MIME-Version: 1.0
References: 
 <CAHJZqBAf3us8t3AwbjqfXvCYz-BZztYy0CLR5-00sfPD904z5A@mail.gmail.com>
In-Reply-To: 
 <CAHJZqBAf3us8t3AwbjqfXvCYz-BZztYy0CLR5-00sfPD904z5A@mail.gmail.com>
From: Don Seiler <don@seiler.us>
Date: Tue, 8 Apr 2025 12:39:42 -0500
Message-ID: 
 <CAHJZqBBKPQt1OX8Uzh+X3r+yuye6TpiBmVHNSC+ayoWiBo95Bw@mail.gmail.com>
Subject: Re: Errors installing/updating postgresql when /tmp has noexec
To: pgsql-pkg-debian@postgresql.org
Content-Type: multipart/alternative; boundary="0000000000002f9cde063247d747"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHJZqBBKPQt1OX8Uzh%2BX3r%2Byuye6TpiBmVHNSC%2BayoWiBo95Bw%40mail.gmail.com>
Precedence: bulk

--0000000000002f9cde063247d747
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 8, 2025 at 12:21=E2=80=AFPM Don Seiler <don@seiler.us> wrote:

> After some recent system hardening, I'm now getting these errors when
> running apt to update our PGDG postgresql packages. In this case we are
> running postgresql-15 on Ubuntu 22.04 LTS.
>
> Preconfiguring packages ...
> Can't exec "/tmp/postgresql-15.config.rOsJHJ": Permission denied at
> /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178. open2: exec of
> /tmp/postgresql-15.config.rOsJHJ configure 15.8-1.pgdg22.04+1 failed:
> Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59.
>
> This doesn't cause the install the fail though, and postgresql gets
> updated to 15.12 and starts up just fine. It's not clear to me if there i=
s
> now some danger/flaw in my installation or if this is something that can =
be
> ignored.
>
> It doesn't appear that I can just set an environment variable like TMP,
> TEMP, TEMPDIR etc to change this. I see that it can be changed via an apt
> config change[1].
>
> However, I'm wondering if this is something that's better changed in the
> packaging. Setting noexec on /tmp (and /var) is a standard CIS/DISA
> security requirement now.
>
> 1.
> https://askubuntu.com/questions/1452390/install-packages-on-systems-with-=
secured-tmp-and-var-noexec
>

For what it's worth, setting this apt config to specify a non-/tmp path
works around the problem:

$ cat /etc/apt/apt.conf.d/99tempdir.conf
APT::ExtractTemplates::TempDir "/some/other/tmp";

However it seems like we still shouldn't be trying to exec from /tmp by
default either. In the meantime we'll see how best to quickly deploy this
workaround to our fleet of machines.

Don.

--=20
Don Seiler
www.seiler.us

--0000000000002f9cde063247d747
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_quote gmail_quote_container"><div =
dir=3D"ltr" class=3D"gmail_attr">On Tue, Apr 8, 2025 at 12:21=E2=80=AFPM Do=
n Seiler &lt;<a href=3D"mailto:don@seiler.us">don@seiler.us</a>&gt; wrote:<=
br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e=
x;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"=
><div>After some recent system hardening, I&#39;m now getting these errors =
when running apt to update our PGDG postgresql packages. In this case we ar=
e running postgresql-15 on Ubuntu 22.04 LTS.</div><div><br></div>Preconfigu=
ring packages ...<br>Can&#39;t exec &quot;/tmp/postgresql-15.config.rOsJHJ&=
quot;: Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.p=
m line 178. open2: exec of /tmp/postgresql-15.config.rOsJHJ configure 15.8-=
1.pgdg22.04+1 failed: Permission denied at /usr/share/perl5/Debconf/ConfMod=
ule.pm line 59.<div><br></div><div>This doesn&#39;t cause the install the f=
ail though, and postgresql gets updated to 15.12 and starts up just fine. I=
t&#39;s not clear to me if there is now some danger/flaw in my installation=
 or if this is something that can be ignored.</div><div><br></div><div>It d=
oesn&#39;t appear that I can just set an environment variable like TMP, TEM=
P, TEMPDIR etc to change this. I see that it can be changed via an apt conf=
ig change[1].</div><div><br></div><div>However, I&#39;m wondering if this i=
s something that&#39;s better changed in the packaging. Setting noexec on /=
tmp (and /var) is a standard CIS/DISA security requirement now.</div><div><=
br></div><div>1. <a href=3D"https://askubuntu.com/questions/1452390/install=
-packages-on-systems-with-secured-tmp-and-var-noexec" target=3D"_blank">htt=
ps://askubuntu.com/questions/1452390/install-packages-on-systems-with-secur=
ed-tmp-and-var-noexec</a></div></div>
</blockquote></div><div><br></div><div>For what it&#39;s worth, setting thi=
s apt config to specify a non-/tmp path works around the problem:</div><div=
><br></div><div><span style=3D"font-family:monospace">$ cat /etc/apt/apt.co=
nf.d/99tempdir.conf<br>APT::ExtractTemplates::TempDir &quot;/some/other/tmp=
&quot;;</span></div><div><br></div><div>However it seems like we still shou=
ldn&#39;t be trying to exec from /tmp by default either. In the meantime we=
&#39;ll see how best to quickly deploy this workaround to our fleet of mach=
ines.</div><div><br></div><div>Don.</div><div><br></div><span class=3D"gmai=
l_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature=
"><div dir=3D"ltr"><div>Don Seiler<br><a href=3D"http://www.seiler.us" targ=
et=3D"_blank">www.seiler.us</a></div></div></div></div>

--0000000000002f9cde063247d747--