6

I'm using the /etc/cron.d/ folder to store my cron tasks. These tasks are symlinks to my actual file which is kept under VCS. These files are owner by a user named "www-data". I've read that Cron will not run tasks that are under a different owner. (http://klenwell.com/press/2010/11/cron-d/) So how can I make Cron run the cron tabs under a different owner from root? I don't want to change the owner to root, as all these files in this folder is owner by "www-data".

3 Answers 3

5

Instead of symlinking the files to /etc/cron.d you could put small scripts in /etc/cron.d which call the script you actually want to run.

Something like:

#!/bin/bash

/srv/www/pathtoactualfile
1
  • This is a smart solution! Nov 1, 2014 at 11:02
3

You either change the ownership to root or you use the crontab command to load a file in that particular user's crontab.

The cron files in /etc/cron.d are a little different than a user's crontab such that you can specify what user a job runs as. Should cron not verify that the file containing this owned by root a user without root privileges could easily grant themselves root privileges.

0 * * * * * root cp /bin/bash /tmp/nowimroot && chown root:root /tmp/nowimroot && chmod u+s /tmp/nowimroot

3
  • 1
    Sorry can you make your answer clearer, I don't understand the second paragraph and the snippet. Jan 11, 2014 at 18:06
  • It basically shows a simple example of how someone can hack root on your system (provided they can access the account that owns the file) if it were to actually allow you to symlink the file owned by another user. It requires the file be owned by root because not doing so could open up a huge security hole.
    – user143703
    Jan 14, 2014 at 19:54
  • So basically you're saying that it's not possible to have a file owned by another user. At any case I ended up just copying the file over to the /etc/cron.d rather than symlinking. This ended up working. Jan 15, 2014 at 7:51
0

Create a crontab for the user that you want to run the script. crontab -u www-data -e will edit the crontab for the www-data user. Just put your full command in there

1
  • I'm currently using /etc/cron.d/ however as it's more modular. Jan 10, 2014 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .