Subject: exim4-base: /tmp partition has noexec mount option; exim4-base fails
Date: Tue, 05 Oct 2021 15:22:56 -0400
Package: exim4-base
Version: 4.94.2-7
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: [email protected]
Dear Maintainer,
Tried to installed 'exim4-base' after its most recent update and failed.
Implemented a rough draft of CIS Security Debian 11.
The portion about /tmp mount partition having that 'noexec' mount
option.
Well, we will not be able to install exim4-base package anymore
if this hardening effort continues.
Besides, who is still trying execute a script in /tmp directory.
Correct action is to do 'bash /tmp/your-script' or 'perl
/tmp/your-script'.
Not to execute directly from '/tmp/your-script'.
Best action is not to execute that script directly in /tmp.
-- System Information:
Debian Release: 11.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.46 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
-- no debconf information
Acknowledgement sent
to S Egbert <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Tue, 05 Oct 2021 19:51:02 GMT) (full text, mbox, link).
Acknowledgement sent
to S Egbert <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Tue, 05 Oct 2021 19:51:03 GMT) (full text, mbox, link).
Acknowledgement sent
to S Egbert <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Tue, 05 Oct 2021 20:00:03 GMT) (full text, mbox, link).
Acknowledgement sent
to S Egbert <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Tue, 05 Oct 2021 20:00:04 GMT) (full text, mbox, link).
Acknowledgement sent
to S Egbert <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Tue, 05 Oct 2021 20:09:08 GMT) (full text, mbox, link).
Subject: Re: Bug#995793: Info received (Bug#995793: exim4-base: /tmp partition has noexec mount option; exim4-base fails)
Date: Tue, 5 Oct 2021 16:07:05 -0400
Actual workaround is to remove ‘noexec” from both /tmp and /var. Tested it working without “noexec” mount options on ‘apt upgrade exim4-base’ to versio ‘4.94.2-7’
This makes it like a major work-stoppage of dealing with 1,000s of those hardened Debian systems.
> On Oct 5, 2021, at 4:00 PM, Debian Bug Tracking System <[email protected]> wrote:
>
> Thank you for the additional information you have supplied regarding
> this Bug report.
>
> This is an automatically generated reply to let you know your message
> has been received.
>
> Your message is being forwarded to the package maintainers and other
> interested parties for their attention; they will reply in due course.
>
> Your message has been sent to the package maintainer(s):
> Exim4 Maintainers <[email protected]>
>
> If you wish to submit further information on this problem, please
> send it to [email protected].
>
> Please do not send mail to [email protected] unless you wish
> to report a problem with the Bug-tracking system.
>
> --
> 995793: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995793
> Debian Bug Tracking System
> Contact [email protected] with problems
Acknowledgement sent
to Marc Haber <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Wed, 06 Oct 2021 12:09:02 GMT) (full text, mbox, link).
Subject: Re: Bug#995793: exim4-base: /tmp partition has noexec mount option;
exim4-base fails
Date: Wed, 6 Oct 2021 14:08:13 +0200
On Tue, Oct 05, 2021 at 03:49:58PM -0400, S Egbert wrote:
> Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178.
This is most obviously not a script that comes from the exim4 package.
Consider talking to the tzdata maintainers instead.
> dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
> [1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2
> [1mdpkg:[0m trying script from the new package instead ...
> dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
> [1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
> new tzdata package post-removal script subprocess returned error exit status 2
This looks like dpkg is trying to execute maintainer scripts. It
obviously does that inside /var/lib/dpkg/info. This is nothing that
exim4 can do anything about. Consider talking to the dpkg maintainers
instead.
> 7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
> [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
> new exim4-config package pre-installation script subprocess returned error exit status 2
Same thing here.
I intend to close this bug report by the end of this week unless
somebody has convinced me that there is anything that the exim4
package can do about.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
Acknowledgement sent
to Andreas Metzler <[email protected]>:
Extra info received and forwarded to list. Copy sent to Exim4 Maintainers <[email protected]>.
(Wed, 06 Oct 2021 17:12:03 GMT) (full text, mbox, link).
Subject: Re: Bug#995793: Info received (Bug#995793: exim4-base: /tmp
partition has noexec mount option; exim4-base fails)
Date: Wed, 6 Oct 2021 19:09:02 +0200
Control: severity -1 normal
Control: reassign -1 apt
Control: forcemerge 546911 995793
On 2021-10-05 S Egbert <[email protected]> wrote:
> Actual workaround is to remove ‘noexec” from both /tmp and /var.
> Tested it working without “noexec” mount options on ‘apt upgrade
> exim4-base’ to versio ‘4.94.2-7’
> This makes it like a major work-stoppage of dealing with 1,000s of
> those hardened Debian systems.
[...]
Hello,
Mounting /var noexec is not supported. For noexec /tmp you will need to
point APT::ExtractTemplates::TempDir to an directory which is not
located on a noexec mount.
cu Andreas
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.