bugfindutils - Bugs: bug #61083, [feature request]: make...

 
 

bug #61083: [feature request]: make updatedb.findutils more compatible by no longer using `su nobody`

Submitter:  Yancey Chiew <yanceychiw>
Submitted:  Wed 25 Aug 2021 08:28:14 PM UTC
   
 
Category:  locate Severity:  1 - Wish
Item Group:  None Status:  Platform Issue
Privacy:  Public Assigned to:  berny
Originator Name:  Open/Closed:  Closed
Release:  4.6.0 Fixed Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 28 Aug 2021 03:03:36 PM UTC, comment #3: 

No worries, thanks for confirming.
I'm hereby closing this issue.

Bernhard Voelker <berny>
Group administrator
Sat 28 Aug 2021 02:58:36 PM UTC, comment #2: 


comment #1:

> First of all, updatedb does not use 'nobody' - it is the wrapping script
> ...


Thank you for your patience.

At first I thought that putting the locate script into cron.daily was a branching behavior adapted to the system environment. So even if systemd logs in the user who is switched to by su without the --login option, that's weird, I am still thinking about making findutils better adapt to it anyway.

Now I realize that adapting to different system environments should be part of the package distribution work, and the locate script itself is not provided by gnu finduitils.

I'm sorry to have made this mistake so that an unreasonable request was made.

Yancey Chiew <yanceychiw>
Thu 26 Aug 2021 08:52:10 PM UTC, comment #1: 

First of all, updatedb does not use 'nobody' - it is the wrapping script
on the particular system which calls it with the --localuser=nobody option.

Then, su(1) is the portable way of switching the user.
setpriv(1) is part of util-linux and therefore probably not available
on other platforms like the BSDs, Solaris, etc.

AFAIK the systemd folks also re-invented the wheel for good old cron,
and they are recommending to use systemd-timer instead.  I'm not sure
whether that would solve that problem wrt/ destroying sessions though.
Still, managing sessions is a problem far outside of the GNU findutils,
and IMO should therefore be fixed or worked around that problem there.

Thus said, if a system is using systemd, but running cron causes problems
there when switching the user, then my suggestion is to already run the cron
job as a dedicated, non-privileged user, and avoid using the --localuser
option in the wrapping script.

I'm hereby changing the severity to "wish", and chances are we can close
this issue soon as "platform issue" or "working as intended".

Bernhard Voelker <berny>
Group administrator
Wed 25 Aug 2021 08:28:14 PM UTC, original submission:  

There is a locate script in the /etc/cron.daily directory, which calls /usr/bin/updatedb.findutils to maintain the update of the file index database.

In the updatedb.findutils script, su is used to switch the user to nobody. Because the script is actually called by cron, which will cause the login of the nobody user and it's subsequent exit.

The login and logout of the nobody user are maintained by systemd-logind.service. Due to the characteristics of logind, after the daily task of locate is executed, the nobody user will log out, and systemd will clean up all the IPC files created by the nobody user. The logind's RemoveIPC option can control that, and it's turned on by default.

Considering that the nobody user is not specifically created by findutils, other programs in the system may also be executed as it, the IPC files they create will be cleaned up along with the exit of the user session of nobody, and causing abnormalities in these programs.

So,if it is necessary to use the identity of nobody to perform the file index database update task, can setpriv or maybe another way without login session replace su?

https://git.savannah.gnu.org/cgit/findutils.git/tree/locate/updatedb.sh?id=a5659a42fa2db0263ca45b1f1806f32c04505dc8#n296

Yancey Chiew <yanceychiw>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by berny (Posted a comment)
  • -email is unavailable- added by yanceychiw (Submitted the item)
  • -email is unavailable- added by yanceychiw (updatedb.findutils issue feedback notification)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-28 berny StatusNone Platform Issue
        Open/ClosedOpen Closed
    2021-08-26 berny Severity3 - Normal 1 - Wish
        Assigned toNone berny
    2021-08-25 yanceychiw Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code