Bugzilla Bug 182998

OK, this is how it *should* look like per sys-process/cronbase ebuild:

drwxr-x--- 2 root root 216 2007-06-13 17:11 /etc/cron.daily
drwxr-x--- 2 root root  72 2006-03-08 22:05 /etc/cron.hourly
drwxr-x--- 2 root root 136 2007-06-22 22:51 /etc/cron.monthly
drwxr-x--- 2 root root  72 2007-01-06 13:01 /etc/cron.weekly
drwxr-x--- 4 root cron 120 2006-03-08 22:06 /var/spool/cron
drwxr-x--- 2 root root 200 2007-06-23 20:10 /var/spool/cron/lastrun

Except that portage does *not* change actual directory permissions if the
directory already exists (see Bug 141619). A quick poll on #gentoo-dev shows
that almost *noone* has the permissions right, most usually they are 0755
root:root, a couple of cases of /var/spool/cron owned by cron user, etc. etc.
Also see Bug 182983.

Suggested solution: revbump sys-process/cronbase and force chown/chmod in
pkg_postinst, which works around portage behaviour.

cron, what's the status here? please advise.

cronbase ebuild activity is rather low. I did the last revbump of vixie-cron
and i can take care of cronbase too. (then i should join the cron herd)

Just ping me again if noone of the cron herd wakes up.

(In reply to comment #2)
> cronbase ebuild activity is rather low. I did the last revbump of vixie-cron
> and i can take care of cronbase too. (then i should join the cron herd)
> 
> Just ping me again if noone of the cron herd wakes up.
> 

*ping* :)

Hi arches,

cronbase-0.3.2-r1 commited to the tree.

After having emerged it, your system should be as described in comment #0.

Please test, and mark stable if appropriate, thanks.

(In reply to comment #4)
> After having emerged it, your system should be as described in comment #0.

*Mainly* that's happened. The only difference is uid/gid bit:
drwxr-s--- 2 root cron 4096 wrz 27 00:58 /var/spool/cron/lastrun

Sparc done.  It sets ownership/permissions the way bug says it's supposed to.

mips stable.

Stable for HPPA.

x86 stable

alpha/ia64 stable

ppc64 stable

Marked stable on amd64.

ppc stable

If this stays at A4, it needs a vote.

Hmm, this is local, minor impact, so I vote NO.

only information disclosure. No big impact. No and closing. Feel free to reopen
if you disagree