Actions
Bug #21999
openSupport compute nodes with /tmp mounted with "noexec" flag
Status:
New
Priority:
Normal
Assigned To:
Category:
Deployment
Target version:
Story points:
-
Description
One of the advisories from the Center for Internet Security regarding hardening hosts is mounting the /tmp
filesystem with noexec
. This produces the following issue when creating a compute node image:
Compute AMI creation fails: The compute image creation base script attempts to execute a program in /tmp
tools/compute-images/scripts/base.sh:135: unzip -q /tmp/awscliv2.zip -d /tmp && $SUDO /tmp/aws/install
Related issues
Updated by Peter Amstutz 3 months ago
So if the problem is mainly using /tmp, we should be using a different directory, maybe /root or /var/spool/something ?
Updated by Lucas Di Pentima 3 months ago
Yes, I was thinking in just using $HOME/tmp
for every case. Maybe a-d-c would benefit of a new config knob to set that directory to some sensible (or /tmp
) default?
Updated by Peter Amstutz 2 months ago
- Target version changed from Development 2024-08-07 sprint to Development 2024-08-28 sprint
Updated by Peter Amstutz 2 months ago
- Target version changed from Development 2024-08-28 sprint to Development 2024-08-07 sprint
Updated by Peter Amstutz 2 months ago
- Target version changed from Development 2024-08-07 sprint to Development 2024-08-28 sprint
- Description updated (diff)
Updated by Peter Amstutz about 2 months ago
- Related to Feature #22029: arvados-dispatch-cloud option to use a different directory than /tmp for staging the crunch-run binary added
Updated by Peter Amstutz about 2 months ago
- Target version changed from Development 2024-08-28 sprint to Development 2024-09-11 sprint
Updated by Peter Amstutz about 1 month ago
- Target version changed from Development 2024-09-11 sprint to Development 2024-09-25 sprint
Updated by Peter Amstutz about 1 month ago
- Blocked by Support #22030: Have a testing environment where /tmp is noexec added
Updated by Peter Amstutz 11 days ago
- Target version changed from Development 2024-09-25 sprint to Development 2024-10-09 sprint
Actions