Copied from Bugtraq: * Version tested: 3.1 * Problem description: slocate doesn't check readability bit of containing directory. It can divulge the existence of files in a directory that is unreadable (e.g. by the 'ls' command) by a user. * Demonstration: As user1: $ cd /tmp $ mkdir dir $ chmod 711 dir $ cd dir $ touch "a-secret-file" $ cd .. $ updatedb -o db -U dir As user2: $ cd /tmp $ ls dir ls: .: Permission denied But: $ slocate -d db file dir/a-secret-file
This needs attention.
Your file /tmp/dir/a-secret-file is NOT inaccessible to user2. as your user2, 'stat /tmp/dir/a-secret-file'. Merely obscuring the existance of said file is no security, as there are other ways to see that it exists. slocate is accurately reporting that it exists, and is accessible to user2. if you change the perms on /tmp/dir/ to 0700, then slocate ceases to report which is correct.
This is correct. My apologies.
