[opensuse] Two questions

older
[opensuse] Leap 15.0 live - Legacy...

John Andersen

23 Apr 2018 23 Apr '18

03:18

What are .aug files? Seeing a lot of these in /usr/share/augeas/lenses/dist/ under Leap 15 I've traced it to http://augeas.net/index.html but Have no idea why it is on my machine. Second Why does this happen: jsa@poulsbo:~> locate updatedb /etc/updatedb.conf /usr/bin/updatedb ... jsa@poulsbo:~> sudo updatedb [sudo] password for jsa: jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied jsa@poulsbo:~> Why does /var/lib/mlocate/mlocate.db get set as owned by root/root? (Not accepting the "security" nonsense, its a single user machine, and I want to find things that my normal user account can't see.) You will note that after some time, I am again able to use locate, so something seems to change its permissions somewhere along the line. This is the only version of Linux I've ever run into where this happens. -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Show replies by date

Ralph

23 Apr 23 Apr

03:49

On Sun, 22 Apr 2018 20:18:00 -0700 John Andersen wrote:

...

Why does this happen:

...

jsa@poulsbo:~> sudo updatedb [sudo] password for jsa:

...

jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

...

Why does /var/lib/mlocate/mlocate.db get set as owned by root/root?

Because you are running updatedb as root. Avoid it by running updatedb as nobody instead of root.

...

You will note that after some time, I am again able to use locate, so something seems to change its permissions somewhere along the line.

Cron job runs updatedb as nobody and permissions get reset properly. Ralph -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen

04:08

On 04/22/2018 08:49 PM, Ralph wrote:

...

Because you are running updatedb as root. Avoid it by running updatedb as nobody instead of root.

And I already explained AHEAD OF TIME why I wanted to do that. I get half the information I'm looking for. See /etc/sysconfig/locate -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Peter Suetterlin

10:52

John Andersen wrote:

...

On 04/22/2018 08:49 PM, Ralph wrote:

...
Because you are running updatedb as root. Avoid it by running updatedb as nobody instead of root.

And I already explained AHEAD OF TIME why I wanted to do that. I get half the information I'm looking for.

Then set up your own cronjob for updates, and set the permissions accordingly yourself. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R.

12:00

On 2018-04-23 05:49, Ralph wrote:

...

On Sun, 22 Apr 2018 20:18:00 -0700 John Andersen wrote:

...
Why does this happen:

...
jsa@poulsbo:~> sudo updatedb [sudo] password for jsa:

...
jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

...
Why does /var/lib/mlocate/mlocate.db get set as owned by root/root?

Because you are running updatedb as root. Avoid it by running updatedb as nobody instead of root.

No, that is not it. I run it as root, and I can query the results as user: Telcontar:~ # updatedb ; ls -l /var/lib/mlocate/mlocate.db -rw-r--r-- 1 root root 154757756 Apr 23 13:45 /var/lib/mlocate/mlocate.db Telcontar:~ # cer@Telcontar:~> locate locate /CopiaSeguridadParcial/etc/apparmor/profiles/extras/etc.cron.daily.slocate.cron ... /var/lib/locatedb /var/lib/mlocate /var/lib/mlocate/mlocate.db /var/lib/mlocate/mlocate.db.W5MUmj /var/lib/mlocate/mlocate.db.ysGAaV cer@Telcontar:~> /etc/sysconfig/locate: RUN_UPDATEDB_AS="root" Simply change the permissions of the database file so that "others" can read it. If I recall correctly, they are kept. The configuration file is "/etc/updatedb.conf". -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

John Andersen

16:58

On April 23, 2018 5:00:01 AM PDT, "Carlos E. R." wrote:

...

On 2018-04-23 05:49, Ralph wrote:

...
On Sun, 22 Apr 2018 20:18:00 -0700 John Andersen wrote:

...
Why does this happen:

...
jsa@poulsbo:~> sudo updatedb [sudo] password for jsa:

...
jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

...
Why does /var/lib/mlocate/mlocate.db get set as owned by root/root?

Because you are running updatedb as root. Avoid it by running updatedb as nobody instead of root.

No, that is not it. I run it as root, and I can query the results as user:

Telcontar:~ # updatedb ; ls -l /var/lib/mlocate/mlocate.db -rw-r--r-- 1 root root 154757756 Apr 23 13:45 /var/lib/mlocate/mlocate.db

Telcontar:~ #

cer@Telcontar:~> locate locate /CopiaSeguridadParcial/etc/apparmor/profiles/extras/etc.cron.daily.slocate.cron ... /var/lib/locatedb /var/lib/mlocate /var/lib/mlocate/mlocate.db /var/lib/mlocate/mlocate.db.W5MUmj /var/lib/mlocate/mlocate.db.ysGAaV cer@Telcontar:~>

/etc/sysconfig/locate:

RUN_UPDATEDB_AS="root"

Simply change the permissions of the database file so that "others" can read it. If I recall correctly, they are kept.

The configuration file is "/etc/updatedb.conf".

I don't think permissions are kept. Not in leap 15. (Because I've set them to root/users and reran updatedb.) I think this changed to operate as it does in SLES, where it makes more sense to allow only root. My point is that it had never been set to root/root in the past. -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R.

18:22

On 2018-04-23 18:58, John Andersen wrote:

...

On April 23, 2018 5:00:01 AM PDT, "Carlos E. R." <> wrote:

...

...
Simply change the permissions of the database file so that "others" can read it. If I recall correctly, they are kept.

The configuration file is "/etc/updatedb.conf".

I don't think permissions are kept.

Not in leap 15. (Because I've set them to root/users and reran updatedb.)

You failed to say it was about Leap 15. It may be a bug. It may be a changed feature.

...

I think this changed to operate as it does in SLES, where it makes more sense to allow only root.

My point is that it had never been set to root/root in the past.

mlocate is different from locate. Access permission to users in mlocate is based on which users can read the database file, simple as that. So either the permissions are kept each time the file is updated, or the configuration file changes them. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

John Andersen

19:15

On 04/23/2018 11:22 AM, Carlos E. R. wrote:

...

On 2018-04-23 18:58, John Andersen wrote:

...
On April 23, 2018 5:00:01 AM PDT, "Carlos E. R." <> wrote:

...
...
Simply change the permissions of the database file so that "others" can read it. If I recall correctly, they are kept.

The configuration file is "/etc/updatedb.conf".

I don't think permissions are kept.

Not in leap 15. (Because I've set them to root/users and reran updatedb.)

You failed to say it was about Leap 15. It may be a bug. It may be a changed feature.

Yup, my bad. Should have mentioned that.

...

...
I think this changed to operate as it does in SLES, where it makes more sense to allow only root.

My point is that it had never been set to root/root in the past.

mlocate is different from locate. Access permission to users in mlocate is based on which users can read the database file, simple as that. So either the permissions are kept each time the file is updated, or the configuration file changes them.

There is only a locate executable on my system. The database is named mlocate.db The package installed is mlocate. The package description says: "A new locate implementation. The m character stands for merging, because updatedb reuses the existing database to avoid re-reading most of the file system." So that sounds EXACTLY like you SUGGESTED, and I could change the permissions and expect it to stay the way I want it. However as shown below, this fails.

...

jsa@poulsbo:~> sudo updatedb [sudo] password for jsa: jsa@poulsbo:~> locate locate locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied ... jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 12:08 /var/lib/mlocate/mlocate.db

By the way, man updatedb already shows there are provisions for allowing visibility checking, ( --require-visibility ) so there should be no reason to restrict visibility with file permissions. And I wager your 42.2 or 42.3 does not behave like this. This seems like another SLES security patch that has found its way into opensuse. -- After all is said and done, more is said than done.

Carlos E. R.

19:46

On 2018-04-23 21:15, John Andersen wrote:

...

On 04/23/2018 11:22 AM, Carlos E. R. wrote:

...
On 2018-04-23 18:58, John Andersen wrote:

...
On April 23, 2018 5:00:01 AM PDT, "Carlos E. R." <> wrote:

...
...
Simply change the permissions of the database file so that "others" can read it. If I recall correctly, they are kept.

The configuration file is "/etc/updatedb.conf".

I don't think permissions are kept.

Not in leap 15. (Because I've set them to root/users and reran updatedb.)

You failed to say it was about Leap 15. It may be a bug. It may be a changed feature.

Yup, my bad. Should have mentioned that.

...
...
I think this changed to operate as it does in SLES, where it makes more sense to allow only root.

My point is that it had never been set to root/root in the past.

mlocate is different from locate. Access permission to users in mlocate is based on which users can read the database file, simple as that. So either the permissions are kept each time the file is updated, or the configuration file changes them.

There is only a locate executable on my system. The database is named mlocate.db The package installed is mlocate.

The package description says:

"A new locate implementation. The m character stands for merging, because updatedb reuses the existing database to avoid re-reading most of the file system."

So that sounds EXACTLY like you SUGGESTED, and I could change the permissions and expect it to stay the way I want it. However as shown below, this fails.

...
jsa@poulsbo:~> sudo updatedb [sudo] password for jsa: jsa@poulsbo:~> locate locate locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied ... jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 12:08 /var/lib/mlocate/mlocate.db

What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again? -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

John Andersen

20:26

On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...

...
...

...
jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 12:08 /var/lib/mlocate/mlocate.db What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

jsa@poulsbo:~> sudo chmod 644 /var/lib/mlocate/mlocate.db jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw-r--r-- 1 root root 11482767 Apr 23 13:20 /var/lib/mlocate/mlocate.db jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate carlos locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied -- After all is said and done, more is said than done.

Carlos E. R.

20:43

On 2018-04-23 22:26, John Andersen wrote:

...

On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
...
...

...
jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 12:08 /var/lib/mlocate/mlocate.db What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

jsa@poulsbo:~> sudo chmod 644 /var/lib/mlocate/mlocate.db jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw-r--r-- 1 root root 11482767 Apr 23 13:20 /var/lib/mlocate/mlocate.db jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate carlos locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

And "l /var/lib/mlocate/mlocate.db"? Well, I think this is a bug or changed feature. IMO, time to ask in the factory mail list prior to entering a bugzilla. I don't have "Leap 15" running this instant to look it up myself. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

John Andersen

20:45

On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...

What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

Tell me Carlos, do you have a locate group, and is your personal account a member of group locate? I see in the package change log that there was a patch that deprecated the locate group, and suse forced in the group of root. -- After all is said and done, more is said than done.

Knurpht ＠ openSUSE

20:51

Op maandag 23 april 2018 22:45:27 CEST schreef John Andersen:

...

On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

Tell me Carlos, do you have a locate group, and is your personal account a member of group locate? I see in the package change log that there was a patch that deprecated the locate group, and suse forced in the group of root. AFAICS you're barking up the wrong tree, i.e. getting away from defaults further and further. Here's output of an updated Leap 15 install:

knurpht@linux-ojp4:~> sudo zypper in mlocate [sudo] password for root: Sorry, try again. [sudo] password for root: Loading repository data... Warning: Repository 'openSUSE-Leap-15.0-Update' appears to be outdated. Consider using a different mirror or server. Warning: Repository 'openSUSE-Leap-15.0-Update-Non-Oss' appears to be outdated. Consider using a different mirror or server. Reading installed packages... Resolving package dependencies... The following 2 NEW packages are going to be installed: mlocate mlocate-lang The following recommended package was automatically selected: mlocate-lang 2 new packages to install. Overall download size: 123.7 KiB. Already cached: 0 B. After the operation, additional 389.3 KiB will be used. Continue? [y/n/...? shows all options] (y): y Retrieving package mlocate-0.26-lp150.2.7.x86_64 (1/2), 68.8 KiB (143.3 KiB unpacked) Retrieving: mlocate-0.26-lp150.2.7.x86_64.rpm ........................................................................................................................................ [done] Retrieving package mlocate-lang-0.26-lp150.2.7.noarch (2/2), 54.9 KiB (246.0 KiB unpacked) Retrieving: mlocate-lang-0.26-lp150.2.7.noarch.rpm ................................................................................................................................... [done] Checking for file conflicts: ......................................................................................................................................................... [done] (1/2) Installing: mlocate-0.26-lp150.2.7.x86_64 ...................................................................................................................................... [done] Additional rpm output: Updating /etc/sysconfig/locate ... (2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ................................................................................................................................. [done] knurpht@linux-ojp4:~> sudo updatedb knurpht@linux-ojp4:~> locate updatedb /etc/updatedb.conf /usr/bin/updatedb /usr/share/augeas/lenses/dist/updatedb.aug /usr/share/man/man5/updatedb.conf.5.gz /usr/share/man/man8/updatedb.8.gz /usr/share/vim/vim80/ftplugin/updatedb.vim /usr/share/vim/vim80/syntax/updatedb.vim knurpht@linux-ojp4:~> So, you must have changed something in the system that stios locate from working. -- Gertjan Lettink a.k.a. Knurpht openSUSE Board Member openSUSE Forums Team -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen

21:16

On 04/23/2018 01:51 PM, Knurpht @ openSUSE wrote:

...

Op maandag 23 april 2018 22:45:27 CEST schreef John Andersen:

...
On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

Tell me Carlos, do you have a locate group, and is your personal account a member of group locate? I see in the package change log that there was a patch that deprecated the locate group, and suse forced in the group of root. AFAICS you're barking up the wrong tree, i.e. getting away from defaults further and further. Here's output of an updated Leap 15 install:

knurpht@linux-ojp4:~> sudo zypper in mlocate [sudo] password for root: Sorry, try again. [sudo] password for root: Loading repository data... Warning: Repository 'openSUSE-Leap-15.0-Update' appears to be outdated. Consider using a different mirror or server. Warning: Repository 'openSUSE-Leap-15.0-Update-Non-Oss' appears to be outdated. Consider using a different mirror or server. Reading installed packages... Resolving package dependencies...

The following 2 NEW packages are going to be installed: mlocate mlocate-lang

The following recommended package was automatically selected: mlocate-lang

2 new packages to install. Overall download size: 123.7 KiB. Already cached: 0 B. After the operation, additional 389.3 KiB will be used. Continue? [y/n/...? shows all options] (y): y Retrieving package mlocate-0.26-lp150.2.7.x86_64 (1/2), 68.8 KiB (143.3 KiB unpacked) Retrieving: mlocate-0.26-lp150.2.7.x86_64.rpm ........................................................................................................................................ [done] Retrieving package mlocate-lang-0.26-lp150.2.7.noarch (2/2), 54.9 KiB (246.0 KiB unpacked) Retrieving: mlocate-lang-0.26-lp150.2.7.noarch.rpm ................................................................................................................................... [done] Checking for file conflicts: ......................................................................................................................................................... [done] (1/2) Installing: mlocate-0.26-lp150.2.7.x86_64 ...................................................................................................................................... [done] Additional rpm output: Updating /etc/sysconfig/locate ...

(2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ................................................................................................................................. [done] knurpht@linux-ojp4:~> sudo updatedb knurpht@linux-ojp4:~> locate updatedb /etc/updatedb.conf /usr/bin/updatedb /usr/share/augeas/lenses/dist/updatedb.aug /usr/share/man/man5/updatedb.conf.5.gz /usr/share/man/man8/updatedb.8.gz /usr/share/vim/vim80/ftplugin/updatedb.vim /usr/share/vim/vim80/syntax/updatedb.vim knurpht@linux-ojp4:~>

So, you must have changed something in the system that stios locate from working.

Nope, don't think so. Even forcing a reinstall and doing exactly as you did, I get different results. jsa@poulsbo:~> sudo zypper in -f mlocate mlocate-lang Loading repository data... Warning: Repository 'openSUSE-Leap-15.0-Update' appears to be outdated. Consider using a different mirror or server. Warning: Repository 'openSUSE-Leap-15.0-Update-Non-Oss' appears to be outdated. Consider using a different mirror or server. Reading installed packages... Forcing installation of 'mlocate-0.26-lp150.2.7.x86_64' from repository 'Main Repository (OSS)'. Forcing installation of 'mlocate-lang-0.26-lp150.2.7.noarch' from repository 'Main Repository (OSS)'. Resolving package dependencies... The following 2 packages are going to be reinstalled: mlocate mlocate-lang 2 packages to reinstall. Overall download size: 123.7 KiB. Already cached: 0 B. No additional space will be used or freed after the operation. Continue? [y/n/...? shows all options] (y): Retrieving package mlocate-0.26-lp150.2.7.x86_64 (1/2), 68.8 KiB (143.3 KiB unpacked) Retrieving: mlocate-0.26-lp150.2.7.x86_64.rpm .....................................................[done (758.5 KiB/s)] Retrieving package mlocate-lang-0.26-lp150.2.7.noarch (2/2), 54.9 KiB (246.0 KiB unpacked) Retrieving: mlocate-lang-0.26-lp150.2.7.noarch.rpm ..............................................................[done] Checking for file conflicts: ....................................................................................[done] (1/2) Installing: mlocate-0.26-lp150.2.7.x86_64 .................................................................[done] Additional rpm output: Updating /etc/sysconfig/locate ... (2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ............................................................[done] jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied BUT, maybe you could check if your permissions and user:group are the same as mine: jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db I'm denied access both by permissions and group membership. If I fix both (root:users and 640 permissions) I can access it till the next time it is run by cron. Check your /etc/cron.daily/mlocate.cron and see all the tricks its doing with permissions and ownership. -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R.

22:00

On 2018-04-23 23:16, John Andersen wrote:

...

On 04/23/2018 01:51 PM, Knurpht @ openSUSE wrote:

...
Op maandag 23 april 2018 22:45:27 CEST schreef John Andersen:

...
On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...

...
knurpht@linux-ojp4:~>

So, you must have changed something in the system that stios locate from working.

Nope, don't think so.

Even forcing a reinstall and doing exactly as you did, I get different results.

The config files are not replaced with a reinstall, only the binaries. Try running "rcrpmconfigcheck" to check.

...

(2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ............................................................[done] jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

BUT, maybe you could check if your permissions and user:group are the same as mine:

jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db

I'm denied access both by permissions and group membership. If I fix both (root:users and 640 permissions) I can access it till the next time it is run by cron. Check your /etc/cron.daily/mlocate.cron and see all the tricks its doing with permissions and ownership.

Let's see. I only have 42.3 this instant. Can you post the 15.0 version? # run the updatedb if possible if [ -x /usr/bin/updatedb ]; then if [ -z "${RUN_UPDATEDB_AS}" ] ; then RUN_UPDATEDB_AS=root fi # change the perms to the var directory to our desired user chown -R "${RUN_UPDATEDB_AS}":root /var/lib/mlocate This is it, it changes the owner, but not the permissions. # change the user and run the updatedb under it /usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" else echo >&2 "Warning: \"/usr/bin/updatedb\" is not executable, unable to run updatedb." exit 0 fi -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

Carlos E. R.

22:08

On 2018-04-24 00:00, Carlos E. R. wrote:

...

On 2018-04-23 23:16, John Andersen wrote:

...

...
I'm denied access both by permissions and group membership. If I fix both (root:users and 640 permissions) I can access it till the next time it is run by cron. Check your /etc/cron.daily/mlocate.cron and see all the tricks its doing with permissions and ownership.

Let's see. I only have 42.3 this instant. Can you post the 15.0 version?

Ok, I have access to the file: cer@minas-tirith:~> diff /etc/cron.daily/mlocate.cron /other//etc/cron.daily/mlocate.cron 8c59 < /usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" ---

...

/usr/bin/su "${RUN_UPDATEDB_AS}" -c "umask 0022; /usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" 7

That's the culprit, they change mask now. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" (Minas Tirith))

John Andersen

22:40

On 04/23/2018 03:08 PM, Carlos E. R. wrote:

...

On 2018-04-24 00:00, Carlos E. R. wrote:

...
On 2018-04-23 23:16, John Andersen wrote:

...
...
I'm denied access both by permissions and group membership. If I fix both (root:users and 640 permissions) I can access it till the next time it is run by cron. Check your /etc/cron.daily/mlocate.cron and see all the tricks its doing with permissions and ownership.

Let's see. I only have 42.3 this instant. Can you post the 15.0 version?

Ok, I have access to the file:

cer@minas-tirith:~> diff /etc/cron.daily/mlocate.cron /other//etc/cron.daily/mlocate.cron

8c59 < /usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" ---

...
/usr/bin/su "${RUN_UPDATEDB_AS}" -c "umask 0022; /usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" 7

That's the culprit, they change mask now.

Worse than that Carlos. They change the owner and permissions depending on HOW updatedb is run. Here is did it by logging in as root: poulsbo:~ # l /var/lib/mlocate/mlocate.db -rw-r----- 1 root users 11585521 Apr 23 15:18 /var/lib/mlocate/mlocate.db poulsbo:~ # updatedb poulsbo:~ # l /var/lib/mlocate/mlocate.db -rw-r--r-- 1 root root 11585521 Apr 23 15:21 /var/lib/mlocate/mlocate.db poulsbo:~ # NOTE: at this point I stepped to another terminal and ran sudo updatedb logged inas my normal user... then stepped back to the root terminal and see it is changed yet again. poulsbo:~ # l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11585521 Apr 23 15:21 /var/lib/mlocate/mlocate.db poulsbo:~ # Running as root it STILL messes it up, and Running as SUDO it messes it up different. I wonder if this is an uSLES specific version of updatedb, because its is sure doing different things on my box than yours and Gertjan Lettink's. -- After all is said and done, more is said than done.

Carlos E. R.

24 Apr 24 Apr

00:06

On 2018-04-24 00:40, John Andersen wrote:

...

On 04/23/2018 03:08 PM, Carlos E. R. wrote:

...

...
cer@minas-tirith:~> diff /etc/cron.daily/mlocate.cron /other//etc/cron.daily/mlocate.cron

8c59 < /usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" ---

...
/usr/bin/su "${RUN_UPDATEDB_AS}" -c "umask 0022; /usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" 7

That's the culprit, they change mask now.

Worse than that Carlos. They change the owner and permissions depending on HOW updatedb is run.

I think that is because of the mask that the process is already running; running the script under su, sudo, etc, maybe gets different umask. This something I'm not clear about, I never fully understood how umask works. You might add a line in the script to do: umask to print it. Then you might change the line in the script above to what it was in 42.3 to restore the old behaviour (remove the umask 022;). -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" (Minas Tirith))

John Andersen

23 Apr 23 Apr

22:48

And, also, Carlos, didn't you say your user is also a member of root? That seems really dangerous and non-standard. Why do you do that? -- After all is said and done, more is said than done.

Carlos E. R.

24 Apr 24 Apr

00:00

On 2018-04-24 00:48, John Andersen wrote:

...

And, also, Carlos, didn't you say your user is also a member of root? That seems really dangerous and non-standard. Why do you do that?

To be able to see the logs and some files as user. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" (Minas Tirith))

John Andersen

23 Apr 23 Apr

22:23

On 04/23/2018 03:00 PM, Carlos E. R. wrote:

...

On 2018-04-23 23:16, John Andersen wrote:

...
On 04/23/2018 01:51 PM, Knurpht @ openSUSE wrote:

...
Op maandag 23 april 2018 22:45:27 CEST schreef John Andersen:

...
On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
...
knurpht@linux-ojp4:~>

So, you must have changed something in the system that stios locate from working.

Nope, don't think so.

Even forcing a reinstall and doing exactly as you did, I get different results.

The config files are not replaced with a reinstall, only the binaries.

Try running "rcrpmconfigcheck" to check.

...
(2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ............................................................[done] jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

BUT, maybe you could check if your permissions and user:group are the same as mine:

jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db

I'm denied access both by permissions and group membership. If I fix both (root:users and 640 permissions) I can access it till the next time it is run by cron. Check your /etc/cron.daily/mlocate.cron and see all the tricks its doing with permissions and ownership.

Let's see. I only have 42.3 this instant. Can you post the 15.0 version?

# run the updatedb if possible if [ -x /usr/bin/updatedb ]; then if [ -z "${RUN_UPDATEDB_AS}" ] ; then RUN_UPDATEDB_AS=root fi # change the perms to the var directory to our desired user

chown -R "${RUN_UPDATEDB_AS}":root /var/lib/mlocate

This is it, it changes the owner, but not the permissions.

# change the user and run the updatedb under it /usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" else echo >&2 "Warning: \"/usr/bin/updatedb\" is not executable, unable to run updatedb." exit 0 fi

Mine is quite a bit larger: It changes both owner and group, and it hammers permissions with umask commands. jsa@poulsbo:~> cat /etc/cron.daily/mlocate.cron #! /bin/sh set -e # ensure we have proper umask bnc#941296 umask 0022 # check if we are already running (lockfile) LOCKFILE="/run/lock/mlocate.daily.lock" if [ -e "${LOCKFILE}" ]; then echo >&2 "Warning: \"${LOCKFILE}\" already present, not running updatedb." exit 1 fi touch "${LOCKFILE}" # trap the lockfile only if we really run the updatedb trap "rm -f ${LOCKFILE}" EXIT # source the user specified variables if [ -f /etc/sysconfig/locate ] ; then . /etc/sysconfig/locate # Compat code for including variables from findutils-locate # where the values were store in /etc/sysconfig/locate if [ -n "${UPDATEDB_PRUNEFS}" ] ; then UPDATEDB_PRUNEFS="--add-prunefs=\"${UPDATEDB_PRUNEFS}\"" fi if [ -n "${UPDATEDB_PRUNEPATHS}" ] ; then UPDATEDB_PRUNEPATHS="--add-prunepaths=\"${UPDATEDB_PRUNEPATHS}\"" fi fi # check if user said he want the db generated if [ -z "${RUN_UPDATEDB}" ] || [ "${RUN_UPDATEDB}" != "yes" ] ; then exit 0 fi # check the config file NODEVS="" if [ ! -f /etc/updatedb.conf ]; then NODEVS="-f $(< /proc/filesystems awk '$1 == "nodev" && $2 != "rootfs" { print $2 }')" fi # alter the priority of the updatedb process if [ -x /usr/bin/renice ]; then /usr/bin/renice +${NICE:-19} -p $$ > /dev/null 2>&1 fi if [ -x /usr/bin/ionice ] && /usr/bin/ionice -c3 true 2>/dev/null; then /usr/bin/ionice -c${IONICE_CLASS:-2} -n${IONICE_PRIORITY:-7} -p $$ > /dev/null 2>&1 fi # run the updatedb if possible if [ -x /usr/bin/updatedb ]; then if [ -z "${RUN_UPDATEDB_AS}" ] ; then RUN_UPDATEDB_AS=root fi # change the perms to the var directory to our desired user chown -R "${RUN_UPDATEDB_AS}":root /var/lib/mlocate # change the user and run the updatedb under it /usr/bin/su "${RUN_UPDATEDB_AS}" -c "umask 0022; /usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}" else echo >&2 "Warning: \"/usr/bin/updatedb\" is not executable, unable to run updatedb." exit 1 fi -- After all is said and done, more is said than done.

Knurpht ＠ openSUSE

24 Apr 24 Apr

12:00

Op maandag 23 april 2018 23:16:49 CEST schreef John Andersen:

...

On 04/23/2018 01:51 PM, Knurpht @ openSUSE wrote:

...
Op maandag 23 april 2018 22:45:27 CEST schreef John Andersen:

...
On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

Tell me Carlos, do you have a locate group, and is your personal account a member of group locate? I see in the package change log that there was a patch that deprecated the locate group, and suse forced in the group of root.

AFAICS you're barking up the wrong tree, i.e. getting away from defaults further and further. Here's output of an updated Leap 15 install:

knurpht@linux-ojp4:~> sudo zypper in mlocate [sudo] password for root: Sorry, try again. [sudo] password for root: Loading repository data... Warning: Repository 'openSUSE-Leap-15.0-Update' appears to be outdated. Consider using a different mirror or server. Warning: Repository 'openSUSE-Leap-15.0-Update-Non-Oss' appears to be outdated. Consider using a different mirror or server. Reading installed packages... Resolving package dependencies...

The following 2 NEW packages are going to be installed: mlocate mlocate-lang

The following recommended package was automatically selected: mlocate-lang

2 new packages to install. Overall download size: 123.7 KiB. Already cached: 0 B. After the operation, additional 389.3 KiB will be used. Continue? [y/n/...? shows all options] (y): y Retrieving package mlocate-0.26-lp150.2.7.x86_64 (1/2), 68.8 KiB (143.3 KiB unpacked) Retrieving: mlocate-0.26-lp150.2.7.x86_64.rpm .......................................................................... .............................................................. [done] Retrieving package mlocate-lang-0.26-lp150.2.7.noarch (2/2), 54.9 KiB (246.0 KiB unpacked) Retrieving: mlocate-lang-0.26-lp150.2.7.noarch.rpm .......................................................................... ......................................................... [done] Checking for file conflicts: .......................................................................... .......................................................................... ..... [done] (1/2) Installing: mlocate-0.26-lp150.2.7.x86_64 .......................................................................... ............................................................ [done] Additional rpm output: Updating /etc/sysconfig/locate ...

(2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch .......................................................................... ....................................................... [done] knurpht@linux-ojp4:~> sudo updatedb knurpht@linux-ojp4:~> locate updatedb /etc/updatedb.conf /usr/bin/updatedb /usr/share/augeas/lenses/dist/updatedb.aug /usr/share/man/man5/updatedb.conf.5.gz /usr/share/man/man8/updatedb.8.gz /usr/share/vim/vim80/ftplugin/updatedb.vim /usr/share/vim/vim80/syntax/updatedb.vim knurpht@linux-ojp4:~>

So, you must have changed something in the system that stios locate from working.

Nope, don't think so.

Even forcing a reinstall and doing exactly as you did, I get different results.

jsa@poulsbo:~> sudo zypper in -f mlocate mlocate-lang Loading repository data... Warning: Repository 'openSUSE-Leap-15.0-Update' appears to be outdated. Consider using a different mirror or server. Warning: Repository 'openSUSE-Leap-15.0-Update-Non-Oss' appears to be outdated. Consider using a different mirror or server. Reading installed packages... Forcing installation of 'mlocate-0.26-lp150.2.7.x86_64' from repository 'Main Repository (OSS)'. Forcing installation of 'mlocate-lang-0.26-lp150.2.7.noarch' from repository 'Main Repository (OSS)'. Resolving package dependencies...

The following 2 packages are going to be reinstalled: mlocate mlocate-lang

2 packages to reinstall. Overall download size: 123.7 KiB. Already cached: 0 B. No additional space will be used or freed after the operation. Continue? [y/n/...? shows all options] (y): Retrieving package mlocate-0.26-lp150.2.7.x86_64 (1/2), 68.8 KiB (143.3 KiB unpacked) Retrieving: mlocate-0.26-lp150.2.7.x86_64.rpm .....................................................[done (758.5 KiB/s)] Retrieving package mlocate-lang-0.26-lp150.2.7.noarch (2/2), 54.9 KiB (246.0 KiB unpacked) Retrieving: mlocate-lang-0.26-lp150.2.7.noarch.rpm ..............................................................[done] Checking for file conflicts: ............................................................................ ........[done] (1/2) Installing: mlocate-0.26-lp150.2.7.x86_64 .................................................................[done] Additional rpm output: Updating /etc/sysconfig/locate ...

(2/2) Installing: mlocate-lang-0.26-lp150.2.7.noarch ............................................................[done] jsa@poulsbo:~> sudo updatedb jsa@poulsbo:~> locate updatedb locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied

BUT, maybe you could check if your permissions and user:group are the same as mine:

jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db Here's the culprit. These are the perms on my Leap 15:

knurpht@linux-ojp4:~> ls -ld /var/lib/mlocate/ drwxr-xr-x 2 nobody root 4096 Apr 23 23:00 /var/lib/mlocate/ -- Gertjan Lettink a.k.a. Knurpht openSUSE Board Member openSUSE Forums Team -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R.

12:11

On 2018-04-24 14:00, Knurpht @ openSUSE wrote:

...

Op maandag 23 april 2018 23:16:49 CEST schreef John Andersen:

...

...
BUT, maybe you could check if your permissions and user:group are the same as mine:

jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db Here's the culprit. These are the perms on my Leap 15:

knurpht@linux-ojp4:~> ls -ld /var/lib/mlocate/ drwxr-xr-x 2 nobody root 4096 Apr 23 23:00 /var/lib/mlocate/

Nope, he wants to run locate as root. So do I. The culprit is this change in the code: Old:

...

/usr/bin/su "${RUN_UPDATEDB_AS}" -c "/usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}"

New:

...

/usr/bin/su "${RUN_UPDATEDB_AS}" -c "umask 0022; /usr/bin/updatedb ${NODEVS} ${UPDATEDB_PRUNEFS} ${UPDATEDB_PRUNEPATHS}"

It sets "umask 0022". I will probably edit the script to forcibly set my choice of user:group and perms. One thing more to do on my systems. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

Carlos E. R.

23 Apr 23 Apr

20:57

On 2018-04-23 22:45, John Andersen wrote:

...

On 04/23/2018 12:46 PM, Carlos E. R. wrote:

...
What happens if you manually change the permissions to, say, "-rw-r--r--" and then run updatedb again?

Tell me Carlos, do you have a locate group, and is your personal account a member of group locate? I see in the package change log that there was a patch that deprecated the locate group, and suse forced in the group of root.

My normal user belongs to "root" group. But I also tested with a different user that doesn't, and could locate just fine. There was some setting that, after having access to the database via file permissions, would allow the user to find files to which he had no permissions; ie, find files of a different user. This could be allowed or disallowed. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)

John Andersen

21:20

On 04/23/2018 01:57 PM, Carlos E. R. wrote:

...

There was some setting that, after having access to the database via file permissions, would allow the user to find files to which he had no permissions; ie, find files of a different user. This could be allowed or disallowed.

Yup, saw that, sudo updatedb --require-visibility no But the problem is that the permissions and ownership are killing me. jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db And I can't figure out where this is being done. -- After all is said and done, more is said than done.

Patrick Shanahan

22:23

* John Andersen [04-23-18 17:23]:

...

On 04/23/2018 01:57 PM, Carlos E. R. wrote:

...
There was some setting that, after having access to the database via file permissions, would allow the user to find files to which he had no permissions; ie, find files of a different user. This could be allowed or disallowed.

Yup, saw that, sudo updatedb --require-visibility no

But the problem is that the permissions and ownership are killing me. jsa@poulsbo:~> l /var/lib/mlocate/mlocate.db -rw------- 1 root root 11482794 Apr 23 14:05 /var/lib/mlocate/mlocate.db

And I can't figure out where this is being done.

my tw: -rw-r--r-- 1 nobody nobody 14978559 Apr 23 00:15 /var/lib/mlocate/mlocate.db don't you have a group "nobody"? -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Registered Linux User #207535 @ http://linuxcounter.net Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen

22:44

On 04/23/2018 03:23 PM, Patrick Shanahan wrote:

...

my tw: -rw-r--r-- 1 nobody nobody 14978559 Apr 23 00:15 /var/lib/mlocate/mlocate.db

don't you have a group "nobody"?

Yes, but don't want to run it as nobody, because nobody can't see all the stuff. (This is a private machine, I don't have a herd of users to worry about, and even if I did, there are built in facilities already in "locate and updatedb" to handle these. The problems I'm having look like the product of a crude suse hack rather than the work of someone who actually read the man pages. -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R.

23:59

On 2018-04-24 00:23, Patrick Shanahan wrote:

...

* John Andersen <> [04-23-18 17:23]:

...

my tw: -rw-r--r-- 1 nobody nobody 14978559 Apr 23 00:15 /var/lib/mlocate/mlocate.db

don't you have a group "nobody"?

But then it doesn't list every file. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" (Minas Tirith))

Peter Suetterlin

24 Apr 24 Apr