Control: reassign -1 locate 4.10.0-3 On 2026-07-29 Andrew Bower <[email protected]> wrote: > Hi Derek,
> A few interesting things arise from this bug report. > > pam_wtmpdb(su:session): add_entry: Adding an entry did not return > > SQLITE_DONE: 8 > > pam_lastlog2(su:session): Delete statement did not return SQLITE_DONE: 8 > 1. forky will benefit from upstream's improved error reporting, which > shows the exact reason for the failure: > Jul 28 22:10:14 [su] pam_wtmpdb(su:session): Adding an entry failed: attempt > to write a readonly database > 2. This points within /usr/lib/systemd/system/locate.service to: > ProtectSystem=strict > I reproduced this condition absent systemd by running: > unshare --mount > mount -o ro /var/log /var/log > /etc/cron.daily/locate systemd-timer > > Running /etc/cron.daily/locate directly doesn't create the errors so it's > > something to do with the sandbox that systemd is setting up. > As you surmise, this is the service hardening tail wagging the > pre-existing functionality dog, in this case not letting a pam module > write to its log files. > One could play whack-a-mole here and open a hole with ReadWritePaths, or > demote ProtectSystem to "=full". > However, I think we can do better. > 3. The real worker, /usr/bin/updatedb.findutils, uses 'su' to become > 'nobody'. This is not the right way to drop privileges. su is designed > for human users, for a start. util-linux ships with 'runuser' which is > more suitable for system scripts, has a minimal pam configuration and > does not reproduce this problem! I tried this and it works, although it > would need to be considered carefully by the 'locate' maintainers for > unintended consequences. > I suggest this is fixed via a shell function which falls back to 'su' so > that 'locate' can still run on hurd (where there is no systemd anyway). I do not get hurd issue, while hurd has no systemd it still has runuser. > So, we have three possible user workarounds: > a) update /etc/pam.d/common.session > b) copy the unit to /etc/systemd/system/locate.service and create > a ReadWritePaths hole for /var/log/ > c) copy the unit to /etc/systemd/system/locate.service and change to > ProtectSystem=full > one bugfix for the locate package: > d) switch 'su' to 'runas' where available. > and one possible improvement to libpam-wtmpdb: > e) add 'su' to the skip_if clause in pam config. d)'s "runas" is a typo, and should read "runuser", shouldn't it? (runas exist, but is very niche and looks dead upstream) > I think 'locate' is probably the most accurate home for this bug! agreed. cu Andreas -- "You people are noisy," Nia said. I made the gesture of agreement.
