On Fri, 2021-02-26 at 08:32 +0100, Steinar H. Gunderson wrote: > Well, what do you think is the right fix? Setting PrivateTmp=false,
Seems like the right fix, or just dropping that as it is the default. > reducing security Looking at the code, the only possible use of /tmp in updatedb.plocate goes via mkstemp, which is secure even with PrivateTmp=false. In addition the call path to mkstemp in updatedb.plocate ensures an absolute path and defaults to an absolute path in /var anyway. The plocate-build code could pass a relative path to mkstemp if the user passes a relative database path, but plocate-build isn't run under systemd anyway. -- bye, pabs https://wiki.debian.org/PaulWise
signature.asc
Description: This is a digitally signed message part
