Hi, Am Freitag, 18. Juni 2021, 17:21:43 CEST schrieb alad via aur-general: > On 18/06/2021 16:43, Jonathon Fernyhough via aur-general wrote: > > On 18/06/2021 14:05, Jan Kohnert via aur-general wrote: > >> a new version of a (binary) package I'm maintaining (clockify-desktop) > >> requires an executable /tmp directory to run. > > > > My immediate questions would be why, and is this an upstream issue?
I really don't know. Upstream changed their version 2.0.2 by a new upload They use S3 storage and have a unique filename for all versions; so I only figure out changes by automatic nightly builds on my GitlLab that fails when the hash changes. I contacted them and the answer I got was "the dev team works on a new version". They promised to notify me when a new version is available, but I can't tell when this will by the case. > > Or, is an executable /tmp a reasonable assumption? 🤔 > > I don't see anything in file-hierarchy(7) that mandates an executable > /tmp. That said, it contains a hint that some programs might break: > > /tmp/, /var/tmp/ and /dev/shm/ should be mounted nosuid and > nodev, which means that set-user-id mode and character or block > special devices are not interpreted on those file systems. In > general it is not possible to mount them noexec, because various > programs use those directories for dynamically generated or > optimized code, and with that flag those use cases would break. > Using this flag is OK on special-purpose installations or systems > where all software that may be installed is known and doesn't > require such functionality. See the discussion of > nosuid/nodev/noexec in mount(8) and PROT_EXEC in mmap(2). Based on this, my setup seems a bit outdated. AFAIR the info to use noexec on / tmp is from the time I switched to Gentoo at around 2004 to remove a possible attack vector. There were even advices to mount /home and /var/tmp noexec to prevent users from executing arbitary code, as then all user-writeable directories whould be noexec. I never changed that setup at least for /tmp and /var/tmp for newer machines, but I do get some errors for some python-related packages from the AUR that require an executable /tmp for building. So maybe I'll just change my setup and push the new version without adding a warning. Thanks for clearification. :) -- MfG Jan
