Subject: Re: [vserver] Problems changing noexex /tmp in guest for apt-get
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 27 Jan 2009 19:42:17 +0100

On Fri, Jan 23, 2009 at 08:41:20AM -0500, John A. Sullivan III wrote:
> On Fri, 2009-01-23 at 11:49 +0100, KwangErn Liew wrote:
> > John A. Sullivan III wrote:
> > > before running apt-get install but we'd like a more automated process.
> > > Within Ubuntu, we can add the following lines
> > > in /etc/apt/apt.conf.d/70debconf:
> > > 
> > > DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";};
> > > DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";};
> > > 
> > > How can we do this in vserver? We cannot do the remounts from within the
> > > guests.  I tried automating the process using vapt-get in an attempt to
> > > execute the changes from the host.  We created a little script to create
> > > an apt-get configuration file ($1 is the xid, $2 is the guest name):

> > You'd need to enable mount capabilities for a Guest to do remounts. See 
> > http://linux-vserver.org/Capabilities_and_Flags
> > 
> > It's possible that there's another method.

> > KwangErn

> Thank you.  I'm a little hesitant to do that as this is a public
> environment so we're keeping the guests highly secure.  

somehow 'highly secure' and the 70debconf above do not fit
together very well :)  why?

first, you state that you do not want somebody to execute
arbitrary code/scripts in /tmp, then you allow dpkg to do
exactly that and, moreover any other user who waits for
one of those dpkg events and uses the oportunity :)

> Then again, I am guessing guests could not mount anything outside 
> of their portion of the file system.  

allowing this 'hack' inside a guest by giving (re)mount
capabilities is just adding to the pile and making it
less secure ...

> Is that correct? Any other ways? - John

the correct way would be to have two namespaces looking
at the same guest, one which has /tmp mounted with all
the required options for dpkg to work, and another one
which is used for the guest processes, which _always_
has to noexec,... options applied ...

note that recent util-vserver supports such dual namespace
setups (actually this is done to get rid of the barrier)
but I do not know how much influence you can have on the
various mount points and options ... have a chat with
Daniel 

best,
Herbert

> -- 
> John A. Sullivan III
> Open Source Development Corporation
> +1 207-985-7880
> jsullivan@opensourcedevel.com
> 
> http://www.spiritualoutreach.com
> Making Christianity intelligible to secular society