Subject: Re: [vserver] Problems changing noexex /tmp in guest for apt-get
From: Corey Wright <undefined@pobox.com>
Date: Sun, 25 Jan 2009 01:45:36 -0600

On Thu, 22 Jan 2009 22:29:48 -0500
"John A. Sullivan III" <jsullivan@opensourcedevel.com> wrote:

> To secure our systems, we normally
> mount /tmp as noexec,nosuid,nodev.  This produces a problem when using
> apt-get install as it frequently stores and executes scripts from /tmp.

does it really use /tmp or does it use $TMP or $TMPDIR which just
happens to be set to /tmp (or not set at all and the default is
/tmp)?

or is there a configuration option to tell apt what directory it should
use for temporary files?

if you can convince apt to use another directory for temporary files,
then you might have it use a non-world-writable directory (eg
/root/tmp) and leave the world-writable directories locked-down.
beware that if apt executes any temporary scripts as a user other than
root, then using a non-world-readable directory (eg /root/tmp as
my /root is always set 700) might be problematic.

and don't forget to lock down /var/tmp (that will be fun ;-).

> Is there a way to automate this remounting of /tmp to install apt
> packages without manually remounting /tmp from the host? Thanks - John

the linux-vserver project does not provide any way for a guest to
communicate with a host as you are expected to reuse existing proven
methods like ssh.  you can create a unique ssh key for each guest, add
that key to the host's authorized_keys file while specifying a script
to remount the /tmp directory in the key's "command" option.  using the
SSH_ORIGINAL_COMMAND environment variable in your script, you can even
use one script to remount as either rw or ro (as compared to two
scripts: one each for rw & ro). see the sshd man page (searching for
"authorized") for details.

corey
-- 
undefined@pobox.com