Bug 2059477
| Summary: | cronie upgrade or reinstallation recreates the /etc/cron.deny file | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Renaud Métrich <rmetrich> | |
| Component: | cronie | Assignee: | Jan Staněk <jstanek> | |
| Status: | CLOSED ERRATA | QA Contact: | Jan Houska <jhouska> | |
| Severity: | low | Docs Contact: | ||
| Priority: | low | |||
| Version: | 8.5 | CC: | jhouska, opohorel | |
| Target Milestone: | rc | Keywords: | Triaged | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | cronie-1.5.2-8.el8 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2105962 (view as bug list) | Environment: | ||
| Last Closed: | 2022-11-08 10:48:38 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2105962 | |||
This seems to be easy to fix – adding 'missingok' to the config directive for the `cron.deny` file seems to do the trick. Renaurd, are you able to test this using Fedora? I will fix it there first and let you know about it if that is OK to you. Yes I can confirm on Fedora. I have opened a PR with the proposed fix for Fedora: https://src.fedoraproject.org/rpms/cronie/pull-request/8 However, as that might take some time to process, I've also created a COPR and build the package with the fix included: https://copr.fedorainfracloud.org/coprs/jstanek/cronie-testing/ (packages for F36: https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/). Let me know if they work for you, Renaud. Hi Jan, I can confirm the new version works fine, see transcript below. ### Reinstalling normal `cronie` (FAIL, `/etc/cron.deny` is re-created) [root@vm-fedora36 ~]# yum -y install cronie Last metadata expiration check: 0:10:21 ago on Sat 02 Jul 2022 09:53:05 AM CEST. Dependencies resolved. ====================================================================================================================== Package Architecture Version Repository Size ====================================================================================================================== Installing: cronie x86_64 1.5.7-4.fc36 fedora 115 k Installing dependencies: cronie-anacron x86_64 1.5.7-4.fc36 fedora 32 k crontabs noarch 1.11-27.20190603git.fc36 updates 18 k Transaction Summary ====================================================================================================================== Install 3 Packages Total download size: 165 k Installed size: 363 k Downloading Packages: (1/3): crontabs-1.11-27.20190603git.fc36.noarch.rpm 154 kB/s | 18 kB 00:00 (2/3): cronie-1.5.7-4.fc36.x86_64.rpm 461 kB/s | 115 kB 00:00 (3/3): cronie-anacron-1.5.7-4.fc36.x86_64.rpm 123 kB/s | 32 kB 00:00 ---------------------------------------------------------------------------------------------------------------------- Total 151 kB/s | 165 kB 00:01 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : cronie-anacron-1.5.7-4.fc36.x86_64 1/3 Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64 1/3 Installing : cronie-1.5.7-4.fc36.x86_64 2/3 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 2/3 Created symlink /etc/systemd/system/multi-user.target.wants/crond.service → /usr/lib/systemd/system/crond.service. Installing : crontabs-1.11-27.20190603git.fc36.noarch 3/3 Running scriptlet: crontabs-1.11-27.20190603git.fc36.noarch 3/3 Verifying : cronie-1.5.7-4.fc36.x86_64 1/3 Verifying : cronie-anacron-1.5.7-4.fc36.x86_64 2/3 Verifying : crontabs-1.11-27.20190603git.fc36.noarch 3/3 Installed: cronie-1.5.7-4.fc36.x86_64 cronie-anacron-1.5.7-4.fc36.x86_64 crontabs-1.11-27.20190603git.fc36.noarch Complete! [root@vm-fedora36 ~]# ls /etc/cron.d cron.d/ cron.daily/ cron.deny [root@vm-fedora36 ~]# ls /etc/cron.deny /etc/cron.deny [root@vm-fedora36 ~]# rm !$ rm /etc/cron.deny rm: remove regular empty file '/etc/cron.deny'? y [root@vm-fedora36 ~]# yum reinstall cronie Last metadata expiration check: 0:10:34 ago on Sat 02 Jul 2022 09:53:05 AM CEST. Dependencies resolved. ====================================================================================================================== Package Architecture Version Repository Size ====================================================================================================================== Reinstalling: cronie x86_64 1.5.7-4.fc36 fedora 115 k Transaction Summary ====================================================================================================================== Total download size: 115 k Installed size: 296 k Is this ok [y/N]: y Downloading Packages: cronie-1.5.7-4.fc36.x86_64.rpm 545 kB/s | 115 kB 00:00 ---------------------------------------------------------------------------------------------------------------------- Total 152 kB/s | 115 kB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Reinstalling : cronie-1.5.7-4.fc36.x86_64 1/2 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 1/2 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 2/2 Cleanup : cronie-1.5.7-4.fc36.x86_64 2/2 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 2/2 Verifying : cronie-1.5.7-4.fc36.x86_64 1/2 Verifying : cronie-1.5.7-4.fc36.x86_64 2/2 Reinstalled: cronie-1.5.7-4.fc36.x86_64 Complete! [root@vm-fedora36 ~]# rm /etc/cron.deny rm: remove regular empty file '/etc/cron.deny'? y ### Updating and reinstalling new `cronie` (PASS, no `/etc/cron.deny` created) [root@vm-fedora36 ~]# yum update https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-anacron-1.6.1-2.fc36.x86_64.rpm Last metadata expiration check: 0:12:42 ago on Sat 02 Jul 2022 09:53:05 AM CEST. cronie-1.6.1-2.fc36.x86_64.rpm 213 kB/s | 116 kB 00:00 cronie-anacron-1.6.1-2.fc36.x86_64.rpm 108 kB/s | 32 kB 00:00 Dependencies resolved. ====================================================================================================================== Package Architecture Version Repository Size ====================================================================================================================== Upgrading: cronie x86_64 1.6.1-2.fc36 @commandline 116 k cronie-anacron x86_64 1.6.1-2.fc36 @commandline 32 k Transaction Summary ====================================================================================================================== Upgrade 2 Packages Total size: 149 k Is this ok [y/N]: y Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Upgrading : cronie-anacron-1.6.1-2.fc36.x86_64 1/4 Running scriptlet: cronie-anacron-1.6.1-2.fc36.x86_64 1/4 Upgrading : cronie-1.6.1-2.fc36.x86_64 2/4 Running scriptlet: cronie-1.6.1-2.fc36.x86_64 2/4 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 3/4 Cleanup : cronie-1.5.7-4.fc36.x86_64 3/4 Running scriptlet: cronie-1.5.7-4.fc36.x86_64 3/4 Cleanup : cronie-anacron-1.5.7-4.fc36.x86_64 4/4 Running scriptlet: cronie-anacron-1.5.7-4.fc36.x86_64 4/4 Verifying : cronie-1.6.1-2.fc36.x86_64 1/4 Verifying : cronie-1.5.7-4.fc36.x86_64 2/4 Verifying : cronie-anacron-1.6.1-2.fc36.x86_64 3/4 Verifying : cronie-anacron-1.5.7-4.fc36.x86_64 4/4 Upgraded: cronie-1.6.1-2.fc36.x86_64 cronie-anacron-1.6.1-2.fc36.x86_64 Complete! [root@vm-fedora36 ~]# ls /etc/cr cron.d/ cron.hourly/ crontab crypto-policies/ cron.daily/ cron.monthly/ cron.weekly/ crypttab [root@vm-fedora36 ~]# ls /etc/cron.d cron.d/ cron.daily/ [root@vm-fedora36 ~]# ls /etc/cron.d cron.d/ cron.daily/ [root@vm-fedora36 ~]# ls /etc/cron.d^C [root@vm-fedora36 ~]# yum reinstall https://download.copr.fedorainfracloud.org/results/jstanek/cronie-testing/fedora-36-x86_64/04589764-cronie/cronie-1.6.1-2.fc36.x86_64.rpm Last metadata expiration check: 0:13:03 ago on Sat 02 Jul 2022 09:53:05 AM CEST. cronie-1.6.1-2.fc36.x86_64.rpm 820 kB/s | 116 kB 00:00 Dependencies resolved. ====================================================================================================================== Package Architecture Version Repository Size ====================================================================================================================== Reinstalling: cronie x86_64 1.6.1-2.fc36 @commandline 116 k Transaction Summary ====================================================================================================================== Total size: 116 k Installed size: 301 k Is this ok [y/N]: y Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Reinstalling : cronie-1.6.1-2.fc36.x86_64 1/2 Running scriptlet: cronie-1.6.1-2.fc36.x86_64 1/2 Running scriptlet: cronie-1.6.1-2.fc36.x86_64 2/2 Cleanup : cronie-1.6.1-2.fc36.x86_64 2/2 Running scriptlet: cronie-1.6.1-2.fc36.x86_64 2/2 Verifying : cronie-1.6.1-2.fc36.x86_64 1/2 Verifying : cronie-1.6.1-2.fc36.x86_64 2/2 Reinstalled: cronie-1.6.1-2.fc36.x86_64 Complete! [root@vm-fedora36 ~]# ls -l /etc/cron.deny ls: cannot access '/etc/cron.deny': No such file or directory Great! This change should now be included in Fedora proper, and I'm starting to work on backporting it to RHEL 8 and 9. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (cronie bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7721 |
Description of problem: When reinstalling or upgrading cronie package, the /etc/cron.deny file is re-created automatically (to an empty file). This is an issue when hardening the system for CIS because the CIS rule requires that /etc/cron.deny be removed. See below extracted from scap-security-guide sources linux_os/guide/services/cron_and_at/restrict_at_cron_users/group.yml: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- title: 'Restrict at and cron to Authorized Users if Necessary' description: |- The <tt>/etc/cron.allow</tt> and <tt>/etc/at.allow</tt> files contain lists of users who are allowed to use <tt>cron</tt> and at to delay execution of processes. If these files exist and if the corresponding files <tt>/etc/cron.deny</tt> and <tt>/etc/at.deny</tt> do not exist, then only users listed in the relevant allow files can run the crontab and <tt>at</tt> commands to submit jobs to be run at scheduled intervals. On many systems, only the system administrator needs the ability to schedule jobs. Note that even if a given user is not listed in <tt>cron.allow</tt>, cron jobs can still be run as that user. The <tt>cron.allow</tt> file controls only administrative access to the crontab command for scheduling and modifying cron jobs. <br /> <br /> To restrict <tt>at</tt> and <tt>cron</tt> to only authorized users: <ul> <li>Remove the <tt>cron.deny</tt> file:<pre>$ sudo rm /etc/cron.deny</pre></li> <li>Edit <tt>/etc/cron.allow</tt>, adding one line for each user allowed to use the crontab command to create cron jobs.</li> <li>Remove the <tt>at.deny</tt> file:<pre>$ sudo rm /etc/at.deny</pre></li> <li>Edit <tt>/etc/at.allow</tt>, adding one line for each user allowed to use the at command to create at jobs.</li> </ul> -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Version-Release number of selected component (if applicable): All cronie releases How reproducible: Always Steps to Reproduce: 1. Delete /etc/cron.deny 2. Reinstall the package Actual results: Empty file /etc/cron.deny re-created Expected results: No file created