Date: Tue, 01 Oct 2024 01:36:18 +0100 From: Jamie Landeg-Jones <jamie@catflap.org> To: kevans@FreeBSD.org, freebsd-current@FreeBSD.org Subject: Re: weekly locate error Was: September 2024 stabilization week Message-ID: <202410010036.4910aIoW095390@donotpassgo.dyslexicfish.net> In-Reply-To: <f01f6af0-d9f2-482c-b2b0-1d86937c86fa@FreeBSD.org> References: <ZvEgC9ak7paxygYw@cell.glebi.us> <ZvRze1gldJTCvjir@cell.glebi.us> <Zvh-8cMF_HtOJ3uu@int21h> <Zvrp25zS9thDe3ak@cell.glebi.us> <3313f951-4f9e-4298-bbd8-f82c5a15a0e3@protected-networks.net> <ZvsTQu_LQFHs1lnN@cell.glebi.us> <ZvsX9qOI_bSAL7Mj@int21h> <f01f6af0-d9f2-482c-b2b0-1d86937c86fa@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Kyle Evans <kevans@FreeBSD.org> wrote:
> It might be that the better long-term approach is to teach updatedb.sh
> how to drop privileges and push that out of the periodic script to avoid
> surprises like this from the different execution environments. This
> /feels/ like the kind of thing we could take an opinionated stance on,
> maybe providing an escape hatch of some sort if someone really wants to
> complain that they can't document all filenames on the system.
This is how it already works. It calls locate.updatedb as "nobody", so
only files readable by "nobody" are indexed:
echo /usr/libexec/locate.updatedb | nice -n 5 su -fm nobody || rc=3
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202410010036.4910aIoW095390>