看板FB_security
标 题Re: [PATCH] Tighten /etc/crontab permissions
发信站NCTU CSIE FreeBSD Server (Wed Aug 11 02:08:41 2004)
转信站ptt!FreeBSD.csie.NCTU!not-for-mail
--BOKacYhQ+x31HxR3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi, Doug
On Tue, Aug 10, 2004 at 10:02:09AM -0700, Doug Barton wrote:
>=20
> On Wed, 11 Aug 2004, Xin LI wrote:
>=20
> >Hi folks,
> >
> >While investigating OpenBSD's cron implementation, I found that they set
> >the systemwide crontab (a.k.a. /etc/crontab) to be readable by the
> >superuser only. The attached patch will bring this to FreeBSD by moving
> >crontab out from BIN1 group and install it along with master.passwd.
>=20
> Do you have a reason for wanting to do this other than, "OpenBSD does it=
=20
> this way?" I personally see no problems, and some benefit for users=20
> being able to see the system crontab. If the superuser needs to run=20
> "secret" cron jobs, then there is root's crontab that can be used for=20
> this purpose.
>=20
> Can you elaborate on your thinking?
Well... This seems much more than "OpenBSD does it" to me :-)
On a system that all users plays good, it does not matter if other users
can see the crontab. However, if it gets compromised, chances that a
badly configured system, say, with some permissions badly granted, would
give the intruder a better chance to get more privilege if [s]he can read
the crontab, and I think this is one of the reasons why the per-user cronta=
bs
are kept in /var/cron and without granting users to see each others'.
I'm not sure if this is a sort of abusing systemwide crontabs, but the
administrators at my company have used them to run some tasks periodly
under other identities (to limit these tasks' privilege), and it provided
a somewhat "centralized" management so they would prefer to use systemwide
crontab rather than per-user ones.
What do you think about the benefit for users being able to see the system
crontab? I think knowing what would be executed under others' identity
is (at least) not always a good thing, especially the users we generally
don't fully trust...
Cheers,
--=20
Xin LI <delphij frontfree net>
http://www.delphij.net/
See complete headers for GPG key and other information.
--BOKacYhQ+x31HxR3
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (FreeBSD)
iD8DBQFBGQ+fOfuToMruuMARAtmyAJ4r2KexkN1yT//vP6rt1gcS4Q87FwCeMcI5
SABDh7+mgJn1GjKTBWLpz1g=
=FQRX
-----END PGP SIGNATURE-----
--BOKacYhQ+x31HxR3--