dev-sec / puppet-os-hardening

This puppet module provides numerous security-related configurations, providing all-round base protection.
http://dev-sec.io/
Apache License 2.0
282 stars 101 forks source link

[PATCH] manage_cron_permissions : users in /etc/cron.allow should have their own crontab #322

Open rmdir opened 2 months ago

rmdir commented 2 months ago

Describe the bug

/etc/cron.allow needs to be readable to use a crontab. manage_cron_permissions enforce it to "og-rwx".

Expected behavior

A user added to /etc/cron.allow should be able to use cron

Actual behavior

# ls -l  /etc/cron.allow 
-rw------- 1 root root 7 23 août  12:53 /etc/cron.allow
# cat /etc/cron.allow 
joris
# su - joris -c "/usr/bin/crontab -l"
/etc/cron.allow: Permission denied
You (joris) are not allowed to use this program (crontab)
See crontab(1) for more information

Tested on debian 11 and 12

Solutions

0001-Normalization-of-cron-files-decaration.txt