Hi, Am Freitag, 18. Juni 2021, 17:21:43 CEST schrieb alad via aur-general:
On 18/06/2021 16:43, Jonathon Fernyhough via aur-general wrote:
On 18/06/2021 14:05, Jan Kohnert via aur-general wrote:
a new version of a (binary) package I'm maintaining (clockify-desktop) requires an executable /tmp directory to run.
My immediate questions would be why, and is this an upstream issue?
I really don't know. Upstream changed their version 2.0.2 by a new upload They use S3 storage and have a unique filename for all versions; so I only figure out changes by automatic nightly builds on my GitlLab that fails when the hash changes. I contacted them and the answer I got was "the dev team works on a new version". They promised to notify me when a new version is available, but I can't tell when this will by the case.
Or, is an executable /tmp a reasonable assumption? 🤔
I don't see anything in file-hierarchy(7) that mandates an executable /tmp. That said, it contains a hint that some programs might break:
/tmp/, /var/tmp/ and /dev/shm/ should be mounted nosuid and nodev, which means that set-user-id mode and character or block special devices are not interpreted on those file systems. In general it is not possible to mount them noexec, because various programs use those directories for dynamically generated or optimized code, and with that flag those use cases would break. Using this flag is OK on special-purpose installations or systems where all software that may be installed is known and doesn't require such functionality. See the discussion of nosuid/nodev/noexec in mount(8) and PROT_EXEC in mmap(2).
Based on this, my setup seems a bit outdated. AFAIR the info to use noexec on / tmp is from the time I switched to Gentoo at around 2004 to remove a possible attack vector. There were even advices to mount /home and /var/tmp noexec to prevent users from executing arbitary code, as then all user-writeable directories whould be noexec. I never changed that setup at least for /tmp and /var/tmp for newer machines, but I do get some errors for some python-related packages from the AUR that require an executable /tmp for building. So maybe I'll just change my setup and push the new version without adding a warning. Thanks for clearification. :) -- MfG Jan