however, we need to close it in every fork, and
+ 	 * we fork a lot more often than the mtime of the dir changes.
+ 	 */
++
+ 	if (!(dir = opendir(SPOOL_DIR))) {
+ 		log_it("CRON", getpid(), "OPENDIR FAILED", SPOOL_DIR);
+ 		(void) exit(ERROR_EXIT);
+@@ -150,20 +137,12 @@
+ 	while (NULL != (dp = readdir(dir))) {
+ 		char fname[MAXNAMLEN+1], tabname[MAXNAMLEN+1];
+ 
+-		/* avoid file names beginning with ".".  this is good
+-		 * because we would otherwise waste two guaranteed calls
+-		 * to getpwnam() for . and .., and also because user names
+-		 * starting with a period are just too nasty to consider.
+-		 */
+-		if (dp->d_name[0] == '.')
++		if ( not_a_crontab( dp ) )
+ 			continue;
+ 
+-		if (strlen(dp->d_name) >= sizeof fname)
+-			continue;	/* XXX log? */
+-		(void) strcpy(fname, dp->d_name);
+-		
+-		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR,
+-				  fname, '/'))
++		strncpy(fname, dp->d_name, MAXNAMLEN);
++
++		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, fname, '/'))
+ 			continue;	/* XXX log? */
+ 
+ 		process_crontab(fname, fname, tabname,
+@@ -322,3 +301,67 @@
+ 		close(crontab_fd);
+ 	}
+ }
++
++static int not_a_crontab( DIR_T *dp )
++{
++	int len;
++
++	/* avoid file names beginning with ".".  this is good
++	 * because we would otherwise waste two guaranteed calls
++	 * to getpwnam() for . and .., and there shouldn't be 
++	 * hidden files in here anyway
++	 */
++	if (dp->d_name[0] == '.')
++		return(1);
++
++	/* ignore files starting with # and ending with ~ */
++	if (dp->d_name[0] == '#')
++		return(1);
++
++	len = strlen(dp->d_name);
++
++	if (len >= MAXNAMLEN)
++		return(1);	/* XXX log? */
++
++	if ((len > 0) && (dp->d_name[len - 1] == '~'))
++		return(1);
++
++	if ((len > 8) && (strncmp(dp->d_name + len - 8, ".rpmsave", 8) == 0))
++		return(1);
++	if ((len > 8) && (strncmp(dp->d_name + len - 8, ".rpmorig", 8) == 0))
++		return(1);
++	if ((len > 7) && (strncmp(dp->d_name + len - 7, ".rpmnew", 7) == 0))
++		return(1);
++
++	return(0);
++}
++
++static void max_mtime( char *dir_name, struct stat *max_st )
++{
++	DIR * dir;
++	DIR_T *dp;
++	struct stat st;
++
++	if (!(dir = opendir(dir_name))) {
++		log_it("CRON", getpid(), "OPENDIR FAILED", dir_name);
++		(void) exit(ERROR_EXIT);
++	}
++
++	while (NULL != (dp = readdir(dir))) 
++	{
++		char tabname[MAXNAMLEN+1];
++
++		if ( not_a_crontab ( dp ) )
++			continue;
++
++		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, dp->d_name, '/'))
++			continue;	/* XXX log? */
++
++		if ( stat( tabname, &st ) < OK )
++			continue;       /* XXX log? */
++		
++		if ( st.st_mtime > max_st->st_mtime )
++			max_st->st_mtime = st.st_mtime;		
++	}
++	closedir(dir);
++}

vixie-cron-4.1-_55-bz203746.patch

@@ -0,0 +1,14 @@
+--- vixie-cron-4.1/do_command.c.rfc3834	2006-08-23 11:19:19.000000000 -0400
++++ vixie-cron-4.1/do_command.c	2006-08-23 11:19:19.000000000 -0400
+@@ -436,6 +436,11 @@
+ 					fprintf(mail,"Content-Transfer-Encoding: %s\n", content_transfer_encoding);
+ 				}
+ 
++				/* The Auto-Submitted header is
++				 * defined (and suggested by) RFC3834.
++				 */
++				fprintf(mail, "Auto-Submitted: auto-generated\n");
++
+ 				for (env = jobenv;  *env;  env++)
+ 					fprintf(mail, "X-Cron-Env: <%s>\n",
+ 						*env);

vixie-cron-4.1-_56-pam-session-system-auth.patch

@@ -0,0 +1,8 @@
+--- vixie-cron-4.1/crond.pam.session-system-auth	2006-09-05 12:54:14.000000000 +0200
++++ vixie-cron-4.1/crond.pam	2006-09-05 12:55:51.000000000 +0200
+@@ -8,4 +8,4 @@
+ account    required   pam_access.so
+ account    include    system-auth
+ session    required   pam_loginuid.so
+-session	   required   pam_limits.so
++session    include    system-auth

vixie-cron-4.1-_5_sprintf_misc.patch

@@ -0,0 +1,46 @@
+--- vixie-cron-4.1-rh/misc.c~	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/misc.c	2004-07-21 20:09:31.000000000 -0400
+@@ -472,18 +472,25 @@
+ 	char *msg;
+ 	TIME_T now = time((TIME_T) 0);
+ 	struct tm *t = localtime(&now);
++	int msg_size;
+ #endif /*LOG_FILE*/
+ 
+ #if defined(LOG_FILE)
+ 	/* we assume that MAX_TEMPSTR will hold the date, time, &punctuation.
+ 	 */
+-	msg = malloc(strlen(username)
++	msg = malloc(msg_size =
++		     ( strlen(username)
+ 		     + strlen(event)
+ 		     + strlen(detail)
+-		     + MAX_TEMPSTR);
++		     + MAX_TEMPSTR
++		     )
++	            );
+ 	if (msg == NULL)
+-		return;
+-
++	{   /* damn, out of mem and we did not test that before... */
++	    fprintf(stderr, "%s: Run OUT OF MEMORY while %s\n",
++		    ProgramName, __FUNCTION__);
++	    return;
++	}
+ 	if (LogFD < OK) {
+ 		LogFD = open(LOG_FILE, O_WRONLY|O_APPEND|O_CREAT, 0600);
+ 		if (LogFD < OK) {
+@@ -495,11 +502,11 @@
+ 		}
+ 	}
+ 
+-	/* we have to sprintf() it because fprintf() doesn't always write
++	/* we have to snprintf() it because fprintf() doesn't always write
+ 	 * everything out in one chunk and this has to be atomically appended
+ 	 * to the log file.
+ 	 */
+-	sprintf(msg, "%s (%02d/%02d-%02d:%02d:%02d-%d) %s (%s)\n",
++	snprintf(msg, msg_size, "%s (%02d/%02d-%02d:%02d:%02d-%d) %s (%s)\n",
+ 		username,
+ 		t->tm_mon+1, t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec, pid,
+ 		event, detail);

vixie-cron-4.1-_60-SELinux-contains-range.patch

@@ -0,0 +1,423 @@
+--- vixie-cron-4.1/do_command.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
++++ vixie-cron-4.1/do_command.c	2006-12-30 09:20:53.000000000 -0500
+@@ -238,6 +238,7 @@
+ 		}
+ 		break;
+ 	default:
++		cron_restore_default_security_context();
+ 		/* parent process */
+ 		break;
+ 	}
+--- vixie-cron-4.1/security.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
++++ vixie-cron-4.1/security.c	2006-12-30 09:22:54.000000000 -0500
+@@ -23,6 +23,7 @@
+ 
+ #ifdef WITH_SELINUX
+ #include <selinux/selinux.h>
++#include <selinux/context.h>
+ #include <selinux/flask.h>
+ #include <selinux/av_permissions.h>
+ #include <selinux/get_context_list.h>
+@@ -30,6 +31,15 @@
+ 
+ static char ** build_env(char **cronenv);
+ 
++#ifdef WITH_SELINUX
++static int cron_change_selinux_range( user *u,
++                                      security_context_t ucontext );
++static int cron_get_job_range( user *u, security_context_t *ucontextp, char **jobenv );
++#endif
++
++int cron_restore_default_security_context() {
++	setexeccon(NULL);
++}
+ int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
+ {
+     time_t minutely_time = 0;
+@@ -58,9 +68,9 @@
+      * we'll not be permitted to read the cron spool directory :-)
+      */
+ 
+-    security_context_t scontext=0, file_context=0; 
++    security_context_t ucontext=0; 
+ 
+-    if ( cron_get_job_context(u, &scontext, &file_context, *jobenv) < OK )
++    if ( cron_get_job_range(u, &ucontext, *jobenv) < OK )
+     {
+ 	syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
+ 	       e->pwd->pw_name, strerror(errno)
+@@ -68,38 +78,37 @@
+ 	return -1;
+     }
+ 
++    if (cron_change_selinux_range(u, ucontext) != 0)
++    {
++        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
++	       e->pwd->pw_name);
++	if ( ucontext )
++		freecon(ucontext);
++	return -1;
++    }
++    if ( ucontext )
++	freecon(ucontext);
+ #endif
+ 
+-    if ( cron_change_user( e->pwd ) != 0 )
++    if ( cron_start_security_session( e->pwd ) != 0 )
+     {
+ 	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+ 	       e->pwd->pw_name, strerror(errno)
+ 	      );
+ 	return -1;
+-    }	
++    }
+ 
+-#if WITH_SELINUX
+-    if ( cron_change_selinux_context( u, scontext, file_context ) != 0 )
++    if ( cron_change_user( e->pwd, env_get("HOME", *jobenv)) != 0 )
+     {
+-        syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
+-	       e->pwd->pw_name);
+-	if ( file_context )
+-		freecon(file_context);
++	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
++	       e->pwd->pw_name, strerror(errno)
++	      );
+ 	return -1;
+-    }
+-    if ( file_context )
+-	freecon(file_context);
+-#endif
++    }	
+ 
+     log_close();
+     openlog(ProgramName, LOG_PID, LOG_CRON);
+ 
+-    if ( chdir(env_get("HOME", *jobenv)) == -1 )
+-    {
+-	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
+-	return -1;
+-    }
+-
+     time_t job_run_time = time(0L);
+ 
+     if( (minutely_time > 0)
+@@ -145,10 +154,20 @@
+     PAM_FAIL_CHECK;
+     retcode = pam_acct_mgmt(pamh, PAM_SILENT);
+     PAM_FAIL_CHECK;
+-    retcode = pam_open_session(pamh, PAM_SILENT);
+-    PAM_FAIL_CHECK;
++#endif
++
++    return retcode;
++}
++
++int cron_start_security_session( struct passwd *pw )
++{
++    int	retcode = 0;
++
++#if defined(WITH_PAM)
+     retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+     PAM_FAIL_CHECK;
++    retcode = pam_open_session(pamh, PAM_SILENT);
++    PAM_FAIL_CHECK;
+     log_close(); /* PAM has now re-opened our log to auth.info ! */
+     openlog(ProgramName, LOG_PID, LOG_CRON);
+ #endif
+@@ -165,7 +184,7 @@
+ #endif
+ }
+ 
+-int cron_change_user( struct passwd *pw )
++int cron_change_user( struct passwd *pw, char *homedir )
+ {    	
+     /* set our directory, uid and gid.  Set gid first, since once
+      * we set uid, we've lost root privledges.
+@@ -176,6 +195,13 @@
+ 	return -1;
+     }
+ 
++    if ( chdir(homedir) == -1 )
++    {
++	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
++	log_it("CRON", getpid(), homedir, strerror(errno));
++	return -1;
++    }
++
+     if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
+     {
+ 	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
+@@ -201,6 +227,7 @@
+ #ifdef WITH_SELINUX
+ 	struct av_decision avd;
+ 	int retval;
++        unsigned int bit = FILE__ENTRYPOINT;
+ 	/*
+ 	 * Since crontab files are not directly executed,
+ 	 * crond must ensure that the crontab file has
+@@ -208,13 +235,35 @@
+ 	 * the user cron job.  It performs an entrypoint
+ 	 * permission check for this purpose.
+ 	 */
+-	retval = security_compute_av(scontext,
+-				     file_context,
+-				     SECCLASS_FILE,
+-				     FILE__ENTRYPOINT,
+-				     &avd);
++	retval = security_compute_av(scontext, file_context,
++				     SECCLASS_FILE, bit, &avd);
++
++	if (retval || ((bit & avd.allowed) != bit))
++		return 0;
++#endif
++	return 1;
++}
++
++static int 
++cron_authorize_range
++( 
++	security_context_t scontext,
++	security_context_t ucontext
++)	
++{
++#ifdef WITH_SELINUX
++	struct av_decision avd;
++	int retval;
++        unsigned int bit = CONTEXT__CONTAINS;
++	/*
++	 * Since crontab files are not directly executed,
++	 * so crond must ensure that any user specified range
++	 * falls within the seusers-specified range for that Linux user.
++	 */
++	retval = security_compute_av(scontext, ucontext,
++				     SECCLASS_CONTEXT, bit, &avd);
+ 
+-	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT))
++	if (retval || ((bit & avd.allowed) != bit))
+ 		return 0;
+ #endif
+ 	return 1;
+@@ -265,6 +314,75 @@
+ 	return 0;
+ }
+ 
++#if WITH_SELINUX
++/* always uses u->scontext as the default process context, then changes the
++   level, and retuns it in ucontextp (or NULL otherwise) */
++static int cron_get_job_range( user *u, security_context_t *ucontextp,
++                               char **jobenv )
++{
++	char *range;
++
++	if ( is_selinux_enabled() <= 0 )
++		return 0;
++	if ( ucontextp == 0L )
++		return -1;
++
++	*ucontextp = 0L;
++
++	if ( (range = env_get("MLS_LEVEL",jobenv)) != 0L )
++	{
++                context_t ccon;
++
++                if (!(ccon = context_new(u->scontext)))
++                {
++			log_it(u->name, 
++                               getpid(), "context_new FAILED for MLS_LEVEL", 
++                               range);
++                        return -1;
++                }                  
++
++                if (context_range_set(ccon, range))
++                {
++                        log_it(u->name, 
++                               getpid(), "context_range_set FAILED for MLS_LEVEL", 
++                               range);
++                        return -1;
++                }
++
++                if (!(*ucontextp = context_str(ccon)))
++                {
++                        log_it(u->name, 
++                               getpid(), "context_str FAILED for MLS_LEVEL", 
++                               range);
++                        return -1;
++                }
++
++                if (!(*ucontextp = strdup(*ucontextp)))
++                {
++                        log_it(u->name, 
++                               getpid(), "strdup FAILED for MLS_LEVEL", 
++                               range);
++                        return -1;
++                }
++
++                context_free(ccon);
++	}
++        else if (!u->scontext)
++        { /* cron_change_selinux_range() deals with this */
++                return 0;
++        }
++        else if (!(*ucontextp = strdup(u->scontext)))
++        {
++                log_it(u->name, 
++                       getpid(), "strdup FAILED for MLS_LEVEL", 
++                       range);
++                return -1;
++        }
++
++	return 0;
++}
++#endif
++
+ int cron_change_selinux_context( user *u, void *scontext, void *file_context )
+ {
+ #ifdef WITH_SELINUX
+@@ -332,6 +450,84 @@
+ 	return 0;
+ }
+ 
++#ifdef WITH_SELINUX
++static int cron_change_selinux_range( user *u,
++                                      security_context_t ucontext )
++{
++	if ( is_selinux_enabled() <= 0 )
++		return 0;
++
++	if ( u->scontext == 0L )
++	{
++		if (security_getenforce() > 0) 
++		{
++			log_it( u->name, getpid(), 
++				"NULL security context for user", 
++				""
++			      );
++			return -1;
++		}else
++		{
++			log_it( u->name, getpid(), 
++				"NULL security context for user, "
++				"but SELinux in permissive mode, continuing",
++				""
++				);
++			return 0;
++		}
++	}
++
++	if ( strcmp(u->scontext, ucontext) )
++	{		
++                if ( ! cron_authorize_range( u->scontext, ucontext ))
++		{
++			if ( security_getenforce() > 0 ) 
++			{
++				syslog(LOG_ERR,
++				       "CRON (%s) ERROR:"
++				       "Unauthorized range %s in MLS_LEVEL for user %s ", 
++				       u->name, (char*)ucontext, u->scontext
++				      );
++				return -1;
++			} else
++			{
++				syslog(LOG_INFO,
++				       "CRON (%s) WARNING:"
++				       "Unauthorized range %s in MLS_LEVEL for user %s,"
++				       " but SELinux in permissive mode, continuing", 
++				       u->name, (char*)ucontext, u->scontext
++				      );
++			}
++		}
++	} 
++
++	if ( setexeccon(ucontext) < 0 ) 
++	{
++		if (security_getenforce() > 0) 
++		{
++			syslog(LOG_ERR,
++			       "CRON (%s) ERROR:"
++			       "Could not set exec context to %s for user", 
++			       u->name, (char*)ucontext
++			      );
++
++			return -1;
++		} else
++		{
++			syslog(LOG_ERR,
++			       "CRON (%s) ERROR:"
++			       "Could not set exec context to %s for user, "
++                               " but SELinux in permissive mode, continuing", 
++			       u->name, (char*)ucontext
++			      );
++
++			return 0;
++		}
++	}
++	return 0;
++}
++#endif
++
+ int get_security_context( const char *name, 
+ 			  int crontab_fd, 
+ 			  security_context_t *rcontext, 
+@@ -449,3 +645,4 @@
+     return env_copy(cronenv);
+ #endif
+ }
++
+--- vixie-cron-4.1/crontab.c.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
++++ vixie-cron-4.1/crontab.c	2006-12-30 09:20:53.000000000 -0500
+@@ -33,6 +33,7 @@
+ #include "cron.h"
+ #ifdef WITH_SELINUX
+ #include <selinux/selinux.h>
++#include <selinux/context.h>
+ #include <selinux/av_permissions.h>
+ #endif
+ 
+@@ -415,8 +416,25 @@
+ #ifdef WITH_SELINUX
+ 	if ( selinux_context )
+ 	{
+-		fprintf(NewCrontab,"SELINUX_ROLE_TYPE=%s\n", selinux_context);
+-		selinux_context = 0;
++                context_t ccon = NULL;
++                char *level = NULL;
++
++                if (!(ccon = context_new(selinux_context)))
++                {
++                        fprintf(stderr, "context_new failed\n");
++                        goto fatal;
++                }
++                
++                if (!(level = context_range_get(ccon)))
++                {
++                        fprintf(stderr, "context_range failed\n");
++                        goto fatal;
++                }
++                
++		fprintf(NewCrontab,"MLS_LEVEL=%s\n", level);
++                context_free(ccon);
++		freecon(selinux_context);
++                selinux_context = NULL;
+ 	}
+ #endif
+ 
+--- vixie-cron-4.1/funcs.h.selinux-contains-range	2006-12-30 09:20:53.000000000 -0500
++++ vixie-cron-4.1/funcs.h	2006-12-30 09:20:53.000000000 -0500
+@@ -80,13 +80,15 @@
+ 
+ /* Red Hat security stuff (security.c): 
+  */
++int cron_restore_default_security_context( void );
++
+ int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
+ 
+ int cron_open_security_session( struct passwd *pw );
+ 
+ void cron_close_security_session( void );
+ 
+-int cron_change_user( struct passwd *pw );
++int cron_change_user( struct passwd *pw, char *homedir );
+ 
+ int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **envp );
+ 

vixie-cron-4.1-_61symlink.patch

@@ -0,0 +1,57 @@
+--- vixie-cron-4.1/cron.c.orig	2007-01-08 14:08:50.000000000 +0000
++++ vixie-cron-4.1/cron.c	2007-01-08 14:08:43.000000000 +0000
+@@ -33,7 +33,7 @@ static	void	usage(void),
+ 		run_reboot_jobs(cron_db *),
+ 		find_jobs(int, cron_db *, int, int),
+ 		set_time(int),
+-		cron_sleep(int),
++		cron_sleep(int, cron_db *),
+ 		sigchld_handler(int),
+ 		sighup_handler(int),
+ 		sigchld_reaper(void),
+@@ -154,7 +154,7 @@ main(int argc, char *argv[]) {
+ 
+ 		/* ... wait for the time (in minutes) to change ... */
+ 		do {
+-			cron_sleep(timeRunning + 1);
++			cron_sleep(timeRunning + 1, &database);
+ 			set_time(FALSE);
+ 		} while (clockTime == timeRunning);
+ 		timeRunning = clockTime;
+@@ -258,6 +258,7 @@ main(int argc, char *argv[]) {
+ 		/* Check to see if we received a signal while running jobs. */
+ 		if (got_sighup) {
+ 			got_sighup = 0;
++			database.mtime = (time_t) 0;
+ 			log_close();
+ 		}
+ 		if (got_sigchld) {
+@@ -357,7 +358,7 @@ set_time(int initialize) {
+  * Try to just hit the next minute.
+  */
+ static void
+-cron_sleep(int target) {
++cron_sleep(int target, cron_db *db) {
+ 	time_t t1, t2;
+ 	int seconds_to_wait;
+ 
+@@ -376,6 +377,7 @@ cron_sleep(int target) {
+ 		 */
+ 		if (got_sighup) {
+ 			got_sighup = 0;
++			db->mtime = (time_t) 0;
+ 			log_close();
+ 		}
+ 		if (got_sigchld) {
+
+--- vixie-cron-4.1/database.c.symlinks	2007-01-28 17:12:24.000000000 +0000
++++ vixie-cron-4.1/database.c	2007-01-28 17:12:34.000000000 +0000
+@@ -354,7 +354,7 @@ static void max_mtime( char *dir_name, s
+ 		if ( not_a_crontab ( dp ) )
+ 			continue;
+ 
+-		if (!glue_strings(tabname, sizeof tabname, SPOOL_DIR, dp->d_name, '/'))
++		if (!glue_strings(tabname, sizeof tabname, dir_name, dp->d_name, '/'))
+ 			continue;	/* XXX log? */
+ 
+ 		if ( stat( tabname, &st ) < OK )

vixie-cron-4.1-_62newyear.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/misc.c.plus	2007-01-22 11:33:10.000000000 +0100
++++ vixie-cron-4.1/misc.c	2007-01-22 11:34:23.000000000 +0100
+@@ -773,7 +773,7 @@
+ 	if (local->tm_year < gmt.tm_year)
+ 		offset -= 24 * 3600;
+ 	else if (local->tm_year > gmt.tm_year)
+-		offset -= 24 * 3600;
++		offset += 24 * 3600;
+ 	else if (local->tm_yday < gmt.tm_yday)
+ 		offset -= 24 * 3600;
+ 	else if (local->tm_yday > gmt.tm_yday)

vixie-cron-4.1-_63newavc.patch

@@ -0,0 +1,32 @@
+--- vixie-cron-4.1/security.c.audit	2007-02-06 13:37:11.000000000 -0500
++++ vixie-cron-4.1/security.c	2007-02-06 13:41:15.000000000 -0500
+@@ -29,6 +29,12 @@
+ #include <selinux/get_context_list.h>
+ #endif
+ 
++#ifdef WITH_AUDIT
++#include <libaudit.h>
++#define _GNU_SOURCE
++#include <stdio.h>
++#endif
++
+ static char ** build_env(char **cronenv);
+ 
+ #ifdef WITH_SELINUX
+@@ -483,6 +489,15 @@
+ 		{
+ 			if ( security_getenforce() > 0 ) 
+ 			{
++#ifdef WITH_AUDIT
++				char *msg = NULL;
++				if (asprintf(&msg, "cron: Unauthorized MLS range acct=%s new_scontext=%s old_scontext=%s",  u->name, (char*)ucontext, u->scontext) >= 0) {
++					int audit_fd = audit_open();
++					audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, msg, NULL, NULL, NULL, 0);
++					close(audit_fd);
++				}
++				free(msg);
++#endif
+ 				syslog(LOG_ERR,
+ 				       "CRON (%s) ERROR:"
+ 				       "Unauthorized range %s in MLS_LEVEL for user %s ", 
+

vixie-cron-4.1-_6_rh_crond.patch

@@ -0,0 +1,97 @@
+--- vixie-cron-4.1-rh/database.c.rh_crond	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/database.c	2004-07-22 09:47:20.000000000 -0400
+@@ -36,7 +36,7 @@
+ 
+ void
+ load_database(cron_db *old_db) {
+-	struct stat statbuf, syscron_stat;
++	struct stat statbuf, syscron_stat, crond_stat;
+ 	cron_db new_db;
+ 	DIR_T *dp;
+ 	DIR *dir;
+@@ -53,6 +53,11 @@
+ 		(void) exit(ERROR_EXIT);
+ 	}
+ 
++	if (stat(RH_CROND_DIR, &crond_stat) < OK) {
++		log_it("CRON", getpid(), "STAT FAILED", RH_CROND_DIR);
++		(void) exit(ERROR_EXIT);
++	}
++
+ 	/* track system crontab file
+ 	 */
+ 	if (stat(SYSCRONTAB, &syscron_stat) < OK)
+@@ -65,7 +70,9 @@
+ 	 * so is guaranteed to be different than the stat() mtime the first
+ 	 * time this function is called.
+ 	 */
+-	if (old_db->mtime == TMAX(statbuf.st_mtime, syscron_stat.st_mtime)) {
++	if (old_db->mtime == TMAX(crond_stat.st_mtime,
++				  TMAX(statbuf.st_mtime, syscron_stat.st_mtime))
++	   ){
+ 		Debug(DLOAD, ("[%ld] spool dir mtime unch, no load needed.\n",
+ 			      (long)getpid()))
+ 		return;
+@@ -76,13 +83,61 @@
+ 	 * actually changed.  Whatever is left in the old database when
+ 	 * we're done is chaff -- crontabs that disappeared.
+ 	 */
+-	new_db.mtime = TMAX(statbuf.st_mtime, syscron_stat.st_mtime);
++	new_db.mtime = TMAX(crond_stat.st_mtime,
++			    TMAX(statbuf.st_mtime, syscron_stat.st_mtime));
+ 	new_db.head = new_db.tail = NULL;
+ 
+ 	if (syscron_stat.st_mtime)
+ 		process_crontab("root", NULL, SYSCRONTAB, &syscron_stat,
+ 				&new_db, old_db);
+ 
++	if (!(dir = opendir(RH_CROND_DIR))) {
++		log_it("CRON", getpid(), "OPENDIR FAILED", RH_CROND_DIR);
++		(void) exit(ERROR_EXIT);
++	}
++
++	while (NULL != (dp = readdir(dir))) {
++		char	fname[MAXNAMLEN+1],
++			tabname[MAXNAMLEN+1];
++		size_t len;
++
++		/* avoid file names beginning with ".".  this is good
++		 * because we would otherwise waste two guaranteed calls
++		 * to getpwnam() for . and .., and there shouldn't be 
++		 * hidden files in here anyway
++		 */
++		if (dp->d_name[0] == '.')
++			continue;
++
++		/* ignore files starting with # and ending with ~ */
++		if (dp->d_name[0] == '#')
++			continue;
++		
++		len = strlen(dp->d_name);
++
++		if (len >= sizeof fname)
++			continue;	/* XXX log? */
++
++		if ((len > 0) && (dp->d_name[len - 1] == '~'))
++			continue;
++
++		(void) strcpy(fname, dp->d_name);
++		
++		if ((len > 8) && (strncmp(fname + len - 8, ".rpmsave", 8) == 0))
++			continue;
++		if ((len > 8) && (strncmp(fname + len - 8, ".rpmorig", 8) == 0))
++			continue;
++		if ((len > 7) && (strncmp(fname + len - 7, ".rpmnew", 7) == 0))
++			continue;
++
++		if (!glue_strings(tabname, sizeof tabname, RH_CROND_DIR, fname, '/'))
++			continue;	/* XXX log? */
++
++		process_crontab("root", "*system*", tabname,
++				&crond_stat, &new_db, old_db);
++	}
++	closedir(dir);
++
+ 	/* we used to keep this dir open all the time, for the sake of
+ 	 * efficiency.  however, we need to close it in every fork, and
+ 	 * we fork a lot more often than the mtime of the dir changes.

vixie-cron-4.1-_7_crontab-stdin.patch

@@ -0,0 +1,14 @@
+--- vixie-cron-4.1-rh/crontab.c.crontab-stdin	2004-07-21 10:16:43.000000000 -0400
++++ vixie-cron-4.1-rh/crontab.c	2004-07-22 10:56:45.000000000 -0400
+@@ -83,6 +83,11 @@
+ #if defined(BSD)
+ 	setlinebuf(stderr);
+ #endif
++	char *n="-";			/*set the n string to - so we have a valid string to use*/ 
++		 			/*should we desire to make changes to behavior later.*/
++	if(argv[1] == NULL){ 		/* change behavior to allow crontab to take stdin with no '-'*/
++		argv[1] =n;
++	}
+ 	parse_args(argc, argv);		/* sets many globals, opens a file */
+ 	set_cron_cwd();
+ 	if (!allowed(RealUser, CRON_ALLOW, CRON_DENY)) {

vixie-cron-4.1-_8_root-allowed.patch

@@ -0,0 +1,32 @@
+--- vixie-cron-4.1-rh/misc.c.root-allowed	2004-07-21 20:09:31.000000000 -0400
++++ vixie-cron-4.1-rh/misc.c	2004-07-22 11:43:10.000000000 -0400
+@@ -449,16 +449,27 @@
+ allowed(const char *username, const char *allow_file, const char *deny_file) {
+ 	FILE	*fp;
+ 	int	isallowed;
++	char    buf[128];
+ 
+-	if (strcmp(username, ROOT_USER) == 0)
+-		return (TRUE);
+ 	isallowed = FALSE;
+ 	if ((fp = fopen(allow_file, "r")) != NULL) {
+ 		isallowed = in_file(username, fp, FALSE);
+ 		fclose(fp);
++		if( ( getuid() == 0 ) && (!isallowed) )
++		{
++		    snprintf(buf,sizeof(buf),"root used -u for user %s not in cron.allow",username);
++		    log_it("crontab",getpid(),"warning",buf);
++		    isallowed = TRUE;
++		}
+ 	} else if ((fp = fopen(deny_file, "r")) != NULL) {
+ 		isallowed = !in_file(username, fp, FALSE);
+ 		fclose(fp);
++		if( ( getuid() == 0 ) && (!isallowed) )
++		{
++		    snprintf(buf,sizeof(buf),"root used -u for user %s in cron.deny",username);
++		    log_it("crontab",getpid(),"warning",buf);
++		    isallowed = TRUE;
++		}
+ 	}
+ 	return (isallowed);
+ }

vixie-cron-4.1-_9_no-header.patch

@@ -0,0 +1,25 @@
+--- vixie-cron-4.1-rh/crontab.c.no-header	2004-07-22 10:56:45.000000000 -0400
++++ vixie-cron-4.1-rh/crontab.c	2004-07-22 11:47:29.000000000 -0400
+@@ -32,7 +32,7 @@
+ 
+ #include "cron.h"
+ 
+-#define NHEADER_LINES 3
++#define NHEADER_LINES 0
+ 
+ enum opt_t	{ opt_unknown, opt_list, opt_delete, opt_edit, opt_replace };
+ 
+@@ -554,9 +554,10 @@
+ 	 *
+ 	 * VERY IMPORTANT: make sure NHEADER_LINES agrees with this code.
+ 	 */
+-	fprintf(tmp, "# DO NOT EDIT THIS FILE - edit the master and reinstall.\n");
+-	fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
+-	fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
++	/*fprintf(tmp, "# DO NOT EDIT THIS FILE - edit the master and reinstall.\n");
++	 *fprintf(tmp, "# (%s installed on %-24.24s)\n", Filename, ctime(&now));
++	 *fprintf(tmp, "# (Cron version %s -- %s)\n", CRON_VERSION, rcsid);
++	 */
+ 
+ 	/* copy the crontab to the tmp
+ 	 */

vixie-cron-4.1-bz178836.patch

@@ -0,0 +1,35 @@
+--- vixie-cron-4.1/crontab.c.fast	2006-10-24 14:01:04.000000000 +0200
++++ vixie-cron-4.1/crontab.c	2006-10-24 14:04:55.000000000 +0200
+@@ -363,13 +363,6 @@
+ 		}
+ 	}
+ 
+-	if (fstat(fileno(f), &statbuf) < 0) {
+-		perror("fstat");
+-		goto fatal;
+-	}
+-	utimebuf.actime = statbuf.st_atime;
+-	utimebuf.modtime = statbuf.st_mtime;
+-
+ 	/* Turn off signals. */
+ 	(void)signal(SIGHUP, SIG_IGN);
+ 	(void)signal(SIGINT, SIG_IGN);
+@@ -425,6 +418,9 @@
+ 		perror(Filename);
+ 		exit(ERROR_EXIT);
+ 	}
++	/* Set it to 1970 */
++	utimebuf.actime = 0;
++	utimebuf.modtime = 0;
+ 	utime(Filename, &utimebuf);
+  again:
+ 	rewind(NewCrontab);
+@@ -521,7 +517,7 @@
+ 		goto remove;	    
+ 	}
+ 
+-	if (utimebuf.modtime == statbuf.st_mtime) {
++	if (statbuf.st_mtime == 0) {
+ 		fprintf(stderr, "%s: no changes made to crontab\n",
+ 			ProgramName);
+ 		goto remove;

vixie-cron-4.1-bz220376.patch

@@ -0,0 +1,49 @@
+--- vixie-cron-4.1/misc.c.myska	2007-04-12 13:20:23.000000000 +0200
++++ vixie-cron-4.1/misc.c	2007-04-12 15:38:50.000000000 +0200
+@@ -214,7 +214,7 @@
+ #ifdef CRON_GROUP
+ 	grp = getgrnam(CRON_GROUP);
+ #endif
+-	/* first check for CRONDIR ("/var/cron" or some such)
++	/* first check for CRONDIR ("/var/spool" or some such)
+ 	 */
+ 	if (stat(CRONDIR, &sb) < OK && errno == ENOENT) {
+ 		perror(CRONDIR);
+@@ -270,6 +270,37 @@
+ 			exit(ERROR_EXIT);
+ 		    }
+ 	}
++	/* now check the RH_CROND_DIR */
++	if (stat(RH_CROND_DIR, &sb) < OK && errno == ENOENT) {
++        perror(RH_CROND_DIR);
++        if (OK == mkdir(RH_CROND_DIR, 0700)) {
++            fprintf(stderr, "%s: created\n", RH_CROND_DIR);
++            stat(RH_CROND_DIR, &sb);
++        } else {
++            fprintf(stderr, "%s: ", RH_CROND_DIR);
++            perror("mkdir");
++            exit(ERROR_EXIT);
++        }
++    }
++    if (!S_ISDIR(sb.st_mode)) {
++        fprintf(stderr, "'%s' is not a directory, bailing out.\n",
++            RH_CROND_DIR);
++        exit(ERROR_EXIT);
++    }
++    if (grp != NULL) {
++        if (sb.st_gid != grp->gr_gid)
++            if( chown(RH_CROND_DIR, -1, grp->gr_gid) == -1 )
++            {
++            fprintf(stderr,"chdir %s failed: %s\n", RH_CROND_DIR, strerror(errno));
++            exit(ERROR_EXIT);
++            }
++        if (sb.st_mode != 01730)
++            if( chmod(RH_CROND_DIR, 01730) == -1 )
++            {
++            fprintf(stderr,"chmod 01730 %s failed: %s\n", RH_CROND_DIR, strerror(errno));
++            exit(ERROR_EXIT);
++            }
++    }
+ }
+ 
+ /* acquire_daemonlock() - write our PID into /etc/cron.pid, unless

vixie-cron-4.1-fixs.patch

@@ -0,0 +1,43 @@
+--- vixie-cron-4.1/security.c.bug	2007-07-02 12:11:56.000000000 +0200
++++ vixie-cron-4.1/security.c	2007-07-02 12:20:25.000000000 +0200
+@@ -201,13 +201,6 @@
+ 	return -1;
+     }
+ 
+-    if ( chdir(homedir) == -1 )
+-    {
+-	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
+-	log_it("CRON", getpid(), homedir, strerror(errno));
+-	return -1;
+-    }
+-
+     if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
+     {
+ 	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
+@@ -219,7 +212,14 @@
+ 	log_it("CRON", getpid(), "setuid failed:", strerror(errno));
+ 	return -1;
+     }
+-    
++
++	if ( chdir(homedir) == -1 )
++    {
++    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
++    log_it("CRON", getpid(), homedir, strerror(errno));
++    return -1;
++    }
++   
+     return 0;
+ }
+ 
+--- vixie-cron-4.1/crontab.1.bug	2007-07-02 12:11:56.000000000 +0200
++++ vixie-cron-4.1/crontab.1	2007-07-02 12:20:55.000000000 +0200
+@@ -19,7 +19,7 @@
+ .\"
+ .\" $Id: crontab.1,v 1.7 2004/01/23 19:03:32 vixie Exp $
+ .\"
+-.TH CRONTAB 1 "16 Januar 2007"
++.TH CRONTAB 1 "16 January 2007"
+ .UC 4
+ .SH NAME
+ crontab \- maintain crontab files for individual users (ISC Cron V4.1)

vixie-cron-4.1-getseuserbyname.patch

@@ -0,0 +1,36 @@
+--- vixie-cron-4.1/user.c~	2005-10-14 14:55:17.000000000 -0400
++++ vixie-cron-4.1/user.c	2005-10-14 15:15:07.000000000 -0400
+@@ -44,15 +44,26 @@
+ 	security_context_t  file_context=NULL;
+ 	struct av_decision avd;
+ 	int retval=0;
++	char *seuser=NULL;
++	char *level=NULL;
+ 	*rcontext = NULL;
+-	if (get_default_context(name, NULL, &scontext)) {
+-		if (security_getenforce() > 0) {
+-			log_it(name, getpid(), "No SELinux security context",tabname);
+-			return -1;
+-		} else {
+-			log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
+-			return 0;
++
++	if (getseuserbyname(name, &seuser, &level) == 0) {
++		retval=get_default_context_with_level(seuser, level, NULL, &scontext);
++		free(seuser);
++		free(level);
++		if (retval) {
++			if (security_getenforce() > 0) {
++				log_it(name, getpid(), "No SELinux security context",tabname);
++				return -1;
++			} else {
++				log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
++				return 0;
++			}
+ 		}
++	} else {
++		log_it(name, getpid(), "getseusername FAILED", name);
++		return (security_getenforce() > 0);
+ 	}
+ 	
+ 	if (fgetfilecon(crontab_fd, &file_context) < OK) {

vixie-cron-4.1-hardlink.patch

@@ -0,0 +1,11 @@
+--- vixie-cron-4.1/database.c.link	2007-03-27 17:59:59.000000000 +0200
++++ vixie-cron-4.1/database.c	2007-04-10 22:40:37.000000000 +0200
+@@ -256,7 +256,7 @@
+ 		    log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
+ 		    goto next_crontab;
+ 	    }
+-	    if (statbuf->st_nlink != 1) {
++	    if (pw && statbuf->st_nlink != 1) {
+ 		    log_it(fname, getpid(), "BAD LINK COUNT", tabname);
+ 		    goto next_crontab;
+ 	    }

vixie-cron-4.1-loginuid.patch

@@ -0,0 +1,26 @@
+--- vixie-cron-4.1/crond.pam.loginuid	2005-06-17 11:15:07.732769000 -0400
++++ vixie-cron-4.1/crond.pam	2005-06-17 11:07:23.000000000 -0400
+@@ -2,12 +2,15 @@
+ # The PAM configuration file for the cron daemon
+ #
+ #
+-auth	   sufficient /lib/security/$ISA/pam_rootok.so
+-auth       required  /lib/security/$ISA/pam_stack.so service=system-auth
+-auth       required  pam_env.so
+-account    required  /lib/security/$ISA/pam_stack.so service=system-auth
+-session    required  /lib/security/$ISA/pam_stack.so service=system-auth
+-# Sets up user limits, please uncomment and read /etc/security/limits.conf
+-# to enable this functionality.
+-# session    required   pam_limits.so
++auth	   sufficient pam_rootok.so
++auth       required   pam_env.so
++auth       include    system-auth
++account    required   pam_access.so
++account    include    system-auth
++session    include    system-auth
++session    required   pam_loginuid.so
++# To enable PAM user limits for cron jobs, 
++# configure /etc/security/limits.conf and 
++# uncomment this line:
++# session  required   pam_limits.so
+ #

vixie-cron-4.1-man-page-typo.patch

@@ -0,0 +1,35 @@
+--- vixie-cron-4.1/cron.8.typo	2006-08-23 11:16:25.000000000 +0200
++++ vixie-cron-4.1/cron.8	2006-08-23 11:40:13.000000000 +0200
+@@ -19,7 +19,7 @@
+ .\"
+ .\" $Id: cron.8,v 1.8 2004/01/23 19:03:32 vixie Exp $
+ .\" 
+-.TH CRON 8 "10 January 1996""
++.TH CRON "8" "10 January 1996" "Linux Programmer's Manual"
+ .UC 4
+ .SH NAME
+ cron \- daemon to execute scheduled commands (ISC Cron V4.1)
+@@ -32,10 +32,10 @@
+ .RB [ \-m <mail command> ]
+ .SH DESCRIPTION
+ .I Cron
+-should be started from /etc/rc or /etc/rc.local.  It will return immediately,
+-so you don't need to start it with '&'.  The \-n option changes this default
+-behavior causing it to run in the foreground.  This can be useful when 
+-starting it out of init.
++should be started from /etc/rc.d/rc or /etc/rc.d/rc.local.  It will return 
++immediately, so you don't need to start it with '&'.  The \-n option changes 
++this default behavior causing it to run in the foreground.  This can be 
++useful when starting it out of init.
+ .PP
+ .I Cron
+ searches /var/spool/cron for crontab files which are named after accounts in
+@@ -91,7 +91,7 @@
+ .SS PAM Access Control
+ On Red Hat systems, crond now supports access control with PAM - see 
+ .IR pam (8) .
+-A PAM configuration file for crond is installed in /etc/pam.d/crond .
++A PAM configuration file for crond is installed in /etc/pam.d/crond.
+ crond loads the PAM environment from the pam_env module, but these
+ can be overriden by settings in the crontab file.
+ .SH SIGNALS

vixie-cron-4.1-mancrond.patch

@@ -0,0 +1,22 @@
+--- vixie-cron-4.1/crontab.5.mancrond	2007-03-27 17:59:59.000000000 +0200
++++ vixie-cron-4.1/crontab.5	2007-04-12 18:16:06.000000000 +0200
+@@ -196,7 +196,18 @@
+ 0 22 * * 1-5    mail -s "It's 10pm" joe%Joe,%%Where are your kids?%                                                           
+ 23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"                                                      
+ 5 4 * * sun     echo "run at 5 after 4 every sunday"                                                                          
+-.fi     
++.fi
++.SH Jobs in /etc/cron.d/
++The jobs in cron.d are system jobs, which are used usually for more than
++one user. That's the reason why is name of the user needed. MAILTO on the first line
++is optional.
++.SH EXAMPLE FOR JOB IN /etc/cron.d/job
++.nf
++#login as root
++#create job with preferred editor (e.g. vim)
++MAILTO=root
++* * * * * root touch /tmp/file
++.fi
+ .SH SELinux with multi level security (MLS)
+ In crontab is important specified security level by \fIcrontab\ -s\fR or specifying 
+ the required level on the first line of the crontab. Each level is specified 

vixie-cron-4.1-manual.patch

@@ -0,0 +1,467 @@
+--- vixie-cron-4.1/cron.8.manual	2007-01-17 11:13:28.000000000 +0100
++++ vixie-cron-4.1/cron.8	2007-01-17 11:13:28.000000000 +0100
+@@ -19,31 +19,40 @@
+ .\"
+ .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
+ .\" 
+-.TH CRON "8" "10 January 1996" "Linux Programmer's Manual"
++.TH CRON "8" "10 January 2007" "Linux Programmer's Manual"
+ .UC 4
+ .SH NAME
+ cron \- daemon to execute scheduled commands (ISC Cron V4.1)
+ .SH SYNOPSIS
+ .B cron
+-.RB [ \-l
+-.IR load_avg ]
+-.RB [ \-n ]
+-.RB [ \-p ]
+-.RB [ \-m <mail command> ]
++.RB [ -n " | " -p " | " -m \fP\fI<mail command>\fP\fB ]
++.br
++.B cron
++.B -x 
++.RB [ext,sch,proc,pars,load,misc,test,bit]
++.br
+ .SH DESCRIPTION
+ .I Cron
+-should be started from /etc/rc.d/rc or /etc/rc.d/rc.local.  It will return 
+-immediately, so you don't need to start it with '&'.  The \-n option changes 
+-this default behavior causing it to run in the foreground.  This can be 
+-useful when starting it out of init.
++should be started from 
++.I /etc/rc.d/init.d 
++or 
++.I /etc/init.d
++. It will return immediately, so you don't need to start it with '&'. 
+ .PP
+ .I Cron
+-searches /var/spool/cron for crontab files which are named after accounts in
+-/etc/passwd; crontabs found are loaded into memory.
++searches 
++.I /var/spool/cron 
++for crontab files which are named after accounts in
++.I/etc/passwd; 
++crontabs found are loaded into memory.
+ .I Cron
+-also searches for /etc/crontab and the files in the /etc/cron.d directory,
+-which are in a different format (see
+-.IR crontab (5)).
++also searches for 
++.I /etc/crontab 
++and the files in the 
++.I/etc/cron.d 
++directory, which are in a different format (see
++.BR crontab (5)
++).
+ .I Cron
+ then wakes up every minute, examining all stored crontabs, checking each
+ command to see if it should be run in the current minute.  When executing
+@@ -61,19 +70,10 @@
+ changed.  Thus
+ .I cron
+ need not be restarted whenever a crontab file is modified.  Note that the
+-.IR Crontab (1)
++.BR crontab (1)
+ command updates the modtime of the spool directory whenever it changes a
+ crontab.
+ .PP 
+-The
+-.B -m
+-option allows you to specify a shell command string to use for sending
+-cron mail output instead of 
+-.IR sendmail (8).
+-This command must accept a fully
+-formatted mail message (with headers) on stdin and send it as a mail
+-message to the recipients specified in the mail headers.
+-.PP 
+ .SS Daylight Saving Time and other time changes
+ Local time changes of less than three hours, such as those caused
+ by the start or end of Daylight Saving Time, are handled specially.
+@@ -94,6 +94,24 @@
+ A PAM configuration file for crond is installed in /etc/pam.d/crond.
+ crond loads the PAM environment from the pam_env module, but these
+ can be overriden by settings in the crontab file.
++.SH "OPTIONS"                                                                                                                 
++.TP                                                                                                                           
++.B "\-m"                                                                                                                      
++This option allows you to specify a shell command string to use for sending cron mail                                         
++output instead of                                                                                                             
++.BR sendmail (8).                                                                                                             
++This command must accept a fully formatted mail message (with headers) on stdin and send it                                   
++as a mail message to the recipients specified in the mail headers.
++.TP                                                                                                                           
++.B "\-n"                                                                                                                      
++This option changes default behavior causing it to run crond in the foreground.  This can be                                  
++useful when starting it out of init.
++.TP
++.B "\-p"
++Cron permit any crontab, which user set.
++.TP
++.B "\-x"
++With this option is possible to set debug flags.
+ .SH SIGNALS
+ On receipt of a \s-2SIGHUP\s+2, the cron daemon will close and reopen its
+ log file.  This is useful in scripts which rotate and age log files.  
+@@ -102,8 +120,9 @@
+ .SH CAVEATS
+ In this version of
+ .BR cron
+-, without the -p option,
+-/etc/crontab must not be writable by any user other than root,
++, without the \fB-p\fP option,
++.I /etc/crontab 
++must not be writable by any user other than root,
+ no crontab files may be links, or linked to by any other file,
+ and no crontab files may be executable, or be writable by any
+ user other than their owner.
+--- vixie-cron-4.1/crontab.1.manual	2007-01-17 11:13:28.000000000 +0100
++++ vixie-cron-4.1/crontab.1	2007-01-22 10:03:36.000000000 +0100
+@@ -19,7 +19,7 @@
+ .\"
+ .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
+ .\"
+-.TH CRONTAB 1 "29 December 1993"
++.TH CRONTAB 1 "16 Januar 2007"
+ .UC 4
+ .SH NAME
+ crontab \- maintain crontab files for individual users (ISC Cron V4.1)
+@@ -31,15 +31,18 @@
+ .B crontab
+ .RB [ -u
+ .IR user ]
+-.RB [ -l " | " -r " | " -e ] [ -i ]
++.RB [ -l " | " -r " | " -e ]\ [ -i ]
+ .RB [ -s ]
+ .SH DESCRIPTION
+ .I Crontab
+ is the program used to install, deinstall or list the tables
+ used to drive the
+-.IR cron (8)
+-daemon in ISC Cron.  Each user can have their own crontab, and though
+-these are files in /var, they are not intended to be edited directly.
++.BR cron (8)
++daemon in ISC Cron.  Each user can have their own crontab, and though these are files in 
++.I /var/spool/
++, they are not intended to be edited directly. For SELinux in mls mode can be even 
++more crontabs - for each range. For more see
++.BR selinux (8).
+ .PP
+ If the
+ .I cron.allow
+@@ -48,55 +51,52 @@
+ .I cron.allow
+ file does not exist but the
+ .I cron.deny
+-file does exist, then you must \fBnot\fR be listed in the
++file does exist, then you must \fInot\fR be listed in the
+ .I cron.deny
+ file in order to use this command.  If neither of these files exists,
+ only the super user will be allowed to use this command.
+ .PP
+-If the
+-.I -u
+-option is given, it specifies the name of the user whose crontab is to be
+-tweaked.  If this option is not given,
++.SH "OPTIONS"
++.TP
++.B "\-u"
++It specifies the name of the user whose crontab is to be tweaked.  If this option 
++is not given,
+ .I crontab
+ examines "your" crontab, i.e., the crontab of the person executing the
+ command.  Note that
+-.IR su (8)
++.BR su (8)
+ can confuse
+ .I crontab
+ and that if you are running inside of
+-.IR su (8)
++.BR su (8)
+ you should always use the
+-.I -u
++.B -u
+ option for safety's sake.
+-.PP
+ The first form of this command is used to install a new crontab from some
+-named file or standard input if the pseudo-filename ``-'' is given.
+-.PP
+-The
+-.I -l
+-option causes the current crontab to be displayed on standard output.
+-.PP
+-The
+-.I -r
+-option causes the current crontab to be removed.
+-.PP
+-The
+-.I -e
+-option is used to edit the current crontab using the editor specified by
++named file or standard input if the pseudo-filename "-" is given.
++.TP
++.B "\-l"
++The current crontab will be displayed on standard output.
++.TP
++.B "\-r"
++The current crontab will be be removed.
++.TP
++.B "\-e"
++This option is used to edit the current crontab using the editor specified by
+ the \s-1VISUAL\s+1 or \s-1EDITOR\s+1 environment variables.  After you exit
+ from the editor, the modified crontab will be installed automatically.
+-.PP
+-The
+-.I -i
+-option modifies the -r option to prompt the user for a 'y/Y' response
++.TP
++.B "\-i"
++This option modifies the 
++.B "\-r"
++option to prompt the user for a 'y/Y' response
+ before actually removing the crontab.
+-.PP
+-The
+-.I -s
+-option will append the current SELinux security context string as an
+-SELINUX_ROLE_TYPE setting to the crontab file before editing / replacement
+-occurs - see the documentation of SELINUX_ROLE_TYPE in 
+-.IR crontab(5) .
++.TP
++.B "\-s"
++It will append the current SELinux security context string as an
++MLS_LEVEL setting to the crontab file before editing / replacement
++occurs - see the documentation of MLS_LEVEL in 
++.BR crontab(5)\.
+ .SH "SEE ALSO"
+ crontab(5), cron(8)
+ .SH FILES
+--- vixie-cron-4.1/crontab.5.manual	2007-01-17 11:13:28.000000000 +0100
++++ vixie-cron-4.1/crontab.5	2007-01-22 10:02:17.000000000 +0100
+@@ -19,7 +19,7 @@
+ .\"
+ .\" $Id: vixie-cron-4.1-manual.patch,v 1.2 2007/01/22 09:11:23 mmaslano Exp $
+ .\" 
+-.TH CRONTAB 5 "24 January 1994"
++.TH CRONTAB 5 "16 January 2007"
+ .UC 4
+ .SH NAME
+ crontab \- tables for driving cron (ISC Cron V4.1)
+@@ -27,12 +27,12 @@
+ A
+ .I crontab
+ file contains instructions to the
+-.IR cron (8)
+-daemon of the general form: ``run this command at this time on this date''.
++.BR cron (8)
++daemon of the general form: "run this command at this time on this date".
+ Each user has their own crontab, and commands in any given crontab will be
+ executed as the user who owns the crontab.  Uucp and News will usually have
+ their own crontabs, eliminating the need for explicitly running
+-.IR su (1)
++.BR su (1)
+ as part of a cron command.
+ .PP
+ Blank lines and leading spaces and tabs are ignored.  Lines whose first
+@@ -58,7 +58,7 @@
+ .PP
+ Several environment variables are set up
+ automatically by the
+-.IR cron (8)
++.BR cron (8)
+ daemon.
+ SHELL is set to /bin/sh, and LOGNAME and HOME are set from the /etc/passwd 
+ line of the crontab\'s owner.
+@@ -68,9 +68,9 @@
+ on these systems, USER will be set also.)
+ .PP
+ In addition to LOGNAME, HOME, and SHELL,
+-.IR cron (8)
++.BR cron (8)
+ will look at MAILTO if it has any reason to send mail as a result of running
+-commands in ``this'' crontab.  If MAILTO is defined (and non-empty), mail is
++commands in "this" crontab.  If MAILTO is defined (and non-empty), mail is
+ sent to the user so named.  If MAILTO is defined but empty (MAILTO=""), no
+ mail will be sent.  Otherwise mail is sent to the owner of the crontab.  This
+ option is useful if you decide on /bin/mail instead of /usr/lib/sendmail as
+@@ -78,44 +78,47 @@
+ usually doesn\'t read its mail.
+ .PP
+ By default, cron will send mail using the mail 'Content-Type:' header of 'text/plain' with the 'charset=' parameter set to the charmap / codeset of the locale in which 
+-.IR crond(8)
++.BR crond (8)
+ is started up - ie. either the default system locale, if no LC_* environment
+ variables are set, or the locale specified by the LC_* environment variables
+-( see 
+-.IR locale(7) ). 
++(see 
++.BR locale (7)).
+ You can use different character encodings for mailed cron job output by 
+ setting the CONTENT_TYPE and CONTENT_TRANSFER_ENCODING variables in crontabs,
+ to the correct values of the mail headers of those names.  
+ .PP
+-The SELINUX_ROLE_TYPE environment variable provides support for multiple per-job 
++The MLS_LEVEL environment variable provides support for multiple per-job 
+ SELinux security contexts in the same crontab.
+ By default, cron jobs execute with the default SELinux security context of the 
+ user that created the crontab file.
+ When using multiple security levels and roles, this may not be sufficient, because
+ the same user may be running in a different role or at a different security level.
+-You can set SELINUX_ROLE_TYPE to the SELinux security context string specifying
++For more about roles and SELinux MLS/MCS see 
++.BR selinux (8) 
++and undermentioned crontab example.
++You can set MLS_LEVEL to the SELinux security context string specifying
+ the SELinux security context in which you want the job to run, and crond will set 
+ the execution context of the or jobs to which the setting applies to the specified 
+ context.
+ See also the 
+-.IR crontab(1) -s option.
++.BR crontab(1)\ -s\ option.
+ .PP
+ The format of a cron command is very much the V7 standard, with a number of
+ upward-compatible extensions.  Each line has five time and date fields,
+ followed by a user name if this is the system crontab file,
+ followed by a command.  Commands are executed by
+-.IR cron (8)
++.BR cron (8)
+ when the minute, hour, and month of year fields match the current time,
+ .I and
+ at least one of the two day fields (day of month, or day of week)
+-match the current time (see ``Note'' below).
++match the current time (see "Note" below).
+ Note that this means that non-existent times, such as "missing hours"
+ during daylight savings conversion, will never match, causing jobs
+ scheduled during the "missing times" not to be run.  Similarly, times
+ that occur more than once (again, during daylight savings conversion)
+ will cause matching jobs to be run twice.
+ .PP
+-.IR cron (8)
++.BR cron (8)
+ examines cron entries once every minute.
+ .PP
+ The time and date fields are:
+@@ -136,30 +139,30 @@
+ day of week	0-7 (0 or 7 is Sun, or use names)
+ .br
+ .PP
+-A field may be an asterisk (*), which always stands for ``first\-last''.
++A field may be an asterisk (*), which always stands for "first\-last".
+ .PP
+ Ranges of numbers are allowed.  Ranges are two numbers separated
+ with a hyphen.  The specified range is inclusive.  For example,
+-8-11 for an ``hours'' entry specifies execution at hours 8, 9, 10
++8-11 for an "hours" entry specifies execution at hours 8, 9, 10
+ and 11.
+ .PP
+ Lists are allowed.  A list is a set of numbers (or ranges)
+-separated by commas.  Examples: ``1,2,5,9'', ``0-4,8-12''.
++separated by commas.  Examples: "1,2,5,9", "0-4,8-12".
+ .PP
+ Step values can be used in conjunction with ranges.  Following
+-a range with ``/<number>'' specifies skips of the number's value
+-through the range.  For example, ``0-23/2'' can be used in the hours
++a range with "<number>" specifies skips of the number's value
++through the range.  For example, "0-23/2" can be used in the hours
+ field to specify command execution every other hour (the alternative
+-in the V7 standard is ``0,2,4,6,8,10,12,14,16,18,20,22'').  Steps are
+-also permitted after an asterisk, so if you want to say ``every two
+-hours'', just use ``*/2''.
++in the V7 standard is "0,2,4,6,8,10,12,14,16,18,20,22").  Steps are
++also permitted after an asterisk, so if you want to say "every two
++hours", just use "*/2".
+ .PP
+-Names can also be used for the ``month'' and ``day of week''
++Names can also be used for the "month" and "day of week"
+ fields.  Use the first three letters of the particular
+ day or month (case doesn't matter).  Ranges or
+ lists of names are not allowed.
+ .PP
+-The ``sixth'' field (the rest of the line) specifies the command to be
++The "sixth" field (the rest of the line) specifies the command to be
+ run.
+ The entire command portion of the line, up to a newline or %
+ character, will be executed by /bin/sh or by the shell
+@@ -175,30 +178,52 @@
+ .I either
+ field matches the current time.  For example,
+ .br
+-``30 4 1,15 * 5''
++"30 4 1,15 * 5"
+ would cause a command to be run at 4:30 am on the 1st and 15th of each
+ month, plus every Friday.
+-.SH EXAMPLE CRON FILE
++.SH EXAMPLE CRON FILE                                                                                                         
++.nf                                                                                                                           
++# use /bin/sh to run commands, no matter what /etc/passwd says                                                                
++SHELL=/bin/sh                                                                                                                 
++# mail any output to `paul', no matter whose crontab this is                                                                  
++MAILTO=paul                                                                                                                   
++#                                                                                                                             
++# run five minutes after midnight, every day                                                                                  
++5 0 * * *       $HOME/bin/daily.job >> $HOME/tmp/out 2>&1                                                                     
++# run at 2:15pm on the first of every month -- output mailed to paul                                                          
++15 14 1 * *     $HOME/bin/monthly                                                                                             
++# run at 10 pm on weekdays, annoy Joe                                                                                         
++0 22 * * 1-5    mail -s "It's 10pm" joe%Joe,%%Where are your kids?%                                                           
++23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"                                                      
++5 4 * * sun     echo "run at 5 after 4 every sunday"                                                                          
++.fi     
++.SH SELinux with multi level security (MLS)
++In crontab is important specified security level by \fIcrontab\ -s\fR or specifying 
++the required level on the first line of the crontab. Each level is specified 
++in \fI/etc/selinux/targeted/seusers\fR. For using crontab in MLS mode is really important:
++.br 
++- check/change actual role, 
++.br
++- set correct \fIrole for directory\fR, which is used for input/output.
++.SH EXAMPLE FOR SELINUX MLS
+ .nf
+-# use /bin/sh to run commands, no matter what /etc/passwd says
+-SHELL=/bin/sh
+-# mail any output to `paul', no matter whose crontab this is
+-MAILTO=paul
+-#
+-# run five minutes after midnight, every day
+-5 0 * * *       $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
+-# run at 2:15pm on the first of every month -- output mailed to paul
+-15 14 1 * *     $HOME/bin/monthly
+-# run at 10 pm on weekdays, annoy Joe
+-0 22 * * 1-5	mail -s "It's 10pm" joe%Joe,%%Where are your kids?%
+-23 0-23/2 * * * echo "run 23 minutes after midn, 2am, 4am ..., everyday"
+-5 4 * * sun     echo "run at 5 after 4 every sunday"
++# login as root
++newrole -r sysadm_r
++mkdir /tmp/SystemHigh
++chcon -l SystemHigh /tmp/SystemHigh
++crontab -e
++# write in crontab file
++MLS_LEVEL=SystemHigh
++0-59 * * * * id -Z > /tmp/SystemHigh/crontest
++Now if I log in as a normal user it can't work, because /tmp/SystemHigh is
++higher than my level.
+ .fi
+ .SH FILES
+-/etc/crontab			System crontab file
+-
+-.SH SEE ALSO
+-cron(8), crontab(1)
++.I /etc/crontab
++system crontab file
++.SH "SEE ALSO"
++.BR cron (8), 
++.BR crontab (1)
+ .SH EXTENSIONS
+ When specifying day of week, both day 0 and day 7 will be considered Sunday.
+ BSD and ATT seem to disagree about this.
+@@ -231,8 +256,10 @@
+ .fi
+ .SH CAVEATS
+ In this version of
+-.BR cron ,
+-/etc/crontab must not be writable by any user other than root.
++.I cron
++,
++.I /etc/crontab 
++must not be writable by any user other than root.
+ No crontab files may be links, or linked to by any other file.
+ No crontab files may be executable, or be writable by any user
+ other than their owner.

vixie-cron-4.1-pam_crontab.patch

@@ -0,0 +1,844 @@
+--- vixie-cron-4.1/cron.h.pamcrontab	2007-09-11 10:22:20.000000000 +0200
++++ vixie-cron-4.1/cron.h	2007-09-11 10:22:21.000000000 +0200
+@@ -47,3 +47,20 @@
+ #include "funcs.h"
+ #include "globals.h"
+ 
++#ifdef WITH_PAM
++static pam_handle_t *pamh = NULL;
++static int pam_session_opened = 0;  //global for open session
++static const struct pam_conv conv = {
++    NULL
++};
++
++#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
++    fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
++    if (pamh != NULL) { \
++        if (pam_session_opened != 0) \
++            pam_close_session(pamh, PAM_SILENT); \
++        pam_end(pamh, retcode); \
++    } \
++        return(retcode);    }
++#endif
++
+--- vixie-cron-4.1/crontab.c.pamcrontab	2007-09-11 10:22:21.000000000 +0200
++++ vixie-cron-4.1/crontab.c	2007-09-11 10:22:21.000000000 +0200
+@@ -37,7 +37,6 @@
+ #include <selinux/av_permissions.h>
+ #endif
+ 
+-
+ #define NHEADER_LINES 0
+ 
+ enum opt_t	{ opt_unknown, opt_list, opt_delete, opt_edit, opt_replace };
+@@ -118,7 +117,14 @@
+ 		fprintf(stderr, "See crontab(1) for more information\n");
+ 		log_it(RealUser, Pid, "AUTH", "crontab command not allowed");
+ 		exit(ERROR_EXIT);
+-	}
++	}	
++	if (cron_start_pam(pw) != PAM_SUCCESS) {
++		fprintf(stderr,
++			"You (%s) are not allowed to access to (%s) because of pam configuration.\n",
++			User, ProgramName);
++		exit(ERROR_EXIT);
++	};
++
+ 	exitstatus = OK_EXIT;
+ 	switch (Option) {
+ 	case opt_unknown:
+@@ -140,6 +146,7 @@
+ 	default:
+ 		abort();
+ 	}
++	cron_close_pam();
+ 	exit(exitstatus);
+ 	/*NOTREACHED*/
+ }
+@@ -384,31 +391,14 @@
+ 		fprintf(stderr, "path too long\n");
+ 		goto fatal;
+ 	}
+-	//syslog(LOG_ERR,"%s%s",Filename,tmp_path());
+-	//syslog(LOG_ERR,"BEFORE MKSTEMP pid: %d uid: %d gid: %d",Pid,MY_UID(pw), MY_GID(pw));//uid, gid);
+ 	uid = MY_UID(pw);
+ 	setreuid(0, uid);
+-  //syslog(LOG_ERR,"BEFORE MKSTEMP SETREUID pid: %d uid: %d gid: %d",Pid,MY_UID(pw), MY_GID(pw));//uid,gid);
+ 	if (-1 == (t = mkstemp(Filename))) {
+ 		perror(Filename);
+ 		goto fatal;
+ 	}
+ 
+-/* instead of chown we're using setreuid */
+-/*#ifdef HAS_FCHOWN
+-	if (fchown(t, MY_UID(pw), MY_GID(pw)) < 0) {
+-		perror("fchown");
+-		goto fatal;
+-	}
+-#else
+-	if (chown(Filename, MY_UID(pw), MY_GID(pw)) < 0) {
+-		perror("chown");
+-		goto fatal;
+-	}
+-#endif*/
+-	
+     setreuid(uid,0);
+-	//syslog(LOG_ERR,"AFTER MKSTEMP pid: %d uid: %d gid: %d",Pid,uid, MY_GID(pw));
+ 	if (!(NewCrontab = fdopen(t, "r+"))) {
+ 		perror("fdopen");
+ 		goto fatal;
+@@ -497,10 +487,6 @@
+ 			perror("setuid(getuid())");
+ 			exit(ERROR_EXIT);
+ 		}
+-/*		if (chdir(_PATH_TMP) < 0) {
+-			perror(_PATH_TMP);
+-			exit(ERROR_EXIT);
+-		}*/
+ 		if (!glue_strings(q, sizeof q, editor, Filename, ' ')) {
+ 			fprintf(stderr, "%s: editor command line too long\n",
+ 			    ProgramName);
+--- vixie-cron-4.1/security.c.pamcrontab	2007-09-11 10:22:21.000000000 +0200
++++ vixie-cron-4.1/security.c	2007-09-11 10:30:26.000000000 +0200
+@@ -46,70 +46,55 @@
+ int cron_restore_default_security_context() {
+ 	setexeccon(NULL);
+ }
+-int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
+-{
++
++int cron_set_job_security_context(entry *e, user *u, char ***jobenv) {
+     time_t minutely_time = 0;
+-    if((e->flags & MIN_STAR)==MIN_STAR)
+-    {
+-	/* "minute-ly" job: Every minute for given hour/dow/month/dom. 
+-	 * Ensure that these jobs never run in the same minute:
+-	 */
+-	minutely_time = time(0);
+-	Debug(DSCH, ("Minute-ly job. Recording time %lu\n", minutely_time))
+-    }
+ 
+-    if ( cron_open_security_session( e->pwd ) != 0 )
+-    {
+-	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+-	       e->pwd->pw_name, strerror(errno)
+-	      );
+-	return -1;
++    if ((e->flags & MIN_STAR)==MIN_STAR) {
++		/* "minute-ly" job: Every minute for given hour/dow/month/dom. 
++		 * Ensure that these jobs never run in the same minute:
++		 */
++		minutely_time = time(0);
++		Debug(DSCH, ("Minute-ly job. Recording time %lu\n", minutely_time))
+     }
+ 
++    if (cron_start_pam(e->pwd) != 0) {
++		syslog(LOG_INFO, "CRON (%s): failed to open PAM security session: %s", e->pwd->pw_name, pam_strerror(pamh,cron_start_pam(e->pwd)));
++		return -1;
++    }
+     *jobenv = build_env( e->envp );
+ 
+ #ifdef WITH_SELINUX
+-
+     /* we must get the crontab context BEFORE changing user, else
+      * we'll not be permitted to read the cron spool directory :-)
+      */
+-
+     security_context_t ucontext=0; 
+ 
+-    if ( cron_get_job_range(u, &ucontext, *jobenv) < OK )
+-    {
+-	syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
+-	       e->pwd->pw_name, strerror(errno)
+-	      );
+-	return -1;
++    if (cron_get_job_range(u, &ucontext, *jobenv) < OK) {
++		syslog(LOG_ERR, "CRON (%s) ERROR: failed to get selinux context: %s", 
++	       e->pwd->pw_name, strerror(errno));
++		return -1;
+     }
+ 
+-    if (cron_change_selinux_range(u, ucontext) != 0)
+-    {
++    if (cron_change_selinux_range(u, ucontext) != 0) {
+         syslog(LOG_INFO,"CRON (%s) ERROR: failed to change SELinux context", 
+ 	       e->pwd->pw_name);
+-	if ( ucontext )
+-		freecon(ucontext);
+-	return -1;
++		if ( ucontext )
++			freecon(ucontext);
++		return -1;
+     }
+-    if ( ucontext )
+-	freecon(ucontext);
++    if (ucontext)
++		freecon(ucontext);
+ #endif
+ 
+-    if ( cron_start_security_session( e->pwd ) != 0 )
+-    {
+-	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+-	       e->pwd->pw_name, strerror(errno)
+-	      );
+-	return -1;
+-    }
+-
+-    if ( cron_change_user( e->pwd, env_get("HOME", *jobenv)) != 0 )
+-    {
+-	syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", 
+-	       e->pwd->pw_name, strerror(errno)
+-	      );
+-	return -1;
++/*    if (cron_open_pam_session(e->pwd) != 0) {
++		syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", e->pwd->pw_name, strerror(errno));
++		return -1;
++    }
++*/
++    if (cron_change_user(e->pwd, env_get("HOME", *jobenv)) != 0) {
++		syslog(LOG_INFO, "CRON (%s) ERROR: failed to open PAM security session: %s", e->pwd->pw_name, strerror(errno));
++		return -1;
+     }	
+ 
+     log_close();
+@@ -117,40 +102,23 @@
+ 
+     time_t job_run_time = time(0L);
+ 
+-    if( (minutely_time > 0)
+-	&&((job_run_time / 60) != (minutely_time / 60))
+-      )
+-    {/* if a per-minute job is delayed into the next minute 
++    if ((minutely_time > 0)	&&((job_run_time / 60) != (minutely_time / 60))) {
++     /* if a per-minute job is delayed into the next minute 
+       * (eg. by network authentication method timeouts), skip it.
+       */
+-	struct tm tmS, tmN;
+-	localtime_r(&job_run_time, &tmN);
+-	localtime_r(&minutely_time,&tmS);
+-	syslog(LOG_ERR, 
++		struct tm tmS, tmN;
++		localtime_r(&job_run_time, &tmN);
++		localtime_r(&minutely_time,&tmS);
++		syslog(LOG_ERR, 
+ 	       "(%s) error: Job execution of per-minute job scheduled for "
+ 	       "%.2u:%.2u delayed into subsequent minute %.2u:%.2u. Skipping job run.",
+ 	       e->pwd->pw_name, tmS.tm_hour, tmS.tm_min, tmN.tm_hour, tmN.tm_min);
+-	return -1;
++		return -1;
+     }
+     return 0;
+ }
+ 
+-#ifdef WITH_PAM
+-static pam_handle_t *pamh = NULL;
+-static const struct pam_conv conv = {
+-    NULL
+-};
+-#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) {		\
+-	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode));	\
+-	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode));	\
+-	pam_close_session(pamh, PAM_SILENT);			\
+-	pam_end(pamh, retcode);					\
+-	return(retcode);					\
+-   }
+-#endif
+-
+-int cron_open_security_session( struct passwd *pw )
+-{
++int cron_start_pam(struct passwd *pw) {
+     int	retcode = 0;
+ 
+ #if defined(WITH_PAM)
+@@ -161,12 +129,11 @@
+     retcode = pam_acct_mgmt(pamh, PAM_SILENT);
+     PAM_FAIL_CHECK;
+ #endif
+-
++	
+     return retcode;
+ }
+ 
+-int cron_start_security_session( struct passwd *pw )
+-{
++int cron_open_pam_session(struct passwd *pw) {
+     int	retcode = 0;
+ 
+ #if defined(WITH_PAM)
+@@ -174,66 +141,57 @@
+     PAM_FAIL_CHECK;
+     retcode = pam_open_session(pamh, PAM_SILENT);
+     PAM_FAIL_CHECK;
+-    log_close(); /* PAM has now re-opened our log to auth.info ! */
+-    openlog(ProgramName, LOG_PID, LOG_CRON);
++	if (retcode == PAM_SUCCESS)
++        pam_session_opened = 1;
+ #endif
+ 
+     return retcode;
+ }
+ 
+-void cron_close_security_session( void )
+-{
++void cron_close_pam(void) {
+ #if defined(WITH_PAM)
+-    pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
+-    pam_close_session(pamh, PAM_SILENT);
+-    pam_end(pamh, PAM_ABORT);
++    if (pam_session_opened != 0) {
++	    pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
++	    pam_close_session(pamh, PAM_SILENT);
++    }
++    pam_end(pamh, PAM_SUCCESS);
+ #endif
+ }
+ 
+-int cron_change_user( struct passwd *pw, char *homedir )
+-{    	
++int cron_change_user(struct passwd *pw, char *homedir) {
+     /* set our directory, uid and gid.  Set gid first, since once
+      * we set uid, we've lost root privledges.
+      */
+-    if ( setgid( pw->pw_gid ) != 0 )
+-    {
+-	log_it("CRON", getpid(), "setgid failed:", strerror(errno));
+-	return -1;
++    if (setgid(pw->pw_gid) != 0) {
++		log_it("CRON", getpid(), "setgid failed:", strerror(errno));
++		return -1;
+     }
+ 
+-    if ( initgroups( pw->pw_name, pw->pw_gid ) != 0 )
+-    {
+-	log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
+-	return -1;	
++    if (initgroups(pw->pw_name, pw->pw_gid) != 0) {
++		log_it("CRON", getpid(), "initgroups failed:", strerror(errno));
++		return -1;	
+     }
+ 
+-    if ( setuid( pw->pw_uid ) != 0 )
+-    {
+-	log_it("CRON", getpid(), "setuid failed:", strerror(errno));
+-	return -1;
++    if (setuid( pw->pw_uid ) != 0) {
++		log_it("CRON", getpid(), "setuid failed:", strerror(errno));
++		return -1;
+     }
+ 
+-	if ( chdir(homedir) == -1 )
+-    {
+-    log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
+-    log_it("CRON", getpid(), homedir, strerror(errno));
+-    return -1;
++    if (chdir(homedir) == -1) {
++	log_it("CRON", getpid(), "chdir(HOME) failed:", strerror(errno));
++        log_it("CRON", getpid(), homedir, strerror(errno));
++        return -1;
+     }
+-   
++                                                        
+     return 0;
+ }
+ 
+-static int 
+-cron_authorize_context
+-( 
+-	security_context_t scontext,
+-	security_context_t file_context
+-)	
+-{
++static int cron_authorize_context
++(security_context_t scontext,security_context_t file_context) {
+ #ifdef WITH_SELINUX
+ 	struct av_decision avd;
+ 	int retval;
+-        unsigned int bit = FILE__ENTRYPOINT;
++	unsigned int bit = FILE__ENTRYPOINT;
+ 	/*
+ 	 * Since crontab files are not directly executed,
+ 	 * crond must ensure that the crontab file has
+@@ -243,24 +201,18 @@
+ 	 */
+ 	retval = security_compute_av(scontext, file_context,
+ 				     SECCLASS_FILE, bit, &avd);
+-
+ 	if (retval || ((bit & avd.allowed) != bit))
+ 		return 0;
+ #endif
+ 	return 1;
+ }
+ 
+-static int 
+-cron_authorize_range
+-( 
+-	security_context_t scontext,
+-	security_context_t ucontext
+-)	
+-{
++static int cron_authorize_range
++(security_context_t scontext,security_context_t ucontext) {
+ #ifdef WITH_SELINUX
+ 	struct av_decision avd;
+ 	int retval;
+-        unsigned int bit = CONTEXT__CONTAINS;
++    unsigned int bit = CONTEXT__CONTAINS;
+ 	/*
+ 	 * Since crontab files are not directly executed,
+ 	 * so crond must ensure that any user specified range
+@@ -275,46 +227,37 @@
+ 	return 1;
+ }
+ 
+-int cron_get_job_context( user *u, void *scontextp, void *file_contextp, char **jobenv )
+-{
++int cron_get_job_context(user *u, void *scontextp, void *file_contextp, char **jobenv) {
+ #if WITH_SELINUX
+ 	char *sroletype;
+ 
+-	if ( is_selinux_enabled() <= 0 )
++	if (is_selinux_enabled() <= 0)
+ 		return 0;
+-	if ( (file_contextp == 0) || (scontextp == 0L) )
++	if ((file_contextp == 0) || (scontextp == 0L))
+ 		return -1;
+ 
+ 	*((security_context_t*)scontextp) = u->scontext;
+ 	*((void **)file_contextp) = 0L;
+ 
+-	if ( (sroletype = env_get("SELINUX_ROLE_TYPE",jobenv)) != 0L )
+-	{
+-	        *((security_context_t*)scontextp) = (security_context_t) sroletype;
++	if ((sroletype = env_get("SELINUX_ROLE_TYPE",jobenv)) != 0L) {
++		*((security_context_t*)scontextp) = (security_context_t) sroletype;
+ 		
+ 		char crontab[MAX_FNAME];
+-		if ( strcmp(u->name,"*system*") == 0 )
++		if (strcmp(u->name,"*system*") == 0)
+ 			strncpy(crontab, u->tabname, MAX_FNAME);
+ 		else
+ 			snprintf(crontab, MAX_FNAME, "%s/%s", CRONDIR, u->tabname);
+ 
+-		if ( getfilecon( crontab, file_contextp ) == -1 )
+-		{		
+-			if ( security_getenforce() > 0 ) 
+-			{
+-				log_it(u->name, 
+-				       getpid(), "getfilecon FAILED for SELINUX_ROLE_TYPE", 
+-				       sroletype
+-				      );
++		if (getfilecon( crontab, file_contextp ) == -1) {
++			if (security_getenforce() > 0) { 
++				log_it(u->name, getpid(), "getfilecon FAILED for SELINUX_ROLE_TYPE", 
++				       sroletype);
+ 				return -1;
+-			} else
+-			if ( access( crontab, F_OK ) == 0 )
+-				log_it(u->name,
+-				       getpid(), 
+-				       "getfilecon FAILED but SELinux in permissive mode, continuing "
+-				       "- SELINUX_ROLE_TYPE=", sroletype
+-				       );
+-		}		       
++			} else if (access( crontab, F_OK ) == 0)
++				log_it(u->name, getpid(), 
++					"getfilecon FAILED but SELinux in permissive mode, continuing "
++				    "- SELINUX_ROLE_TYPE=", sroletype);
++		}
+ 	}
+ #endif
+ 	return 0;
+@@ -323,132 +266,100 @@
+ #if WITH_SELINUX
+ /* always uses u->scontext as the default process context, then changes the
+    level, and retuns it in ucontextp (or NULL otherwise) */
+-static int cron_get_job_range( user *u, security_context_t *ucontextp,
+-                               char **jobenv )
+-{
++static int cron_get_job_range(user *u, security_context_t *ucontextp, char **jobenv) {
+ 	char *range;
+ 
+-	if ( is_selinux_enabled() <= 0 )
++	if (is_selinux_enabled() <= 0)
+ 		return 0;
+-	if ( ucontextp == 0L )
++	if (ucontextp == 0L)
+ 		return -1;
+ 
+ 	*ucontextp = 0L;
+ 
+-	if ( (range = env_get("MLS_LEVEL",jobenv)) != 0L )
+-	{
+-                context_t ccon;
+-
+-                if (!(ccon = context_new(u->scontext)))
+-                {
+-			log_it(u->name, 
+-                               getpid(), "context_new FAILED for MLS_LEVEL", 
+-                               range);
+-                        return -1;
+-                }                  
+-
+-                if (context_range_set(ccon, range))
+-                {
+-                        log_it(u->name, 
+-                               getpid(), "context_range_set FAILED for MLS_LEVEL", 
+-                               range);
+-                        return -1;
+-                }
+-
+-                if (!(*ucontextp = context_str(ccon)))
+-                {
+-                        log_it(u->name, 
+-                               getpid(), "context_str FAILED for MLS_LEVEL", 
+-                               range);
+-                        return -1;
+-                }
+-
+-                if (!(*ucontextp = strdup(*ucontextp)))
+-                {
+-                        log_it(u->name, 
+-                               getpid(), "strdup FAILED for MLS_LEVEL", 
+-                               range);
+-                        return -1;
+-                }
+-
+-                context_free(ccon);
+-	}
+-        else if (!u->scontext)
+-        { /* cron_change_selinux_range() deals with this */
+-                return 0;
++	if ((range = env_get("MLS_LEVEL",jobenv)) != 0L) {
++	    context_t ccon;
++        if (!(ccon = context_new(u->scontext))) {
++			log_it(u->name, getpid(), "context_new FAILED for MLS_LEVEL", range);
++	        return -1;
++        }                  
++
++        if (context_range_set(ccon, range)) {
++            log_it(u->name, getpid(), "context_range_set FAILED for MLS_LEVEL", 
++	            range);
++            return -1;
++        }
++
++        if (!(*ucontextp = context_str(ccon))) {
++	        log_it(u->name, getpid(), "context_str FAILED for MLS_LEVEL", 
++	            range);
++            return -1;
+         }
+-        else if (!(*ucontextp = strdup(u->scontext)))
+-        {
+-                log_it(u->name, 
+-                       getpid(), "strdup FAILED for MLS_LEVEL", 
+-                       range);
+-                return -1;
++
++        if (!(*ucontextp = strdup(*ucontextp))) {
++	        log_it(u->name, getpid(), "strdup FAILED for MLS_LEVEL", 
++	            range);
++            return -1;
+         }
++        context_free(ccon);
++	}
++    else if (!u->scontext) { 
++			/* cron_change_selinux_range() deals with this */
++            return 0;
++    }
++    else if (!(*ucontextp = strdup(u->scontext))) {
++    	log_it(u->name, getpid(), "strdup FAILED for MLS_LEVEL", 
++	        range);
++        return -1;
++    }
+ 
+ 	return 0;
+ }
+ #endif
+ 
+-int cron_change_selinux_context( user *u, void *scontext, void *file_context )
+-{
++int cron_change_selinux_context(user *u, void *scontext, void *file_context) {
+ #ifdef WITH_SELINUX
+-	if ( is_selinux_enabled() <= 0 )
++	if (is_selinux_enabled() <= 0)
+ 		return 0;
+ 
+-	if ( scontext == 0L )
+-	{
+-		if (security_getenforce() > 0) 
+-		{
+-			log_it( u->name, getpid(), 
+-				"NULL security context for user", 
+-				""
+-			      );
++	if (scontext == 0L) {
++		if (security_getenforce() > 0) { 
++			log_it( u->name, getpid(), "NULL security context for user", "");
+ 			return -1;
+-		}else
+-		{
++		} 
++		else {
+ 			log_it( u->name, getpid(), 
+ 				"NULL security context for user, "
+ 				"but SELinux in permissive mode, continuing",
+-				""
+-				);
++				"");
+ 			return 0;
+ 		}
+ 	}
+ 	
+-	if ( file_context )
+-	{		
+-		if ( ! cron_authorize_context( scontext, file_context ) )
+-		{
+-			if ( security_getenforce() > 0 ) 
+-			{
++	if (file_context) {
++		if (!cron_authorize_context( scontext, file_context)) {
++			if (security_getenforce() > 0) {
+ 				syslog(LOG_ERR,
+ 				       "CRON (%s) ERROR:"
+ 				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user", 
+-				       u->name, (char*)scontext
+-				      );
++				       u->name, (char*)scontext);
+ 				return -1;
+-			} else
+-			{
++			}
++			else {
+ 				syslog(LOG_INFO,
+ 				       "CRON (%s) WARNING:"
+ 				       "Unauthorized exec context to SELINUX_ROLE_TYPE %s for user,"
+ 				       " but SELinux in permissive mode, continuing", 
+-				       u->name, (char*)scontext
+-				      );
++				       u->name, (char*)scontext);
+ 			}
+ 		}
+-	} 
++	}
+ 
+-	if ( setexeccon(scontext) < 0 ) 
+-	{
+-		if (security_getenforce() > 0) 
+-		{
++	if (setexeccon(scontext) < 0) { 
++		if (security_getenforce() > 0) {
+ 			syslog(LOG_ERR,
+ 			       "CRON (%s) ERROR:"
+ 			       "Could not set exec context to %s for user", 
+-			       u->name, (char*)scontext
+-			      );
+-
++			       u->name, (char*)scontext);
+ 			return -1;
+ 		}
+ 	}
+@@ -457,41 +368,34 @@
+ }
+ 
+ #ifdef WITH_SELINUX
+-static int cron_change_selinux_range( user *u,
+-                                      security_context_t ucontext )
+-{
+-	if ( is_selinux_enabled() <= 0 )
++static int cron_change_selinux_range(user *u,security_context_t ucontext) {
++	if (is_selinux_enabled() <= 0)
+ 		return 0;
+ 
+-	if ( u->scontext == 0L )
+-	{
++	if (u->scontext == 0L) {
+ 		if (security_getenforce() > 0) 
+ 		{
+ 			log_it( u->name, getpid(), 
+ 				"NULL security context for user", 
+-				""
+-			      );
++				"");
+ 			return -1;
+-		}else
+-		{
++		}
++		else {
+ 			log_it( u->name, getpid(), 
+ 				"NULL security context for user, "
+ 				"but SELinux in permissive mode, continuing",
+-				""
+-				);
++				"");
+ 			return 0;
+ 		}
+ 	}
+ 
+-	if ( strcmp(u->scontext, ucontext) )
+-	{		
+-                if ( ! cron_authorize_range( u->scontext, ucontext ))
+-		{
+-			if ( security_getenforce() > 0 ) 
+-			{
++	if (strcmp(u->scontext, ucontext)) {		
++	    if (!cron_authorize_range( u->scontext, ucontext)) {
++			if (security_getenforce() > 0) {
+ #ifdef WITH_AUDIT
+ 				char *msg = NULL;
+-				if (asprintf(&msg, "cron: Unauthorized MLS range acct=%s new_scontext=%s old_scontext=%s",  u->name, (char*)ucontext, u->scontext) >= 0) {
++				if (asprintf(&msg, "cron: Unauthorized MLS range acct=%s new_scontext=%s old_scontext=%s",  
++					u->name, (char*)ucontext, u->scontext) >= 0) {
+ 					int audit_fd = audit_open();
+ 					audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, msg, NULL, NULL, NULL, 0);
+ 					close(audit_fd);
+@@ -501,40 +405,33 @@
+ 				syslog(LOG_ERR,
+ 				       "CRON (%s) ERROR:"
+ 				       "Unauthorized range %s in MLS_LEVEL for user %s ", 
+-				       u->name, (char*)ucontext, u->scontext
+-				      );
++				       u->name, (char*)ucontext, u->scontext);
+ 				return -1;
+-			} else
+-			{
++			}
++			else {
+ 				syslog(LOG_INFO,
+ 				       "CRON (%s) WARNING:"
+ 				       "Unauthorized range %s in MLS_LEVEL for user %s,"
+ 				       " but SELinux in permissive mode, continuing", 
+-				       u->name, (char*)ucontext, u->scontext
+-				      );
++				       u->name, (char*)ucontext, u->scontext);
+ 			}
+ 		}
+-	} 
++	}
+ 
+-	if ( setexeccon(ucontext) < 0 ) 
+-	{
+-		if (security_getenforce() > 0) 
+-		{
++	if (setexeccon(ucontext) < 0) {
++		if (security_getenforce() > 0) {
+ 			syslog(LOG_ERR,
+ 			       "CRON (%s) ERROR:"
+ 			       "Could not set exec context to %s for user", 
+-			       u->name, (char*)ucontext
+-			      );
+-
++			       u->name, (char*)ucontext);
+ 			return -1;
+-		} else
+-		{
++		}
++		else {
+ 			syslog(LOG_ERR,
+ 			       "CRON (%s) ERROR:"
+ 			       "Could not set exec context to %s for user, "
+                                " but SELinux in permissive mode, continuing", 
+-			       u->name, (char*)ucontext
+-			      );
++			       u->name, (char*)ucontext);
+ 
+ 			return 0;
+ 		}
+@@ -589,19 +486,17 @@
+ 		}
+ 	}
+     
+-	if ( ! cron_authorize_context( scontext, file_context ) )
+-	{
++	if (!cron_authorize_context( scontext, file_context)) {
+ 		freecon(scontext);
+ 		freecon(file_context);
+ 		if (security_getenforce() > 0) {
+ 			log_it(name, getpid(), "Unauthorized SELinux context", tabname);
+ 			return -1;
+-		} else
+-		{
++		}
++		else {
+ 			log_it(name, getpid(), 
+ 			       "Unauthorized SELinux context, but SELinux in permissive mode, continuing",
+-			       tabname
+-			      );
++			       tabname);
+ 			return  0;
+ 		}
+ 	}
+@@ -612,19 +507,16 @@
+ 	return 0;
+ }
+ 
+-void free_security_context( security_context_t *scontext )
+-{
++void free_security_context(security_context_t *scontext) {
+ #ifdef WITH_SELINUX
+-    if( *scontext != NULL )
+-    {
+-	freecon(*scontext);
+-	*scontext=0L;
+-    }	    
++    if (*scontext != NULL) {
++		freecon(*scontext);
++		*scontext=0L;
++    }
+ #endif	
+ }
+ 
+-int crontab_security_access(void)
+-{
++int crontab_security_access(void) {
+ #ifdef WITH_SELINUX
+     if (is_selinux_enabled() > 0)
+ 	if (selinux_check_passwd_access(PASSWD__CRONTAB)!=0)
+@@ -644,16 +536,15 @@
+     int count = 0;
+     jobenv = env_copy(pamenv);
+ 
+-
+         /* Now add the cron environment variables. Since env_set()
+            overwrites existing variables, this will let cron's
+            environment settings override pam's */
+ 
+     while ((cronvar = cronenv[count++])) {
+-	if (!(jobenv = env_set(jobenv, cronvar))) {
+-	    syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
+-	    return NULL;
+-	}
++		if (!(jobenv = env_set(jobenv, cronvar))) {
++		    syslog(LOG_ERR, "Setting Cron environment variable %s failed", cronvar);
++	    	return NULL;
++		}
+     }
+     return jobenv;    
+ #else
+--- vixie-cron-4.1/do_command.c.pamcrontab	2007-09-11 10:22:21.000000000 +0200
++++ vixie-cron-4.1/do_command.c	2007-09-11 10:22:21.000000000 +0200
+@@ -71,7 +71,7 @@
+          */
+ 	if ( cron_set_job_security_context( e, u, &jobenv ) != 0 )
+ 	{
+-	    syslog(LOG_INFO, "CRON (%s) ERROR: cannot set security context", e->pwd->pw_name);
++	    //syslog(LOG_INFO, "CRON (%s) ERROR: cannot set security context", e->pwd->pw_name);
+ 	    exit(ERROR_EXIT);
+ 	}
+ 
+@@ -158,7 +158,7 @@
+ 	switch (fork()) {
+ 	case -1:
+ 		log_it("CRON", getpid(), "error", "can't fork");
+-		cron_close_security_session();
++		cron_close_pam();
+ 		exit(ERROR_EXIT);
+ 		/*NOTREACHED*/
+ 	case 0:
+@@ -523,7 +523,7 @@
+ 			Debug(DPROC, (", dumped core"))
+ 		Debug(DPROC, ("\n"))
+ 	}
+-	cron_close_security_session();
++	cron_close_pam();
+ 	env_free(jobenv);
+ }
+ 

vixie-cron-4.1-resetcontext.patch

@@ -0,0 +1,36 @@
+--- vixie-cron-4.1/do_command.c~	2006-10-23 11:52:21.000000000 -0400
++++ vixie-cron-4.1/do_command.c	2006-10-23 12:01:14.000000000 -0400
+@@ -238,6 +238,7 @@
+ 		}
+ 		break;
+ 	default:
++		cron_clear_job_security_context();
+ 		/* parent process */
+ 		break;
+ 	}
+--- vixie-cron-4.1/funcs.h~	2006-10-23 11:52:21.000000000 -0400
++++ vixie-cron-4.1/funcs.h	2006-10-23 12:02:36.000000000 -0400
+@@ -82,6 +82,8 @@
+  */
+ int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
+ 
++void cron_clear_job_security_context(void);
++
+ int cron_open_security_session( struct passwd *pw );
+ 
+ void cron_close_security_session( void );
+--- vixie-cron-4.1/security.c~	2006-10-23 11:52:21.000000000 -0400
++++ vixie-cron-4.1/security.c	2006-10-23 12:06:29.000000000 -0400
+@@ -30,6 +30,12 @@
+ 
+ static char ** build_env(char **cronenv);
+ 
++void cron_clear_job_security_context(void) {
++#if WITH_SELINUX
++	setexeccon(NULL);
++#endif
++}
++
+ int cron_set_job_security_context( entry *e, user *u, char ***jobenv )
+ {
+     time_t minutely_time = 0;

vixie-cron-4.1-tmp.patch

@@ -0,0 +1,86 @@
+--- vixie-cron-4.1/crontab.c.tmp	2007-05-18 21:17:02.000000000 +0200
++++ vixie-cron-4.1/crontab.c	2007-05-18 21:17:02.000000000 +0200
+@@ -74,6 +74,7 @@
+ 			parse_args(int c, char *v[]),
+ 			die(int);
+ static	int		replace_cmd(void);
++static  char	*tmp_path(void);
+ 
+ static void
+ usage(const char *msg) {
+@@ -336,6 +337,14 @@
+ 	fprintf(stderr, "\"%s\":%d: %s\n", Filename, LineNumber-1, msg);
+ }
+ 
++static char *
++tmp_path() {
++   char *tmpdir;
++
++   tmpdir = getenv("TMPDIR");
++   return tmpdir ? tmpdir : "/tmp";
++}
++
+ static void
+ edit_cmd(void) {
+ 	char n[MAX_FNAME], q[MAX_TEMPSTR], *editor;
+@@ -345,7 +354,8 @@
+ 	struct utimbuf utimebuf;
+ 	WAIT_T waiter;
+ 	PID_T pid, xpid;
+-
++	int uid;
++	
+ 	log_it(RealUser, Pid, "BEGIN EDIT", User);
+ 	if (!glue_strings(n, sizeof n, SPOOL_DIR, User, '/')) {
+ 		fprintf(stderr, "path too long\n");
+@@ -376,16 +386,23 @@
+ 	(void)signal(SIGINT, SIG_IGN);
+ 	(void)signal(SIGQUIT, SIG_IGN);
+ 
+-	if (!glue_strings(Filename, sizeof Filename, _PATH_TMP,
++	if (!glue_strings(Filename, sizeof Filename, tmp_path(),
+ 	    "crontab.XXXXXXXXXX", '/')) {
+ 		fprintf(stderr, "path too long\n");
+ 		goto fatal;
+ 	}
++	//syslog(LOG_ERR,"%s%s",Filename,tmp_path());
++	//syslog(LOG_ERR,"BEFORE MKSTEMP pid: %d uid: %d gid: %d",Pid,MY_UID(pw), MY_GID(pw));//uid, gid);
++	uid = MY_UID(pw);
++	setreuid(0, uid);
++  //syslog(LOG_ERR,"BEFORE MKSTEMP SETREUID pid: %d uid: %d gid: %d",Pid,MY_UID(pw), MY_GID(pw));//uid,gid);
+ 	if (-1 == (t = mkstemp(Filename))) {
+ 		perror(Filename);
+ 		goto fatal;
+ 	}
+-#ifdef HAS_FCHOWN
++
++/* instead of chown we're using setreuid */
++/*#ifdef HAS_FCHOWN
+ 	if (fchown(t, MY_UID(pw), MY_GID(pw)) < 0) {
+ 		perror("fchown");
+ 		goto fatal;
+@@ -395,7 +412,10 @@
+ 		perror("chown");
+ 		goto fatal;
+ 	}
+-#endif
++#endif*/
++	
++    setreuid(uid,0);
++	//syslog(LOG_ERR,"AFTER MKSTEMP pid: %d uid: %d gid: %d",Pid,uid, MY_GID(pw));
+ 	if (!(NewCrontab = fdopen(t, "r+"))) {
+ 		perror("fdopen");
+ 		goto fatal;
+@@ -481,10 +501,10 @@
+ 			perror("setuid(getuid())");
+ 			exit(ERROR_EXIT);
+ 		}
+-		if (chdir(_PATH_TMP) < 0) {
++/*		if (chdir(_PATH_TMP) < 0) {
+ 			perror(_PATH_TMP);
+ 			exit(ERROR_EXIT);
+-		}
++		}*/
+ 		if (!glue_strings(q, sizeof q, editor, Filename, ' ')) {
+ 			fprintf(stderr, "%s: editor command line too long\n",
+ 			    ProgramName);

vixie-cron.init

@@ -0,0 +1,95 @@
+#! /bin/bash
+#
+# crond          Start/Stop the cron clock daemon.
+#
+# chkconfig: 2345 90 60
+# description: cron is a standard UNIX program that runs user-specified \
+#              programs at periodic scheduled times. vixie cron adds a \
+#              number of features to the basic UNIX cron, including better \
+#              security and more powerful configuration options.
+# processname: crond
+# config: /etc/crontab
+# pidfile: /var/run/crond.pid
+
+RETVAL=0
+prog="crond"
+CROND=/usr/sbin/crond
+LOCK_FILE=/var/lock/subsys/crond
+
+# Source function library.
+. /etc/init.d/functions
+
+# set sysconfig settings
+[ -f /etc/sysconfig/crond ] && . /etc/sysconfig/crond
+
+[ -f /etc/sysconfig/crond ] || exit 6
+
+# validate mail
+t=${CRON_VALIDATE_MAILRCPTS:-UNSET}
+[ "$t" != "UNSET" ] && export CRON_VALIDATE_MAILRCPTS="$t"
+ 
+prog="crond"
+
+start() {
+	echo -n $"Starting $prog: "
+	daemon $prog $OPTIONS && success || failure
+	RETVAL=$?
+	[ "$RETVAL" = 0 ] && touch $LOCK_FILE
+	echo
+}
+
+stop() {
+	echo -n $"Stopping $prog: "
+	if [ -n "`pidfileofproc $CROND`" ]; then
+		killproc $CROND
+	else
+		failure $"Stopping $prog"
+	fi
+	RETVAL=$?
+	[ "$RETVAL" = 0 ] && rm -f $LOCK_FILE
+	echo
+}	
+
+reload() {
+	echo -n $"Reloading $prog: "
+	if [ -n "`pidfileofproc $CROND`" ]; then
+		killproc $CROND -HUP
+	else
+		failure $"Reloading $prog"
+	fi
+	RETVAL=$?
+	echo
+}	
+
+case "$1" in
+  start)
+  	start
+	;;
+  stop)
+  	stop
+	;;
+  restart)
+	stop
+  	start
+	;;
+  reload)
+  	reload
+	;;
+  status)
+	status $CROND
+	;;
+  condrestart)
+    if [ -f  $LOCK_FILE ]; then
+        if [ "$RETVAL" = 0 ]; then
+            stop
+            sleep 3
+            start
+        fi
+    fi
+    ;;
+  *)
+	echo $"Usage: $0 {start|stop|status|reload|restart|condrestart}"
+	RETVAL=3
+esac
+exit $RETVAL
+

vixie-cron.spec

@@ -0,0 +1,822 @@
+%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}
+%define WITH_SELINUX 1
+%endif
+%if %{?WITH_PAM:0}%{!?WITH_PAM:1}
+%define WITH_PAM 1
+%endif
+%if %{?WITH_AUDIT:0}%{!?WITH_AUDIT:1}
+%define WITH_AUDIT 1
+%endif
+Summary: The Vixie cron daemon for executing specified programs at set times
+Name: vixie-cron
+Version: 4.1
+Release: 84%{?dist}
+Epoch: 4
+License: BSD
+Group: System Environment/Base
+Source0: ftp://ftp.isc.org/isc/cron/vixie-cron-%{version}.tar.gz
+Source1: vixie-cron.init
+Source2: crond.sysconfig
+Patch0:  vixie-cron-4.1-_0_rh_Makefile.patch
+Patch1:  vixie-cron-4.1-_1_rh_pathnames.patch
+Patch2:  vixie-cron-4.1-_2_config.patch
+Patch3:  vixie-cron-4.1-_3_selinux.patch
+Patch4:  vixie-cron-4.1-_4_vfork_sigchld.patch
+Patch5:  vixie-cron-4.1-_5_sprintf_misc.patch
+Patch6:  vixie-cron-4.1-_6_rh_crond.patch
+Patch7:  vixie-cron-4.1-_7_crontab-stdin.patch
+Patch8:  vixie-cron-4.1-_8_root-allowed.patch
+Patch9:  vixie-cron-4.1-_9_no-header.patch
+Patch10: vixie-cron-4.1-_10_manpages.patch
+Patch11: vixie-cron-4.1-_11_with_selinux.patch
+Patch12: vixie-cron-4.1-_12_pam.patch
+Patch13: vixie-cron-4.1-_13_with_pam.patch
+Patch14: vixie-cron-4.1-_14_pamd_crond.patch
+Patch15: vixie-cron-4.1-_15_system_crontab_user.patch
+Patch16: vixie-cron-4.1-_16_crontab_selinux.patch
+Patch17: vixie-cron-4.1-_17_pam-rootok.patch
+Patch18: vixie-cron-4.1-_18_cron_log_facility.patch
+Patch19: vixie-cron-4.1-_19_crontab_stat_not_fstat.patch
+Patch20: vixie-cron-4.1-_20_nickname_man.patch
+Patch21: vixie-cron-4.1-_21_-i_option.patch
+Patch22: vixie-cron-4.1-_22_no_0600_mode_enforce.patch
+Patch23: vixie-cron-4.1-_23_freecon_segv.patch
+Patch24: vixie-cron-4.1-_24_crontab_selinux_new.patch
+Patch25: vixie-cron-4.1-_25-allow-root-crontab.patch
+Patch26: vixie-cron-4.1-_26-saved-uids.patch
+Patch27: vixie-cron-4.1-_27-no-strip-header-comments.patch
+Patch28: vixie-cron-4.1-_28-fix_ppc.patch
+Patch29: vixie-cron-4.1-_29-permit_any_crontab_option.patch
+Patch30: vixie-cron-4.1-_30-uninitialized.patch
+Patch31: vixie-cron-4.1-_31-allow_pam_access.patch
+Patch32: vixie-cron-4.1-_32-no_mail_rcpt_safe_p.patch
+Patch33: vixie-cron-4.1-_33-fix_selinux_segfault.patch
+Patch34: vixie-cron-4.1-_34-pam_fail_close_session.patch
+Patch35: vixie-cron-4.1-_35-crontab-job-control.patch
+Patch36: vixie-cron-4.1-_36-pam_close_fork_fail.patch
+Patch37: vixie-cron-4.1-_37-limits.patch
+Patch38: vixie-cron-4.1-_38-CAN-2005-1038.patch
+Patch39: vixie-cron-4.1-loginuid.patch
+Patch40: vixie_cron-4.1-162887.patch
+Patch41: vixie-cron-4.1-CAN-2005-1038-fix-race.patch
+Patch42: vixie-cron-4.1-_42-getseuserbyname.patch
+Patch43: vixie-cron-4.1-_43-config_comments.patch
+Patch44: vixie-cron-4.1-_44-build_env.patch
+Patch45: vixie-cron-4.1-_45-warnings.patch
+Patch46: vixie-cron-4.1-_46-audit.patch
+Patch47: vixie-cron-4.1-_47-m_option.patch
+Patch48: vixie-cron-4.1-_48-security.patch
+Patch49: vixie-cron-4.1-_49-bz178436.patch
+Patch50: vixie-cron-4.1-_50-bz178931.patch
+Patch51: vixie-cron-4.1-_51-bz180145-mail_i18n.patch
+Patch52: vixie-cron-4.1-_52-bz181439.patch
+Patch53: vixie-cron-4.1-_53_bz199294_selinux_mls.patch
+Patch54: vixie-cron-4.1-_54_bz198019_database_changes.patch
+Patch55: vixie-cron-4.1-man-page-typo.patch
+Patch56: vixie-cron-4.1-_55-bz203746.patch
+Patch57: vixie-cron-4.1-_44-delayed_database.patch 
+Patch58: vixie-cron-4.1-_52-bz181439_2.patch
+Patch59: vixie-cron-4.1-_56-pam-session-system-auth.patch
+Patch60: vixie-cron-4.1-bz178836.patch
+Patch61: vixie-cron-4.1-_60-SELinux-contains-range.patch
+Patch62: vixie-cron-4.1-_61symlink.patch
+Patch63: vixie-cron-4.1-manual.patch
+Patch64: vixie-cron-4.1-_62newyear.patch
+Patch65: vixie-cron-4.1-_63newavc.patch
+Patch66: vixie-cron-4.1-bz220376.patch
+Patch67: vixie-cron-4.1-hardlink.patch
+Patch68: vixie-cron-4.1-mancrond.patch
+Patch69: vixie-cron-4.1-tmp.patch
+Patch70: vixie-cron-4.1-fixs.patch
+Patch71: vixie-cron-4.1-pam_crontab.patch
+
+Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: syslog, bash >= 2.0
+Conflicts: sysklogd < 1.4.1
+%if %{WITH_SELINUX}
+Requires: libselinux >= 2.0.0
+Buildrequires: libselinux-devel >= 2.0.0
+%endif
+%if %{WITH_PAM}
+Requires: pam >= 0.99.6.2
+Buildrequires: pam-devel >= 0.99.6.2
+%endif
+%if %{WITH_AUDIT}
+Requires: audit-libs >= 1.4.1
+Buildrequires: audit-libs >= 1.4.1
+Buildrequires: audit-libs-devel >= 1.4.1
+%endif
+
+Requires(post): /sbin/chkconfig coreutils
+Requires(postun): /sbin/chkconfig
+Requires(postun): /sbin/service 
+Requires(preun): /sbin/chkconfig 
+Requires(preun): /sbin/service
+
+%description
+The vixie-cron package contains the Vixie version of cron.  Cron is a
+standard UNIX daemon that runs specified programs at scheduled times.
+Vixie cron adds better security and more powerful configuration
+options to the standard version of cron.
+
+%prep
+%setup -q
+%patch0 -p1 -b .rh_Makefile
+%patch1 -p1 -b .rh_pathnames
+%patch2 -p1 -b .config
+%patch3 -p1 -b .selinux
+%patch4 -p1 -b .vfork_sigchld
+%patch5 -p1 -b .sprintf_misc
+%patch6 -p1 -b .rh_crond
+%patch7 -p1 -b .crontab-stdin
+%patch8 -p1 -b .root-allowed
+%patch9 -p1 -b .no-header
+%patch10 -p1 -b .manpages
+#%if %{WITH_SELINUX}
+#SELinux
+# Enables SELinux support
+%patch11 -p1 -b .with_selinux
+#%endif
+%patch12 -p1 -b .pam
+#%if %{WITH_PAM}
+%patch13 -p1 -b .with_pam
+%patch14 -p1 -b .pamd_crond
+%patch15 -p1 -b .system_crontab_user
+#%endif
+%patch16 -p1 -b .crontab_selinux
+%patch17 -p1 -b .pam-rootok
+%patch18 -p1 -b .cron_log_facility
+%patch19 -p1 -b .crontab_stat_not_fstat
+%patch20 -p1 -b .nickname_man
+%patch21 -p1 -b .-i_option
+%patch22 -p1 -b .no_0600_mode_enforce
+#%if %{WITH_SELINUX}
+%patch23 -p1 -b .freecon_segv
+%patch24 -p1 -b .selinux_crontab_new
+#%endif
+%patch25 -p1 -b .allow-root-crontab
+%patch26 -p1 -b .saved_uids
+%patch27 -p1 -b .no-strip-header-comments
+%patch28 -p1 -b .fix_ppc
+%patch29 -p1 -b .permit_any_crontab_option
+%patch30 -p1 -b .uninitialized
+%patch31 -p1 -b .allow_pam_access
+%patch32 -p1 -b .no_mail_rcpt_safe_p
+%patch33 -p1 -b .fix_selinux_segfault
+%patch34 -p1 -b .pam_fail_close_session
+%patch35 -p1 -b .job_control
+%patch36 -p1 -b .pam_close_fork_fail
+%patch37 -p1 -b .limits
+%patch38 -p1 -b .CAN-2005-1038
+%patch39 -p1 -b .loginuid
+%patch40 -p1 -b .162887
+%patch41 -p1 -b .CAN-2005-1038-fix-race
+%patch42 -p1 -b .getseuserbyname
+%patch43 -p1 -b .config_comments
+%patch44 -p1 -b .build_env
+%patch45 -p1 -b .warnings
+%patch46 -p1 -b .audit_deny
+%patch47 -p1 -b .-m_option
+%patch48 -p1 -b .security
+%patch49 -p1 -b .bz178436
+%patch50 -p1 -b .bz178931
+%patch51 -p1 -b .mail_i18n
+%patch52 -p1 -b .bz181439
+%patch53 -p1 -b .selinux_mls
+%patch54 -p1 -b .bz198019
+%patch55 -p1 -b .man-page-typo
+%patch56 -p1 -b .bz203746
+%patch57 -p1 -b .delayed_database
+%patch58 -p1 -b .bz181439_2
+%patch59 -p1 -b .pam-session-system-auth
+%patch60 -p1 -b .bz178836
+%patch61 -p1 -b .selinux-contains-range
+%patch62 -p1 -b ._61symlink.patch
+%patch63 -p1 -b .manual
+%patch64 -p1 -b ._62newyear
+%patch65 -p1 -b ._63newavc
+#%patch66 -p1 -b .bz220376
+%patch67 -p1 -b .hardlink
+%patch68 -p1 -b .mancrond
+%patch69 -p1 -b .tmp
+%patch70 -p1 -b .fix
+%patch71 -p1 -b .pamcrontab
+
+%build
+# RPM_OPT_FLAGS are better here, because we don't have configure for set up variables ;-)
+make %{?_smp_mflags} RPM_OPT_FLAGS="$RPM_OPT_FLAGS -g -DLINT -Dlint" \
+%if %{WITH_SELINUX}
+WITH_SELINUX=1 \
+%endif
+%if %{WITH_PAM}
+WITH_PAM=1 \
+%endif
+%if %{WITH_AUDIT}
+WITH_AUDIT=1 \
+%endif
+;
+
+%install
+rm -rf $RPM_BUILD_ROOT
+mkdir -p $RPM_BUILD_ROOT/%{_bindir}
+mkdir -p $RPM_BUILD_ROOT/%{_sbindir}
+mkdir -p $RPM_BUILD_ROOT/%{_mandir}/man{1,5,8}
+mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
+mkdir -p $RPM_BUILD_ROOT/etc/pam.d
+make install DESTDIR=$RPM_BUILD_ROOT DESTMAN=$RPM_BUILD_ROOT%{_mandir}
+mkdir -pm700 $RPM_BUILD_ROOT/var/spool/cron
+mkdir -pm755 $RPM_BUILD_ROOT/etc/cron.d
+install -pm755 %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/crond
+mkdir -p $RPM_BUILD_ROOT/etc/sysconfig/
+cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/crond
+%if ! %{WITH_PAM}
+	rm -rf $RPM_BUILD_ROOT/etc/pam.d
+%endif
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%post
+/sbin/chkconfig --add crond
+[ ! -f /etc/cron.allow ] && [ ! -f /etc/cron.deny ] && touch /etc/cron.deny ||:;
+ 
+%preun
+if [ $1 = 0 ]; then
+	/sbin/service crond stop >/dev/null 2>&1 || :
+	/sbin/chkconfig --del crond
+fi
+
+%postun
+if [ "$1" -ge "1" ]; then
+	/sbin/service crond condrestart >/dev/null 2>&1
+fi
+
+%triggerpostun -- vixie-cron < 3.0.1-56
+/sbin/chkconfig --del crond
+/sbin/chkconfig --add crond
+
+%files
+%defattr(-,root,root,-)
+%{_sbindir}/crond
+%attr(6755,root,root) %{_bindir}/crontab
+%{_mandir}/man8/crond.*
+%{_mandir}/man8/cron.*
+%{_mandir}/man5/crontab.*
+%{_mandir}/man1/crontab.*
+%attr(700,root,root) %dir /var/spool/cron
+%attr(700,root,root) %dir /etc/cron.d
+%attr(755,root,root) /etc/rc.d/init.d/crond
+%if %{WITH_PAM}   
+	%attr(0644,root,root) %config(noreplace) /etc/pam.d/crond
+%endif
+%config(noreplace) /etc/sysconfig/crond
+
+%changelog
+* Tue Sep 11 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-84
+- fix problem with selinux homedir #241877 in patch pam_crontab
+
+* Mon Jul 31 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-83
+- update from devel
+- add pam to crontab, add variable tmpdir, fix man again
+
+* Thu Apr 12 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-82
+- removed bz220376.patch
+- change in manual - using jobs in cron.d
+- Resolves: rhbz#235932, rhbz#235998
+
+* Tue Apr 10 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-81
+- hard link from /etc/crontab cause stop running jobs
+- rhbz#235880
+
+* Thu Apr  5 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-80
+- jobs from RH_CROND_DIR wasn't "sometimes" run
+- rhbz#220376
+
+* Thu Mar 07 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-79
+- merge review
+
+* Mon Mar 05 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-76
+- rhbz#226529 merge review
+
+* Wed Feb 28 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-75
+- rhbz#226529 merge review
+
+* Wed Feb  7 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-74
+- rhbz#223894
+
+* Mon Jan 29 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-73
+- symlinks again - change in symlinks.patch
+- rhbz#225078
+
+* Mon Jan 22 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-72
+- change in manual
+- rhbz#223532
+- rhbz#223662, rhbz#222464
+
+* Tue Jan 16 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-70
+- change in manual
+
+* Fri Jan 10 2007 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-69
+- patch from bz - Cron does not detect changed symlink
+- rhbz#221856
+
+* Thu Dec 14 2006 Dan Walsh <dwalsh@redhat.com> - 4:4.1-68
+- Patch to run vixie-cron with mls correctly
+
+* Tue Oct 24 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-67
+- setexeccon in SELinux - patch from dwalsh
+- (#178836) - patch from bugzilla for "quick" editing crontab -e
+
+* Tue Sep 05 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-64
+- include system-auth for session in crond.pam, it now avoids
+  using pam_unix if the process is crond
+
+* Wed Aug 30 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-63
+- fix problem with selinux (#181439)
+
+* Mon Aug 28 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-61
+- changes in spec file (#204230)
+
+* Fri Aug 25 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-60
+- patch from Jose Plans fixed: Job delayed after using crontab -e
+
+* Fri Aug 25 2006 Marcela Maslanova <mmaslano@redhat.com> - 4:4.1-59
+- small changes in man-page cron
+- (#203746) RFC3834, patch from James Ralston
+
+* Thu Jul 20 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-58
+- fix bug 199294: support for LSPP multiple per-job SELinux contexts
+- fix bug 198019: make database.c correct if crontab mtime changes 
+	while spool dir mtime does not.
+
+* Fri Jul 14 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-56.FC6
+- fix bug 198893 - change permissions of cron spool directories to 0700
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 4:4.1-55.FC6.1
+- rebuild
+
+* Tue May 30 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-55.FC6
+- fix bug 191823: fix missing BuildRequires: audit-libs-devel
+
+* Wed Feb 15 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-54.FC5
+- fix bug 181702: Requires:audit-libs, not Requires:audit
+
+* Tue Feb 14 2006 Jason Vas Dias <jvdias@redhat.com> - 4:4.1-52.FC5
+- fix bug 181439: enable easier selection of optional 'WITH_*'
+  compilation features
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 4:4.1-51.FC5.1
+- bump again for double-long bug on ppc(64)
+
+* Tue Feb 07 2006 Jason Vas Dias<jvdias@redhat.com> - 4.1-51.FC5
+- fix bug 180145: provide support for mail in non-ascii charsets
+
+* Thu Jan 26 2006 Jason Vas Dias<jvdias@redhat.com> - 4.1-50.FC5
+- fix bug 178436: prevent per-minute jobs being delayed into next minute
+- fix bug 178931: remove pam_unix and pam_krb5 from pam session stack
+
+* Tue Jan 10 2006 Jason Vas Dias<jvdias@redhat.com>
+- fix bug 177476: make minder/mailer process run as job user 
+  with user context; re-organize PAM and SELinux code 
+ 
+* Thu Dec 15 2005 Jason Vas Dias<jvdias@redhat.com>
+- fix bug 172885: Replace Requires:sysklogd with Requires:syslog
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Sun Nov 13 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-41.FC5
+- patches for IBM LSPP testing:
+- Steve Grubb's patch to emit audit log message on crontab denial
+- Use of sendmail unacceptable for LSPP: provide -m <mail command> option
+
+* Tue Oct 18 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-40.FC5
+- *** NOTE : please do not modify vixie-cron without contacting ***
+  *** the package maintainer (me at the moment).				***
+  *** Or at least test it first!								***
+- fix bug 170830: it was not the pam_stack change - the setuid
+  mode of crontab was dropped for some reason.
+- apply Dan's new getseuserbyname patch
+- somehow build_env() invocation was dropped - use pam_env settings.
+
+* Fri Oct 14 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-39-FC5
+- fix bug 170830: the last PAM change disabled all cron jobs.
+  backing out the new PAM configuration file until I've had a
+  chance to test it with replacement of pam_stack.so.
+
+* Thu Oct 13 2005 Tomas Mraz <tmraz@redhat.com> - 4.1-38.FC5
+- use include instead of pam_stack in pam config
+
+* Sat Aug 13 2005 Dan Walsh <dwalsh@redhat.com>  - 4.1-37.FC5
+- Change checkPasswdAccess to selinux_check_passwd_access for new selinux api
+
+* Mon Jul 11 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-36.FC4
+- fix bug 162887: allow multiple /etc/cron.d crontabs for *system* user
+- further fix for bug 154920 / CAN-2005-1038 ( crontab -e ):
+	invoke editor and copy operation as non-root user
+   
+* Fri Jun 17 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-FC4.34
+- fix bug 160811: FC3 version compared >= FC4 version
+- fix bug 159216: add pam_loginuid support for new audit system
+
+* Thu Apr 14 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-33_FC4
+- fix bug 154922 / CAN-2005-1038: check that new crontab is 
+	regular file after editor session ends.
+- fix bug 154575: use PATH_MAX (4096) as max filename length; also make 
+	limits on command line and env.var. lengths sensible (131072).
+
+* Fri Apr 08 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-32_FC4
+- do pam_close_session and pam_setcred(pamh, PAM_DELETE_CRED)
+- if fork fails
+
+* Thu Apr 07 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-30_FC4
+- fix bug 154065: crontab's job control broken: by 
+-	xpid = waitpid(pid,&waiter,WUNTRACED);... 
+-	if( WIFSTOPPED(waiter) )... kill(getpid(),WSTOPSIG(waiter));
+- crontab should not kill itself with SIGSTOP if its child
+- gets SIGSTOP; hence it does not need the waitpid WUNTRACED flag.
+ 
+* Tue Apr 05 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-28_FC4
+- Required for EAL Audit certification: 
+- If pam_setcred should fail, the pam_session could fail to be
+- closed, leaving autofs user directories still mounted.
+
+* Tue Mar 15 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-26_FC4
+- fix bug 151145: segfault if cronjob runs without any SELinux user 
+- security context (eg. in a broken chroot environment)
+
+* Fri Feb 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-24_FC4
+- Add an /etc/sysconfig/crond file for containing CRONDARGS and
+- settings like CRON_VALIDATE_MAILRCPTS .
+
+* Fri Feb 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-24_FC4
+- Fix bug 147636 - disable silly mail recipient name checking 
+- (do_command.c's safe_p()) by default . Can be enabled by 
+- presence of CRON_VALIDATE_MAILRCPTS variable in crond's 
+- environment - also '_'s in MAILTOs are allowed.
+
+* Tue Jan 25 2005 Jason Vas Dias <jvdias@redhat.com> - 4.1-22
+- Fix bug 146073 - allow the 'pam_access' module to be used with
+- cron - set 'PAM_TTY' item to 'cron' .
+
+* Wed Dec 20 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-21
+- fix bug 142953 : allow read-only crontabs + provide -p 
+- 'permit all crontabs' option to disable mode checking. 
+
+* Wed Dec 20 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-21
+- fixed all uninitialized variable warnings
+
+* Fri Dec 03 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-20
+- Fix for ppc -m32 RPM_OPT_FLAGS compilation options
+- (bug 141760)
+
+* Fri Oct 15 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-19
+- crontab -e should only strip NHEADER_LINES comments 
+- (NHEADER_LINES==0), not at least one header comment line.
+- (bug 135845)
+
+* Sat Oct 09 2004 Florian La Roche <laroche@redhat.com> - 4.1-18
+- no need to make user installed crontabs readable
+
+* Thu Sep 30 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-17
+- Users not allowed to use 'crontab mycrontab', while
+- 'crontab < mycrontab' allowed; this is because misc.c's
+- swap_uids_back() was not using save_euid / save_egid .
+- Thanks to Mads Martin Joergensen <mmj@suse.de> for pointing this out.
+
+* Wed Sep 29 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-16
+- Just found out in testing that if neither /etc/cron.{deny,allow}
+- exist, root is unable to use crontab - I'm sure root could before,
+- but is in any case meant to be able to. Allowing root to use crontab.
+
+* Wed Sep 29 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-14
+- Fix for bug 130102 got dropped somehow from latest CVS.
+- This is now restored - in post, if neither /etc/cron.{deny,allow}
+- exist, touch /etc/cron.deny, to allow all users to use crontab,
+- as was previous default vixie-cron behaviour.
+
+* Fri Sep 17 2004 Jason Vas Dias <jvdias@redhat.com> - 4.1-12
+- Merged Dan's patch with vixie-cron-4.1-11 which was not 
+- latest version according to new CVS ?!?!
+
+* Fri Sep 17 2004 Dan Walsh <dwalsh@redhat.com>  - 4.1-12
+- Updated SELinux patch to use checkPasswdAccess
+
+* Tue Aug 31 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-11
+- Fixed SIGSEGV in free_user when !is_selinux_enabled() and crontab
+- has no valid jobs (bug 131390).
+
+* Wed Aug 18 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.10
+- Fixed bug 130102: Restored default behaviour if neither 
+- /etc/cron.deny nor /etc/cron.allow exist - 'touch /etc/cron.deny'
+- in post
+
+* Wed Aug 11 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.9
+- Removed 0600 mode enforcement as per Florian La Roche's request
+
+* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
+- Allowed editors such as 'gedit' which do not modify original
+- file, but which rename(2) a temp file to original, to be used
+- by crontab -e (bug 129170).
+
+* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
+- Added '-i' option to crontab to prompt the user before deleting
+- crontab with '-r'.
+
+* Tue Aug 10 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.8
+- Added documentation for '@' nicknames to crontab.5
+- (bugs 107542, 89899). Also removed 'second when' (bug 59802). 
+
+* Sun Aug 1  2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.7
+- fixed bug 128924: 'cron' log facility not being used
+
+* Fri Jul 30 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1.6
+- Added PAM 'auth sufficient pam_rootok.so' to /etc/pam.d/crond
+- (fixes bug 128843) - on dwalsh's advice.
+
+* Thu Jul 29 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-5
+- Added Buildrequires: pam-devel
+
+* Wed Jul 28 2004 Dan Walsh <dwalsh@redhat.com> - 4.1-4
+- Fix crontab to do SELinux checkaccess
+
+* Wed Jul 28 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-3
+- Fixed bug 128701: cron fails to parse user 6th field in
+- system crontabs (patch15)
+
+* Tue Jul 27 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-2
+- Changed 'Requires' dependency from 'pam-devel' to 'pam'.
+
+* Mon Jul 26 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
+- Added PAM access control support.
+
+* Thu Jul 22 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
+- Changed post-install to change mode of existing crontabs to
+- 0600 to allow run by new ISC cron 4.1 
+
+* Thu Jul 22 2004 Jason Vas Dias <jvdias@redhat.com>  - 4.1-1
+- Upgraded to ISC cron 4.1
+
+* Thu Jul  1 2004 Jens Petersen <petersen@redhat.com> - 3.0.1-94
+- add vixie-cron-3.0.1-cron-descriptors-125110.patch to close std descriptors
+  when forking (Bernd Schmidt, 121280)
+- add vixie-cron-3.0.1-no-crontab-header-89809.patch to not prepend header to
+  crontab files (Damian Menscher, 103899)
+- fix use of RETVAL in init.d script (Enrico Scholz, 97784)
+- add safer malloc call to vixie-cron-3.0.1-sprintf.patch 
+- add cron-3.0.1-crontab-syntax-error-114386.patch to fix looping on crontab
+  syntax error (Miloslav Trmac, 89937)
+
+* Fri Jun 25 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-93
+- Add fixes from NSA 
+
+* Tue Jun 22 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-92
+- Add fixes from NSA 
+
+* Tue Jun 15 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-91
+- Change patch to check SElinux properly, go back to using fname instead of uname
+
+* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Fri Jun 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-89
+- Fix patch
+
+* Fri Jun 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-88
+- Add patch to allow it to run in permissive mode.
+
+* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Wed Feb 4 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-86
+- Add security_getenforce check.
+
+* Mon Jan 26 2004 Dan Walsh <dwalsh@redhat.com> - 3.0.1-85
+- Fix call to is_selinux_enabled()
+
+* Mon Dec 8 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-84
+- change daemon flag to 1
+
+* Wed Dec 3 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-83
+- Add daemon to make sure child is clean
+
+* Fri Nov  7 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-82
+- add vixie-cron-3.0.1-pie.patch to build crond as pie (#108414)
+  [Ulrich Drepper]
+- require libselinux and buildrequire libselinux-devel
+
+* Thu Oct 30 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-81.sel
+- turn on selinux
+
+* Tue Sep 30 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-80
+- add vixie-cron-3.0.1-vfork-105616.patch to use fork instead of vfork
+  (#105616) [report and patch from ian@caliban.org]
+- update vixie-cron-3.0.1-redhat.patch not to change DESTMAN redundantly
+  (it is overrriden in the spec file anyway)
+
+* Fri Sep 5 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-79
+- turn off selinux
+
+* Fri Sep 5 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-78.sel
+- turn on selinux
+
+* Tue Jul 29 2003 Dan Walsh <dwalsh@redhat.com> - 3.0.1-77
+- Patch to run on SELinux
+
+* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Wed Mar 19 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-75
+- add vixie-cron-3.0.1-root_-u-85879.patch from Valdis Kletnieks to allow
+  root to run "crontab -u <user>" even for users that aren't allowed to
+
+* Wed Feb 19 2003 Jens Petersen <petersen@redhat.com> - 3.0.1-74
+- fix preun script typo (#75137) [reported by Peter Bieringer]
+
+* Tue Feb 11 2003 Bill Nottingham <notting@redhat.com> 3.0.1-73
+- don't set SIGCHLD to SIG_IGN and then try and wait... (#84046)
+
+* Fri Feb  7 2003 Nalin Dahyabhai <nalin@redhat.com> 3.0.1-72
+- adjust cron.d patch so that it ignores file with names that begin with '#'
+  or end with '~', '.rpmorig', '.rpmsave', or '.rpmnew'
+- merge hunk of buffer overflow patch into the cron.d patch
+
+* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
+- rebuilt
+
+* Wed Dec 11 2002 Tim Powers <timp@redhat.com> 3.0.1-70
+- rebuild on all arches
+
+* Sat Jul 20 2002 Akira TAGOH <tagoh@redhat.com> 3.0.1-69
+- vixie-cron-3.0.1-nonstrip.patch: applied to fix the stripped binary issue.
+
+* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Mon Jun 10 2002 Bill Huang <bhuang@redhat.com>
+- Fix preun bugs.(#55340)
+- Fix fprintf bugs.(#65209)
+
+* Thu May 23 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Mon Apr 15 2002 Bill Huang <bhuang@redhat.com>
+- Fixed #62963.
+
+* Thu Apr 04 2002 James McDermott <jmcdermo@redhat.com>
+- Alter behavior of crontab to take stdin as the default
+  behavior if no options are specified. 
+
+* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
+- Bump release + rebuild.
+
+* Thu Mar  8 2001 Bill Nottingham <notting@redhat.com>
+- add patch from Alan Eldridge <alane@geeksrus.net> to
+  fix double execution of jobs (#29868)
+
+* Mon Feb 11 2001 Bill Nottingham <notting@redhat.com>
+- fix buffer overflow in crontab
+
+* Wed Feb  7 2001 Trond Eivind Glomsrød <teg@redhat.com>
+- fix usage string in initscript (#26533)
+
+* Tue Feb  6 2001 Bill Nottingham <notting@redhat.com>
+- fix build with new glibc (#25931)
+
+* Tue Jan 23 2001 Bill Nottingham <notting@redhat.com>
+- change i18n mechanism
+
+* Fri Jan 19 2001 Bill Nottingham <notting@redhat.com>
+- log as 'crond', not 'CROND' (#19410)
+- account for shifts in system clock (#23230, patch from <pererik@onedial.se>)
+- i18n-ize initscript
+
+* Thu Aug 24 2000 Than Ngo <than@redhat.com>
+- fix to set startup position correct at update
+
+* Wed Aug 24 2000 Than Ngo <than@redhat.com>
+- add /sbin/service to Prereq
+- call /sbin/service instead service
+- fix startup position (Bug #13353)
+
+* Mon Aug  7 2000 Bill Nottingham <notting@redhat.com>
+- fix crond logging patch (dan@doom.cmc.msu.ru)
+- log via syslog (suggestion from jos@xos.nl)
+- put system crontab location in crontab(5) (#14842)
+
+* Fri Jul 28 2000 Bill Nottingham <notting@redhat.com>
+- fix condrestart
+
+* Fri Jul 21 2000 Bill Nottingham <notting@redhat.com>
+- fix reload bug (#14065)
+
+* Fri Jul 14 2000 Bill Nottingham <notting@redhat.com>
+- move initscript back
+
+* Thu Jul 13 2000 Prospector <bugzilla@redhat.com>
+- automatic rebuild
+
+* Thu Jul  6 2000 Bill Nottingham <notting@redhat.com>
+- prereq /etc/init.d
+
+* Mon Jul  3 2000 Bill Nottingham <notting@redhat.com>
+- fix post; we do condrestart in postun
+
+* Thu Jun 29 2000 Bill Nottingham <notting@redhat.com>
+- oops, fix init script
+
+* Tue Jun 27 2000 Bill Nottingham <notting@redhat.com>
+- require new initscripts, not prereq
+
+* Mon Jun 26 2000 Bill Nottingham <notting@redhat.com>
+- initscript hacks
+
+* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
+- tweak logrotate config
+
+* Sun Jun 11 2000 Bill Nottingham <notting@redhat.com>
+- rebuild in new env.
+- FHS fixes
+- don't ship chkconfig links
+
+* Fri Mar 31 2000 Bill Nottingham <notting@redhat.com>
+- fix non-root builds (#10490)
+
+* Sun Mar 26 2000 Florian La Roche <Florian.LaRoche@redhat.com>
+- do not remove log files
+
+* Thu Feb  3 2000 Bill Nottingham <notting@redhat.com>
+- handle compressed man pages
+
+* Fri Sep 10 1999 Bill Nottingham <notting@redhat.com>
+- chkconfig --del in preun, not postun
+
+* Wed Aug 25 1999 Bill Nottingham <notting@redhat.com>
+- fix buffer overflow
+
+* Mon Aug 16 1999 Bill Nottingham <notting@redhat.com>
+- initscript munging
+
+* Fri Jul 30 1999 Michael K. Johnson <johnsonm@redhat.com>
+- dayofmonth and month can't be 0
+
+* Thu Jun  3 1999 Jeff Johnson <jbj@redhat.com>
+- in cron.log use "kill -HUP pid" not killall to preserve errors (#2241).
+
+* Wed Apr 14 1999 Michael K. Johnson <johnsonm@redhat.com>
+- add note to man page about DST conversion causing strangeness
+- documented cron.d patch
+
+* Tue Apr 13 1999 Michael K. Johnson <johnsonm@redhat.com>
+- improved cron.d patch
+
+* Mon Apr 12 1999 Erik Troan <ewt@redhat.com>
+- added cron.d patch
+
+* Tue Mar 23 1999 Bill Nottingham <notting@redhat.com>
+- logrotate changes
+
+* Tue Mar 23 1999 Preston Brown <pbrown@redhat.com>
+- clean up log files on deinstallation
+
+* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com> 
+- auto rebuild in the new build environment (release 28)
+
+* Wed Dec 30 1998 Cristian Gafton <gafton@redhat.com>
+- build for glibc 2.1
+
+* Wed Jun 10 1998 Prospector System <bugs@redhat.com>
+- translations modified for de
+
+* Wed Jun 10 1998 Jeff Johnson <jbj@redhat.com>
+- reset SIGCHLD before grandchild execle (problem #732)
+
+* Sat May 02 1998 Cristian Gafton <gafton@redhat.com>
+- enhanced initscript
+
+* Mon Apr 27 1998 Prospector System <bugs@redhat.com>
+- translations modified for de, fr, tr
+
+* Thu Dec 11 1997 Cristian Gafton <gafton@redhat.com>
+- added a patch to get rid of the dangerous sprintf() calls
+- added BuildRoot and Prereq: /sbin/chkconfig
+
+* Sun Nov 09 1997 Michael K. Johnson <johnsonm@redhat.com>
+- fixed cron/crond dichotomy in init file.
+
+* Wed Oct 29 1997 Donnie Barnes <djb@redhat.com>
+- fixed bad init symlinks
+
+* Thu Oct 23 1997 Erik Troan <ewt@redhat.com>
+- force it to use SIGCHLD instead of defunct SIGCLD
+
+* Mon Oct 20 1997 Erik Troan <ewt@redhat.com>
+- updated for chkconfig
+- added status, restart options to init script
+
+* Tue Jun 17 1997 Erik Troan <ewt@redhat.com>
+- built against glibc
+
+* Wed Feb 19 1997 Erik Troan <ewt@redhat.com>
+- Switch conditional from "axp" to "alpha" 
+

vixie_cron-4.1-162887.patch

@@ -0,0 +1,95 @@
+--- vixie-cron-4.1/structs.h.162887	2005-07-11 14:10:09.243826000 -0400
++++ vixie-cron-4.1/structs.h	2005-07-11 13:33:59.348326000 -0400
+@@ -48,11 +48,12 @@
+ typedef	struct _user {
+ 	struct _user	*next, *prev;	/* links */
+ 	char		*name;
++        char            *tabname;       /* /etc/cron.d/ file name or NULL */
+ 	time_t		mtime;		/* last modtime of crontab */
+ 	entry		*crontab;	/* this person's crontab */
+ #ifdef WITH_SELINUX
+         security_context_t scontext;    /* SELinux security context */
+-#endif
++#endif        
+ } user;
+ 
+ typedef	struct _cron_db {
+--- vixie-cron-4.1/funcs.h.162887	2005-07-11 14:10:09.234835000 -0400
++++ vixie-cron-4.1/funcs.h	2005-07-11 13:40:43.401868000 -0400
+@@ -66,7 +66,7 @@
+ 		**env_set(char **, char *);
+ 
+ user		*load_user(int, struct passwd *, const char *, const char *, const char *),
+-		*find_user(cron_db *, const char *);
++		*find_user(cron_db *, const char *, const char *);
+ 
+ entry		*load_entry(FILE *, void (*)(), struct passwd *, char **);
+ 
+--- vixie-cron-4.1/user.c.162887	2005-07-11 14:10:11.115952000 -0400
++++ vixie-cron-4.1/user.c	2005-07-11 14:06:25.297996000 -0400
+@@ -99,6 +99,7 @@
+ 	entry *e, *ne;
+ 
+ 	free(u->name);
++	free(u->tabname);
+ 	for (e = u->crontab;  e != NULL;  e = ne) {
+ 		ne = e->next;
+ 		free_entry(e);
+@@ -130,12 +131,16 @@
+ 	 */
+ 	if ((u = (user *) malloc(sizeof(user))) == NULL)
+ 		return (NULL);
+-	if ((u->name = strdup(fname)) == NULL) {
++
++	if ( ((u->name = strdup(fname)) == NULL) 
++           ||((u->tabname = strdup(tabname)) == NULL)
++           ){
+ 		save_errno = errno;
+ 		free(u);
+ 		errno = save_errno;
+ 		return (NULL);
+ 	}
++	
+ 	u->crontab = NULL;
+ 
+ 	/* init environment.  this will be copied/augmented for each entry.
+--- vixie-cron-4.1/database.c.162887	2005-07-11 14:10:10.769299000 -0400
++++ vixie-cron-4.1/database.c	2005-07-11 13:44:49.568455000 -0400
+@@ -218,12 +218,15 @@
+ }
+ 
+ user *
+-find_user(cron_db *db, const char *name) {
++find_user(cron_db *db, const char *name, const char *tabname) {
+ 	user *u;
+ 
+ 	for (u = db->head;  u != NULL;  u = u->next)
+-		if (strcmp(u->name, name) == 0)
+-			break;
++	    if (  (strcmp(u->name, name) == 0) 
++		&&(   (tabname == NULL) 
++		   || ( strcmp(tabname, u->tabname) == 0 )
++		  )
++	       ) break;
+ 	return (u);
+ }
+ 
+@@ -234,6 +237,7 @@
+ 	struct passwd *pw = NULL;
+ 	int crontab_fd = OK - 1;
+ 	user *u;
++	int crond_crontab = (fname == NULL) && (strcmp(tabname, SYSCRONTAB) != 0);
+ 
+ 	if (fname == NULL) {
+ 		/* must be set to something for logging purposes.
+@@ -280,7 +284,9 @@
+ 	}
+ 
+ 	Debug(DLOAD, ("\t%s:", fname))
+-	u = find_user(old_db, fname);
++
++	u = find_user(old_db, fname, crond_crontab ? tabname : NULL );
++
+ 	if (u != NULL) {
+ 		/* if crontab has not changed since we last read it
+ 		 * in, then we can just use our existing entry.