Issued:

2011-05-19

Updated:

2011-05-19

RHBA-2011:0788 - cronie bug fix update

Synopsis

cronie bug fix update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated cronie packages that fix various bugs are now available.

Description

Cronie contains the standard UNIX daemon crond that runs specified programs at scheduled times and related tools. It is a fork of the original vixie-cron and has security and configuration enhancements like the ability to use pam and SELinux.

This update fixes the following bugs:

• The initscript output written to /var/log/boot.log contained a double output of "OK", printed by /etc/init.d/crond and daemon. This error has been corrected: the echo from /etc/init.d/crond is removed, thus the output is now as expected. (BZ#615107)

• Cronie didn't close file descriptor, which caused other applications such as anacron that are subsequently started by cronie to inherit the file descriptor. This caused SELinux to prevent /bin/bash access. With this update, the file descriptor is no longer inherited by other applications, thus SELinux no longer prevents /bin/bash access. (BZ#624043)

• An incorrect option in the bash script caused anacron to run daily instead of hourly if the /var/spool/anacron/cron.daily file existed. The error has been corrected: the bash script option is fixed and anacron now runs once a day if the /var/spool/anacron/cron.daily file exists. (BZ#675077)

• RELRO flags were previously not set by default from crond. This is now fixed so that cronie is compiled with RELRO protection enabled. (BZ#676040)

• The /usr/bin/crontab was set to use both setuid and setgid permissions, but this was changed to use only setuid. (BZ#676081)

• Multiple code quality improvements were made, which include:

  • In src/crontab.c, mkstemp expects six X's to be replaced with digits at the end of each filename. This fix removes the extra X's.
  • In src/security.c, ccon was not freed after a return. This is fixed and ccon is now freed using context_free.
  • In anacron/run_job.c, fdin was tested before being initialized. This is fixed to ensure that fdin is now initialized prior to testing. (BZ#677364)

All users of cronie are advised to upgrade to this updated package, which resolves these issues.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

Updated Packages

• cronie-1.4.4-7.el6.src.rpm
• cronie-1.4.4-7.el6.x86_64.rpm
• cronie-anacron-1.4.4-7.el6.x86_64.rpm
• cronie-1.4.4-7.el6.ppc64.rpm
• cronie-noanacron-1.4.4-7.el6.x86_64.rpm
• cronie-anacron-1.4.4-7.el6.s390x.rpm
• cronie-noanacron-1.4.4-7.el6.s390x.rpm
• cronie-noanacron-1.4.4-7.el6.ppc64.rpm
• cronie-debuginfo-1.4.4-7.el6.s390x.rpm
• cronie-debuginfo-1.4.4-7.el6.x86_64.rpm
• cronie-debuginfo-1.4.4-7.el6.ppc64.rpm
• cronie-1.4.4-7.el6.i686.rpm
• cronie-noanacron-1.4.4-7.el6.i686.rpm
• cronie-anacron-1.4.4-7.el6.ppc64.rpm
• cronie-1.4.4-7.el6.s390x.rpm
• cronie-anacron-1.4.4-7.el6.i686.rpm
• cronie-debuginfo-1.4.4-7.el6.i686.rpm

Fixes

• This content is not included.BZ - 615107
• This content is not included.BZ - 624043
• This content is not included.BZ - 675077

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.