Date: Mon, 20 Jul 2015 12:23:44 +0100 From: Arthur Chance <freebsd@qeng-ho.org> To: Scott Bennett <bennett@sdf.org>, freebsd@edvax.de Cc: freebsd-questions@freebsd.org Subject: Re: limiting find(1) in /etc/periodic scripts Message-ID: <55ACDA40.7040908@qeng-ho.org> In-Reply-To: <201507201039.t6KAdwCU014203@sdf.org> References: <201507200910.t6K9A9J6007857@sdf.org> <20150720114036.b83e5116.freebsd@edvax.de> <201507201039.t6KAdwCU014203@sdf.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 20/07/2015 11:39, Scott Bennett wrote:
> Polytropon <freebsd@edvax.de> wrote:
>
>> On Mon, 20 Jul 2015 04:10:09 -0500, Scott Bennett wrote:
>>> What is the best way to keep find(1) in the various /etc/periodic
>>> scripts from descending into certain directories?
To control locate, you can edit /etc/locate.rc to modify PRUNEPATHS
suitably. For the rest, I think you'll have to hack the periodic scripts
directly.
>>
>> If I remember correctly, find will only descend into directories
>> that have the o+rx attribute (readable by everyone). If you do
>
> No, it goes wherever it has read access (plus execute access
> for directories). Also, the /etc/periodic scripts get run as root.
>
>> not want a subtree to be searched, make sure it's +rx for the
>> owner and +rx for the group, as well as +w where needed, usually
>> +rwx for the user. A typical setting then is drwxr-x--- for such
>> directories.
>>
>> There is another problem:
>>
>> Directories such as /root should not be searched. The problem
>> is that there will be an additional information leak, like
>>
>> $ locate system_secrets
>> /root/system_secrets.txt
>>
> Well, that's not a worry because the locate stuff has only
> created empty locate databases since sometime in FreeBSD 6.
It's always worked fine for me, I'm currently on 10.1-REL. Do most of
your files live on servers rather than the box you're running locate on?
By default locate.updatedb does not consider files that are network
mounted. To override edit FILESYSTEMS in /etc/locate.conf to control the
flavours of filesystem that are searched. Mine has
FILESYSTEMS="ufs zfs nfs"
> I've
> tried several times without success to get it to work and to get
> it to run as "nobody". It's almost as irritating as the five-
> minute stall for vi.recover during multi-user startup.
But building the locate database already runs as nobody. Line 26 of
/etc/periodic/weekly/310.locate reads
echo /usr/libexec/locate.updatedb | nice -n 5 su -fm nobody || rc=3
There's an su in the middle of that. If locate.updatedb is actually run
as root it complains loudly (but does it anyway as you told it to).
--
Those who do not learn from computing history are doomed to
GOTO 1
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55ACDA40.7040908>