oss-sec mailing list archives

Re: Vixie/ISC Cron group crontab to root escalation


From: Ian Zimmerman <itz () primate net>
Date: Thu, 8 Jun 2017 15:44:41 -0700

On 2017-06-08 20:05, Solar Designer wrote:

Gentoo has a wiki page describing their Vixie Cron here:

https://wiki.gentoo.org/wiki/Cron#vixie-cron

Per their description, it's based on 4.1 and has some Linux specifics
added (SELinux, PAM, etc.)  I don't know whether they use group
crontab.

Yes:

~$ ls -l /usr/bin/crontab
-rwxr-sr-x 1 root crontab 44336 Oct 12  2016 /usr/bin/crontab

-- 
Please *no* private Cc: on mailing lists and newsgroups
Personal signed mail: please _encrypt_ and sign
Don't clear-text sign:
http://primate.net/~itz/blog/the-problem-with-gpg-signatures.html


Current thread: