On Sat, 13 Sep 2003, Steven M. Bellovin wrote:

> >Has there been any discussion on getting rid of setuid root and just using
> >setgid of cron-specific group? (And making the cron tabs directory
> >writable by that group.)

> That's a distinction without a difference, since a subverted crontab
> could rewrite root's file, which would be executed as root by crond.

Can crontab be made smarter to only edit root's crontab if the user is
root and root's cron tab (or any other crontab of a uid 0) could be forced
to be saved outside of the standard tab directory.

And the cron daemon could check to never use a cron tab for a user which
has a uid of 0 from within the tabs directory and also will use the root's
tab which is a different location?



   Jeremy C. Reed
   http://www.reedmedia.net/