Here's a weird issue. I want to make crontab for a user that is read-only for that particular user and can only be managed via root. Sounds easy? Here's the catch:
$ ls -alh /var/spool/cron/my_user -r-------- 1 root root 386 May 8 15:13 /var/spool/cron/my_user
So, the file is owned/grouped for root and only has read privileges (0400) for root.
$ su - my_user my_user~$ crontab -e (write something to the crontab) crontab: installing new crontab $ ls -alh /var/spool/cron/my_user -rw------- 1 my_user my_user 386 May 8 15:13 /var/spool/cron/my_user
So a file owned by root, with read-only privileges by root, could be read by a non-privileged user and was then modified to a 0600 (rw) and owned for that user?
What obvious catch am I missing?