On Fri, Jan 23, 2009 at 08:41:20AM -0500, John A. Sullivan III wrote: > On Fri, 2009-01-23 at 11:49 +0100, KwangErn Liew wrote: > > John A. Sullivan III wrote: > > > before running apt-get install but we'd like a more automated process. > > > Within Ubuntu, we can add the following lines > > > in /etc/apt/apt.conf.d/70debconf: > > > > > > DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";}; > > > DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";}; > > > > > > How can we do this in vserver? We cannot do the remounts from within the > > > guests. I tried automating the process using vapt-get in an attempt to > > > execute the changes from the host. We created a little script to create > > > an apt-get configuration file ($1 is the xid, $2 is the guest name): > > You'd need to enable mount capabilities for a Guest to do remounts. See > > http://linux-vserver.org/Capabilities_and_Flags > > > > It's possible that there's another method. > > KwangErn > Thank you. I'm a little hesitant to do that as this is a public > environment so we're keeping the guests highly secure. somehow 'highly secure' and the 70debconf above do not fit together very well :) why? first, you state that you do not want somebody to execute arbitrary code/scripts in /tmp, then you allow dpkg to do exactly that and, moreover any other user who waits for one of those dpkg events and uses the oportunity :) > Then again, I am guessing guests could not mount anything outside > of their portion of the file system. allowing this 'hack' inside a guest by giving (re)mount capabilities is just adding to the pile and making it less secure ... > Is that correct? Any other ways? - John the correct way would be to have two namespaces looking at the same guest, one which has /tmp mounted with all the required options for dpkg to work, and another one which is used for the guest processes, which _always_ has to noexec,... options applied ... note that recent util-vserver supports such dual namespace setups (actually this is done to get rid of the barrier) but I do not know how much influence you can have on the various mount points and options ... have a chat with Daniel best, Herbert > -- > John A. Sullivan III > Open Source Development Corporation > +1 207-985-7880 > jsullivan@opensourcedevel.com > > http://www.spiritualoutreach.com > Making Christianity intelligible to secular society