partkeepr / PartKeepr

Open Source Inventory Management
http://www.partkeepr.org
GNU General Public License v3.0
1.4k stars 403 forks source link

Cronjobs as foreign user #864

Open Drachenkaetzchen opened 7 years ago

Drachenkaetzchen commented 7 years ago

System Information

How to reproduce

Setup the cronjob as root, whilst running PartKeepr on another user account. As the cronjob also would create files in the app/cache directory, the webserver doesn't have access to those files.

We need to ensure that:

  1. Cronjobs may not be ran as root
  2. Log the user as which the cronjob ran in the database table
andreaslink-de commented 7 years ago

Is this really an issue? You can easily run cronjobs as any user when setting up a cron in cron.d as seen in the following example, which is run as "www-data":

_/etc/cron.d/partkeepr #Job for PartKeepr 20 0,6,12,18 * * * www-data /usr/bin/php7.0 /var/www/partkeepr/app/console partkeepr:cron:run

Drachenkaetzchen commented 7 years ago

Yes, people are running PartKeepr as, for example, www-data but then try to run their cronjobs as root. Now, when they attempt to upgrade PartKeepr, Setup will remove the caches as www-data. If now their cronjob runs as root while they run Setup, the cache files will now be owned by root and setup cannot continue because it doesn't have write access to the files, leading to all sorts of strange errors and behaviors.

baradhili commented 4 years ago

I think this is not actually a feature request.. its a case that people are configuring their cronjobs incorrectly.. needs to be show in wiki that cronjobs need to be the same user as partkeepr i.e. crontab -u www-data -e