#!/bin/sh
#
#     tiger - A UN*X security checking system
#     Copyright (C) 1993 Douglas Lee Schales, David K. Hess, David R. Safford
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2, or (at your option)
#    any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#     Please see the file `COPYING' for the complete copyright notice.
#
# Linux/2/gen_cron - 06/14/93
# 11/08/2007 - jfs - Handles properly the case when the special @daily,@reboot,
#                    etc. definitions are used instead of real times. Also fix
#                    bug deailing with variables in crontab contents 
#                    (Debian bug 418440) 
# 03/21/2005 - jfs - Fixed -a checks to be POSIX compatbile
# 10/01/2003 - jfs - Added check to see if CRONSPOOL can be read, also
#    fixed the way the information is read since LS might be locale
#    dependant and it's cleaner to call FIND than to access the directory
#    and list its contents.
# 03/27/2002 - jfs 
#    changed to add CRONSPOOLTAB and included ARSC change to not confuse
#    empty directories 
# 02/10/2018 - jfs - Remove unnecessary calls. 
#                   Check if CRONSPOOL is readable or not and warn if this is
#                   the case (happens when running as unpriviledged user)
#
#-----------------------------------------------------------------------------
#
# Defin commands we need, just in case
[ -z "$FIND" ] && FIND=`which find` 
[ -z "$LS" ] && LS=`which ls` 
[ -z "$SED" ] && SED=`which sed` 
[ -z "$CRONSPOOL" ] && CRONSPOOL="/var/spool/cron/crontabs"

[ ! -n "$GETUSERHOME" ] && GETUSERHOME=echo

outfile=$1
[ -z "$outfile" ] && { echo "Bad usage: $0 outfile"; exit 1;  }
> $outfile

if [ ! -d "$CRONSPOOL" ] ; then
    echo "--ERROR-- Cron spool directory $CRONSPOOL does not exist."
fi
if [ ! -r "$CRONSPOOL" ] ; then
    echo "--ERROR-- Cannot read contents of spool directory $CRONSPOOL."
fi


# First check the System's cron files (all in /etc)
# these are output with just the cron owner and the file 
for dir in /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly
# TODO: consider using cron.* as suggested by unspawn instead of
# an explicit for
do
    if [ -d "$dir" ] && [ -r "$dir" ]; then 
    	$FIND "$dir" -type f -printf "%p %u\n" |
	while read  file owner
	do
	[ "$owner" != "root" ] && {
		echo "--WARN-- CRON file \`$file' is owned by $owner."
	}
        echo "$owner $file" >> $outfile
       done
    fi
done 

# Then check the cron's spool (both of the system's and the user's)
# TODO (fix): same as above
if [ -d $CRONSPOOL ] && [ -r $CRONSPOOL ]; then 
    $FIND "$CRONSPOOL" -type f -printf "%p %u %f\n" |
    while read  file owner name
    do
        [ "$owner" != "root" ] && {
            echo "--WARN-- CRON file \`$file' is owned by $owner."
        }
        case $name in
            *[!a-zA-Z0-9]*)
            echo "--WARN-- Unusual cron file \`$file' found."
            ;;
        *)
            $GETUSERHOME "$file" >/dev/null 2>/dev/null

          if [ $? = 0 ]; then
        # Parse the crontab file:
        # - Replace '@' commands (Debian-specific), since we don't care on
        #   times we just replace them with '0 0 0 0 0'
        # - Remove variable definitions
	    $SED -e 's/#.*$//' -e '/^$/d' $CRONSPOOL/$name |
            $SED -e 's/^@[A-Za-z]*/0 0 0 0 0/' |
            $SED -e '/^[A-Za-z]*.*=/d' |
            while read a b c d e command
            do
                [ -n "$command" ] && echo "$name $command"
                done >> $outfile
            else
                echo "--WARN-- Found cron file for unknown user $file."
            fi
            ;;
       esac
   done
fi

