Bug 68274 – sys-apps/slocate-2.7-r6: slocate installed setuid root

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Ulrich Müller 2004-10-20 07:27:50 UTC]

/usr/bin/slocate is installed setuid root which is not necessary.
It should be installed setgid slocate as it used to be for -r5.

Besides, there seems to be no ChangeLog entry about this change. :-(

[Comment 1 Thierry Carrez (RETIRED) 2004-10-20 07:32:13 UTC]

*** This bug has been marked as a duplicate of 67977 ***

[Comment 2 Ulrich Müller 2004-10-20 07:39:33 UTC]

I disagree about this being a duplicate. From the time in the CVS header:

$Header: /var/cvsroot/gentoo-x86/sys-apps/slocate/slocate-2.7-r6.ebuild,v 1.2 
2004/10/18 19:30:42 vapier Exp $

it appears that in the original -r6 v1.1 the setgid bit was lost and the "fix"
of bug 67977 was to install slocate setuid root instead.

[Comment 3 Sven Wegener 2004-10-20 07:41:44 UTC]

No, this is not a dup. vapier messed the ebuild up by setting go-r,a+s which sets suid and sgid. And created no ChangeLog entry. I just fixed the ebuild.

[Comment 4 Thierry Carrez (RETIRED) 2004-10-20 07:59:45 UTC]

Sorry about this

[Comment 5 Thierry Carrez (RETIRED) 2004-10-20 08:02:32 UTC]

Blame vapier
As problem was only temporary and only affected a ~ package, no GLSA is needed.

swegener: be sure to revbump (if not already done) so that people having installed the bad ebuild will catch the new one at the next update.