Gentoo: order of installed packages may result in vary directories permissions, leading to crontab not requiring cron group membership as example.

[KARBOWSKI Piotr <piotr.karbowski () gmail com>]

Hi,

The packages in Gentoo often utilizes Portage's functions like keepdir 
to create a directories, with specified permissions. One of the examples 
is 'cronbase', which the only purpose is to setup 
/etc/cron.{hourly,daily,weekly,monthly} and /var/spool/cron.

The /var/spool/cron is meant to have root:cron 750, which makes the 
crontab usable only for the users that are members of cron group.

As for the /etc/cron.{hourly,daily,weekly,monthly} they're meant to be 
root:root 750.

If, for instance, a mlocate package will be installed before cronbase, 
due to installing /etc/cron.daily/mlocate, the /etc/cron.daily will end 
up with 755 permissions. After than when crontab package is installed, 
due to usage of portage's keepdir function, the directory in temporary 
directory will be installed as root:cron 750, but during the merge 
process to rootfs no directory permissions will be merged, leaving the 
/etc/cron.daily as 755.

On one system after installing set of packages, the /var/spool/cron 
ended up being cron:root 755, which results in possibility for any local 
user to actually create the crontabs (including system users like nginx, 
mysql, and so on).

The way a (directory) ownership and permissions are handled in Gentoo 
seems to be flawed, it's not clear to me whatever Portage should 
provided a soluton to that, or the ebuilds authors should make sure to 
always depends, in case of touching cronbase directories, on the 
cronbase package, to ensure that it's installed prior to installing 
them. Nonetheless I do believe this issue is worth CVE.

-- Piotr.