Owl: crontab / crond


What privileges does crontab(1) require?

Ability to insert jobs into crond(8) spool

The least privilege principle in the flesh

owl!root:/var/spool/cron# ls -ld . joe
drwx-wx--T	root	crontab	 1024 Nov  5 14:10 .
-rw-------	joe	crontab	  493 Apr  3  2001 joe

owl!root:/usr/bin# ls -l crontab
-rwx--s--x	root	crontab	21116 Nov  5 14:10 crontab

crond(8) must not blindly trust its spool directory (and ours doesn't)