Re: setgid crontab
Sorry, just read this on Debian Weekly News so am a bit late to the
thread.
Looking at those new permissions, I think it would improve them if you
also set the sticky bit on the directory containing the crontabs.
Supposing someone hacks the cron group, they may not be able to edit
another user's (or root's) crontab but they could remove them. Regardless
of the sticky bit, they could even create a new one though the ownership
of it would probably be wrong (unless chown is unrestricted[1], in which
case it is then easy).
I haven't tested it but what if a symlink to a script that happens to
have the right ownership is created? If there was an easy way to escalate
group cron to root, we'd be better off without the change.
Oliver Kiddle
[1] is unrestricted chown a kernel option in Linux? I've seen it on
IRIX.
Reply to: