# Ensure permissions on /etc/cron.daily are configured

Necessity: The '/etc/cron.daily' directory contains scripts that are automatically executed daily with root privileges. If an unauthorized user can write to or modify files within this directory, they could introduce malicious code that would be executed with the highest privileges on the system. This represents a critical privilege escalation vulnerability. Restricting access ensures that only the root user can manage these scheduled tasks, maintaining system integrity and preventing unauthorized actions.

Auditing and Remediation: The audit script uses the 'stat' command to check the current access permissions (in octal format), the owner user, and the owner group of the '/etc/cron.daily' directory. The remediation script uses the 'chmod' and 'chown' commands to set these attributes to the specified secure values, directly addressing the configuration.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '700 root root'. This is the standard secure configuration recommended by security benchmarks like CIS. Permissions '700' (drwx------) ensure that only the owner can read, write, and list the directory's contents. Setting the owner and group to 'root' ensures that this owner is the superuser. This configuration strictly adheres to the principle of least privilege, as no other user on the system requires access to these system-level cron jobs. There is no more secure functional configuration, hence the recommendation is consistent across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700 root root']` |
| **Moderate** | `['700 root root']` |
| **Strict** | `['700 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that retrieves the permissions, owner, and group for the '/etc/cron.daily' directory. The script must use the 'stat' command with the format '%a %U %G' and output only the resulting string (e.g., '700 root root'), with no additional text or formatting.

## Remediation Script Working

shell script that sets the permissions, owner, and group for the '/etc/cron.daily' directory. The script must accept three positional command-line arguments in this order: permissions (in octal format, e.g., '700'), owner user (e.g., 'root'), and owner group (e.g., 'root'). The script must use 'chmod' and 'chown' to apply the settings. It must return 'true' if the operations succeed and 'false' if they fail.

