So why not simply uninstall it? [LWN.net]

So why not simply uninstall it?

Posted Oct 10, 2023 20:11 UTC (Tue) by mikebenden (guest, #74702)
Parent article: A remote code execution vulnerability in GNOME

E.g., on Fedora: rpm -e --nodeps tracker tracker-miners

Yeah, gnome-session (via nautilus) and gnome-photos or whatever will "miss" it, but other than that, why would I *not* just nuke it from orbit? :)

to post comments

So why not simply uninstall it?

Posted Oct 10, 2023 23:58 UTC (Tue) by jreiser (subscriber, #11027) [Link] (4 responses)

In Fedora Linux (and thus perhaps RHEL), the 'locate' utililty (search an updated-in-advance list of filenames present on the system) was removed in favor of tracker stuff. That's a loss for me.

So why not simply uninstall it?

Posted Oct 11, 2023 4:59 UTC (Wed) by zdzichu (subscriber, #17118) [Link] (3 responses)

No it wasn't! It was even updated from `mlocate` to `plocate` recently.
I have plocate-1.1.17-3.fc39.x86_64 installed on this very computer.

Replacement for locate on Fedora?

Posted Oct 11, 2023 12:11 UTC (Wed) by fredrik (subscriber, #232) [Link] (2 responses)

I was just about to suggest to jreiser to install the package plocate instead.

https://plocate.sesse.net/
https://packages.fedoraproject.org/pkgs/plocate/plocate/

Though, plocate is implemented in C++, so it too seems to use a memory-unsafe language to parse unsafe user input.

Replacement for locate on Fedora?

Posted Oct 11, 2023 15:50 UTC (Wed) by hmh (subscriber, #3838) [Link] (1 responses)

"locate" and friends (plocate, slocate, etc) do not parse files, they don't even open them. They just fstat() them, if that much.

The typical security issue with locate, is that one user could find out the existence of files owned by some other user, supposedly addressed by slocate, and hopefully by plocate (didn't check).

Replacement for locate on Fedora?

Posted Oct 12, 2023 6:51 UTC (Thu) by Sesse (subscriber, #53779) [Link]

plocate makes pretty much the same set of security checks as mlocate, indeed, which is that the calling user should be able to find the file from / (i.e., it verifies that you can access() with +rx the entire containing path up from the root).

It does not try to protect the user against itself, i.e., being safe against untrusted .db files (and it takes pains to drop setgid before actually starting to parse the files, so that you cannot run an attack on a secret .db file using your own malicious one).

(I am the author of plocate.)

So why not simply uninstall it?

Posted Oct 11, 2023 15:24 UTC (Wed) by dskoll (subscriber, #1630) [Link] (2 responses)

Yeah. I run XFCE4 on Debian, and there were only a couple of packages that depended on it. They weren't packages I'd miss, so I did the old apt --purge remove libcue2

So why not simply uninstall it?

Posted Oct 11, 2023 16:35 UTC (Wed) by ballombe (subscriber, #9523) [Link] (1 responses)

You should rather remove tracker-miners.

So why not simply uninstall it?

Posted Oct 12, 2023 2:10 UTC (Thu) by dskoll (subscriber, #1630) [Link]

That was removed as part of the uninstallation. But the flaw is in the libcue2 library and there were other programs (audacious) that depended on it.