Remove setuid bit on crontab.

component/dcron/buildout.cfg

@@ -4,6 +4,13 @@ extends =
 
 parts = dcron-output
 
+[dcron-hooks-download]
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/${:filename}
+md5sum = 860e914dff4108b47565965fe5ebc7b5
+download-only = true
+filename = dcron-hooks.py
+
 [dcron-patch-nonroot]
 recipe = hexagonit.recipe.download
 md5sum = d5408ab682b65cc1eda40d588fcd7db8
@@ -21,12 +28,13 @@ patches =
 patch-options = -p1
 make-options =
   PREFIX=${buildout:parts-directory}/${:_buildout_section_name_}
+post-make-hook = ${dcron-hooks-download:location}/${dcron-hooks-download:filename}:post_make_hook
 
 [dcron-output]
 # Shared binary location to ease migration
 recipe = plone.recipe.command
 stop-on-error = true
 update-command = ${:command}
-command = ${coreutils-output:test} -x ${:crond} -a -x ${:crontab}
+command = ${coreutils-output:test} -x ${:crond} -a -x ${:crontab} -a ! -u ${:crontab}
 crond = ${dcron:location}/sbin/crond
 crontab = ${dcron:location}/bin/crontab

component/dcron/dcron-hooks.py

+import os
+import shutil
+def post_make_hook(options, buildout):
+  crontab_path = os.path.join(options['location'], 'bin', 'crontab')
+  os.chmod(crontab_path, 0750)