Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have noticed on my debian machine that the crontab user does not have read permissions on the /var/spool/cron/crontabs directory.

drwx-wx--T 2 root crontab 4096 Jun 20 21:34 crontabs

Further more the actual crontab files only have read/write permissions from the user that they belong to.

I have two questions.

  1. Is there any reason that a user crontab would not have read access to the crontabs directory?
  2. Is it a bad idea to give this user read access to the individual crontab files?

The reason for my questions is I have a few developers who need access to edit each crontab. Ideally I would like to have them all in svn or similar so that we can review the changes before putting them live and then some form of deploy script. The svn and deploy is no issue but I was looking for a common user that could edit all crontabs without being root.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The only reason is security. This is a quite popular use case for SGID bit.

There is a group 'crontab' over there. This group is empty so there are no members. Group 'crontab' has a very special purpose. Crontab binary owned by 'crontab' group and has a SGID (Set Group ID) bit

# ls -l /usr/bin/crontab
-rwxr-sr-x 1 root crontab 34784 Jun 14  2012 /usr/bin/crontab

So the file whose SGID bit are set (crontab command) would be used as if they belong to that group rather than to that user alone. And as far as file is created within directory with SGID (crontab user's file) it inherits its group as well.

1) user can edit or read his crontab file within crontab command only

2) user has not permissions to read either list files in /var/spool/cron/crontabs

share|improve this answer
    
thank you for your reply, I have updated the question to provide a bit more insight into why I have asked the question. –  David Manners Jun 24 '13 at 12:19
    
It seems like a bad idea. If I understand you correctly you are looking for an approach to deploying a developer's cron jobs into production server aren't you ? –  hostmaster Jun 24 '13 at 14:48
    
yes, the idea was to allow anyone to edit the cron jobs, but only allow a set number of people to review/deploy –  David Manners Jun 24 '13 at 15:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.