Configure the Scripts Executed by crontab to Be Writable Only by Their Owners

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130351");
  script_version("2025-11-21T05:40:28+0000");
  script_tag(name:"last_modification", value:"2025-11-21 05:40:28 +0000 (Fri, 21 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:44:20 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Configure the Scripts Executed by crontab to Be Writable Only by Their Owners");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.4 Scheduled Tasks: 3.4.1 Configure the Scripts Executed by crontab to Be Writable Only by Their Owners (Requirement)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.4 Scheduled Tasks: 3.4.1 Configure the Scripts Executed by crontab to Be Writable Only by Their Owners (Requirement)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.4 Scheduled Tasks: 3.4.1 Configure the Scripts Executed by crontab to Be Writable Only by Their Owners (Requirement)");

  script_tag(name:"summary", value:"crontab is the configuration file used by the system to execute
scheduled tasks. The path of the configuration file is /etc/crontab. With crontab, the OS
automatically executes the tasks defined by the administrator based on service requirements.
Therefore, the execution scripts (or programs) configured in the crontab configuration file must be
writable only by their owners.

Otherwise, other users can modify the scripts to implement privilege escalation.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Configure the Scripts Executed by crontab to Be Writable Only by Their Owners";

solution = "If the execution scripts (or programs) in the /etc/crontab configuration file are
writable by low-privilege users, rectify the fault based on the actual service scenario.

1. Method

Modify the permissions on the execution scripts (or programs) in the /etc/crontab configuration
file to remove the write permission of other low-privilege users to prevent privilege escalation.

2. Method

Modify the /etc/crontab configuration file to delete the configuration options of the execution
scripts (or programs) to prevent privilege escalation.";

check_type = "SSH_Cmd";

action = 'Run the command in the terminal:
# awk \'!/^#/{print \\$7}\' /etc/crontab | while read f; do [ -e "$f" ] && find "$f" -perm /022 -ls; done';

expected_value = 'The output should be empty';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

# ------------------------------------------------------------------
# CHECK : Verify command `awk '!/^#/{print \$7}' /etc/crontab | while read f; do [ -e "$f" ] && find "$f" -perm /022 -ls; done`
# ------------------------------------------------------------------

step_cmd = 'awk \'!/^#/{print \\$7}\' /etc/crontab | while read f; do [ -e "$f" ] && find "$f" -perm /022 -ls; done';
actual_value = ssh_cmd(socket:sock, cmd:step_cmd, return_errors:TRUE, return_linux_errors_only:TRUE);

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the audit check. Please try again.";
}else if(!actual_value){
  compliant = "yes";
  comment = "Check passed";
}else{
  compliant = "no";
  comment = "Check failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);