If the cron.allow file exists, then you must be listed therein in order to be allowed to use this command. If the cron.allow file does not exist but the cron.deny file does exist, then you must not be listed in the cron.deny file in order to use this command. If neither of these files exists, only the super user will be allowed to use this command.
If the -u option is given, it specifies the name of the user whose crontab is to be tweaked. If this option is not given, crontab examines "your" crontab, i.e., the crontab of the person executing the command. Note that su(8) can confuse crontab and that if you are running inside of su(8) you should always use the -u option for safety's sake.
The first form of this command is used to install a new crontab from some named file or standard input if the pseudo-filename ``-'' is given.
The -l option causes the current crontab to be displayed on standard output.
The -r option causes the current crontab to be removed.
The -e option is used to edit the current crontab using the editor specified by the VISUAL or EDITOR environment variables. After you exit from the editor, the modified crontab will be installed automatically.
The -i option modifies the -r option to prompt the user for a 'y/Y' response before actually removing the crontab.
The -s option will append the current SELinux security context string as an SELINUX_ROLE_TYPE setting to the crontab file before editing / replacement occurs - see the documentation of SELINUX_ROLE_TYPE in crontab(5).
/etc/cron.allow /etc/cron.deny
Paul Vixie <vixie@isc.org>