MIME-Version: 1.0
From: Don Seiler <don@seiler.us>
Date: Tue, 8 Apr 2025 12:21:05 -0500
Message-ID: 
 <CAHJZqBAf3us8t3AwbjqfXvCYz-BZztYy0CLR5-00sfPD904z5A@mail.gmail.com>
Subject: Errors installing/updating postgresql when /tmp has noexec
To: pgsql-pkg-debian@postgresql.org
Content-Type: multipart/alternative; boundary="0000000000008ed8c506324794c9"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHJZqBAf3us8t3AwbjqfXvCYz-BZztYy0CLR5-00sfPD904z5A%40mail.gmail.com>
Precedence: bulk

--0000000000008ed8c506324794c9
Content-Type: text/plain; charset="UTF-8"

After some recent system hardening, I'm now getting these errors when
running apt to update our PGDG postgresql packages. In this case we are
running postgresql-15 on Ubuntu 22.04 LTS.

Preconfiguring packages ...
Can't exec "/tmp/postgresql-15.config.rOsJHJ": Permission denied at
/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178. open2: exec of
/tmp/postgresql-15.config.rOsJHJ configure 15.8-1.pgdg22.04+1 failed:
Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59.

This doesn't cause the install the fail though, and postgresql gets updated
to 15.12 and starts up just fine. It's not clear to me if there is now some
danger/flaw in my installation or if this is something that can be ignored.

It doesn't appear that I can just set an environment variable like TMP,
TEMP, TEMPDIR etc to change this. I see that it can be changed via an apt
config change[1].

However, I'm wondering if this is something that's better changed in the
packaging. Setting noexec on /tmp (and /var) is a standard CIS/DISA
security requirement now.

1.
https://askubuntu.com/questions/1452390/install-packages-on-systems-with-secured-tmp-and-var-noexec

-- 
Don Seiler
www.seiler.us

--0000000000008ed8c506324794c9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>After some recent system hardening, I&#39;m now getti=
ng these errors when running apt to update our PGDG postgresql packages. In=
 this case we are running postgresql-15 on Ubuntu 22.04 LTS.</div><div><br>=
</div>Preconfiguring packages ...<br>Can&#39;t exec &quot;/tmp/postgresql-1=
5.config.rOsJHJ&quot;: Permission denied at /usr/lib/x86_64-linux-gnu/perl-=
base/IPC/Open3.pm line 178. open2: exec of /tmp/postgresql-15.config.rOsJHJ=
 configure 15.8-1.pgdg22.04+1 failed: Permission denied at /usr/share/perl5=
/Debconf/ConfModule.pm line 59.<div><br></div><div>This doesn&#39;t cause t=
he install the fail though, and postgresql gets updated to 15.12 and starts=
 up just fine. It&#39;s not clear to me if there is now some danger/flaw in=
 my installation or if this is something that can be ignored.</div><div><br=
></div><div>It doesn&#39;t appear that I can just set an environment variab=
le like TMP, TEMP, TEMPDIR etc to change this. I see that it can be changed=
 via an apt config change[1].</div><div><br></div><div>However, I&#39;m won=
dering if this is something that&#39;s better changed in the packaging. Set=
ting noexec on /tmp (and /var) is a standard CIS/DISA security requirement =
now.</div><div><br></div><div>1. <a href=3D"https://askubuntu.com/questions=
/1452390/install-packages-on-systems-with-secured-tmp-and-var-noexec">https=
://askubuntu.com/questions/1452390/install-packages-on-systems-with-secured=
-tmp-and-var-noexec</a></div><div><br></div><span class=3D"gmail_signature_=
prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature" data-smart=
mail=3D"gmail_signature"><div dir=3D"ltr"><div>Don Seiler<br><a href=3D"htt=
p://www.seiler.us" target=3D"_blank">www.seiler.us</a></div></div></div></d=
iv>

--0000000000008ed8c506324794c9--