>>107371538
~ $ ll $(which plocate) /var/lib/plocate/plocate.db
-rwxr-s--x 1 root locate 327K 09-02-2025 10:02 /usr/bin/plocate
-rw-r----- 1 root locate 37M 29-11-2025 17:11 /var/lib/plocate/plocate.db
So whoever executes plocate does so with privileges of the locate group and therefore can access the database, makes sense. But then the strace(1) manpage says:
-u username
--user=username
Runs command with the user ID, group ID, and supplementary groups of username.
This option is only useful when running as root, as it enables the correct exe‐
cution of setuid and/or setgid binaries. Unless this option is used, setuid and
setgid programs are executed without their effective privileges.
Can you just drop the privileges assigned to you via the setgid bit? I'm getting "/var/lib/plocate/plocate.db: Permission denied" and the same thing happens when I try t run it from within a bwrap sandbox.