Replacement for locate on Fedora? [LWN.net]

Replacement for locate on Fedora?

Posted Oct 11, 2023 15:50 UTC (Wed) by hmh (subscriber, #3838)
In reply to: Replacement for locate on Fedora? by fredrik
Parent article: A remote code execution vulnerability in GNOME

"locate" and friends (plocate, slocate, etc) do not parse files, they don't even open them. They just fstat() them, if that much.

The typical security issue with locate, is that one user could find out the existence of files owned by some other user, supposedly addressed by slocate, and hopefully by plocate (didn't check).

to post comments

Replacement for locate on Fedora?

Posted Oct 12, 2023 6:51 UTC (Thu) by Sesse (subscriber, #53779) [Link]

plocate makes pretty much the same set of security checks as mlocate, indeed, which is that the calling user should be able to find the file from / (i.e., it verifies that you can access() with +rx the entire containing path up from the root).

It does not try to protect the user against itself, i.e., being safe against untrusted .db files (and it takes pains to drop setgid before actually starting to parse the files, so that you cannot run an attack on a secret .db file using your own malicious one).

(I am the author of plocate.)