personal crontab not allowed due to wrong permissions on directory

[jbwells]

Qubes OS version (e.g., R3.1):

R3.2-rc2

Affected TemplateVMs (e.g., fedora-23, if applicable):

AppVM using debian-8 TemplateVM

---

Expected behavior:

"crontab FILE" should set the user's personal (non-root) crontab.

Actual behavior:

crontab fails with this error message:

/var/spool/cron: chdir: Permission denied

Steps to reproduce the behavior:

Run "crontab < /dev/null" while cron is active.

General notes:

The bug is the permissions used in this line in /lib/systemd/system/cron.service.d/30_qubes.conf:

ExecStartPre=/bin/mkdir --mode=0700 -p /rw/cron

That only allows root to have a crontab.

---

Related issues:

none.

[marmarek]

This differs between Fedora and Debian. On Fedora crontab tool is
set-uid root, so the current mode is ok. But on Debian, it is set-gid
crontab, so crontab group write is needed.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[marmarek]

This differs between Fedora and Debian. On Fedora crontab tool is
set-uid root, so the current mode is ok. But on Debian, it is set-gid
crontab, so crontab group write is needed.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?