Benoit GUERIN <benoit.guerin@gmail.com> writes:

I've added a patch for review on this bug report.

Colin, could you take a look on it and ack it for me to push it?

Cheers,

Allowing users to install a system with a noexec /var strikes me as a
bad idea, because such a system will require a knowledgeable admin to
intervene to allow it to upgrade, or install new packages.

I think that partman should prevent the user from foot-shooting of this
magnitude. It should ensure that at least / /usr /tmp /var are not
noexec. (/tmp due to #223683)

(FWIW, I have always considered /var/lib/dpkg to be a FHS violation,
being that the data in it is no more "variable" than is /bin/sh. And here
we have a nice example of why that should have been moved a decade plus
ago. Unfortunatly, I never had much luck convincing anyone to care about
that. But even if that were fixed, /var can potentially contiain FHS
compliant executables. For example, ucf's cache files are executable if
the conffile is executable.)

2010/4/15 Joey Hess <joeyh@debian.org>
I totally agree with that, but as a similary thing, one can configure /usr
read-only (for security reasons)
The installation process does not break with /usr configured read only, and
once you have rebooted, you HAVE to do some extra configuration
(/etc/apt/apt.conf.d/... ok this works with apt, aptitude, synaptic but not
with dpkg itself)  to install / upgrade packages

My 2 cents ...

* Joey Hess <joeyh@debian.org> [100415 19:21]:

I don't think /tmp should be forced to be non-noexec. People getting
some nasty warnings when forgetting to disabling preconfigure when using
a noexec /tmp is not really a problem when everything just works
otherwise.

Hochachtungsvoll,
	Bernhard R. Link

I tried to contact you, but was unsuccessful. I need an urgent answer
..................................................................................................................
Am încercat să vă contactez, dar nu a avut succes. Am nevoie de un răspuns
urgent

-- 
How are you?