[CIS L1] tmpfs hardening

[VariableDeclared]

Hello,

When hardening Octavia units on Ubuntu to CIS Level 1, the hardening prevents execution on the /tmp directory with the following configuration:

tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0

This in turn causes an expected condition where pip packages fail to install: https://pastebin.canonical.com/p/wZHytnTqWN/

Removing the noexec configuration for tmpfs will workaround this issue, but will break compliance.

Many thanks,

Peter

[ajkavanagh]

A solution to this may including either:

1. provide TMPDIR to pip so that the build during installation of cryptography (in this case) takes place somewhere else.
2. AND/OR use binary wheels so that no building takes place.

More recent versions of the octavia charm use binary wheels, but a more general solution for hardening is probably something along the lines of option 1. above.

Note that this is not an exhaustive set of options; there may be better ways of dealing this this.

[jpuskar]

Do you have any leads on how to implement either of those options in a custom charm that uses layer-basic?

[ajkavanagh]

@jpuskar no, this probably wouldn't be possible in the charm code; it would need to happen in the layer-basic code where the pip command is executed. layer-basic is basically responsible to installing the charm and getting it going, and that includes installing from the wheelhouse/ in the built charm; if these are "source" wheels (i.e. may need building), and that requires /tmp (or TMPDIR location) then this would need to be specified in layer-basic; it could be exposed as an option in the layers.yaml as part of the build and then layer-basic could read it. It's a little complex!