Bug 1993 - Task Scheduler Needs Re-write
Hi, Comments in bug 1993 state that using 'at' for task scheduling is bad for security. Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab. I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ? -- Julian Maurice <julian.maurice@biblibre.com> BibLibre
Greetings, I think Galen's idea is probably a good way to do it. When attempting to install Koha on non-Debian OS', 'at' was one of the sticky points, if I recall correctly. GPML, Mark Tompsett -----Original Message----- From: Julian Maurice Sent: Tuesday, October 27, 2015 6:20 AM To: koha-devel@lists.koha-community.org Subject: [Koha-devel] Bug 1993 - Task Scheduler Needs Re-write Hi, Comments in bug 1993 state that using 'at' for task scheduling is bad for security. Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab. I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ? -- Julian Maurice <julian.maurice@biblibre.com> BibLibre
Julian, Have a look at bug 14435. If you want to store report results, it could interest you :) Cheers, Jonathan 2015-10-27 10:20 GMT+00:00 Julian Maurice <julian.maurice@biblibre.com>:
Hi,
Comments in bug 1993 state that using 'at' for task scheduling is bad for security.
Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab.
I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ?
-- Julian Maurice <julian.maurice@biblibre.com> BibLibre _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Hum, you can forget that :) 2015-10-27 12:29 GMT+00:00 Jonathan Druart <jonathan.druart@bugs.koha-community.org>:
Julian,
Have a look at bug 14435. If you want to store report results, it could interest you :)
Cheers, Jonathan
2015-10-27 10:20 GMT+00:00 Julian Maurice <julian.maurice@biblibre.com>:
Hi,
Comments in bug 1993 state that using 'at' for task scheduling is bad for security.
Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab.
I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ?
-- Julian Maurice <julian.maurice@biblibre.com> BibLibre _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
I would love to see a proper queuing system used for this, maybe introduce a really nice solution here that we can apply across the board for other things that need queuing. I'm thinking things like zebra updates, sending checkin/checkout emails, and others I'm sure I'm not thinking of. The at based scheduler has a really nasty bug on ubuntu 14/apache2.4 where the task scheduler doesn't work at all (see bug 14774). I am absolutely not opposed to replacing the current scheduler for reports. Cheers, Liz On 28/10/15 01:31, Jonathan Druart wrote:
Hum, you can forget that :)
2015-10-27 12:29 GMT+00:00 Jonathan Druart <jonathan.druart@bugs.koha-community.org>:
Julian,
Have a look at bug 14435. If you want to store report results, it could interest you :)
Cheers, Jonathan
2015-10-27 10:20 GMT+00:00 Julian Maurice <julian.maurice@biblibre.com>:
Hi,
Comments in bug 1993 state that using 'at' for task scheduling is bad for security.
Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab.
I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ?
-- Julian Maurice <julian.maurice@biblibre.com> BibLibre _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
-- -- Liz Rea Catalyst.Net Limited Level 6, Catalyst House, 150 Willis Street, Wellington. P.O Box 11053, Manners Street, Wellington 6142 GPG: B149 A443 6B01 7386 C2C7 F481 B6c2 A49D 3726 38B7
We've done something like that, here, using plugins to do anything we needed. The reason we never published it was that it was not secure _at all_ and we needed to revisit it. Do you intend to "hardcode" the jobs available, or leave the user to decide, thus opening your backend to some unwelcomed behavior? I suppose that if you limit it to running tasks under you hierarchy/misc/cronjobs, that would work just fine, even if being somewhat limited. curious Philippe Blouin, Responsable du développement informatique Tél. : (888) 604-2627 philippe.blouin@inLibro.com <mailto:philippe.blouin@inLibro.com> inLibro | pour esprit libre | www.inLibro.com <http://www.inLibro.com> On 10/27/2015 06:20 AM, Julian Maurice wrote:
Hi,
Comments in bug 1993 state that using 'at' for task scheduling is bad for security.
Galen suggests (comment 34) to use a DB table to store a list of jobs, and check periodically this list with a script in crontab.
I would like to know if someone is already working on something like that (I didn't find anything in Bugzilla). If not, do you agree with Galen's proposal as a replacement for the task scheduler ? Do you have better ideas ?
participants (5)
-
Jonathan Druart -
Julian Maurice -
Liz Rea -
Mark Tompsett -
Philippe Blouin