Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Anyone interested in a mlocate spell?

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: seth AT swoolley.homeip.net
  • To: Ethan Grammatikidis <eekee57 AT fastmail.fm>
  • Cc: SourceMage Discuss mailing List <SM-Discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Anyone interested in a mlocate spell?
  • Date: Mon, 10 Nov 2008 23:47:29 -0800


On Tue, Nov 11, 2008 at 07:36:04AM +0000, Ethan Grammatikidis wrote:
>
> It may be complicated, but the locate bundled with findutils is not
> appropriate for some systems. It shows the existence of files that a
> user should not ordinarily be able to see. Mlocate, being derived from
> slocate (secure locate), doesn't have this issue. Also I remember
> findutils locate being noticably slower at searching the database than
> slocate, but I may be going back to when findutils depended on perl.

So you've identified a possible security issue. Keep this in mind.

>
> I'm going to hate myself for saying this, :) but I'd like to modify
> findutils, & also take on the mlocate spell if Kevin doesn't want to
> persist with it. I'm wondering which is the best way to modify
> findutils:
>
> 1: findutils optionally depends on mlocate.
> 2: findutils optionally doesn't install locate.
>
> I prefer #2 as locate isn't strictly needed, there may be no use for it
> at all on a very small system. Also it 'feels purer', it doesn't
> introduce a dependency only to satisfy expectations. Any comments?
>
> The modification to not install locate is actually quite simple, & goes
> in PRE_BUILD rather than INSTALL. All that's needed is a sed command to
> remove "locate" from the SUBDIRS setting in the makefile.

You're suggesting changing how we handle upstream.

I suggest you put a SECURITY file in the findutils spell to mention the
issue with using locate if it's that important to you.

There's no reason to not install it if it came that way and nobody is
forced to use it.

Believe it or not maybe somebody does want it installed on their system
because it's a PC and doesn't care about filename visibility. Truth be
told, filenames often show up in ps as well, so they've never been
considered secure.

Seth

--
3403 NE Stanton St gnupg.org key 84317E6A = http://swoolley.org/
Portland, OR 97212 8C97 9818 F889 EDE3 B54C Cell: (503) 953-3943
USA, 97212-2744 03 AAD6 E936 BF83 8431 7E6A 45.5438 N 122.6295 W




Archive powered by MHonArc 2.6.24.

Top of Page