* Andrew Bower <[email protected]> [260729 22:29]:
On Wed, Jul 29, 2026 at 06:47:00PM +0200, Andreas Metzler wrote:
On 2026-07-29 Andrew Bower <[email protected]> wrote:
> 3. The real worker, /usr/bin/updatedb.findutils, uses 'su' to become
> 'nobody'. This is not the right way to drop privileges. su is designed
> for human users, for a start. util-linux ships with 'runuser' which is
> more suitable for system scripts, has a minimal pam configuration and
> does not reproduce this problem! I tried this and it works, although it
> would need to be considered carefully by the 'locate' maintainers for
> unintended consequences.
This seems to be the right take away to me (with my util-linux
package maintainer hat on). `su` is not meant to be run
non-interactively, even though that was popular in the past.
Another thing: maybe updatedb should not start out as root in the
first place?
Chris
