Does pacman ever have to execute scripts etc from /tmp

Fruity · 2010-11-30 09:34:32

I read in another thread about setting noexec on /tmp as being a small step in making systems more secure. But if I do this (and nosuid?) Might it cause problems, for example with pacman or yaourt. Can anyone think of a reason not to noexec,nosuid on /tmp?

Allan · 2010-11-30 11:00:34

pacman should be fine. But I thought yaourt builds in /tmp (never used it so I may be wrong...).

dyscoria · 2010-11-30 11:44:45

I have both /tmp and /var mounted noexec,nodev,nosuid.

Compilling some packages (e.g.ffmpeg) require /tmp to be remount exec (mount -o remount,exec /tmp) but normal usage shouldn't be affected.

Mount /dev/shm and /home noexec too if you want to further increase security.

Last edited by dyscoria (2010-11-30 11:44:58)

Mr.Elendig · 2010-11-30 18:23:33

Just build in $HOME instead of in /tmp

dyscoria · 2010-11-30 21:16:47

Mr.Elendig wrote:

Just build in $HOME instead of in /tmp

ffmpeg and qemu and maybe other packages execute scripts in /tmp no matter where you compile.

And my $HOME is actually mounted noexec anyways I mount a tmpfs with exec only when I need to compile stuff so most of my partitions can be mounted noexec for most/all of the time (/tmp /home /var /dev/shm).

Leonid.I · 2010-12-01 16:31:49

dyscoria wrote:

qemu and maybe other packages execute scripts in /tmp no matter where you compile.

can you elaborate on this?

dyscoria · 2010-12-01 21:22:44

Leonid.I wrote:

dyscoria wrote:
qemu and maybe other packages execute scripts in /tmp no matter where you compile.
can you elaborate on this?

mount /tmp noexec and then try to compile ffmpeg from abs (/var/abs/extra/ffmpeg). Last time I checked, it dies with error message.

I'm not really sure what's happening with qemu. It copies scripts to /tmp and then fails to run them, but then carries on compiling anyway and completes successfully, but don't know if it breaks something. Probably does, didn't test.

Arch Linux

#1 2010-11-30 09:34:32

Does pacman ever have to execute scripts etc from /tmp

#2 2010-11-30 11:00:34

Re: Does pacman ever have to execute scripts etc from /tmp

#3 2010-11-30 11:44:45

Re: Does pacman ever have to execute scripts etc from /tmp

#4 2010-11-30 18:23:33

Re: Does pacman ever have to execute scripts etc from /tmp

#5 2010-11-30 21:16:47

Re: Does pacman ever have to execute scripts etc from /tmp

#6 2010-12-01 16:31:49

Re: Does pacman ever have to execute scripts etc from /tmp

#7 2010-12-01 21:22:44

Re: Does pacman ever have to execute scripts etc from /tmp

Board footer