bugManeage - Bugs: bug #60819, Avoid blocking install (configure)...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60819: Avoid blocking install (configure) if /dev/shm is non-executable

Submitter:  Boud Roukema <boud>
Submitted:  Thu 24 Jun 2021 07:50:35 PM UTC
   
 
Category:  Software Severity:  3 - Normal
Item Group:  Crash Status:  Fixed
Privacy:  Public Assigned to:  boud
Open/Closed:  Closed

Fri 25 Jun 2021 10:59:30 PM UTC, comment #4: 

OK

Boud Roukema <boud>
Group Member
Fri 25 Jun 2021 10:49:47 PM UTC, comment #3: 

Thanks for the check Boud.

By flags, I meant the executable "flag" that is important for this test (its not just the contents of the file that is important here).

Mohammad Akhlaghi <makhlaghi>
Group administrator
Fri 25 Jun 2021 10:42:57 PM UTC, comment #2: 

The diff b97c1ff..016d938 worked fine on the system where I discovered the problem. :)

I think your innovation in describing the commit as a two-authored commit is a good idea. :)

BTW, I think there's a typo:


+        rm -f $shmexecfile      # We also don't want any existing flags.


Surely "flags" should be "files"?

Boud Roukema <boud>
Group Member
Fri 25 Jun 2021 07:09:20 PM UTC, comment #1: 

Very interesting situation, thanks a lot for the find and the fix. It has been merged in Commit 016d938c.

I just made some corrections to the commit as described below, here I am listing the things that aren't clear from the commit message:

  • Some basic context was added at the start of the commit message to describe the problem. Don't forget that most Maneage users won't have much low-level operating system information and we encourage Maneage users to read the commit messages before merging their projects with Maneage. So we should write every commit message for a random M.Sc student who has just started coding. Later, I want to setup the system to send an email on every commit to people who register. This can itself be a good way to teach users :-).


  • Instead of using '-x' of 'if', I simply tried calling the executable script and redirected all outputs (to 'stdout' or 'stderr' to '/dev/null'). Since users can be on any shell within this script, its safest to assume the least amount of high-level features.


I am closing the task. Can you please try it on the system to make sure the changes indeed work on the faulty system? If there was a problem in the commit, please open this bug again and let me know ;-).

Thanks again for this nice catch and fix Boud.

Mohammad Akhlaghi <makhlaghi>
Group administrator
Thu 24 Jun 2021 07:50:35 PM UTC, original submission:  

BUG: Some systems have /dev/shm and set the `noexec' flag on /dev/shm for security
reasons [1]. In this case on one system that I tried, the initial software build failed with

./reproduce/software/shell/pre-make-build.sh: line 183: ./configure: Permission denied


COMMENT:
A Maneage project should not require an extra
hack on a system just because it is secure.

REPRODUCE:
On a system with /dev/shm, do


sudo mount -o remount,noexec /dev/shm


and then try a completely fresh install of Maneage (e.g. commit b97c1ff). This should fail with the message above.


PROPOSED SOLUTION:

This commit https://codeberg.org/boud/maneage_dev/commit/3b0e314efab87b9e6da35d554730f2b8583d1c6a
creates a trivial dummy executable script file in /dev/shm
and resets the `configure.sh' variable associated with /dev/shm
to an empty string if the dummy script is found to
be not executable despite having been given executable rights
with chmod.

A possible simplification of this script would be for
the dummy script to be a zero-byte file.


[1] https://serverfault.com/questions/72356/how-useful-is-mounting-tmp-noexec
    (archive:
    https://web.archive.org/web/20210624192819/https://serverfault.com/questions/72356/how-useful-is-mounting-tmp-noexec)


Boud Roukema <boud>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by makhlaghi (Posted a comment)
  • -email is unavailable- added by boud (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-06-25 makhlaghi CategoryNone Software
        Item GroupNone Crash
        StatusNone Fixed
        Assigned toNone boud
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.14-f13d.
    Corresponding source code