crontab fails with "RuntimeError: Operation not permitted" for caged users after the CageFS 7.6.44 update

Issue

After CageFS is updated to cagefs-7.6.44-1, users with CageFS enabled can no longer run the crontab command. Listing or installing a crontab fails immediately:

$ crontab -l
crontab: RuntimeError: Operation not permitted.

The same command run from the command line as root, or with CageFS disabled for that user, works as expected.

On Plesk servers the problem is widespread: it affects every hosting account that has one or more Additional FTP accounts, which can be dozens of accounts on a single server.

Environment

• CloudLinux OS 
• CageFS 7.6.44-1 
• Any control panel that creates more than one system account with the same UID — confirmed on Plesk with Additional FTP accounts

Solution

1. Confirm the installed CageFS version:

   rpm -q cagefs

Versions 7.6.43-1 and earlier are not affected. Only 7.6.44-1 is.

2. Confirm that the affected user shares its UID with another entry in the password database, replacing user1 with the account name:

   getent passwd | awk -F: -v uid="$(id -u user1)" '$3 == uid'

Two or more lines returned confirms this issue. On Plesk, the extra lines are Additional FTP accounts and have /bin/false as their shell.

3. Apply the permanent fix. The check that causes the error is reverted in cagefs-7.6.45-1 (internal task CLOS-6949). Once that build is available in the production repository, update CageFS:

   yum update cagefs

4. If cagefs-7.6.45-1 has not been released yet, downgrade CageFS to the previous version:

   yum downgrade cagefs

The downgrade also brings back the matching cagefs-safebin and lvemanager packages, and it takes effect immediately — no CageFS remount or restart is required.

5. Verify that crontab works again for an affected user:

   su - user1 -s /bin/bash -c "/usr/bin/crontab -l"

The user's crontab is printed instead of the error.

Disabling CageFS for the affected users (cagefsctl --disable user1) also restores access to crontab, but it removes CageFS protection for those users and is not recommended as anything other than a short-term measure.

Cause

cagefs-7.6.44-1 introduced a new authentication step in the CageFS crontab proxy wrapper. The wrapper resolves the calling user by UID: it collects every password database entry whose UID matches the caller and refuses to continue unless exactly one entry is found.

Plesk creates Additional FTP accounts that share the UID of the subscription's main system user and use /bin/false as their shell. This is standard Plesk behavior, not a misconfiguration, so on those accounts the UID lookup returns two or more names and the wrapper raises RuntimeError: Operation not permitted.

The check runs on both crontab -l and crontab <file>, and it runs before website isolation is evaluated, so it affects caged users even when website isolation is turned off. With CageFS disabled the proxy is bypassed and the stock cron binary handles the command, which is why the same command succeeds in that case.

Useful links

• CageFS — CloudLinux OS documentation 
• CloudLinux OS Shared changelog 
• Plesk: Additional FTP accounts