Project

General

Profile

Actions
Copy link

Bug #21999

open

Support compute nodes with /tmp mounted with "noexec" flag

Added by Lucas Di Pentima 3 months ago. Updated 11 days ago.

Status:
New
Priority:
Normal
Assigned To:
Lucas Di Pentima
Category:
Deployment
Target version:
Development 2024-10-09 sprint
Story points:
-

Description

One of the advisories from the Center for Internet Security regarding hardening hosts is mounting the /tmp filesystem with noexec. This produces the following issue when creating a compute node image:

Compute AMI creation fails: The compute image creation base script attempts to execute a program in /tmp

tools/compute-images/scripts/base.sh:135:  unzip -q /tmp/awscliv2.zip -d /tmp && $SUDO /tmp/aws/install

Subtasks 1 (1 open — 0 closed)

Task #22118: ReviewNewBrett SmithActions

Related issues

Related to Arvados - Feature #22029: arvados-dispatch-cloud option to use a different directory than /tmp for staging the crunch-run binaryNewActions
Blocked by Arvados - Support #22030: Have a testing environment where /tmp is noexecResolvedLucas Di PentimaActions
Actions
Copy link
 #1

Updated by Peter Amstutz 3 months ago

So if the problem is mainly using /tmp, we should be using a different directory, maybe /root or /var/spool/something ?

Actions
Copy link
 #2

Updated by Lucas Di Pentima 3 months ago

Yes, I was thinking in just using $HOME/tmp for every case. Maybe a-d-c would benefit of a new config knob to set that directory to some sensible (or /tmp) default?

Actions
Copy link
 #3

Updated by Peter Amstutz 2 months ago

  • Target version changed from Development 2024-08-07 sprint to Development 2024-08-28 sprint
Actions
Copy link
 #4

Updated by Peter Amstutz 2 months ago

  • Target version changed from Development 2024-08-28 sprint to Development 2024-08-07 sprint
Actions
Copy link
 #5

Updated by Peter Amstutz 2 months ago

  • Target version changed from Development 2024-08-07 sprint to Development 2024-08-28 sprint
  • Description updated (diff)
Actions
Copy link
 #6

Updated by Peter Amstutz 2 months ago

TODO split this into 3 tickets.

Actions
Copy link
 #7

Updated by Peter Amstutz about 2 months ago

  • Related to Feature #22029: arvados-dispatch-cloud option to use a different directory than /tmp for staging the crunch-run binary added
Actions
Copy link
 #8

Updated by Peter Amstutz about 2 months ago

  • Description updated (diff)
Actions
Copy link
 #9

Updated by Peter Amstutz about 2 months ago

  • Target version changed from Development 2024-08-28 sprint to Development 2024-09-11 sprint
Actions
Copy link
 #10

Updated by Peter Amstutz about 1 month ago

  • Target version changed from Development 2024-09-11 sprint to Development 2024-09-25 sprint
Actions
Copy link
 #11

Updated by Peter Amstutz about 1 month ago

  • Blocked by Support #22030: Have a testing environment where /tmp is noexec added
Actions
Copy link
 #12

Updated by Lucas Di Pentima 25 days ago

  • Assigned To set to Lucas Di Pentima
Actions
Copy link
 #13

Updated by Peter Amstutz 11 days ago

  • Target version changed from Development 2024-09-25 sprint to Development 2024-10-09 sprint
Actions
Copy link

Also available in: Atom PDF