Home / server / Questions / 506054
Accepted
Mojah
Asked: 2013-05-09 07:27:17 +0800 CST

Read-only cronjobs for users

  • 772

Here's a weird issue. I want to make crontab for a user that is read-only for that particular user and can only be managed via root. Sounds easy? Here's the catch:

$ ls -alh /var/spool/cron/my_user
-r-------- 1 root root 386 May  8 15:13 /var/spool/cron/my_user

So, the file is owned/grouped for root and only has read privileges (0400) for root.

The catch:

$ su - my_user
my_user~$ crontab -e
(write something to the crontab)
crontab: installing new crontab
$ ls -alh /var/spool/cron/my_user
-rw------- 1 my_user my_user 386 May  8 15:13 /var/spool/cron/my_user

So a file owned by root, with read-only privileges by root, could be read by a non-privileged user and was then modified to a 0600 (rw) and owned for that user?

What obvious catch am I missing?

permissions

4 Answers

  1. Best Answer

    crontab is setuid. So users can update their crontab.

    What version of cron are you running. If you are running a version that supports putting fragements in /etc/cron.d then you should do that.

    • 4

  2. Use the system /etc/crontab file instead of a user contab.

    • 3

  3. You could make /var/spool/cron/my_user immutable after you install the modifications you desire to prevent changes.

    sudo chattr +i /var/spool/cron/my_user

    • 1

  4. You can add the user to /etc/cron.deny. This will deny the user access to the command crontab and she cannot edit her crontab anymore.

    AFAICT an entry in /etc/cron.deny does not disable the defined cronjobs.

    • 1