Subject: Re: [vserver] Problems changing noexex /tmp in guest for apt-get
From: KwangErn Liew <admin@musmo.com>
Date: Fri, 23 Jan 2009 17:43:28 +0100



John A. Sullivan III wrote:
> On Fri, 2009-01-23 at 11:49 +0100, KwangErn Liew wrote:
>> John A. Sullivan III wrote:
>>> before running apt-get install but we'd like a more automated process.
>>> Within Ubuntu, we can add the following lines
>>> in /etc/apt/apt.conf.d/70debconf:
>>>
>>> DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";};
>>> DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";};
>>>
>>> How can we do this in vserver? We cannot do the remounts from within the
>>> guests.  I tried automating the process using vapt-get in an attempt to
>>> execute the changes from the host.  We created a little script to create
>>> an apt-get configuration file ($1 is the xid, $2 is the guest name):
>> You'd need to enable mount capabilities for a Guest to do remounts. See 
>> http://linux-vserver.org/Capabilities_and_Flags
>>
>> It's possible that there's another method.
>>
>>
>> KwangErn
> Thank you.  I'm a little hesitant to do that as this is a public
> environment so we're keeping the guests highly secure.  Then again, I am
> guessing guests could not mount anything outside of their portion of the
> file system.  Is that correct? Any other ways? - John

Yes, that's correct. Guests do not have the privilege to mount unless 
specified using capabilities.


KwangErn