Subject: Re: [vserver] Problems changing noexex /tmp in guest for apt-get
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Fri, 23 Jan 2009 08:41:20 -0500

On Fri, 2009-01-23 at 11:49 +0100, KwangErn Liew wrote:
> John A. Sullivan III wrote:
> > before running apt-get install but we'd like a more automated process.
> > Within Ubuntu, we can add the following lines
> > in /etc/apt/apt.conf.d/70debconf:
> > 
> > DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";};
> > DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";};
> > 
> > How can we do this in vserver? We cannot do the remounts from within the
> > guests.  I tried automating the process using vapt-get in an attempt to
> > execute the changes from the host.  We created a little script to create
> > an apt-get configuration file ($1 is the xid, $2 is the guest name):
> 
> You'd need to enable mount capabilities for a Guest to do remounts. See 
> http://linux-vserver.org/Capabilities_and_Flags
> 
> It's possible that there's another method.
> 
> 
> KwangErn
Thank you.  I'm a little hesitant to do that as this is a public
environment so we're keeping the guests highly secure.  Then again, I am
guessing guests could not mount anything outside of their portion of the
file system.  Is that correct? Any other ways? - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society