From nobody Tue Oct 01 00:36:18 2024 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XHfBk6TMRz5Xvh7 for ; Tue, 01 Oct 2024 00:36:30 +0000 (UTC) (envelope-from jamie@catflap.org) Received: from donotpassgo.dyslexicfish.net (donotpassgo.dyslexicfish.net [IPv6:2001:19f0:7400:8808:123::1]) by mx1.freebsd.org (Postfix) with ESMTP id 4XHfBk3hq2z4kk6; Tue, 1 Oct 2024 00:36:30 +0000 (UTC) (envelope-from jamie@catflap.org) Authentication-Results: mx1.freebsd.org; none X-Catflap-Envelope-From: X-Catflap-Envelope-To: freebsd-current@FreeBSD.org Received: from donotpassgo.dyslexicfish.net (donotpassgo.dyslexicfish.net [209.250.224.51]) by donotpassgo.dyslexicfish.net (8.14.5/8.14.5) with ESMTP id 4910aIPv095391; Tue, 1 Oct 2024 01:36:18 +0100 (BST) (envelope-from jamie@donotpassgo.dyslexicfish.net) Received: (from jamie@localhost) by donotpassgo.dyslexicfish.net (8.14.5/8.14.5/Submit) id 4910aIoW095390; Tue, 1 Oct 2024 01:36:18 +0100 (BST) (envelope-from jamie) From: Jamie Landeg-Jones Message-Id: <202410010036.4910aIoW095390@donotpassgo.dyslexicfish.net> Date: Tue, 01 Oct 2024 01:36:18 +0100 Organization: Dyslexic Fish To: kevans@FreeBSD.org, freebsd-current@FreeBSD.org Subject: Re: weekly locate error Was: September 2024 stabilization week References: <3313f951-4f9e-4298-bbd8-f82c5a15a0e3@protected-networks.net> In-Reply-To: User-Agent: Heirloom mailx 12.4 7/29/08 List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.7 (donotpassgo.dyslexicfish.net [209.250.224.51]); Tue, 01 Oct 2024 01:36:18 +0100 (BST) X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:20473, ipnet:2001:19f0:7400::/38, country:US] X-Rspamd-Queue-Id: 4XHfBk3hq2z4kk6 X-Spamd-Bar: ---- Kyle Evans wrote: > It might be that the better long-term approach is to teach updatedb.sh > how to drop privileges and push that out of the periodic script to avoid > surprises like this from the different execution environments. This > /feels/ like the kind of thing we could take an opinionated stance on, > maybe providing an escape hatch of some sort if someone really wants to > complain that they can't document all filenames on the system. This is how it already works. It calls locate.updatedb as "nobody", so only files readable by "nobody" are indexed: echo /usr/libexec/locate.updatedb | nice -n 5 su -fm nobody || rc=3