Subject: Re: [vserver] Problems changing noexex /tmp in guest for apt-get
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Tue, 27 Jan 2009 13:49:27 -0500

On Tue, 2009-01-27 at 19:42 +0100, Herbert Poetzl wrote:
> On Fri, Jan 23, 2009 at 08:41:20AM -0500, John A. Sullivan III wrote:
> > On Fri, 2009-01-23 at 11:49 +0100, KwangErn Liew wrote:
> > > John A. Sullivan III wrote:
> > > > before running apt-get install but we'd like a more automated process.
> > > > Within Ubuntu, we can add the following lines
> > > > in /etc/apt/apt.conf.d/70debconf:
> > > > 
> > > > DPkg::Pre-Invoke {"mount -o remount,exec,suid,dev /tmp";};
> > > > DPkg::Post-Invoke {"mount -o remount,noexec,nosuid,nodev /tmp";};
> > > > 
> > > > How can we do this in vserver? We cannot do the remounts from within the
> > > > guests.  I tried automating the process using vapt-get in an attempt to
> > > > execute the changes from the host.  We created a little script to create
> > > > an apt-get configuration file ($1 is the xid, $2 is the guest name):
<snip>
> the correct way would be to have two namespaces looking
> at the same guest, one which has /tmp mounted with all
> the required options for dpkg to work, and another one
> which is used for the guest processes, which _always_
> has to noexec,... options applied ...
> 
> note that recent util-vserver supports such dual namespace
> setups (actually this is done to get rid of the barrier)
> but I do not know how much influence you can have on the
> various mount points and options ... have a chat with
> Daniel 
> 
> best,
> Herbert
<snip>
Thank you for the excellent (as usual) suggestion - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society