RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2059477 - cronie upgrade or reinstallation recreates the /etc/cron.deny file
Summary: cronie upgrade or reinstallation recreates the /etc/cron.deny file
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: cronie
Version: 8.5
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Jan Staněk
QA Contact: Jan Houska
URL:
Whiteboard:
Depends On:
Blocks: 2105962
TreeView+ depends on / blocked
 
Reported: 2022-03-01 07:01 UTC by Renaud Métrich
Modified: 2023-04-25 13:37 UTC (History)
2 users (show)

Fixed In Version: cronie-1.5.2-8.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2105962 (view as bug list)
Environment:
Last Closed: 2022-11-08 10:48:38 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-114090 0 None None None 2022-03-01 07:11:35 UTC
Red Hat Product Errata RHBA-2022:7721 0 None None None 2022-11-08 10:48:42 UTC

Description Renaud Métrich 2022-03-01 07:01:30 UTC 
Description of problem:

When reinstalling or upgrading cronie package, the /etc/cron.deny file is re-created automatically (to an empty file).
This is an issue when hardening the system for CIS because the CIS rule requires that /etc/cron.deny be removed.

See below extracted from scap-security-guide sources linux_os/guide/services/cron_and_at/restrict_at_cron_users/group.yml:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
title: 'Restrict at and cron to Authorized Users if Necessary'

description: |-
    The <tt>/etc/cron.allow</tt> and <tt>/etc/at.allow</tt> files contain lists of
    users who are allowed to use <tt>cron</tt> and at to delay execution of
    processes. If these files exist and if the corresponding files
    <tt>/etc/cron.deny</tt> and <tt>/etc/at.deny</tt> do not exist, then only users
    listed in the relevant allow files can run the crontab and <tt>at</tt> commands
    to submit jobs to be run at scheduled intervals. On many systems, only the 
    system administrator needs the ability to schedule jobs. Note that even if a
    given user is not listed in <tt>cron.allow</tt>, cron jobs can still be run as
    that user. The <tt>cron.allow</tt> file controls only administrative access
    to the crontab command for scheduling and modifying cron jobs.
    <br />
    <br />
    To restrict <tt>at</tt> and <tt>cron</tt> to only authorized users:
    <ul>
    <li>Remove the <tt>cron.deny</tt> file:<pre>$ sudo rm /etc/cron.deny</pre></li>
    <li>Edit <tt>/etc/cron.allow</tt>, adding one line for each user allowed to use 
    the crontab command to create cron jobs.</li>
    <li>Remove the <tt>at.deny</tt> file:<pre>$ sudo rm /etc/at.deny</pre></li>
    <li>Edit <tt>/etc/at.allow</tt>, adding one line for each user allowed to use 
    the at command to create at jobs.</li>
    </ul>
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

All cronie releases

How reproducible:

Always

Steps to Reproduce:
1. Delete /etc/cron.deny
2. Reinstall the package

Actual results:

Empty file /etc/cron.deny re-created

Expected results:

No file created
Comment 1 Jan Staněk 2022-06-28 13:57:10 UTC 
This seems to be easy to fix – adding 'missingok' to the config directive for the `cron.deny` file seems to do the trick.

Renaurd, are you able to test this using Fedora? I will fix it there first and let you know about it if that is OK to you.
Comment 2 Renaud Métrich 2022-06-28 14:24:54 UTC 
Yes I can confirm on Fedora.
Comment 3 Jan Staněk 2022-07-01 10:52:02 UTC 
I have opened a PR with the proposed fix for Fedora: https://src.fedoraproject.org/rpms/cronie/pull-request/8

However, as that might take some time to process, I've also created a COPR and build the package with the fix included: https://copr.fedorainfracloud.org/coprs/jstanek/cronie-testing/ (packages for F36: https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/).
Let me know if they work for you, Renaud.
Comment 4 Renaud Métrich 2022-07-02 08:08:59 UTC 
Hi Jan,

I can confirm the new version works fine, see transcript below.

### Reinstalling normal `cronie` (FAIL, `/etc/cron.deny` is re-created)

[root@vm-fedora36 ~]# yum -y install cronie
Last metadata expiration check: 0:10:21 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
Dependencies resolved.
======================================================================================================================
 Package                      Architecture         Version                                Repository             Size
======================================================================================================================
Installing:
 cronie                       x86_64               1.5.7-4.fc36                           fedora                115 k
Installing dependencies:
 cronie-anacron               x86_64               1.5.7-4.fc36                           fedora                 32 k
 crontabs                     noarch               1.11-27.20190603git.fc36               updates                18 k

Transaction Summary
======================================================================================================================
Install  3 Packages

Total download size: 165 k
Installed size: 363 k
Downloading Packages:
(1/3): crontabs-1.11-27.20190603git.fc36.noarch.rpm                                   154 kB/s |  18 kB     00:00    
(2/3): cronie-1.5.7-4.fc36.x86_64.rpm                                                 461 kB/s | 115 kB     00:00    
(3/3): cronie-anacron-1.5.7-4.fc36.x86_64.rpm                                         123 kB/s |  32 kB     00:00    
----------------------------------------------------------------------------------------------------------------------
Total                                                                                 151 kB/s | 165 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Installing       : cronie-anacron-1.5.7-4.fc36.x86_64                                                           1/3 
  Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64                                                           1/3 
  Installing       : cronie-1.5.7-4.fc36.x86_64                                                                   2/3 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/3 
Created symlink /etc/systemd/system/multi-user.target.wants/crond.service → /usr/lib/systemd/system/crond.service.

  Installing       : crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 
  Running scriptlet: crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   1/3 
  Verifying        : cronie-anacron-1.5.7-4.fc36.x86_64                                                           2/3 
  Verifying        : crontabs-1.11-27.20190603git.fc36.noarch                                                     3/3 

Installed:
  cronie-1.5.7-4.fc36.x86_64     cronie-anacron-1.5.7-4.fc36.x86_64     crontabs-1.11-27.20190603git.fc36.noarch    

Complete!
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ cron.deny   
[root@vm-fedora36 ~]# ls /etc/cron.deny 
/etc/cron.deny
[root@vm-fedora36 ~]# rm !$
rm /etc/cron.deny
rm: remove regular empty file '/etc/cron.deny'? y
[root@vm-fedora36 ~]# yum reinstall cronie
Last metadata expiration check: 0:10:34 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
Dependencies resolved.
======================================================================================================================
 Package                   Architecture              Version                          Repository                 Size
======================================================================================================================
Reinstalling:
 cronie                    x86_64                    1.5.7-4.fc36                     fedora                    115 k

Transaction Summary
======================================================================================================================

Total download size: 115 k
Installed size: 296 k
Is this ok [y/N]: y
Downloading Packages:
cronie-1.5.7-4.fc36.x86_64.rpm                                                        545 kB/s | 115 kB     00:00    
----------------------------------------------------------------------------------------------------------------------
Total                                                                                 152 kB/s | 115 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Reinstalling     : cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Cleanup          : cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   2/2 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   1/2 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   2/2 

Reinstalled:
  cronie-1.5.7-4.fc36.x86_64                                                                                          

Complete!
[root@vm-fedora36 ~]# rm /etc/cron.deny
rm: remove regular empty file '/etc/cron.deny'? y



### Updating and reinstalling new `cronie` (PASS, no `/etc/cron.deny` created)

[root@vm-fedora36 ~]# yum update https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-anacron-1.6.1-2.fc36.x86_64.rpm
Last metadata expiration check: 0:12:42 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
cronie-1.6.1-2.fc36.x86_64.rpm                                                        213 kB/s | 116 kB     00:00    
cronie-anacron-1.6.1-2.fc36.x86_64.rpm                                                108 kB/s |  32 kB     00:00    
Dependencies resolved.
======================================================================================================================
 Package                       Architecture          Version                        Repository                   Size
======================================================================================================================
Upgrading:
 cronie                        x86_64                1.6.1-2.fc36                   @commandline                116 k
 cronie-anacron                x86_64                1.6.1-2.fc36                   @commandline                 32 k

Transaction Summary
======================================================================================================================
Upgrade  2 Packages

Total size: 149 k
Is this ok [y/N]: y
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Upgrading        : cronie-anacron-1.6.1-2.fc36.x86_64                                                           1/4 
  Running scriptlet: cronie-anacron-1.6.1-2.fc36.x86_64                                                           1/4 
  Upgrading        : cronie-1.6.1-2.fc36.x86_64                                                                   2/4 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/4 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Cleanup          : cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Running scriptlet: cronie-1.5.7-4.fc36.x86_64                                                                   3/4 
  Cleanup          : cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 
  Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   1/4 
  Verifying        : cronie-1.5.7-4.fc36.x86_64                                                                   2/4 
  Verifying        : cronie-anacron-1.6.1-2.fc36.x86_64                                                           3/4 
  Verifying        : cronie-anacron-1.5.7-4.fc36.x86_64                                                           4/4 

Upgraded:
  cronie-1.6.1-2.fc36.x86_64                            cronie-anacron-1.6.1-2.fc36.x86_64                           

Complete!
[root@vm-fedora36 ~]# ls /etc/cr
cron.d/          cron.hourly/     crontab          crypto-policies/ 
cron.daily/      cron.monthly/    cron.weekly/     crypttab         
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ 
[root@vm-fedora36 ~]# ls /etc/cron.d
cron.d/     cron.daily/ 
[root@vm-fedora36 ~]# ls /etc/cron.d^C
[root@vm-fedora36 ~]# yum reinstall https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm
Last metadata expiration check: 0:13:03 ago on Sat 02 Jul 2022 09:53:05 AM CEST.
cronie-1.6.1-2.fc36.x86_64.rpm                                                        820 kB/s | 116 kB     00:00    
Dependencies resolved.
======================================================================================================================
 Package                 Architecture            Version                          Repository                     Size
======================================================================================================================
Reinstalling:
 cronie                  x86_64                  1.6.1-2.fc36                     @commandline                  116 k

Transaction Summary
======================================================================================================================

Total size: 116 k
Installed size: 301 k
Is this ok [y/N]: y
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                              1/1 
  Reinstalling     : cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Cleanup          : cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Running scriptlet: cronie-1.6.1-2.fc36.x86_64                                                                   2/2 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   1/2 
  Verifying        : cronie-1.6.1-2.fc36.x86_64                                                                   2/2 

Reinstalled:
  cronie-1.6.1-2.fc36.x86_64                                                                                          

Complete!
[root@vm-fedora36 ~]# ls -l /etc/cron.deny
ls: cannot access '/etc/cron.deny': No such file or directory
Comment 5 Jan Staněk 2022-07-11 09:04:30 UTC 
Great! This change should now be included in Fedora proper, and I'm starting to work on backporting it to RHEL 8 and 9.
Comment 14 errata-xmlrpc 2022-11-08 10:48:38 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (cronie bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7721
Note You need to log in before you can comment on or make changes to this bug.