Crontab group permissions

Question

I have noticed on my debian machine that the crontab user does not have read permissions on the /var/spool/cron/crontabs directory.

drwx-wx--T 2 root crontab 4096 Jun 20 21:34 crontabs

Further more the actual crontab files only have read/write permissions from the user that they belong to.

I have two questions.

1. Is there any reason that a user crontab would not have read access to the crontabs directory?
2. Is it a bad idea to give this user read access to the individual crontab files?

The reason for my questions is I have a few developers who need access to edit each crontab. Ideally I would like to have them all in svn or similar so that we can review the changes before putting them live and then some form of deploy script. The svn and deploy is no issue but I was looking for a common user that could edit all crontabs without being root.

Answer 1

The only reason is security. This is a quite popular use case for SGID bit.

There is a group 'crontab' over there. This group is empty so there are no members. Group 'crontab' has a very special purpose. Crontab binary owned by 'crontab' group and has a SGID (Set Group ID) bit

# ls -l /usr/bin/crontab
-rwxr-sr-x 1 root crontab 34784 Jun 14  2012 /usr/bin/crontab

So the file whose SGID bit are set (crontab command) would be used as if they belong to that group rather than to that user alone. And as far as file is created within directory with SGID (crontab user's file) it inherits its group as well.

1) user can edit or read his crontab file within crontab command only

2) user has not permissions to read either list files in /var/spool/cron/crontabs