Bug 2105962

Summary: cronie upgrade or reinstallation recreates the /etc/cron.deny file
Product: Red Hat Enterprise Linux 9 Reporter: Jan Staněk <jstanek>
Component: cronieAssignee: Jan Staněk <jstanek>
Status: CLOSED ERRATA QA Contact: Jan Houska <jhouska>
Severity: low Docs Contact:
Priority: low    
Version: CentOS StreamCC: bstinson, jhouska, jwboyer, opohorel, rhel-cs-apps-subsystem-qe, rmetrich
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: cronie-1.5.7-8.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2059477 Environment:
Last Closed: 2022-11-15 11:18:48 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2059477    
Bug Blocks:    

Description Jan Staněk 2022-07-11 10:59:53 UTC 
+++ This bug was initially created as a clone of Bug #2059477 +++

Description of problem:

When reinstalling or upgrading cronie package, the /etc/cron.deny file is re-created automatically (to an empty file).
This is an issue when hardening the system for CIS because the CIS rule requires that /etc/cron.deny be removed.

See below extracted from scap-security-guide sources linux_os/guide/services/cron_and_at/restrict_at_cron_users/group.yml:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
title: 'Restrict at and cron to Authorized Users if Necessary'

description: |-
    The <tt>/etc/cron.allow</tt> and <tt>/etc/at.allow</tt> files contain lists of
    users who are allowed to use <tt>cron</tt> and at to delay execution of
    processes. If these files exist and if the corresponding files
    <tt>/etc/cron.deny</tt> and <tt>/etc/at.deny</tt> do not exist, then only users
    listed in the relevant allow files can run the crontab and <tt>at</tt> commands
    to submit jobs to be run at scheduled intervals. On many systems, only the 
    system administrator needs the ability to schedule jobs. Note that even if a
    given user is not listed in <tt>cron.allow</tt>, cron jobs can still be run as
    that user. The <tt>cron.allow</tt> file controls only administrative access
    to the crontab command for scheduling and modifying cron jobs.
    <br />
    <br />
    To restrict <tt>at</tt> and <tt>cron</tt> to only authorized users:
    <ul>
    <li>Remove the <tt>cron.deny</tt> file:<pre>$ sudo rm /etc/cron.deny</pre></li>
    <li>Edit <tt>/etc/cron.allow</tt>, adding one line for each user allowed to use 
    the crontab command to create cron jobs.</li>
    <li>Remove the <tt>at.deny</tt> file:<pre>$ sudo rm /etc/at.deny</pre></li>
    <li>Edit <tt>/etc/at.allow</tt>, adding one line for each user allowed to use 
    the at command to create at jobs.</li>
    </ul>
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

All cronie releases

How reproducible:

Always

Steps to Reproduce:
1. Delete /etc/cron.deny
2. Reinstall the package

Actual results:

Empty file /etc/cron.deny re-created

Expected results:

No file created

--- Additional comment from Jan Staněk on 2022-06-28 13:57:10 UTC ---

This seems to be easy to fix – adding 'missingok' to the config directive for the `cron.deny` file seems to do the trick.

Renaurd, are you able to test this using Fedora? I will fix it there first and let you know about it if that is OK to you.

--- Additional comment from Renaud Métrich on 2022-06-28 14:24:54 UTC ---

Yes I can confirm on Fedora.

--- Additional comment from Jan Staněk on 2022-07-01 10:52:02 UTC ---

I have opened a PR with the proposed fix for Fedora: https://src.fedoraproject.org/rpms/cronie/pull-request/8

However, as that might take some time to process, I've also created a COPR and build the package with the fix included: https://copr.fedorainfracloud.org/coprs/jstanek/cronie-testing/ (packages for F36: https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/).
Let me know if they work for you, Renaud.

--- Additional comment from Renaud Métrich on 2022-07-02 08:08:59 UTC ---

Hi Jan,

I can confirm the new version works fine, see transcript below.

### Reinstalling normal `cronie` (FAIL, `/etc/cron.deny` is re-created)

[root@vm-fedora36 ~]# yum -y install cronie
Last metadata expiration check: 0:10:21 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
Dependencies resolved.
======================================================================================================================
 Package                      Architecture         Version                                Repository             Size
======================================================================================================================
Installing:
 cronie                       x86_64               1.5.7-4.fc36                           fedora                115 k
Installing dependencies:
 cronie-anacron               x86_64               1.5.7-4.fc36                           fedora                 32 k
 crontabs                     noarch               1.11-27.20190603git.fc36               updates                18 k

Transaction Summary
======================================================================================================================
Install  3 Packages

Total download size: 165 k
Installed size: 363 k
Downloading Packages:
(1/3): crontabs-1.11-27.20190603git.fc36.noarch.rpm                                   154 kB/s |  18 kB     00:00    
(2/3): cronie-1.5.7-4.fc36.x86_64.rpm                                                 461 kB/s | 115 kB     00:00    
(3/3): cronie-anacron-1.5.7-4.fc36.x86_64.rpm                                         123 kB/s |  32 kB     00:00    
----------------------------------------------------------------------------------------------------------------------
Total                                                                                 151 kB/s | 165 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Installing       : cronie-anacron-1.5.7-4.fc36.x86_64                                                           1/3 
  Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64                                                           1/3 
  Installing       : cronie-1.5.7-4.fc36.x86_64                                                                   2/3 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/3 
Created symlink /etc/systemd/system/multi-user.target.wants/crond.service → /usr/lib/systemd/system/crond.service.

  Installing       : crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 
  Running scriptlet: crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   1/3 
  Verifying        : cronie-anacron-1.5.7-4.fc36.x86_64                                                           2/3 
  Verifying        : crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 

Installed:
  cronie-1.5.7-4.fc36.x86_64     cronie-anacron-1.5.7-4.fc36.x86_64     crontabs-1.11-27.20190603git.fc36.noarch    

Complete!
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ cron.deny   
[root@vm-fedora36 ~]# ls /etc/cron.deny 
/etc/cron.deny
[root@vm-fedora36 ~]# rm !$
rm /etc/cron.deny
rm: remove regular empty file '/etc/cron.deny'? y
[root@vm-fedora36 ~]# yum reinstall cronie
Last metadata expiration check: 0:10:34 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
Dependencies resolved.
======================================================================================================================
 Package                   Architecture              Version                          Repository                 Size
======================================================================================================================
Reinstalling:
 cronie                    x86_64                    1.5.7-4.fc36                     fedora                    115 k

Transaction Summary
======================================================================================================================

Total download size: 115 k
Installed size: 296 k
Is this ok [y/N]: y
Downloading Packages:
cronie-1.5.7-4.fc36.x86_64.rpm                                                        545 kB/s | 115 kB     00:00    
----------------------------------------------------------------------------------------------------------------------
Total                                                                                 152 kB/s | 115 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Reinstalling     : cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Cleanup          : cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   2/2 

Reinstalled:
  cronie-1.5.7-4.fc36.x86_64                                                                                          

Complete!
[root@vm-fedora36 ~]# rm /etc/cron.deny
rm: remove regular empty file '/etc/cron.deny'? y



### Updating and reinstalling new `cronie` (PASS, no `/etc/cron.deny` created)

[root@vm-fedora36 ~]# yum update https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-anacron-1.6.1-2.fc36.x86_64.rpm
Last metadata expiration check: 0:12:42 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
cronie-1.6.1-2.fc36.x86_64.rpm                                                        213 kB/s | 116 kB     00:00    
cronie-anacron-1.6.1-2.fc36.x86_64.rpm                                                108 kB/s |  32 kB     00:00    
Dependencies resolved.
======================================================================================================================
 Package                       Architecture          Version                        Repository                   Size
======================================================================================================================
Upgrading:
 cronie                        x86_64                1.6.1-2.fc36                   @commandline                116 k
 cronie-anacron                x86_64                1.6.1-2.fc36                   @commandline                 32 k

Transaction Summary
======================================================================================================================
Upgrade  2 Packages

Total size: 149 k
Is this ok [y/N]: y
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Upgrading        : cronie-anacron-1.6.1-2.fc36.x86_64                                                           1/4 
  Running scriptlet: cronie-anacron-1.6.1-2.fc36.x86_64                                                           1/4 
  Upgrading        : cronie-1.6.1-2.fc36.x86_64                                                                   2/4 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/4 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Cleanup          : cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Cleanup          : cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 
  Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   1/4 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   2/4 
  Verifying        : cronie-anacron-1.6.1-2.fc36.x86_64                                                           3/4 
  Verifying        : cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 

Upgraded:
  cronie-1.6.1-2.fc36.x86_64                            cronie-anacron-1.6.1-2.fc36.x86_64                           

Complete!
[root@vm-fedora36 ~]# ls /etc/cr
cron.d/          cron.hourly/     crontab          crypto-policies/ 
cron.daily/      cron.monthly/    cron.weekly/     crypttab         
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ 
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ 
[root@vm-fedora36 ~]# ls /etc/cron.d^C
[root@vm-fedora36 ~]# yum reinstall https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm
Last metadata expiration check: 0:13:03 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
cronie-1.6.1-2.fc36.x86_64.rpm                                                        820 kB/s | 116 kB     00:00    
Dependencies resolved.
======================================================================================================================
 Package                 Architecture            Version                          Repository                     Size
======================================================================================================================
Reinstalling:
 cronie                  x86_64                  1.6.1-2.fc36                     @commandline                  116 k

Transaction Summary
======================================================================================================================

Total size: 116 k
Installed size: 301 k
Is this ok [y/N]: y
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Reinstalling     : cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Cleanup          : cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   2/2 

Reinstalled:
  cronie-1.6.1-2.fc36.x86_64                                                                                          

Complete!
[root@vm-fedora36 ~]# ls -l /etc/cron.deny
ls: cannot access '/etc/cron.deny': No such file or directory

--- Additional comment from Jan Staněk on 2022-07-11 09:04:30 UTC ---

Great! This change should now be included in Fedora proper, and I'm starting to work on backporting it to RHEL 8 and 9.
Comment 2 Jan Staněk 2022-07-11 12:00:24 UTC 
Merged into CentOS Stream: https://gitlab.com/redhat/centos-stream/rpms/cronie/-/merge_requests/7
Comment 8 errata-xmlrpc 2022-11-15 11:18:48 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (cronie bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8332