Centos – /etc/crontab permissions

centoscronlinuxpermissions

The /etc/crontab file has the permissions:

-rw-r--r--

I understand that this file is for system cron jobs and other users should not have permission to modify it. The current permissions allows all users read access to the file, enabling them to view the contents.

Is it necessary for all users to be able read /etc/crontab? I believe that all users should not know some administrative commands, so wouldn't it be better to change the permissions to -rw-r-----?

I used the permission string from CentOS and have not tested it on other distros.

Best Answer

This would be security by obscurity. There is no real benefit by preventing normal users from reading /etc/crontab. Even if a user can't read the file, it's still possible to gather the executed command just by regularly capturing the process list with ps or by reading /proc.

There should be no need at all to hide some administrative commands except when you put credentials in the command-line. But you should never put credentials in the command line anyway as a normal user can read the command-line, so no real benefit.

There is a mount option/kernel patch for procfs preventing PID leakage as well as some kernel modules like grsec which prevent PID leaks.

The benefit of having the file system readable is that you can have a look/debug the system as a non root user. You don't have to switch to the root user just to check the system crontabs.

Related Question