Bug 472468 – cron runs locate.updatedb as root

• Status: RESOLVED FIXED
• Product: Gentoo/Alt

[Description Doug Miller 2013-06-06 06:51:38 UTC]

I get the following message emailed to root on a Gentoo/FreeBSD system running vixie-cron:

>>> WARNING
>>> Executing updatedb as root.  This WILL reveal all filenames
>>> on your machine to all login users, which is a security risk.

This seems like something that should be avoided as default behavior.

The offending job is /etc/cron.daily/locate.updatedb, which runs /usr/libexec/locate.updatedb, which outputs the error message when run as root.

Perhaps an updatedb user could be added to run this file as its shell, and the cron could run "su updatedb"

Reproducible: Always

[Comment 1 Naohiro Aota 2013-06-06 11:19:17 UTC]

Replacing the cron crommand with  "echo /usr/libexec/locate.updatedb | nice -n 5 su -fm nobody" would work for you?

[Comment 2 Doug Miller 2013-06-08 19:37:40 UTC]

I tried, and it gave me
/usr/libexec/locate.updatedb: cannot create /var/db/locate.database: Permission denied

[Comment 3 Naohiro Aota 2013-06-10 11:26:57 UTC]

Please touch the file and make it owned by nobody

 ~ # touch /var/db/locate.database                                                                                                    
 ~ # chwon nobody:nobody /var/db/locate.database

[Comment 4 Doug Miller 2013-06-12 13:15:14 UTC]

Works for me now.

[Comment 5 Naohiro Aota 2014-01-05 00:57:35 UTC]

+  05 Jan 2014; Naohiro Aota <[e-mail]> files/locate-updatedb-cron,
+  freebsd-ubin-9.1-r2.ebuild, freebsd-ubin-9.2.ebuild:
+  Run updatedb with nobody; Generate locate database beforehand. #472468