Why is /var/cron/tabs unreadable by the regular users?

[tembun]

I have a simple shell scripts that makes a small system backup using tar(1): it backs up only my personal directory under /home, and configuration files in /etc, /boot/loader.conf and others, so I can run it as my regular user. I'd also like to backup my crontab files, but as a regular user, I can't read this directory:

$ ls -ld /var/cron/tabs
drwx------  2 root wheel 512 Jun  2 22:14 /var/cron/tabs

crontab(1) says:

Each user can have their own crontab, and though these are files in /var/cron/tabs, 
hey are not intended to be edited directly.

That makes sense to me, and I understand that it's much safer to edit them with a special tool, because it checks the syntax for instance. But I can't understand why /var/cron/tabs has such strict permission even for the wheel group. /var/cron by the way has different permissions:

ls -ld /var/cron
drwxr-x---  3 root wheel 512 Nov 28  2025 /var/cron

I know that I can (and I'm supposed to) read crontabs with crontab -l, but this way I can't backup them with tar(1) without writing an extra logic for these specific files.

I also know that I can just change the permissions for this directory (just to see files inside it), but I don't really like to change system defaults, because they are almost always quite sensible. But I can't understand this one.

Do you know why it has such permissions? And is it a way to read these files (and backup them) without changing permissions?

 

[bakul]

A normal user should not be able to read other people's crontabs for privacy reasons. Backup everything as root.

 

[tembun]

A normal user should not be able to read other people's crontabs for privacy reasons. Backup everything as root.

That makes sense. Although if I designed it, I guess I would probably make each directory under /var/cron/tabs readable by the group of the user who owns it.

 

[kent_dorfman766]

That makes sense. Although if I designed it, I guess I would probably make each directory under /var/cron/tabs readable by the group of the user who owns it.

allowing a user to even see if another has a crontab file can be considered a security risk. User A should not even know if user B has a crontab.

Of course you are free to make /var/cron/tabs readable by others as your use case needs dictate.