[gentoo-hardened] vixie-cron not working at all

[Jan Dušek]

Hi, is there a reason why shouldn't vixie-cron work at all on my SELinux?

Here is what happens:

(I'm in permissive mode.)
$ crontab /etc/crontab
$ crontab -e

this is what I got:
# for vixie cron
# remember to give cron a sighup when updating this file
#
# $Header: /home/cvsroot/gentoo-x86/sys-apps/vixie-cron/files/crontab,v 
1.3 2003
#

# Global variables
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# just test
* * * * *       echo "1" > /tmp/test.txt

# check scripts in cron.hourly, cron.daily, cron.weekly and cron.monthly
*/15 * * * *    test -x /usr/sbin/run-crons && /usr/sbin/run-crons
0  *  * * *     rm -f /var/spool/cron/lastrun/cron.hourly
0  3  * * *     rm -f /var/spool/cron/lastrun/cron.daily
15 4  * * 6     rm -f /var/spool/cron/lastrun/cron.weekly
30 5  1 * *     rm -f /var/spool/cron/lastrun/cron.monthly

# EOF

$ killall -HUP cron
(or even)
$ /etc/init.d/vixie-cron restart

This works on my non-SELinux systems but on the SELinux system nothing 
happens. The cron jobs just aren't executed (tested on the /tmp/test.txt 
file).

The only error I get regarging this is the well known urandom thing:

avc:  denied  { read } for  pid=4385 exe=/usr/bin/crontab name=urandom 
dev=08:03 ino=325496 scontext=root:sysadm_r:sysadm_crontab_t 
tcontext=system_u:object_r:random_device_t tclass=chr_file


Btw this all happens when in permissive mode so it shouldn't be 
SELinux's fault, but it works on all my non-SELinux gentoo systems so I 
though there may be some relation...


Any ideas?

--jd

--
gentoo-hardened@g.o mailing list