[CIS L1] tmpfs hardening

Hello,

When hardening Octavia units on Ubuntu to CIS Level 1, the hardening prevents execution on the /tmp directory with the following configuration:

tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0

This in turn causes an expected condition where pip packages fail to install: https://pastebin.canonical.com/p/wZHytnTqWN/

Removing the noexec configuration for tmpfs will workaround this issue, but will break compliance.

Many thanks,

Peter

Start by reproducing the pip package installation failure on Ubuntu with the stated tmpfs /tmp configuration and review the linked paste. Determine how installation can work while retaining the CIS Level 1 noexec requirement; done means pip packages install successfully without breaking compliance.

Scritto dal modello di indicizzazione a partire dal testo della issue.