Page MenuHomePhabricator

Cron spam from phab1001 delete of temporary files
Closed, ResolvedPublic

Description

We got at least 120 emails in the last 2 days about this:

Cron <www-data@phab1001> /usr/bin/find /tmp -user www-data -mtime +14 | xargs rm -r

They put in stderr either missed files:

/usr/bin/find: `/tmp/tmpfmh9GWw': No such file or directory

or permission denied:

/usr/bin/find: `/tmp/pymp-0SIwt8': Permission denied
/usr/bin/find: `/tmp/pymp-ERaEHo': Permission denied
/usr/bin/find: `/tmp/tmux-4967': Permission denied
/usr/bin/find: `/tmp/systemd-private-4cace0e2fe1f446fa8b636ad8d409fb6-systemd-timesyncd.service-XbmQ2B': Permission denied
/usr/bin/find: `/tmp/pymp-_FSHCo': Permission denied
/usr/bin/find: `/tmp/pymp-UXcTWc': Permission denied

Event Timeline

Volans created this task.May 31 2019, 12:25 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 31 2019, 12:25 PM
Volans triaged this task as High priority.May 31 2019, 12:25 PM
ayounsi removed a subscriber: ayounsi.May 31 2019, 1:50 PM
ArielGlenn closed this task as Resolved.Jun 10 2019, 7:05 AM
ArielGlenn claimed this task.
ArielGlenn added a subscriber: ArielGlenn.

The cronjob producing these has been removed maually on June 3 and will not reappear since the role was removed earlier from the host. I don't see any cronspam since then, so closing.