Fix for plocate error - Unknown group nobody

English Applications
1

Hello,

I ran across this issue Catfish, plocate & updatedb broken - TW (XFCE)after installing Tumbleweed, which is connected to apparmor, and I was able to resolve it. Here are the apparmor profiles for updatedb and plocate.

╭─[Fri Jul 10 17:42:13] [root@netdog] [/home/tangent]
╰─# cat /etc/apparmor.d/usr.bin.plocate 
# Last Modified: Sun Aug 27 12:14:13 2023
include <tunables/global>

/usr/bin/{p,}locate {
  include <abstractions/base>
  include <abstractions/nameservice>

  capability setgid,
  capability setuid,

  /usr/bin/{p,}locate mr,
  /var/lib/plocate/plocate.db r,

}

╭─[Fri Jul 10 17:43:15] [root@netdog] [/home/tangent]
╰─# cat /etc/apparmor.d/usr.sbin.updatedb 
include <tunables/global>

/usr/{bin,sbin}/updatedb {
  include <abstractions/base>
  include <abstractions/nameservice>

  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability chown,
  capability setgid,
  capability setuid,

  / r,
  /**/ r,
  /etc/updatedb.conf r,
  /usr/{bin,sbin}/updatedb mr,
  /var/lib/plocate r,
  /var/lib/plocate/* rwlk,
  owner /proc/@{pid}/mounts r,

}

Reload apparmor

systemctl reload apparmor

Run updatedb

╭─[Fri Jul 10 17:47:20] [root@netdog] [/home/tangent]
╰─# strace -f -e trace=setuid,setgid,setreuid,setregid,setresuid,setresgid,setgroups,capset /sbin/updatedb --require-visibility yes
+++ exited with 0 +++

Someone reported a bug here: Bug 1259029 - Cannot update the database (plocate.db) with catfish , which is still open.

2

Due to the same issue with locate, I started a thread re: user nobody and got no answer that I could understand and act on .

Searches found a working solution.

To update location db (updatedb) use: sudo systemctl start plocate-updatedb

Following this you can use locate as a user and get search results in both system and user directories.

hope this helps.

tom kosvic

3

There is a timer in lieu of the old cron. I require instant lookups, thus anytime I have a large directory with several hundreds of files, I must instantly execute ‘updatedb’.

4

You could put up datedb command into a cron file to run as frequently as you wished. Old locate used to run once a day at midnight if I remember right.

I tinker with system files pretty often and, therefore, I run that updatedb command manually before each search to make sure I am searching in the latest file list. Note: I have a lot of files and sometimes updatedb takes more than 5 min to run.

You could run updatedb every 10 minutes if you wished. If you have many files, that might be nearly continuously but you would have a nearly instantaneously accurate file list.

tom kosvic

5

This argument ignores the operational intent of system indexing. Utilities like updatedb must be reliable both when automated and when invoked on-demand by an administrator. When a standard execution crashes because the application’s containment profile restricts its own privilege-dropping mechanisms, that is a packaging defect, not user error. Relying on a systemd wrapper to paper over a broken AppArmor policy doesn’t change the fact that the binary is failing downstream. Fixing the capabilities isn’t a workaround; it’s restoring the system to its engineered state.

6

When I upgraded from leap 15.6 to tumbleweed a couple of months ago, I moved from apparmor to selinux as that was the new default. No permission issues have surfaced.

tom kosvic

7

During installation, I expressly selected SELinux, but it did not materialize.