Bug 170201

Summary: slocate allows listing directories that can not be viewed with ls -l
Product: [Fedora] Fedora Reporter: Russell Coker <rcoker>
Component: slocateAssignee: Miloslav Trmač <mitr>
Status: CLOSED RAWHIDE QA Contact: Brock Organ <borgan>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: dwmw2, sgrubb
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 2.7-28 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-10-10 21:23:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
patch to fix this bug none

Description Russell Coker 2005-10-08 22:56:51 UTC 
From Bugzilla Helper: User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.91 (like Gecko)  Description of problem: if (UID == 0 || check_path_access(strdup(codedpath)))    slocate currently has the above code.  This means that if it is run as root it  will be able to display information on all files unconditionally.  On a non-SE  system this is OK as root will have ultimate access.  On a SE Linux with  targeted policy it's not a problem as the daemons can't run slocate and user  sessions are unconfined (so a user session as root can do everything).    On a SE Linux machine running the strict policy this is not desirable as an  unprivileged root user can list all the files on the system.  We don't  recommend that you have unprivileged root users so in the past this bug has  really only affected me.    Now that we are working on MLS support for LSPP certification this has become  a serious issue.  We don't want a copy of slocate running at "secret"  clearance to be able to see the names of files in a "top secret" classified  directory.   Version-Release number of selected component (if applicable):   How reproducible: Always  Steps to Reproduce: Run locate as an unprivileged root user.   Additional info:
Comment 1 Russell Coker 2005-10-08 22:59:11 UTC 
Created attachment 119737 [details]
patch to fix this bug
Comment 2 Miloslav Trmač 2005-10-10 21:23:31 UTC 
Fixed in slocate-2.7-28.  Thanks!