summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin H. Johnson <robbat2@gentoo.org>2015-08-08 13:49:04 -0700
committerRobin H. Johnson <robbat2@gentoo.org>2015-08-08 17:38:18 -0700
commit56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch)
tree3f91093cdb475e565ae857f1c5a7fd339e2d781e /sys-process/vixie-cron
downloadgentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.bz2
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.zip
proj/gentoo: Initial commit
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'sys-process/vixie-cron')
-rw-r--r--sys-process/vixie-cron/Manifest2
-rw-r--r--sys-process/vixie-cron/files/cron.pam.d7
-rw-r--r--sys-process/vixie-cron/files/crontab17
-rw-r--r--sys-process/vixie-cron/files/crontab-3.0.1-r415
-rw-r--r--sys-process/vixie-cron/files/crontab.5.diff35
-rw-r--r--sys-process/vixie-cron/files/pamd.compatible7
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-basename.diff20
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-commandline.patch13
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-cron.deny5
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-crontabrace.patch29
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-hardlink.patch11
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-pam.patch67
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-selinux-1.diff144
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-selinux.diff117
-rw-r--r--sys-process/vixie-cron/files/vixie-cron-4.1-setuid_check.patch29
-rwxr-xr-xsys-process/vixie-cron/files/vixie-cron.rc622
-rw-r--r--sys-process/vixie-cron/files/vixie-cron.rc713
-rw-r--r--sys-process/vixie-cron/files/vixie-cron.service11
-rw-r--r--sys-process/vixie-cron/metadata.xml5
-rw-r--r--sys-process/vixie-cron/vixie-cron-4.1-r14.ebuild125
20 files changed, 694 insertions, 0 deletions
diff --git a/sys-process/vixie-cron/Manifest b/sys-process/vixie-cron/Manifest
new file mode 100644
index 00000000000..102b8d49a05
--- /dev/null
+++ b/sys-process/vixie-cron/Manifest
@@ -0,0 +1,2 @@
+DIST vixie-cron-4.1-gentoo-r4.patch.bz2 4204 SHA256 8de14b11da567f7859df3dcf71802f32ac1b3650ae07c6cb6dbc259e1f6da7fc SHA512 eec8f89a97927a3557bd1350ed7e9baa0ec133e2c49f8f0fbf51adf62c377451dc48867ca6affcc7576833a5b6b749613c9b99641b1b658853f91d8071c3411b WHIRLPOOL 9951885d10f0f49cb0b66b1b592a870f24c04647688422c7fb396e266af0aeed7ae357bb571f13ee30aeec747ecfe78abb0335f80ea5bfd0084aee4321a581d4
+DIST vixie-cron-4.1.tar.bz2 54246 SHA256 fd25119b301e0e8306ec27ee912298740c5c8ae879bac02381429cf355d1122d SHA512 1db9a246243dbd4934438ce70bf022215ccffed4b899a77b076d5a7679a7b98a23ef67344e329fc7a836df90685581e10b1c95709db40601c33d2052ce561e04 WHIRLPOOL e137a0e056103efc1bf0aa022bf0f9e2ca3ab8bb3ff97645de27c2e381a4aa5303d477cd1bc6220177aa503c2bce5bbe2331d311dfac4f5ab43cf6928dbe1ea7
diff --git a/sys-process/vixie-cron/files/cron.pam.d b/sys-process/vixie-cron/files/cron.pam.d
new file mode 100644
index 00000000000..e09d6f8d832
--- /dev/null
+++ b/sys-process/vixie-cron/files/cron.pam.d
@@ -0,0 +1,7 @@
+#%PAM-1.0
+
+account required pam_unix.so
+
+auth required pam_unix.so
+
+session required pam_limits.so
diff --git a/sys-process/vixie-cron/files/crontab b/sys-process/vixie-cron/files/crontab
new file mode 100644
index 00000000000..7a923117deb
--- /dev/null
+++ b/sys-process/vixie-cron/files/crontab
@@ -0,0 +1,17 @@
+# for vixie cron
+#
+# $Id$
+#
+
+# Global variables
+SHELL=/bin/bash
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+MAILTO=root
+HOME=/
+
+# check scripts in cron.hourly, cron.daily, cron.weekly and cron.monthly
+*/15 * * * * root test -x /usr/sbin/run-crons && /usr/sbin/run-crons
+0 * * * * root rm -f /var/spool/cron/lastrun/cron.hourly
+0 3 * * * root rm -f /var/spool/cron/lastrun/cron.daily
+15 4 * * 6 root rm -f /var/spool/cron/lastrun/cron.weekly
+30 5 1 * * root rm -f /var/spool/cron/lastrun/cron.monthly
diff --git a/sys-process/vixie-cron/files/crontab-3.0.1-r4 b/sys-process/vixie-cron/files/crontab-3.0.1-r4
new file mode 100644
index 00000000000..f7939c25b1d
--- /dev/null
+++ b/sys-process/vixie-cron/files/crontab-3.0.1-r4
@@ -0,0 +1,15 @@
+# for vixie cron
+# $Id$
+
+# Global variables
+SHELL=/bin/bash
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+MAILTO=root
+HOME=/
+
+# check scripts in cron.hourly, cron.daily, cron.weekly and cron.monthly
+59 * * * * root rm -f /var/spool/cron/lastrun/cron.hourly
+9 3 * * * root rm -f /var/spool/cron/lastrun/cron.daily
+19 4 * * 6 root rm -f /var/spool/cron/lastrun/cron.weekly
+29 5 1 * * root rm -f /var/spool/cron/lastrun/cron.monthly
+*/10 * * * * root test -x /usr/sbin/run-crons && /usr/sbin/run-crons
diff --git a/sys-process/vixie-cron/files/crontab.5.diff b/sys-process/vixie-cron/files/crontab.5.diff
new file mode 100644
index 00000000000..f50db3dc790
--- /dev/null
+++ b/sys-process/vixie-cron/files/crontab.5.diff
@@ -0,0 +1,35 @@
+--- crontab.5.orig 2004-02-19 20:40:04.954132624 +0000
++++ crontab.5 2004-02-19 20:45:27.033169168 +0000
+@@ -153,6 +153,32 @@
+ ``30 4 1,15 * 5''
+ would cause a command to be run at 4:30 am on the 1st and 15th of each
+ month, plus every Friday.
++.PP
++Instead of the first five fields, one of eight special strings may
++appear:
++.IP
++.ta 1.5i
++string meaning
++.br
++------ -------
++.br
++@reboot Run once, at startup.
++.br
++@yearly Run once a year, "0 0 1 1 *".
++.br
++@annually (same as @yearly)
++.br
++@monthly Run once a month, "0 0 1 * *".
++.br
++@weekly Run once a week, "0 0 * * 0".
++.br
++@daily Run once a day, "0 0 * * *".
++.br
++@midnight (same as @daily)
++.br
++@hourly Run once an hour, "0 * * * *".
++.br
++.fi
+ .SH EXAMPLE CRON FILE
+ .nf
+
diff --git a/sys-process/vixie-cron/files/pamd.compatible b/sys-process/vixie-cron/files/pamd.compatible
new file mode 100644
index 00000000000..62eb029eac5
--- /dev/null
+++ b/sys-process/vixie-cron/files/pamd.compatible
@@ -0,0 +1,7 @@
+#%PAM-1.0
+
+account required pam_unix.so
+
+auth required pam_unix.so
+
+session optional pam_limits.so
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-basename.diff b/sys-process/vixie-cron/files/vixie-cron-4.1-basename.diff
new file mode 100644
index 00000000000..c7930ddc4e9
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-basename.diff
@@ -0,0 +1,20 @@
+diff --exclude='*~' -urN vixie-cron-4.1.orig/cron.c vixie-cron-4.1/cron.c
+--- vixie-cron-4.1.orig/cron.c 2005-02-23 02:05:30.730975808 -0500
++++ vixie-cron-4.1/cron.c 2005-02-23 02:07:13.233393072 -0500
+@@ -25,6 +25,7 @@
+
+ #define MAIN_PROGRAM
+
++#include <libgen.h>
+ #include "cron.h"
+
+ enum timejump { negative, small, medium, large };
+@@ -61,7 +62,7 @@
+ cron_db database;
+ int fd;
+
+- ProgramName = argv[0];
++ ProgramName = basename(argv[0]);
+
+ setlocale(LC_ALL, "");
+
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-commandline.patch b/sys-process/vixie-cron/files/vixie-cron-4.1-commandline.patch
new file mode 100644
index 00000000000..d204ad882aa
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-commandline.patch
@@ -0,0 +1,13 @@
+--- entry.c.orig 2004-08-27 20:09:34.000000000 +0200
++++ entry.c 2004-12-01 22:16:10.992268200 +0100
+@@ -336,7 +336,9 @@
+
+ /* If the first character of the command is '-' it is a cron option.
+ */
+- while ((ch = get_char(file)) == '-') {
++ ch = get_char(file);
++ Skip_Blanks(ch, file)
++ while (ch == '-') {
+ switch (ch = get_char(file)) {
+ case 'q':
+ e->flags |= DONT_LOG;
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-cron.deny b/sys-process/vixie-cron/files/vixie-cron-4.1-cron.deny
new file mode 100644
index 00000000000..42cdd5f8c9a
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-cron.deny
@@ -0,0 +1,5 @@
+# $Id$
+# If for any reason you have users in the 'cron' group who should not
+# be allowed to run crontab, add them to this file (one username per
+# line)
+
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-crontabrace.patch b/sys-process/vixie-cron/files/vixie-cron-4.1-crontabrace.patch
new file mode 100644
index 00000000000..5109554e1dd
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-crontabrace.patch
@@ -0,0 +1,29 @@
+--- vixie-cron-4.1/crontab.c
++++ vixie-cron-4.1/crontab.c
+@@ -314,8 +314,6 @@
+ perror("fstat");
+ goto fatal;
+ }
+- utimebuf.actime = statbuf.st_atime;
+- utimebuf.modtime = statbuf.st_mtime;
+
+ /* Turn off signals. */
+ (void)signal(SIGHUP, SIG_IGN);
+@@ -374,6 +372,17 @@
+ perror(Filename);
+ exit(ERROR_EXIT);
+ }
++ if (swap_uids() < OK) {
++ perror("swapping uids");
++ exit(ERROR_EXIT);
++ }
++ utimebuf.actime = statbuf.st_atime;
++ utimebuf.modtime = statbuf.st_mtime;
++ utime(Filename, &utimebuf);
++ if (swap_uids_back() < OK) {
++ perror("swapping uids back");
++ exit(ERROR_EXIT);
++ }
+ utime(Filename, &utimebuf);
+ again:
+ rewind(NewCrontab);
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-hardlink.patch b/sys-process/vixie-cron/files/vixie-cron-4.1-hardlink.patch
new file mode 100644
index 00000000000..cabdef02e67
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-hardlink.patch
@@ -0,0 +1,11 @@
+--- database.c.orig 2007-04-08 21:06:16.913019387 +0200
++++ database.c 2007-04-08 21:06:29.489736093 +0200
+@@ -251,7 +251,7 @@
+ log_it(fname, getpid(), "WRONG FILE OWNER", tabname);
+ goto next_crontab;
+ }
+- if (statbuf->st_nlink != 1) {
++ if (statbuf->st_nlink != 1 && pw != NULL) {
+ log_it(fname, getpid(), "BAD LINK COUNT", tabname);
+ goto next_crontab;
+ }
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-pam.patch b/sys-process/vixie-cron/files/vixie-cron-4.1-pam.patch
new file mode 100644
index 00000000000..64bf67138e7
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-pam.patch
@@ -0,0 +1,67 @@
+--- vixie-cron-3.0.1.orig/Makefile Thu May 30 19:47:00 2002
++++ vixie-cron-3.0.1/Makefile Thu May 30 20:54:46 2002
+@@ -55,7 +55,7 @@
+ INCLUDE = -I.
+ #INCLUDE =
+ #<<need getopt()>>
+-LIBS =
++LIBS = -lpam
+ #<<optimize or debug?>>
+ OPTIM = $(RPM_OPT_FLAGS)
+ #OPTIM = -g
+--- vixie-cron-3.0.1.orig/do_command.c Thu May 30 19:47:00 2002
++++ vixie-cron-3.0.1/do_command.c Thu May 30 20:55:50 2002
+@@ -25,6 +25,18 @@
+
+ #include "cron.h"
+
++#include <security/pam_appl.h>
++static pam_handle_t *pamh = NULL;
++static const struct pam_conv conv = {
++ NULL
++};
++#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
++ fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
++ syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
++ pam_end(pamh, retcode); exit(1); \
++ }
++
++
+ static void child_process(entry *, user *);
+ static int safe_p(const char *, const char *);
+
+@@ -65,6 +77,7 @@
+ int stdin_pipe[2], stdout_pipe[2];
+ char *input_data, *usernm, *mailto;
+ int children = 0;
++ int retcode = 0;
+
+ Debug(DPROC, ("[%ld] child_process('%s')\n", (long)getpid(), e->cmd))
+
+@@ -134,6 +147,16 @@
+ *p = '\0';
+ }
+
++
++ retcode = pam_start("cron", usernm, &conv, &pamh);
++ PAM_FAIL_CHECK;
++ retcode = pam_acct_mgmt(pamh, PAM_SILENT);
++ PAM_FAIL_CHECK;
++ retcode = pam_open_session(pamh, PAM_SILENT);
++ PAM_FAIL_CHECK;
++ retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
++ PAM_FAIL_CHECK;
++
+ /* fork again, this time so we can exec the user's command.
+ */
+ switch (vfork()) {
+@@ -507,6 +530,9 @@
+ Debug(DPROC, (", dumped core"))
+ Debug(DPROC, ("\n"))
+ }
++ pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
++ retcode = pam_close_session(pamh, PAM_SILENT);
++ pam_end(pamh, retcode);
+ }
+
+ static int
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-selinux-1.diff b/sys-process/vixie-cron/files/vixie-cron-4.1-selinux-1.diff
new file mode 100644
index 00000000000..ec2493e8c3c
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-selinux-1.diff
@@ -0,0 +1,144 @@
+diff -purN vixie-cron-4.1.orig/Makefile vixie-cron-4.1/Makefile
+--- vixie-cron-4.1.orig/Makefile 2004-08-27 14:09:33.000000000 -0400
++++ vixie-cron-4.1/Makefile 2008-08-25 15:17:20.062720415 -0400
+@@ -68,7 +68,8 @@ LINTFLAGS = -hbxa $(INCLUDE) $(DEBUGGING
+ #<<want to use a nonstandard CC?>>
+ CC = gcc -Wall -Wno-unused -Wno-comment
+ #<<manifest defines>>
+-DEFS =
++DEFS = -s -DWITH_SELINUX
++LIBS += -lselinux
+ #(SGI IRIX systems need this)
+ #DEFS = -D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>
+diff -purN vixie-cron-4.1.orig/database.c vixie-cron-4.1/database.c
+--- vixie-cron-4.1.orig/database.c 2004-08-27 14:09:34.000000000 -0400
++++ vixie-cron-4.1/database.c 2008-08-27 08:19:37.948930858 -0400
+@@ -28,6 +28,16 @@ static char rcsid[] = "# $Id$
+
+ #include "cron.h"
+
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/flask.h>
++#include <selinux/av_permissions.h>
++#include <selinux/get_context_list.h>
++#define SYSUSERNAME "system_u"
++#else
++#define SYSUSERNAME "*system*"
++#endif
++
+ #define TMAX(a,b) ((a)>(b)?(a):(b))
+
+ static void process_crontab(const char *, const char *,
+@@ -183,7 +193,7 @@ process_crontab(const char *uname, const
+ if (fname == NULL) {
+ /* must be set to something for logging purposes.
+ */
+- fname = "*system*";
++ fname = SYSUSERNAME;
+ } else if ((pw = getpwnam(uname)) == NULL) {
+ /* file doesn't have a user in passwd file.
+ */
+@@ -245,6 +255,56 @@ process_crontab(const char *uname, const
+ free_user(u);
+ log_it(fname, getpid(), "RELOAD", tabname);
+ }
++#ifdef WITH_SELINUX
++ if (is_selinux_enabled()) {
++ security_context_t file_context=NULL;
++ security_context_t user_context=NULL;
++ struct av_decision avd;
++ int retval=0;
++ char *seuser=NULL;
++ char *level=NULL;
++
++ if (fgetfilecon(crontab_fd, &file_context) < OK) {
++ log_it(fname, getpid(), "getfilecon FAILED", tabname);
++ goto next_crontab;
++ }
++
++ /*
++ * Since crontab files are not directly executed,
++ * crond must ensure that the crontab file has
++ * a context that is appropriate for the context of
++ * the user cron job. It performs an entrypoint
++ * permission check for this purpose.
++ */
++ if (getseuserbyname(fname, &seuser, &level) < 0) {
++ log_it(fname, getpid(), "NO SEUSER", tabname);
++ goto next_crontab;
++ }
++
++ if (get_default_context_with_level(seuser, level, NULL, &user_context) < 0) {
++ log_it(fname, getpid(), "NO CONTEXT", tabname);
++ freecon(file_context);
++ free(seuser);
++ free(level);
++ goto next_crontab;
++ }
++
++ retval = security_compute_av(user_context,
++ file_context,
++ SECCLASS_FILE,
++ FILE__ENTRYPOINT,
++ &avd);
++ freecon(user_context);
++ freecon(file_context);
++ free(seuser);
++ free(level);
++
++ if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
++ log_it(fname, getpid(), "ENTRYPOINT FAILED", tabname);
++ goto next_crontab;
++ }
++ }
++#endif
+ u = load_user(crontab_fd, pw, fname);
+ if (u != NULL) {
+ u->mtime = statbuf->st_mtime;
+diff -purN vixie-cron-4.1.orig/do_command.c vixie-cron-4.1/do_command.c
+--- vixie-cron-4.1.orig/do_command.c 2004-08-27 14:09:34.000000000 -0400
++++ vixie-cron-4.1/do_command.c 2008-08-25 15:43:43.289174371 -0400
+@@ -25,6 +25,11 @@ static char rcsid[] = "# $Id$
+
+ #include "cron.h"
+
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/get_context_list.h>
++#endif
++
+ static void child_process(entry *, user *);
+ static int safe_p(const char *, const char *);
+
+@@ -265,6 +270,29 @@ child_process(entry *e, user *u) {
+ _exit(OK_EXIT);
+ }
+ # endif /*DEBUGGING*/
++#ifdef WITH_SELINUX
++ if (is_selinux_enabled()) {
++ char *seuser=NULL;
++ char *level=NULL;
++ security_context_t scontext;
++
++ if (getseuserbyname(u->name, &seuser, &level) < 0) {
++ fprintf(stderr, "getseuserbyname: Could not determine seuser for user %s\n", u->name);
++ _exit(ERROR_EXIT);
++ }
++ if (get_default_context_with_level(seuser, level, NULL, &scontext) < 0) {
++ fprintf(stderr, "get_default_context_with_level: could not get security context for user %s, seuser %s\n", u->name, seuser);
++ _exit(ERROR_EXIT);
++ }
++ if (setexeccon(scontext) < 0) {
++ fprintf(stderr, "setexeccon: Could not set exec context to %s for user %s\n", scontext, u->name);
++ _exit(ERROR_EXIT);
++ }
++ free(seuser);
++ free(level);
++ freecon(scontext);
++ }
++#endif
+ execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
+ fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
+ perror("execl");
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-selinux.diff b/sys-process/vixie-cron/files/vixie-cron-4.1-selinux.diff
new file mode 100644
index 00000000000..a4621e2530d
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-selinux.diff
@@ -0,0 +1,117 @@
+--- vixie-cron-3.0.1/Makefile.selinux 2003-05-20 14:52:06.000000000 -0400
++++ vixie-cron-3.0.1/Makefile 2003-05-20 14:52:21.000000000 -0400
+@@ -71,7 +71,8 @@ LINTFLAGS = -hbxa $(INCLUDE) $(COMPAT) $
+ #<<want to use a nonstandard CC?>>
+ #CC = vcc
+ #<<manifest defines>>
+-DEFS =
++DEFS = -s -DWITH_SELINUX
++LIBS += -lselinux
+ #(SGI IRIX systems need this)
+ #DEFS = -D_BSD_SIGNALS -Dconst=
+ #<<the name of the BSD-like install program>>
+--- vixie-cron-3.0.1/database.c.selinux 2003-05-20 14:52:56.000000000 -0400
++++ vixie-cron-3.0.1/database.c 2003-05-23 13:27:24.898020960 -0400
+@@ -28,6 +28,15 @@
+
+ #include "cron.h"
+
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#include <selinux/flask.h>
++#include <selinux/av_permissions.h>
++#define SYSUSERNAME "system_u"
++#else
++#define SYSUSERNAME "*system*"
++#endif
++
+ #define TMAX(a,b) ((a)>(b)?(a):(b))
+
+ static void process_crontab(const char *, const char *,
+@@ -217,7 +226,7 @@
+ if (fname == NULL) {
+ /* must be set to something for logging purposes.
+ */
+- fname = "*system*";
++ fname = SYSUSERNAME;
+ } else if ((pw = getpwnam(uname)) == NULL) {
+ /* file doesn't have a user in passwd file.
+ */
+@@ -279,6 +288,43 @@
+ free_user(u);
+ log_it(fname, getpid(), "RELOAD", tabname);
+ }
++#ifdef WITH_SELINUX
++ if (is_selinux_enabled()) {
++ security_context_t file_context=NULL;
++ security_context_t user_context=NULL;
++ struct av_decision avd;
++ int retval=0;
++
++ if (fgetfilecon(crontab_fd, &file_context) < OK) {
++ log_it(fname, getpid(), "getfilecon FAILED", tabname);
++ goto next_crontab;
++ }
++
++ /*
++ * Since crontab files are not directly executed,
++ * crond must ensure that the crontab file has
++ * a context that is appropriate for the context of
++ * the user cron job. It performs an entrypoint
++ * permission check for this purpose.
++ */
++ if (get_default_context(fname, NULL, &user_context)) {
++ log_it(fname, getpid(), "NO CONTEXT", tabname);
++ freecon(file_context);
++ goto next_crontab;
++ }
++ retval = security_compute_av(user_context,
++ file_context,
++ SECCLASS_FILE,
++ FILE__ENTRYPOINT,
++ &avd);
++ freecon(user_context);
++ freecon(file_context);
++ if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
++ log_it(fname, getpid(), "ENTRYPOINT FAILED", tabname);
++ goto next_crontab;
++ }
++ }
++#endif
+ u = load_user(crontab_fd, pw, fname);
+ if (u != NULL) {
+ u->mtime = statbuf->st_mtime;
+--- vixie-cron-3.0.1/do_command.c.selinux 2003-05-20 14:53:12.000000000 -0400
++++ vixie-cron-3.0.1/do_command.c 2003-05-20 14:58:06.000000000 -0400
+@@ -25,6 +25,10 @@
+
+ #include "cron.h"
+
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ static void child_process(entry *, user *);
+ static int safe_p(const char *, const char *);
+
+@@ -265,6 +269,20 @@
+ _exit(OK_EXIT);
+ }
+ # endif /*DEBUGGING*/
++#ifdef WITH_SELINUX
++ if (is_selinux_enabled()) {
++ security_context_t scontext;
++ if (get_default_context(u->name, NULL, &scontext)) {
++ fprintf(stderr, "execle_secure: couldn't get security context for user %s\n", u->name);
++ _exit(ERROR_EXIT);
++ }
++ if (setexeccon(scontext) < 0) {
++ fprintf(stderr, "Could not set exec context to %s for user %s\n", scontext,u->name);
++ _exit(ERROR_EXIT);
++ }
++ freecon(scontext);
++ }
++#endif
+ execle(shell, shell, "-c", e->cmd, (char *)0, e->envp);
+ fprintf(stderr, "execl: couldn't exec `%s'\n", shell);
+ perror("execl");
diff --git a/sys-process/vixie-cron/files/vixie-cron-4.1-setuid_check.patch b/sys-process/vixie-cron/files/vixie-cron-4.1-setuid_check.patch
new file mode 100644
index 00000000000..42fd8e13edd
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron-4.1-setuid_check.patch
@@ -0,0 +1,29 @@
+--- vixie-cron-4.1/do_command.c 2006-05-25 16:44:26.000000000 +0400
++++ vixie-cron-4.1.lk/do_command.c 2006-05-25 16:42:25.000000000 +0400
+@@ -240,12 +240,23 @@
+ }
+ }
+ #else
+- setgid(e->pwd->pw_gid);
++
+ initgroups(usernm, e->pwd->pw_gid);
+ #if (defined(BSD)) && (BSD >= 199103)
+ setlogin(usernm);
+ #endif /* BSD */
+- setuid(e->pwd->pw_uid); /* we aren't root after this... */
++ // setuid(e->pwd->pw_uid); /* we aren't root after this... */
++
++ if ( setgid(e->pwd->pw_gid) == -1 ) {
++ fprintf(stderr,"can't set gid for %s\n", e->pwd->pw_name);
++ _exit(1);
++ }
++
++ if ( setuid(e->pwd->pw_uid) == -1 ) {
++ fprintf(stderr,"can't set uid for %s\n", e->pwd->pw_name);
++ _exit(1);
++ }
++
+
+ #endif /* LOGIN_CAP */
+ chdir(env_get("HOME", e->envp));
+
diff --git a/sys-process/vixie-cron/files/vixie-cron.rc6 b/sys-process/vixie-cron/files/vixie-cron.rc6
new file mode 100755
index 00000000000..ea72ceddde8
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron.rc6
@@ -0,0 +1,22 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+depend() {
+ use clock logger
+ need localmount
+ provide cron
+}
+
+start() {
+ ebegin "Starting vixie-cron"
+ start-stop-daemon --start --quiet --exec /usr/sbin/cron
+ eend $?
+}
+
+stop() {
+ ebegin "Stopping vixie-cron"
+ start-stop-daemon --stop --quiet --pidfile /var/run/cron.pid
+ eend $?
+}
diff --git a/sys-process/vixie-cron/files/vixie-cron.rc7 b/sys-process/vixie-cron/files/vixie-cron.rc7
new file mode 100644
index 00000000000..25d6bd116f7
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron.rc7
@@ -0,0 +1,13 @@
+#!/sbin/runscript
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+command=/usr/sbin/cron
+pidfile=/var/run/cron.pid
+
+depend() {
+ use clock logger
+ need localmount
+ provide cron
+}
diff --git a/sys-process/vixie-cron/files/vixie-cron.service b/sys-process/vixie-cron/files/vixie-cron.service
new file mode 100644
index 00000000000..66c3862e47e
--- /dev/null
+++ b/sys-process/vixie-cron/files/vixie-cron.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Vixie Cron Daemon
+
+[Service]
+Type=forking
+ExecStart=/usr/sbin/cron
+ExecStop=/bin/kill -TERM $MAINPID
+IgnoreSIGPIPE=false
+
+[Install]
+WantedBy=multi-user.target
diff --git a/sys-process/vixie-cron/metadata.xml b/sys-process/vixie-cron/metadata.xml
new file mode 100644
index 00000000000..3f399e92bcf
--- /dev/null
+++ b/sys-process/vixie-cron/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <herd>cron</herd>
+</pkgmetadata>
diff --git a/sys-process/vixie-cron/vixie-cron-4.1-r14.ebuild b/sys-process/vixie-cron/vixie-cron-4.1-r14.ebuild
new file mode 100644
index 00000000000..e551741be55
--- /dev/null
+++ b/sys-process/vixie-cron/vixie-cron-4.1-r14.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+inherit cron toolchain-funcs pam eutils flag-o-matic user systemd
+
+# no useful homepage, bug #65898
+HOMEPAGE="ftp://ftp.isc.org/isc/cron/"
+DESCRIPTION="Paul Vixie's cron daemon, a fully featured crond implementation"
+
+SELINUX_PATCH="${P}-selinux-1.diff"
+GENTOO_PATCH_REV="r4"
+
+SRC_URI="mirror://gentoo/${P}.tar.bz2
+ mirror://gentoo/${P}-gentoo-${GENTOO_PATCH_REV}.patch.bz2"
+
+LICENSE="ISC BSD-2 BSD"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd"
+IUSE="selinux pam debug"
+
+DEPEND="selinux? ( sys-libs/libselinux )
+ pam? ( virtual/pam )"
+
+RDEPEND="selinux? ( sys-libs/libselinux )
+ pam? ( virtual/pam )"
+
+#vixie-cron supports /etc/crontab
+CRON_SYSTEM_CRONTAB="yes"
+
+pkg_setup() {
+ enewgroup crontab
+}
+
+src_unpack() {
+ unpack ${A}
+ cd "${S}"
+
+ epatch "${WORKDIR}"/${P}-gentoo-${GENTOO_PATCH_REV}.patch
+ epatch "${FILESDIR}"/crontab.5.diff
+ epatch "${FILESDIR}"/${P}-commandline.patch
+ epatch "${FILESDIR}"/${P}-basename.diff
+ epatch "${FILESDIR}"/${P}-setuid_check.patch
+ epatch "${FILESDIR}"/${P}-hardlink.patch
+ epatch "${FILESDIR}"/${P}-crontabrace.patch
+ use pam && epatch "${FILESDIR}"/${P}-pam.patch
+ use selinux && epatch "${FILESDIR}"/${SELINUX_PATCH}
+}
+
+src_compile() {
+ use debug && append-flags -DDEBUGGING
+
+ sed -i -e "s:gcc \(-Wall.*\):$(tc-getCC) \1 ${CFLAGS}:" \
+ -e "s:^\(LDFLAGS[ \t]\+=\).*:\1 ${LDFLAGS}:" Makefile \
+ || die "sed Makefile failed"
+
+ emake || die "emake failed"
+}
+
+src_install() {
+ docrondir -m 1730 -o root -g crontab
+ docron
+ docrontab -m 2755 -o root -g crontab
+
+ # /etc stuff
+ insinto /etc
+ newins "${FILESDIR}"/crontab-3.0.1-r4 crontab
+ newins "${FILESDIR}"/${P}-cron.deny cron.deny
+
+ keepdir /etc/cron.d
+ newpamd "${FILESDIR}"/pamd.compatible cron
+ newinitd "${FILESDIR}"/vixie-cron.rc7 vixie-cron
+
+ # doc stuff
+ doman crontab.1 crontab.5 cron.8
+ dodoc "${FILESDIR}"/crontab
+ dodoc CHANGES CONVERSION FEATURES MAIL README THANKS
+
+ systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+pkg_preinst() {
+ has_version "<${CATEGORY}/${PN}-4.1-r10"
+ fix_spool_dir_perms=$?
+}
+
+pkg_postinst() {
+ if [[ -f ${ROOT}/etc/init.d/vcron ]]
+ then
+ ewarn "Please run:"
+ ewarn "rc-update del vcron"
+ ewarn "rc-update add vixie-cron default"
+ fi
+
+ # bug 71326
+ if [[ -u ${ROOT}/etc/pam.d/cron ]] ; then
+ echo
+ ewarn "Warning: previous ebuilds didn't reset permissions prior"
+ ewarn "to installing crontab, resulting in /etc/pam.d/cron being"
+ ewarn "installed with the SUID and executable bits set."
+ ewarn
+ ewarn "Run the following as root to set the proper permissions:"
+ ewarn " chmod 0644 /etc/pam.d/cron"
+ echo
+ fi
+
+ # bug 164466
+ if [[ $fix_spool_dir_perms = 0 ]] ; then
+ echo
+ ewarn "Previous ebuilds didn't correctly set permissions on"
+ ewarn "the crontabs spool directory. Proper permissions are"
+ ewarn "now being set on ${ROOT}var/spool/cron/crontabs/"
+ ewarn "Look at this directory if you have a specific configuration"
+ ewarn "that needs special ownerships or permissions."
+ echo
+ chmod 1730 "${ROOT}/var/spool/cron/crontabs" || die "chmod failed"
+ chgrp -R crontab "${ROOT}/var/spool/cron/crontabs" || die "chgrp failed"
+ cd "${ROOT}/var/spool/cron/crontabs/"
+ for cronfile in * ; do
+ [[ ! -f $cronfile ]] || chown "$cronfile:crontab" "$cronfile" \
+ || ewarn "chown failed on $cronfile, you probably have an orphan file."
+ done
+ fi
+
+ cron_pkg_postinst
+}