# Ensure permissions on /etc/cron.daily are configured

Necessity: The '/etc/cron.daily' directory contains scripts that are executed daily with root privileges. If this directory's permissions are insecure, an unauthorized user could add or modify scripts, leading to arbitrary code execution as root and a complete system compromise. Restricting access is critical to prevent privilege escalation.

Auditing and Remediation: The audit script checks the directory's access mode (in octal), the user owner, and the group owner. The remediation script uses the 'chmod' and 'chown' commands to enforce the specified permissions and ownership, ensuring that only the root user has control over the directory's contents.

Recommended State Rationale: The recommended state of '700:root:root' is consistently applied across all hardening levels because it is a fundamental security requirement. '700' permissions (rwx------) ensure only the owner can read, write, and execute files within the directory. Assigning ownership to 'root:root' ensures that the owner is the superuser. Any less stringent configuration introduces an unacceptable risk of privilege escalation. This configuration adheres to the principle of least privilege and aligns with established security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700:root:root']` |
| **Moderate** | `['700:root:root']` |
| **Strict** | `['700:root:root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the 'stat' command to check the permissions and ownership of the '/etc/cron.daily' directory. The script must output a single string in the format 'permissions:user:group' (e.g., '700:root:root') and nothing else.

## Remediation Script Working

Bash script that accepts a single string argument in the format 'permissions:user:group' (e.g., '700:root:root'). The script must parse this argument to set the permissions on '/etc/cron.daily' using 'chmod' and the ownership using 'chown'. The script must output 'true' on success and 'false' on failure.

