Contents
What is the context of cron in SELinux?
Cron is SELinux aware. Cron runs tasks on behalf of either the system or on behalf of users (using pam_selinux). These tasks generally get run with permissions different than the permissions associated with the context of crond itself.
How to check the context associated with crontab?
You need to make sure that the context associated with /etc/crontab is valid and that it can be used as an entrypoint to the context you want crond to run the task with. If you want an example then look at the cron policy and cron context configuration files enclosed with reference policy.
What does MLS mean in SELinux for cron jobs?
The MLS_LEVEL environment variable provides support for multiple per-job SELinux security contexts in the same crontab. By default, cron jobs execute with the default SELinux security context of the user that created the crontab file.
When to run the crontab command in Linux?
If both fields are restricted (i.e., do not contain the “*” character), the command will be run when either field matches the current time. For example, “30 4 1,15 * 5” would cause a command to be run at 4:30 am on the 1st and 15th of each month, plus every Friday. A crontab file syntax can be tested before an install using the -T option.
What can you do with a cron system?
Cron is usually used to automate system administration tasks. But for the individual user, you can use Cron to automate tasks like downloading emails, running malware scanners and checking websites for updates. Today, let’s dive into how to use Cron and the security risks of a misconfigured Cron system.
Are there any security holes in using Cron?
Another common security hole is vulnerabilities in the scripts themselves. If a script behaves in an insecure manner and you run it as root using Cron, then that could introduce vulnerabilities too. For example, let’s say that the system-wide crontab runs a script that contains a wildcard injection vulnerability.