ilorest doesn't start on CIS hardened system

[Nikolay Vinogradov]

Hi,

We're deploying hw-health charm to Bionic hardened with recent Ubuntu Bionic CIS benchmark 18.04.17 (based on CIS 2.0.1). ilorest tool that charm uses for hardware monitoring fails to start:

$ ilorest
ilorest: error while loading shared libraries: libz.so.1: failed to map segment from shared object

As strace ilorest shows (the loader attempts to load a number of .so files with randomized names from /tmp, see below comments for why), the root cause is this CIS remediation:

# 1.1.5 Ensure noexec option set on /tmp partition (Automated)
rule-1.1.5()
{
    ensure_opt_mountpoint /tmp noexec
}

Which breaks pyinstaller as documented in https://pyinstaller.readthedocs.io/en/stable/when-things-go-wrong.html#operation-not-permitted-error. ilorest seems to be using pyinstaller (see https://pastebin.ubuntu.com/p/PpzvwdSwBZ/, based on https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). So ilorest is essentially ELF binary that has a number of .so files packaged in it that are being unpacked to /tmp when the script starts. The same problem also causes other problems, like the one described here: https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1791241

The workaround is to remount /tmp as described below:

$ sudo mount /tmp -o remount,exec
ubuntu@cz20420g87:/var/log$ ilorest
iLOrest : RESTful Interface Tool version 3.1.1
....

[Jose Guedez (jfguedez)]

Another option would be to use a specific directory for the charm without the `noexec` restriction. It can be specified using the TMP environment variable. This allows the tool to run without remounting /tmp with `exec` (which is being specifically checked by CIS), for example:

# original issue
root@myhost:~# /usr/sbin/ilorest list -j --selector=Chassis
/usr/sbin/ilorest: error while loading shared libraries: libz.so.1: failed to map segment from shared object

# workaround via TMP
root@myhost:~# mkdir /var/lib/hw-health
root@myhost:~# export TMP=/var/lib/health
root@myhost:~# /usr/sbin/ilorest list -j --selector=Chassis
iLOrest : RESTful Interface Tool version 3.2.2
Copyright (c) 2014-2021 Hewlett Packard Enterprise Development LP
--------------------------------------------------------------------------------------------------------------------------------------------------------------
[
  {
    "@odata.context": "/redfish/v1/$metadata#Chassis.Chassis",
    "@odata.etag": "<redacted>",
    "@odata.id": "/redfish/v1/Chassis/1/",
    "@odata.type": "#Chassis.v1_10_2.Chassis",
    "AssetTag": " ",
(...)

[Stephan Pampel (stephanpampel)]

Potential workaround without compromising CIS hardening:

$ mkdir /var/lib/nagios/ipmi_sensors_tmp
$ cat /etc/cron.d/hwhealth_ilorest
2,7,12,17,22,27,32,37,42,47,52,57 * * * * root export TMP=/var/lib/nagios/ipmi_sensors_tmp; /usr/local/lib/nagios/plugins/cron_ilorest.py