Hi, The patch I sent on 4 October could not have been applied either (Gmail sent it as HTML, and the text part the BTS keeps lost its indentation), and it had a flaw: it put each pattern inside single quotes in the text find_files hands to eval, so a pattern with an apostrophe broke the quoting. Attached is a reworked patch with a DEP-3 header, against 1:3.2.4~rc1-3.5. It applies with patch -p1, and to the debian branch on Savannah.
Tiger_FSScan_PruneDirs is still Nicholas Bamber's '|'-separated list of find -path patterns, empty by default, and each entry prunes the directory and everything below it, since a mount point inside a pruned directory is a starting point of its own. The patterns now reach find through variables, so eval expands them but never reads them as shell code. They are added to the find options; the eval line itself is unchanged. Tested in a debian:stable container with tiger 1:3.2.4~rc1-3.4, Tiger_FSScan_WDIR=Y and world-writable directories in several places, with Tiger_FSScan_PruneDirs set to: /srv/t/prune1|/srv/t/it's|/srv/t/glob/*/.cache|/srv/t/slash/|/srv/t/x$(touch /tmp/pwned) find reported only the directory outside them. The plain path, the trailing slash, the glob, the apostrophe and the $(...) were all pruned, the last taken literally (/tmp/pwned was not created), and so was a second starting point inside a pruned directory, which is how a mount point there reaches find. The 4 October version left the path with the apostrophe unpruned. With the setting empty, the find command is the same as before. Andrei Trimbitas
Description: find_files: skip the directories in Tiger_FSScan_PruneDirs Tiger_FSScan_PruneDirs, as Nicholas Bamber proposed here, lists find -path patterns separated by '|', and the file system scan prunes each directory and everything below it, since a mount point inside a pruned directory is a starting point of its own (Docker's overlay mounts under /var/lib/docker, for example). It is empty by default, and then the scan is unchanged. . The patterns reach find through variables: the find command is run by eval, which expands them but never reads them as shell code, so a pattern may hold quotes, blanks or a $. The patterns join the find options; the eval line itself is not touched. Author: Andrei Trimbitas <[email protected]> Bug-Debian: https://bugs.debian.org/610785 Forwarded: no Last-Update: 2026-10-29 --- diff --git a/scripts/find_files b/scripts/find_files index a07707f..766198a 100755 --- a/scripts/find_files +++ b/scripts/find_files @@ -255,6 +255,30 @@ done [ -n "$suidopt$sgidopt$devopt$linkopt$wdiropt$nownopt$nogrpopt" ] && findopt="$findopt \)" +# +# Directories not to scan: Tiger_FSScan_PruneDirs, find -path patterns +# separated by '|'. Each prunes the directory and everything below it, +# since a mount point inside it is a starting point of its own. eval +# reads the patterns only through variables, never as shell code. +# +if [ -n "$Tiger_FSScan_PruneDirs" ]; then + pruneopt= + nprune=0 + IFS='|' + set -f + for prunedir in $Tiger_FSScan_PruneDirs + do + [ -n "$prunedir" ] || continue + nprune=`$EXPR $nprune + 1` + eval "prune$nprune=\${prunedir%/} prunebelow$nprune=\${prunedir%/}/\*" + [ -n "$pruneopt" ] && pruneopt="$pruneopt -o" + pruneopt="$pruneopt -path \"\$prune$nprune\" -o -path \"\$prunebelow$nprune\"" + done + set +f + IFS=$saveifs + [ -n "$pruneopt" ] && findopt="\\( $pruneopt \\) -prune -o $findopt" +fi + pidlist=$WORKDIR/pid.list$$ mountlist=$WORKDIR/mount.list$$ outfile=$WORKDIR/find.out.$$ diff --git a/tigerrc b/tigerrc index 35949a4..61fdcba 100644 --- a/tigerrc +++ b/tigerrc @@ -325,6 +325,11 @@ Tiger_FSScan_NonLocal='' # Filesystems considered to be non-local to the system, # Tiger_FSScan_ReadOnly=N # +# Directories the file system scan should skip, separated by '|'. Each +# is a find -path pattern, such as '/srv/backups|/home/*/.cache'. +# +Tiger_FSScan_PruneDirs='' +# # List of dot files commonly found in user home directories. These # will be checked by check_accounts for proper access permissions. #
