Subject: exim4-base: /tmp partition has noexec mount option; exim4-base fails

From: Steve Egbert <[email-masked]>
Date: Tue, 05 Oct 2021 15:22:56 -0400

Package: exim4-base
Version: 4.94.2-7
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: [email-masked]

Dear Maintainer,

Tried to installed 'exim4-base' after its most recent update and failed.

Implemented a rough draft of CIS Security Debian 11.

The portion about /tmp mount partition having that 'noexec' mount
option.

Well, we will not be able to install exim4-base package anymore 
if this hardening effort continues.

Besides, who is still trying execute a script in /tmp directory.

Correct action is to do 'bash /tmp/your-script' or 'perl
/tmp/your-script'.

Not to execute directly from '/tmp/your-script'.

Best action is not to execute that script directly in /tmp.

-- System Information:
Debian Release: 11.0
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.46 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

-- no debconf information

---

From: S Egbert <[email-masked]>
Date: Tue, 5 Oct 2021 15:49:58 -0400

WORKAROUND
Remove the “no exec” from /tmp mount point options in /etcfstab, reboot, then attempt ‘apt upgrade exim4-base’ so that Perl script for ‘exam-config’ can continue. 

OUTPUT of failed upgrade:

~# apt upgrade exim4-base
[?2004l

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done

Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree... Done

Reading state information... 0% 

Reading state information... 0%

Reading state information... Done

Calculating upgrade... 0%

Calculating upgrade... 10%

Calculating upgrade... Done

The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp
Use 'apt autoremove' to remove them.
The following packages will be upgraded:
  exim4-base exim4-config tzdata
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
8 not fully installed or removed.
Need to get 0 B/1,906 kB of archives.
After this operation, 2,784 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... 25%
Reading changelogs... 50%
Reading changelogs... 100%
                          
Reading changelogs... Done
Preconfiguring packages ...
Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178.
open2: exec of /tmp/tzdata.config.jtoGAt configure 2021a-1 failed: Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59.

7[0;24r8[1A(Reading database ... 
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 181409 files and directories currently installed.)
Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ...
7[25;0f[42m[30mProgress: [  0%][49m[39m [..........................................................] 87[25;0f[42m[30mProgress: [  5%][49m[39m [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ...
dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
[1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2
[1mdpkg:[0m trying script from the new package instead ...
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
[1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
 new tzdata package post-removal script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
[1mdpkg[0m: [1;31merror while cleaning up:[0m
 new tzdata package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-config_4.94.2-7_all.deb ...
7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
[1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
 new exim4-config package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
[1mdpkg[0m: [1;31merror while cleaning up:[0m
 new exim4-config package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ...
7[25;0f[42m[30mProgress: [ 14%][49m[39m [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
[1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack):
 new exim4-base package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
[1mdpkg[0m: [1;31merror while cleaning up:[0m
 new exim4-base package post-removal script subprocess returned error exit status 2
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb
 /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb
 /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb

7[0;25r8[1A[J[1;31mE: [0mSub-process /usr/bin/dpkg returned an error code (1)[0m
[?2004hroot@circa:~# exit
[?2004l
exit

Script done on 2021-10-05 15:48:17-04:00 [COMMAND_EXIT_CODE="100"]

---

From: S Egbert <[email-masked]>
Date: Tue, 5 Oct 2021 15:57:15 -0400

workaround of removing ‘noexec’ from /tmp partition in /etc/fstab still doesn’t work.  

00 [TERM="linux" TTY="/dev/tty1" COLUMNS="80" LINES="25"]
[?2004hroot@circa:~# apt upgrade exim4-base
[?2004l

                          

Script done on 2021-10-05 15:53:17-04:00 [COMMAND_EXIT_CODE="100"]

I still have “nosuid” and “nodev” mount options left but i won’t remove that.

---

From: S Egbert <[email-masked]>
Date: Tue, 5 Oct 2021 16:07:05 -0400

Actual workaround is to remove ‘noexec” from both /tmp and /var. Tested it working without “noexec” mount options on ‘apt upgrade exim4-base’ to versio ‘4.94.2-7’

This makes it like a major work-stoppage of dealing with 1,000s of those hardened Debian systems. 

> On Oct 5, 2021, at 4:00 PM, Debian Bug Tracking System <[email-masked]> wrote:
> 
> Thank you for the additional information you have supplied regarding
> this Bug report.
> 
> This is an automatically generated reply to let you know your message
> has been received.
> 
> Your message is being forwarded to the package maintainers and other
> interested parties for their attention; they will reply in due course.
> 
> Your message has been sent to the package maintainer(s):
> Exim4 Maintainers <[email-masked]>
> 
> If you wish to submit further information on this problem, please
> send it to [email-masked].
> 
> Please do not send mail to [email-masked] unless you wish
> to report a problem with the Bug-tracking system.
> 
> -- 
> 995793: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995793
> Debian Bug Tracking System
> Contact [email-masked] with problems

---

From: Marc Haber <[email-masked]>
Date: Wed, 6 Oct 2021 14:08:13 +0200

> Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178.

This is most obviously not a script that comes from the exim4 package.
Consider talking to the tzdata maintainers instead.

>  new tzdata package post-removal script subprocess returned error exit status 2

This looks like dpkg is trying to execute maintainer scripts. It
obviously does that inside /var/lib/dpkg/info. This is nothing that
exim4 can do anything about. Consider talking to the dpkg maintainers
instead.

>  new exim4-config package pre-installation script subprocess returned error exit status 2

Same thing here.

I intend to close this bug report by the end of this week unless
somebody has convinced me that there is anything that the exim4
package can do about.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

---

From: Andreas Metzler <[email-masked]>
Date: Wed, 6 Oct 2021 19:09:02 +0200

Control: severity -1 normal
Control: reassign -1 apt
Control: forcemerge 546911 995793

On 2021-10-05 S Egbert <[email-masked]> wrote:
> Actual workaround is to remove ‘noexec” from both /tmp and /var.
> Tested it working without “noexec” mount options on ‘apt upgrade
> exim4-base’ to versio ‘4.94.2-7’

> those hardened Debian systems. 
[...]

Hello,

Mounting /var noexec is not supported. For noexec /tmp you will need to
point APT::ExtractTemplates::TempDir to an directory which is not
located on a noexec mount.

cu Andreas