With default installation of cronie 1.52 (have not tested other versions), all users are allowed to create crontabs. According to the wiki page https://wiki.gentoo.org/wiki/Cron#Giving_trusted_users_access_to_cron and from what the files in cronie seem to indicate, only users in the cron group should be able to create/edit crontabs. Reproducible: Always Steps to Reproduce: 1. useradd -m test 2. su - test 3. crontab -e Actual Results: Opens crontab for editing and allows saving. Expected Results: You (test) are not allowed to use this program (crontab) See crontab(1) for more information [ebuild R ] sys-process/cronie-1.5.2::gentoo USE="anacron inotify pam (-selinux)" 0 KiB
group membership is not used for cronie. but it does create crontab group (not cron) for other purposes. wiki describes other cron implementation. from man crontab: If the /etc/cron.allow file exists, a user must be listed in it to be allowed to use cron. If the cron.allow file does not exist but the cron.deny file does exist, then a user must not be listed in the cron.deny file in order to use cron. If neither of these files exists, only the super user is allowed to use cron. gentoo ships /etc/cron.deny by default (via sys-process/cronie)
Ahh, thank you. I was going off of the line "No matter which cron package has been chosen, to allow a user to use crontab he will first have to be in the cron group". I'll look into updating that wiki page.
Oh, my apologies. It seems my /var/spool/cron had incorrect permissions, so the cron group is indeed required. Looks as though cronbase sets this up. Sorry for taking up your time.
no problem, I also learned something wile digging it =) thanks for reporting bugs, it helps.
