Subject: Problems changing noexex /tmp in guest for apt-get
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Thu, 22 Jan 2009 22:29:48 -0500

Hello, all.  I'm having a pretty convoluted problem in my attempts to
build an Ubuntu Hardy guest.  To secure our systems, we normally
mount /tmp as noexec,nosuid,nodev.  This produces a problem when using
apt-get install as it frequently stores and executes scripts from /tmp.

We realize we could do something like:

vnamespace -e 40017 mount -t tmpfs -o remount,exec,suid,dev
none /vservers/vdbase/tmp

before running apt-get install but we'd like a more automated process.
Within Ubuntu, we can add the following lines
in /etc/apt/apt.conf.d/70debconf:

DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";};
DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";};

How can we do this in vserver? We cannot do the remounts from within the
guests.  I tried automating the process using vapt-get in an attempt to
execute the changes from the host.  We created a little script to create
an apt-get configuration file ($1 is the xid, $2 is the guest name):

echo -e "DPkg::Pre-Invoke {\"vnamespace -e ${1} mount -t tmpfs -o
remount,exec,suid,dev none /vservers/${2}/tmp\";};\nDPkg::Post-Invoke
{\"vnamespace -e ${1} mount -t tmpfs -o remount,noexec,nosuid,nodev
none /vservers/${2}/tmp\";};\n" > /vservers/${2}/etc/apt/apttmp

We first tried to write the file to /etc/apt but then realized it is not
looking in the host's file system but in the guest's.  So we placed the
file in the guest's file system and then did:

vapt-get vdbase -- -c /etc/apt/apttmp install locales
language-pack-en-base

This time, it found the file but gave this error:

sh: vnamespace: not found
E: Problem executing scripts DPkg::Pre-Invoke 'vnamespace -e 40017 mount
-t tmpfs -o remount,exec,suid,dev none /vservers/vdbase/tmp'

which leads me to believe it is executing within the guest context.

Is there a way to automate this remounting of /tmp to install apt
packages without manually remounting /tmp from the host? Thanks - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society