How do I mount /tmp on VPSes with noexec,nosuid options?

[eUK-Scott]

The idea is to create a separate file which will contain a filesystem for /tmp directories for all VPS Hostinges and mount that file as a loop device using noexec,nosuid options.

It can be done thusly:

1) Create a special file, and create a filesystem inside that file and mount it:

# dd if=/dev/zero of=/vz/tmpVE bs=1k count=2000000
# losetup /dev/loop0 /vz/tmpVE
# mkfs.ext2 /dev/loop0
# mkdir /vz/tmpVEs
# mount /dev/loop0 /vz/tmpVEs -o noexec,nosuid,nodev,rw

2) Add the following lines into /etc/sysconfig/vz-scripts/dists/scripts/postcreate.sh:

function vztmpsetup()
{

VEID=`basename $VE_ROOT`

cp /etc/sysconfig/vz-scripts/new.mount /etc/sysconfig/vz-scripts/$VEID.mount
cp /etc/sysconfig/vz-scripts/new.umount /etc/sysconfig/vz-scripts/$VEID.umount

if [ "$" != "" ]; then
[ -d /vz/tmpVEs/$ ] && rm -rf /vz/tmpVEs/$VEID/*
fi

chmod 755 /etc/sysconfig/vz-scripts/$VEID.mount
/etc/sysconfig/vz-scripts/$VEID.umount

}

vztmpsetup

exit 0

3) Create "/etc/sysconfig/vz-scripts/new.mount":

#!/bin/bash
#
# if one of these files does not exist then something is really broken
[ -f /etc/sysconfig/vz ] || exit 1
[ -f $VE_CONFFILE ] || exit 1
[ -f /etc/sysconfig/vz-scripts/$VEID.conf ] || exit 1
# Source configuration files to access $VE_ROOT
. /etc/sysconfig/vz
. $VE_CONFFILE
[ -e /vz/tmpVEs/$VEID ] || mkdir /vz/tmpVEs/$VEID
mount --bind /vz/tmpVEs/$VEID $VE_ROOT/tmp

4) Create "/etc/sysconfig/vz-scripts/new.umount":

#!/bin/bash
# if one of these files does not exist then something is really broken
[ -f /etc/sysconfig/vz ] || exit 1
[ -f $VE_CONFFILE ] || exit 1
# Source configuration files to access $VE_ROOT
. /etc/sysconfig/vz
. $VE_CONFFILE
# Unmount shared directory
if grep "/vz/root/$VEID/tmp" /proc/mounts >/dev/null; then
umount $VE_ROOT/tmp
fi

5) Add the following lines into "/etc/rc.sysinit":

losetup /dev/loop0 /vz/tmpVE
mount /dev/loop0 /vz/tmpVEs -o noexec,nosuid,nodev,rw

[Fidget]

Wow, what an excellent guide.

This looks like it is for those with vzpp, could you also provide a guide for those of us who don't have it?

[Fidget]

I might get shot for bumping this, but hopefully you guys can advise when you have a moment

[DPS Computing]

Originally Posted by Fidget

I might get shot for bumping this, but hopefully you guys can advise when you have a moment

I'm sure you won't get shot lol . Your question just probably wasn't seen at the original time .

[eUKhost.com]

Alex is not available right now so I will ask him to reply tomorrow morning.

[DPS Computing]

Originally Posted by eukhost.com

Alex is not available right now so I will ask him to reply tomorrow morning.

There you go Fidget - an answer will be on its way to you soon (hopefully tommorow if Alex has the time!)

[eUK-Scott]

Fidget,

We have not tried this with OpenVZ. Also Swsoft has provided /tmp security option with the Linux Virtuozzo SP1 itself now. If you want, you can secure /tmp for individual VPS Hosting using following steps :

* Login to VPS Hosting.

* Edit /etc/fstab

- Under the existing line (there should only be one line)
- add >> none /tmp tmpfs nodev,nosuid,noexec 0 0
- Reboot the VPS Hosting to make the changes take effect.
- Log back in and enter "df -h" to see whether the changes have taken effect.

IMPORTANT NOTE 1: You should see a separated /tmp partition now). Note that unlike with a dedicated server, this /tmp partition isn't a real partition. What it basically does is to create a ramdisk on the hardware node for the VPS Hosting, of which the diskusage isn't accounted towards the quota of the rest of the VPS Hosting. The usage is accounted against the "shmpages" of the VPS Hosting, which can only be set from the hardware node. Usually this is set to either 32mb or 64mb. Also note that the /tmp ramdisk isn't the only thing that consumes the shmpages, there are also several other things that use up the space.

NOTE 2: because it's a ramdisk, all data on the /tmp 'partition' will be lost after a reboot. That's not a problem because all data on the /tmp partition' is temporary data anyway. However, when you install eaccelerator for instance, it needs its own directory on the /tmp partition (it needs /tmp/eaccelerator and needs to be chmod to 777). So after a reboot, that directory would be lost and eaccelerator wouldn't function properly. So if you install eaccelerator (or anything else that requires something like this), then make sure that after a reboot the required directory and chmod are automatically created. You could do this with /etc/rc.local for instance (at the end of that file just add "mkdir /tmp/eaccelerator" "chmod 777 /tmp/eaccelerator").

[Fidget]

Thanks Alex! What a cracking guide.

I happened to ask support to do it for us after our last move, and they handled it very effectively, but this is excellent advice for those who want to do it themselves.

Thanks very much indeed

.

[DPS Computing]

Originally Posted by Fidget

Thanks Alex! What a cracking guide.

I happened to ask support to do it for us after our last move, and they handled it very effectively, but this is excellent advice for those who want to do it themselves.

Thanks very much indeed

.

At least you got your answer that you were waiting for in the end!

[Rock]

Since Virtuozzo 3.0 SP1 it is very easy to mount /tmp (and /var/tmp if needed) dir on VEs with noexec, nosuid, nodev options using introduced 'bindmount' technology. You can follow the steps below to mount /tmp and /var/tmp directories on all VEs with noexec,nosuid options.

1. Update Virtuozzo installation to Virtuozzo 3 SP1 using 'vzup2date' utility.

2. If you want to mount /tmp and /var/tmp on all VEs with noexec,nosuid,nodev options then do the following:
Insert the following line into the main Virtuozzo configuration file /etc/sysconfig/vz:

BINDMOUNT="/tmp,nosuid,noexec,nodev /var/tmp,nosuid,noexec,nodev "

and restart all VEs.

3. If you want to mount /tmp and /var/tmp in this way on a particular VE only, you should insert the line above into the VE configuration file /etc/sysconfig/vz-scripts/VEID.conf manually or do it using 'vzctl' utility:

# vzctl set VEID --bindmount_add /tmp,nosuid,noexec,nodev --bindmount_add /var/tmp,nosuid,noexec,nodev --save

where VEID is an ID of VE you want to apply changes to. VE must be restarted for the changes to take effect.

I hope this will make your task a bit easier in securing the VPS Hosting's /tmp with noexec,nosuid options...