Re: 'locate' does not check permissions

[Jim Breton <jamesb-debian@alongtheway.com>]

On Thu, Jun 07, 2001 at 06:57:18PM -0300, Pedro Zorzenon Neto wrote:
>    $ locate private | grep "/home/pzn/private"
>      the whole contents of my private dir suddenly appears here...

Did you run "updatedb" as root anytime recently?

Notice that by default, this command is run (from cron) as user
'nobody,' so any directory he would not be able to read would not appear
in the locate database.

$ cat /etc/cron.daily/find 
#! /bin/sh
#
# cron script to update the `find.codes' database.
#
# Written by Ian A. Murdock <imurdock@debian.org> and 
#            Kevin Dalley <kevin@aimnet.com>

if [ -f /etc/updatedb.conf ]; then
  . /etc/updatedb.conf
fi

cd / && updatedb --localuser=nobody 2>/dev/null


Otoh if you just invoke 'updatedb' as root then every file on every
filesystem scanned will appear in the database, hence producing the
behavior you are seeing.