Configuring a Multilevel Secure System › Using Security Labels › Protecting the cron Daemon

Protecting the cron Daemon

The cron daemon, which runs commands on a schedule, does not support MAC security label checking. Therefore, it is recommended that you do not allow general users to run cron jobs, including crontab jobs and batch shell commands in an CA Top Secret MLS system.

To protect the cron daemon, do the following:

• Define and assign a unique security label (for example, LBLCRON) to cron that contains the highest security level defined in the system and one unique category that no other security label has. This will prevent any user, other than a user logged on with the security label, SYSHIGH, from using cron.
• For information on how to define and assign security levels, categories, and security labels, see the “Implementing and Administering a Multilevel-Secure System” chapter.
• Using the chlabel command, assign the newly defined security label or SYSHIGH to the following directories: /usr/spool/cron/, /usr/spool/cron/crontabs, and /usr/spool/cron/atjobs, by issuing the following commands:

  chlabel lblcron /usr/spool/cron/
  chlabel lblcron /usr/spool/cron/crontabs
  chlabel lblcron /usr/spool/cron/atjobs