On Thu, 22 Jan 2009 22:29:48 -0500 "John A. Sullivan III" <jsullivan@opensourcedevel.com> wrote: > To secure our systems, we normally > mount /tmp as noexec,nosuid,nodev. This produces a problem when using > apt-get install as it frequently stores and executes scripts from /tmp. does it really use /tmp or does it use $TMP or $TMPDIR which just happens to be set to /tmp (or not set at all and the default is /tmp)? or is there a configuration option to tell apt what directory it should use for temporary files? if you can convince apt to use another directory for temporary files, then you might have it use a non-world-writable directory (eg /root/tmp) and leave the world-writable directories locked-down. beware that if apt executes any temporary scripts as a user other than root, then using a non-world-readable directory (eg /root/tmp as my /root is always set 700) might be problematic. and don't forget to lock down /var/tmp (that will be fun ;-). > Is there a way to automate this remounting of /tmp to install apt > packages without manually remounting /tmp from the host? Thanks - John the linux-vserver project does not provide any way for a guest to communicate with a host as you are expected to reuse existing proven methods like ssh. you can create a unique ssh key for each guest, add that key to the host's authorized_keys file while specifying a script to remount the /tmp directory in the key's "command" option. using the SSH_ORIGINAL_COMMAND environment variable in your script, you can even use one script to remount as either rw or ro (as compared to two scripts: one each for rw & ro). see the sshd man page (searching for "authorized") for details. corey -- undefined@pobox.com