Joey Hess <[EMAIL PROTECTED]> writes: > Anthony Towns wrote: > > [...] but at least a couple of packages use /var > > for executable files, notably dpkg (/var/lib/dpkg/info/*), and the > > distributed-net client (/var/lib/distributed-net/distributed-net). > > > > BTW, if /var was noexec, it remains possible to have something like > > /var/lib/distributed-net/distributed-net -> /usr/bin/distributed-net, > > and still be able to cd /var/lib/distributed-net; ./distributed-net, > > This is currently exactly how /var/lib/distributed-net/distributed-net is > set up, so I don't know what you're worrying about.
As it turns out neither do I. Which is odd, because I did double check this. Apologies for the blatant misinformation. > /var/lib/dpkg/info/* is a stickier problem.. After thinking about this a little more, I think it might be best to move /var/lib/dpkg/info to /usr/lib/dpkg/info. One obvious possible problem with this is that that /usr can be (ought to be able to be) mounted read-only, and having these files unmodifiable could, theoretically cause problems. I don't think this should be a problem though, because the only time those files should be being changed is when an install or removal is happening -- which is when /usr should be mounted read-write in any case. I still have a lingering concern that /var -feels- better for these files than /usr does, but I can think of technical reasons for one and not for the other at the moment, so... What other concerns would moving /var/lib/dpkg/info raise? The other thing that's worth noting that almost all of these are either scripts or text configfiles. On my system, there's exactly one ELF binary -- libreadline2's postinst. Another option might thus be to have a config file that specified an interpretor to run over each of the package's preinst, postinst and whatever scripts. Instead of just executing the preinst script, the script would be piped to the interpretor, or something similar. This gets by any noexec problems, but does limit our options, and personally seems much less than elegant. Cheers, aj -- Anthony Towns <[EMAIL PROTECTED]> <http://azure.humbug.org.au/~aj/> I don't speak for anyone save myself. PGP encrypted mail preferred. ``It's not a vision, or a fear. It's just a thought.''
