at(1) is no longer setuid root, it is setgid crontab.

This means that /var/at/at.{allow,deny} must be readable by group
crontab, /var/at/jobs is mode 01770, and /var/at/.SEQ is mode 0660.

src/etc/Makefile

@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.157 2002/04/28 14:56:38 miod Exp $
+#	$OpenBSD: Makefile,v 1.158 2002/05/11 18:41:19 millert Exp $
 
 TZDIR=		/usr/share/zoneinfo
 LOCALTIME=	US/Pacific
@@ -185,8 +185,10 @@ distribution-etc-root-var: distrib-dirs
 		${DESTDIR}/etc/dumpdates
 	${INSTALL} -c -o ${BINOWN} -g wheel -m 600 /dev/null \
 		${DESTDIR}/etc/skeykeys
-	${INSTALL} -c -o root -g wheel -m 600 /dev/null \
+	${INSTALL} -c -o root -g crontab -m 660 /dev/null \
 		${DESTDIR}/var/at/at.deny
+	${INSTALL} -c -o root -g crontab -m 660 /dev/null \
+		${DESTDIR}/var/at/.SEQ
 	${INSTALL} -c -o root -g wheel -m 600 /dev/null \
 		${DESTDIR}/var/cron/log
 	${INSTALL} -c -o root -g wheel -m 444 /dev/null \

src/etc/mtree/4.4BSD.dist

@@ -1,4 +1,4 @@
-#	$OpenBSD: 4.4BSD.dist,v 1.124 2002/05/09 21:22:01 millert Exp $
+#	$OpenBSD: 4.4BSD.dist,v 1.125 2002/05/11 18:41:20 millert Exp $
 
 /set type=dir uname=root gname=wheel mode=0755
 # .
@@ -1840,7 +1840,7 @@ empty		mode=0755
 at		gname=daemon
 
 # ./var/at/jobs
-jobs		mode=0700
+jobs		gname=crontab mode=01770
 # ./var/at/jobs
 ..