#995793 exim4-base: /tmp partition has noexec mount option; exim4-base fails

Package:
apt
Source:
apt
Description:
commandline package manager
Submitter:
Steve Egbert
Date:
2021-10-06 17:12:06 UTC
Severity:
normal
#995793#5
Date:
2021-10-05 19:22:56 UTC
From:
To:
Dear Maintainer,

Tried to installed 'exim4-base' after its most recent update and failed.


Implemented a rough draft of CIS Security Debian 11.

The portion about /tmp mount partition having that 'noexec' mount
option.

Well, we will not be able to install exim4-base package anymore
if this hardening effort continues.

Besides, who is still trying execute a script in /tmp directory.

Correct action is to do 'bash /tmp/your-script' or 'perl
/tmp/your-script'.

Not to execute directly from '/tmp/your-script'.

Best action is not to execute that script directly in /tmp.

#995793#10
Date:
2021-10-05 19:49:58 UTC
From:
To:
WORKAROUND
Remove the “no exec” from /tmp mount point options in /etcfstab, reboot, then attempt ‘apt upgrade exim4-base’ so that Perl script for ‘exam-config’ can continue.

OUTPUT of failed upgrade:

~# apt upgrade exim4-base
[?2004l

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done


Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree... Done


Reading state information... 0%

Reading state information... 0%

Reading state information... Done


Calculating upgrade... 0%

Calculating upgrade... 10%

Calculating upgrade... Done

The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp
Use 'apt autoremove' to remove them.
The following packages will be upgraded:
  exim4-base exim4-config tzdata
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
8 not fully installed or removed.
Need to get 0 B/1,906 kB of archives.
After this operation, 2,784 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... 25%
Reading changelogs... 50%
Reading changelogs... 100%

Reading changelogs... Done
Preconfiguring packages ...
Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178.
open2: exec of /tmp/tzdata.config.jtoGAt configure 2021a-1 failed: Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59.

78(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 181409 files and directories currently installed.)
Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ...
7Progress: [  0%] [..........................................................] 87Progress: [  5%] [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ...
dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
dpkg: warning: old tzdata package post-removal script subprocess returned error exit status 2
dpkg: trying script from the new package instead ...
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
 new tzdata package post-removal script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new tzdata package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-config_4.94.2-7_all.deb ...
7Progress: [ 10%] [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
 new exim4-config package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-config package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ...
7Progress: [ 14%] [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack):
 new exim4-base package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-base package post-removal script subprocess returned error exit status 2
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb
 /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb
 /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb

78E: Sub-process /usr/bin/dpkg returned an error code (1)
[?2004hroot@circa:~# exit
[?2004l
exit

Script done on 2021-10-05 15:48:17-04:00 [COMMAND_EXIT_CODE="100"]

#995793#15
Date:
2021-10-05 19:49:58 UTC
From:
To:
WORKAROUND
Remove the “no exec” from /tmp mount point options in /etcfstab, reboot, then attempt ‘apt upgrade exim4-base’ so that Perl script for ‘exam-config’ can continue.

OUTPUT of failed upgrade:

~# apt upgrade exim4-base
[?2004l

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done


Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree... Done


Reading state information... 0%

Reading state information... 0%

Reading state information... Done


Calculating upgrade... 0%

Calculating upgrade... 10%

Calculating upgrade... Done

The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp
Use 'apt autoremove' to remove them.
The following packages will be upgraded:
  exim4-base exim4-config tzdata
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
8 not fully installed or removed.
Need to get 0 B/1,906 kB of archives.
After this operation, 2,784 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... 25%
Reading changelogs... 50%
Reading changelogs... 100%

Reading changelogs... Done
Preconfiguring packages ...
Can't exec "/tmp/tzdata.config.jtoGAt": Permission denied at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 178.
open2: exec of /tmp/tzdata.config.jtoGAt configure 2021a-1 failed: Permission denied at /usr/share/perl5/Debconf/ConfModule.pm line 59.

78(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 181409 files and directories currently installed.)
Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ...
7Progress: [  0%] [..........................................................] 87Progress: [  5%] [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ...
dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
dpkg: warning: old tzdata package post-removal script subprocess returned error exit status 2
dpkg: trying script from the new package instead ...
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
 new tzdata package post-removal script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new tzdata package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-config_4.94.2-7_all.deb ...
7Progress: [ 10%] [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
 new exim4-config package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-config package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ...
7Progress: [ 14%] [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack):
 new exim4-base package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-base package post-removal script subprocess returned error exit status 2
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb
 /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb
 /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb

78E: Sub-process /usr/bin/dpkg returned an error code (1)
[?2004hroot@circa:~# exit
[?2004l
exit

Script done on 2021-10-05 15:48:17-04:00 [COMMAND_EXIT_CODE="100"]

#995793#20
Date:
2021-10-05 19:57:15 UTC
From:
To:
workaround of removing ‘noexec’ from /tmp partition in /etc/fstab still doesn’t work.

00 [TERM="linux" TTY="/dev/tty1" COLUMNS="80" LINES="25"]
[?2004hroot@circa:~# apt upgrade exim4-base
[?2004l

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done


Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree... Done


Reading state information... 0%

Reading state information... 0%

Reading state information... Done


Calculating upgrade... 0%

Calculating upgrade... 10%

Calculating upgrade... Done

The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp
Use 'apt autoremove' to remove them.
The following packages will be upgraded:
  exim4-base exim4-config tzdata
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
8 not fully installed or removed.
Need to get 0 B/1,906 kB of archives.
After this operation, 2,784 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... 25%
Reading changelogs... 50%
Reading changelogs... 100%

Reading changelogs... Done
Preconfiguring packages ...

78(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 181409 files and directories currently installed.)
Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ...
7Progress: [  0%] [..........................................................] 87Progress: [  5%] [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ...
dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
dpkg: warning: old tzdata package post-removal script subprocess returned error exit status 2
dpkg: trying script from the new package instead ...
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
 new tzdata package post-removal script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new tzdata package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-config_4.94.2-7_all.deb ...
7Progress: [ 10%] [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
 new exim4-config package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-config package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ...
7Progress: [ 14%] [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack):
 new exim4-base package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-base package post-removal script subprocess returned error exit status 2
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb
 /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb
 /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb

78E: Sub-process /usr/bin/dpkg returned an error code (1)
[?2004hroot@circa:~# exit
[?2004l
exit

Script done on 2021-10-05 15:53:17-04:00 [COMMAND_EXIT_CODE="100"]


I still have “nosuid” and “nodev” mount options left but i won’t remove that.

#995793#25
Date:
2021-10-05 19:57:15 UTC
From:
To:
workaround of removing ‘noexec’ from /tmp partition in /etc/fstab still doesn’t work.

00 [TERM="linux" TTY="/dev/tty1" COLUMNS="80" LINES="25"]
[?2004hroot@circa:~# apt upgrade exim4-base
[?2004l

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done


Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree... Done


Reading state information... 0%

Reading state information... 0%

Reading state information... Done


Calculating upgrade... 0%

Calculating upgrade... 10%

Calculating upgrade... Done

The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libopts25 sntp
Use 'apt autoremove' to remove them.
The following packages will be upgraded:
  exim4-base exim4-config tzdata
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
8 not fully installed or removed.
Need to get 0 B/1,906 kB of archives.
After this operation, 2,784 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Reading changelogs... 25%
Reading changelogs... 50%
Reading changelogs... 100%

Reading changelogs... Done
Preconfiguring packages ...

78(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 181409 files and directories currently installed.)
Preparing to unpack .../tzdata_2021a-1+deb11u1_all.deb ...
7Progress: [  0%] [..........................................................] 87Progress: [  5%] [##........................................................] 8Unpacking tzdata (2021a-1+deb11u1) over (2021a-1) ...
dpkg (subprocess): unable to execute old tzdata package post-removal script (/var/lib/dpkg/info/tzdata.postrm): Permission denied
dpkg: warning: old tzdata package post-removal script subprocess returned error exit status 2
dpkg: trying script from the new package instead ...
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error processing archive /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb (--unpack):
 new tzdata package post-removal script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new tzdata package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new tzdata package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-config_4.94.2-7_all.deb ...
7Progress: [ 10%] [#####.....................................................] 8dpkg (subprocess): unable to execute new exim4-config package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb (--unpack):
 new exim4-config package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-config package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-config package post-removal script subprocess returned error exit status 2
Preparing to unpack .../exim4-base_4.94.2-7_amd64.deb ...
7Progress: [ 14%] [########..................................................] 8dpkg (subprocess): unable to execute new exim4-base package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb (--unpack):
 new exim4-base package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new exim4-base package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
 new exim4-base package post-removal script subprocess returned error exit status 2
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2021a-1+deb11u1_all.deb
 /var/cache/apt/archives/exim4-config_4.94.2-7_all.deb
 /var/cache/apt/archives/exim4-base_4.94.2-7_amd64.deb

78E: Sub-process /usr/bin/dpkg returned an error code (1)
[?2004hroot@circa:~# exit
[?2004l
exit

Script done on 2021-10-05 15:53:17-04:00 [COMMAND_EXIT_CODE="100"]


I still have “nosuid” and “nodev” mount options left but i won’t remove that.

#995793#30
Date:
2021-10-05 20:07:05 UTC
From:
To:
Actual workaround is to remove ‘noexec” from both /tmp and /var. Tested it working without “noexec” mount options on ‘apt upgrade exim4-base’ to versio ‘4.94.2-7’

This makes it like a major work-stoppage of dealing with 1,000s of those hardened Debian systems.

#995793#35
Date:
2021-10-06 12:08:13 UTC
From:
To:
This is most obviously not a script that comes from the exim4 package.
Consider talking to the tzdata maintainers instead.

This looks like dpkg is trying to execute maintainer scripts. It
obviously does that inside /var/lib/dpkg/info. This is nothing that
exim4 can do anything about. Consider talking to the dpkg maintainers
instead.

Same thing here.

I intend to close this bug report by the end of this week unless
somebody has convinced me that there is anything that the exim4
package can do about.

Greetings
Marc

#995793#40
Date:
2021-10-06 17:09:02 UTC
From:
To:
Control: severity -1 normal
Control: reassign -1 apt
Control: forcemerge 546911 995793
[...]

Hello,

Mounting /var noexec is not supported. For noexec /tmp you will need to
point APT::ExtractTemplates::TempDir to an directory which is not
located on a noexec mount.

cu Andreas