Search code examples
linuxcronsuse

Cronfile did not execute sudo -u line?


I have made the following cronjob sh file :

Vi RestartServices.sh


/etc/init.d/b1s stop
sleep 10
/etc/init.d/sapb1servertools stop
sleep 10
sudo -u ndbadm /usr/sap/NDB/HDB00/HDB stop
sleep 20
sudo -u ndbadm /usr/sap/NDB/HDB00/HDB start
sleep 10
/etc/init.d/sapb1servertools start
sleep 10
/etc/init.d/b1s start

When I run this file manually the job runs correctly.

When scheduled in crontab (root user)

Crontab content:

# srvmagtCron: restarts daemons that died
0,5,10,15,20,25,30,35,40,45,50,55 * * * * /bin/sh -c "[ -x     /etc/srvmagt/srvmagtCron ] && /etc/srvmagt/srvmagtCron"
0 2 * * * /hanamnt/shared/NDB/HDB00/backup/scripts/VGRbackup.sh
#RESTARTS SERVICE LAYER , SAPB1ServerTools service , HDB
0 3 * * * /hanamnt/shared/NDB/HDB00/backup/scripts/RestartServices.sh

It does get started at the requested time but I think it failed to execute the sudo line as the HDB service has not been restarted.

I'm trying to find out why? Is it because sudo cannot be executed in a cronjob? (service needs to start using user ndbadm)

path: /opt/sap/sapjvm_6//bin:/opt/fujitsu/bwai/bin:/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/games:/usr/lib64/jvm/jre/bin:/usr/lib/mit/bin:/usr/lib/mit/sbin


Solution

  • You have a non-standard $PATH and crond(8) is running your crontab(5) entries with a shorter $PATH. See also environ(7), credentials(7) and execvp(3) with execve(2)

    My recommendation would be to write a complete shell script, and put only that in crontab. So don't use sh -c in crontab entries, and set explicitly the PATH (either, and preferably, in the shell scripts your crontab entry is firing, or maybe in your crontab file).

    You could for example have

    0,5,10,15,20,25,30,35,40,45,50,55 * * * *  /hanamnt/shared/srvmagt.sh
    

    in your crontab, and have an executable /hanamnt/shared/srvmagt.sh file starting with

    #!/bin/bash
    export PATH=/opt/sap/sapjvm_6//bin:/opt/fujitsu/bwai/bin:/sbin:\
    /usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:\
    /usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/games:\
    /usr/lib64/jvm/jre/bin:/usr/lib/mit/bin:/usr/lib/mit/sbin
    # log a starting message
    logger start of $0
    

    Notice the use of logger(1) - and you should use it more wisely to get appropriate log messages under /var/log

    BTW, your PATH is ridiculously too long. Such a long PATH is messy (and might slow down your shells) and could be a security risk; my recommendation would be to have a much shorter one (perhaps as short as $HOME/bin:/usr/local/bin:/bin:/usr/bin) and add appropriate symlinks or scripts in e.g. $HOME/bin/ or /usr/local/bin/ using explicit program paths.

    Notice that sudo could be used in a crontab job (but that is often unwise) and then probably should be configured in /etc/sudoers ; perhaps you should prefer /bin/su (see su(1)...) in some shell script.

    Read also more about setuid. Sometimes it is wiser to write in C a wrapper setuid- program using it (with setreuid(2)), but be careful (you could open huge security holes by mistake).

    Read also Advanced Linux Programming (freely downloadable, a bit old) then syscalls(2) to understand better how Linux works internally. You need to have a better and more clear picture of your system in your head.