use bind-dirs to handle crontab persistence

Makefile

@@ -260,6 +260,10 @@ endif
 
 	install -D -m 0644 misc/xorg-preload-apps.conf $(DESTDIR)/etc/X11/xorg-preload-apps.conf
 
+	install -d $(DESTDIR)/usr/lib/qubes-bind-dirs.d
+	install -D -m 0644 misc/30_cron.conf $(DESTDIR)/usr/lib/qubes-bind-dirs.d/30_cron.conf
+
+
 	install -d $(DESTDIR)/var/run/qubes
 	install -d $(DESTDIR)/home_volatile/user
 	install -d $(DESTDIR)/rw

debian/changelog

@@ -1,3 +1,10 @@
+qubes-core-agent (3.2.12-1) wheezy; urgency=medium
+
+  [ Unman ]
+  * cron: set up bind-dirs for /var/spool/cron
+
+ -- unman <unman@thirdeyesecurity.org>  Sat, 16 Oct 2016 21:53:40 +0000
+
 qubes-core-agent (3.2.11-1) wheezy; urgency=medium
 
   [ HW42 ]

misc/30_cron.conf

@@ -0,0 +1 @@
+binds+=( '/var/spool/cron' )

rpm_spec/core-vm.spec

@@ -425,6 +425,8 @@ rm -f %{name}-%{version}
 /usr/lib/yum-plugins/yum-qubes-hooks.py*
 /usr/lib/dracut/dracut.conf.d/30-qubes.conf
 /usr/lib/NetworkManager/conf.d/30-qubes.conf
+%dir /usr/lib/qubes-bind-dirs.d
+/usr/lib/qubes-bind-dirs.d/30_cron.conf
 /usr/lib64/python2.7/site-packages/qubes/xdg.py*
 /usr/sbin/qubes-firewall
 /usr/sbin/qubes-netwatcher

version

@@ -1 +1 @@
-3.2.11
+3.2.12

vm-systemd/cron.service.d/30_qubes.conf

@@ -1,3 +1,5 @@
 [Unit]
 ConditionPathExists=/var/run/qubes-service/crond
+
+[Service]
 After=qubes-sysinit.service

vm-systemd/crond.service.d/30_qubes.conf

@@ -1,3 +1,5 @@
 [Unit]
 ConditionPathExists=/var/run/qubes-service/crond
+
+[Service]
 After=qubes-sysinit.service