* Version tested: 3.1 * Problem description: slocate doesn't check readability bit of containing directory. It can divulge the existence of files in a directory that is unreadable (e.g. by the 'ls' command) by a user. * Demonstration: As user1: $ cd /tmp $ mkdir dir $ chmod 711 dir $ cd dir $ touch "a-secret-file" $ cd .. $ updatedb -o db -U dir As user2: $ cd /tmp $ ls dir ls: .: Permission denied But: $ slocate -d db file dir/a-secret-file
