drop root for crontab

[Steven Dake]

crontab runs as root. I think it is possible in the kolla use case to run cron for logrotate as a non-root user.

Four things need to happen:
/run needs to be mode 775 and owned by kolla (to permit writing of the pid file).
crontab needs to run as the kolla user and group
crontab needs to use sudo to logrotate
logrotate needs to be added to the sudoers file for cron

[Steven Dake (sdake)]

After changing /run to 777:
[sdake@minime-03 cron.d]$ crond -n
setuid: Operation not permitted

[Steven Dake (sdake)]

cronie used in CentOS requires root. During startup it runs the following code:

void set_cron_uid(void) {
#if defined(BSD) || defined(POSIX)
        if (seteuid(ROOT_UID) < OK) {
                perror("seteuid");
                exit(ERROR_EXIT);
        }
#else
        if (setuid(ROOT_UID) < OK) {
                perror("setuid");
                exit(ERROR_EXIT);
        }
#endif
}

[Steven Dake (sdake)]

crontab cannot be run as a non-root user. on startup it executes seteuid(0)) and exits if that fails.

[Duong Ha-Quang (duonghq)]

Ref: http://eavesdrop.openstack.org/irclogs/%23openstack-kolla/%23openstack-kolla.2017-03-16.log.html#t2017-03-16T01:43:04