[SM-Discuss] Anyone interested in a mlocate spell?

seth at swoolley.homeip.net seth at swoolley.homeip.net
Tue Nov 11 02:47:29 EST 2008


On Tue, Nov 11, 2008 at 07:36:04AM +0000, Ethan Grammatikidis wrote:
> 
> It may be complicated, but the locate bundled with findutils is not
> appropriate for some systems. It shows the existence of files that a
> user should not ordinarily be able to see. Mlocate, being derived from
> slocate (secure locate), doesn't have this issue. Also I remember
> findutils locate being noticably slower at searching the database than
> slocate, but I may be going back to when findutils depended on perl.

So you've identified a possible security issue.  Keep this in mind.

> 
> I'm going to hate myself for saying this, :) but I'd like to modify
> findutils, & also take on the mlocate spell if Kevin doesn't want to
> persist with it. I'm wondering which is the best way to modify
> findutils:
> 
> 1: findutils optionally depends on mlocate.
> 2: findutils optionally doesn't install locate.
> 
> I prefer #2 as locate isn't strictly needed, there may be no use for it
> at all on a very small system. Also it 'feels purer', it doesn't
> introduce a dependency only to satisfy expectations. Any comments?
> 
> The modification to not install locate is actually quite simple, & goes
> in PRE_BUILD rather than INSTALL. All that's needed is a sed command to
> remove "locate" from the SUBDIRS setting in the makefile.

You're suggesting changing how we handle upstream.

I suggest you put a SECURITY file in the findutils spell to mention the 
issue with using locate if it's that important to you.

There's no reason to not install it if it came that way and nobody is 
forced to use it.

Believe it or not maybe somebody does want it installed on their system 
because it's a PC and doesn't care about filename visibility.  Truth be 
told, filenames often show up in ps as well, so they've never been 
considered secure.

Seth

-- 
3403 NE Stanton St   gnupg.org key 84317E6A =   http://swoolley.org/
Portland, OR 97212   8C97 9818 F889 EDE3 B54C   Cell: (503) 953-3943
USA, 97212-2744 03   AAD6 E936 BF83 8431 7E6A   45.5438 N 122.6295 W


More information about the SM-Discuss mailing list