Dear Maintainer, Tried to installed 'exim4-base' after its most recent update and failed. Implemented a rough draft of CIS Security Debian 11. The portion about /tmp mount partition having that 'noexec' mount option. Well, we will not be able to install exim4-base package anymore if this hardening effort continues. Besides, who is still trying execute a script in /tmp directory. Correct action is to do 'bash /tmp/your-script' or 'perl /tmp/your-script'. Not to execute directly from '/tmp/your-script'. Best action is not to execute that script directly in /tmp.
WORKAROUND Remove the “no exec” from /tmp mount point options in /etcfstab, reboot, then attempt ‘apt upgrade exim4-base’ so that Perl script for ‘exam-config’ can continue. OUTPUT of failed upgrade: ~# apt upgrade exim4-base [?2004l Reading package lists... 0% Reading package lists... 100% Reading package lists... Done Building dependency tree... 0% Building dependency tree... 0% Building dependency tree... 50% Building dependency tree... 50% Building dependency tree... Done Reading state information... 0% Reading state information... 0% Reading state information... Done Calculating upgrade... 0% Calculating upgrade... 10% Calculating upgrade... Done The following packages were automatically installed and are no longer required: libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp Use 'apt autoremove' to remove them. The following packages will be upgraded: exim4-base exim4-config tzdata 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 8 not fully installed or removed. Need to get 0 B/1,906 kB of archives. After this operation, 2,784 kB of additional disk space will be used. Do you want to continue? [Y/n] y Reading changelogs... 25% Reading changelogs... 50% Reading changelogs... 100% Reading changelogs... Done Preconfiguring packages ... Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178. open2: exec of /tmp/tzdata.config.jtoGAt configure 2021a-1 failed: Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59. 7[0;24r8[1A(Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 181409 files and directories currently installed.) Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ... 7[25;0f[42m[30mProgress: [ 0%][49m[39m [..........................................................] 87[25;0f[42m[30mProgress: [ 5%][49m[39m [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ... dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied [1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2 [1mdpkg:[0m trying script from the new package instead ... dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack): new tzdata package post-removal script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new tzdata package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-config_4.94.2-7_all.deb ... 7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack): new exim4-config package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-config package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ... 7[25;0f[42m[30mProgress: [ 14%][49m[39m [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack): new exim4-base package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-base package post-removal script subprocess returned error exit status 2 Errors were encountered while processing: /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb 7[0;25r8[1A[J[1;31mE: [0mSub-process /usr/bin/dpkg returned an error code (1)[0m [?2004hroot@circa:~# exit [?2004l exit Script done on 2021-10-05 15:48:17-04:00 [COMMAND_EXIT_CODE="100"]
WORKAROUND Remove the “no exec” from /tmp mount point options in /etcfstab, reboot, then attempt ‘apt upgrade exim4-base’ so that Perl script for ‘exam-config’ can continue. OUTPUT of failed upgrade: ~# apt upgrade exim4-base [?2004l Reading package lists... 0% Reading package lists... 100% Reading package lists... Done Building dependency tree... 0% Building dependency tree... 0% Building dependency tree... 50% Building dependency tree... 50% Building dependency tree... Done Reading state information... 0% Reading state information... 0% Reading state information... Done Calculating upgrade... 0% Calculating upgrade... 10% Calculating upgrade... Done The following packages were automatically installed and are no longer required: libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp Use 'apt autoremove' to remove them. The following packages will be upgraded: exim4-base exim4-config tzdata 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 8 not fully installed or removed. Need to get 0 B/1,906 kB of archives. After this operation, 2,784 kB of additional disk space will be used. Do you want to continue? [Y/n] y Reading changelogs... 25% Reading changelogs... 50% Reading changelogs... 100% Reading changelogs... Done Preconfiguring packages ... Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178. open2: exec of /tmp/tzdata.config.jtoGAt configure 2021a-1 failed: Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59. 7[0;24r8[1A(Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 181409 files and directories currently installed.) Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ... 7[25;0f[42m[30mProgress: [ 0%][49m[39m [..........................................................] 87[25;0f[42m[30mProgress: [ 5%][49m[39m [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ... dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied [1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2 [1mdpkg:[0m trying script from the new package instead ... dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack): new tzdata package post-removal script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new tzdata package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-config_4.94.2-7_all.deb ... 7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack): new exim4-config package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-config package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ... 7[25;0f[42m[30mProgress: [ 14%][49m[39m [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack): new exim4-base package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-base package post-removal script subprocess returned error exit status 2 Errors were encountered while processing: /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb 7[0;25r8[1A[J[1;31mE: [0mSub-process /usr/bin/dpkg returned an error code (1)[0m [?2004hroot@circa:~# exit [?2004l exit Script done on 2021-10-05 15:48:17-04:00 [COMMAND_EXIT_CODE="100"]
workaround of removing ‘noexec’ from /tmp partition in /etc/fstab still doesn’t work. 00 [TERM="linux" TTY="/dev/tty1" COLUMNS="80" LINES="25"] [?2004hroot@circa:~# apt upgrade exim4-base [?2004l Reading package lists... 0% Reading package lists... 100% Reading package lists... Done Building dependency tree... 0% Building dependency tree... 0% Building dependency tree... 50% Building dependency tree... 50% Building dependency tree... Done Reading state information... 0% Reading state information... 0% Reading state information... Done Calculating upgrade... 0% Calculating upgrade... 10% Calculating upgrade... Done The following packages were automatically installed and are no longer required: libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp Use 'apt autoremove' to remove them. The following packages will be upgraded: exim4-base exim4-config tzdata 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 8 not fully installed or removed. Need to get 0 B/1,906 kB of archives. After this operation, 2,784 kB of additional disk space will be used. Do you want to continue? [Y/n] y Reading changelogs... 25% Reading changelogs... 50% Reading changelogs... 100% Reading changelogs... Done Preconfiguring packages ... 7[0;24r8[1A(Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 181409 files and directories currently installed.) Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ... 7[25;0f[42m[30mProgress: [ 0%][49m[39m [..........................................................] 87[25;0f[42m[30mProgress: [ 5%][49m[39m [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ... dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied [1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2 [1mdpkg:[0m trying script from the new package instead ... dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack): new tzdata package post-removal script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new tzdata package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-config_4.94.2-7_all.deb ... 7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack): new exim4-config package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-config package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ... 7[25;0f[42m[30mProgress: [ 14%][49m[39m [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack): new exim4-base package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-base package post-removal script subprocess returned error exit status 2 Errors were encountered while processing: /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb 7[0;25r8[1A[J[1;31mE: [0mSub-process /usr/bin/dpkg returned an error code (1)[0m [?2004hroot@circa:~# exit [?2004l exit Script done on 2021-10-05 15:53:17-04:00 [COMMAND_EXIT_CODE="100"] I still have “nosuid” and “nodev” mount options left but i won’t remove that.
workaround of removing ‘noexec’ from /tmp partition in /etc/fstab still doesn’t work. 00 [TERM="linux" TTY="/dev/tty1" COLUMNS="80" LINES="25"] [?2004hroot@circa:~# apt upgrade exim4-base [?2004l Reading package lists... 0% Reading package lists... 100% Reading package lists... Done Building dependency tree... 0% Building dependency tree... 0% Building dependency tree... 50% Building dependency tree... 50% Building dependency tree... Done Reading state information... 0% Reading state information... 0% Reading state information... Done Calculating upgrade... 0% Calculating upgrade... 10% Calculating upgrade... Done The following packages were automatically installed and are no longer required: libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp Use 'apt autoremove' to remove them. The following packages will be upgraded: exim4-base exim4-config tzdata 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 8 not fully installed or removed. Need to get 0 B/1,906 kB of archives. After this operation, 2,784 kB of additional disk space will be used. Do you want to continue? [Y/n] y Reading changelogs... 25% Reading changelogs... 50% Reading changelogs... 100% Reading changelogs... Done Preconfiguring packages ... 7[0;24r8[1A(Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 181409 files and directories currently installed.) Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ... 7[25;0f[42m[30mProgress: [ 0%][49m[39m [..........................................................] 87[25;0f[42m[30mProgress: [ 5%][49m[39m [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ... dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied [1mdpkg:[0m [1;33mwarning:[0m old tzdata package post-removal script subprocess returned error exit status 2 [1mdpkg:[0m trying script from the new package instead ... dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack): new tzdata package post-removal script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new tzdata package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-config_4.94.2-7_all.deb ... 7[25;0f[42m[30mProgress: [ 10%][49m[39m [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack): new exim4-config package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-config package post-removal script subprocess returned error exit status 2 Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ... 7[25;0f[42m[30mProgress: [ 14%][49m[39m [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied [1mdpkg:[0m error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack): new exim4-base package pre-installation script subprocess returned error exit status 2 dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied [1mdpkg[0m: [1;31merror while cleaning up:[0m new exim4-base package post-removal script subprocess returned error exit status 2 Errors were encountered while processing: /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb 7[0;25r8[1A[J[1;31mE: [0mSub-process /usr/bin/dpkg returned an error code (1)[0m [?2004hroot@circa:~# exit [?2004l exit Script done on 2021-10-05 15:53:17-04:00 [COMMAND_EXIT_CODE="100"] I still have “nosuid” and “nodev” mount options left but i won’t remove that.
Actual workaround is to remove ‘noexec” from both /tmp and /var. Tested it working without “noexec” mount options on ‘apt upgrade exim4-base’ to versio ‘4.94.2-7’ This makes it like a major work-stoppage of dealing with 1,000s of those hardened Debian systems.
This is most obviously not a script that comes from the exim4 package. Consider talking to the tzdata maintainers instead. This looks like dpkg is trying to execute maintainer scripts. It obviously does that inside /var/lib/dpkg/info. This is nothing that exim4 can do anything about. Consider talking to the dpkg maintainers instead. Same thing here. I intend to close this bug report by the end of this week unless somebody has convinced me that there is anything that the exim4 package can do about. Greetings Marc
Control: severity -1 normal Control: reassign -1 apt Control: forcemerge 546911 995793 [...] Hello, Mounting /var noexec is not supported. For noexec /tmp you will need to point APT::ExtractTemplates::TempDir to an directory which is not located on a noexec mount. cu Andreas