Question
What permissions and ownership should files in /var/spool/cron have?
Answer
Unused files in this area should be owned by root:root and have 600 permissions.
Populated files should be owned by their respective users and have 600 permissions.
This prevents another user from being able to read, write, or otherwise compromise another users' scheduled tasks.