Ubuntu deb package broken with nonexec /tmp about wazuh-packages

[kravietz]

Seems to be still broken in the 3.9.2 package:

# apt-get install --reinstall wazuh-agent
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  ruby-rgen ruby-safe-yaml
Use 'apt-get autoremove' to remove them.
The following packages will be upgraded:
  wazuh-agent
1 to upgrade, 0 to newly install, 0 to remove and 106 not to upgrade.
Need to get 10.5 MB of archives.
After this operation, 3,302 kB of additional disk space will be used.
Fetched 10.5 MB in 10s (1,003 kB/s)
Preconfiguring packages ...
Can't exec "/tmp/wazuh-agent.config.8LlYul": Permission denied at /usr/share/perl/5.18/IPC/Open3.pm line 173.
open2: exec of /tmp/wazuh-agent.config.8LlYul configure 3.8.1-1 failed at /usr/share/perl5/Debconf/ConfModule.pm line 59.
(Reading database ... 79480 files and directories currently installed.)
Preparing to unpack .../wazuh-agent_3.9.2-1_amd64.deb ...
Unpacking wazuh-agent (3.9.2-1) over (3.8.1-1) ...
Processing triggers for ureadahead (0.100.0-16) ...
Setting up wazuh-agent (3.9.2-1) ...
wazuh-modulesd not running...
ossec-logcollector not running...
ossec-syscheckd not running...
ossec-agentd not running...
ossec-execd not running...
Wazuh v3.9.2 Stopped
Starting Wazuh v3.9.2...
Started ossec-execd...
Started ossec-agentd...
2019/06/13 14:40:32 ossec-syscheckd: WARNING: The check_unixaudit option is deprecated in favor of the SCA module.
Started ossec-syscheckd...
Started ossec-logcollector...
Started wazuh-modulesd...
Completed.

[fluential]

@BraulioV You need to do mount -o remount,noexec /tmp to do the valid test

[BraulioV]

Hi @fluential,

sorry for such a late response. We are working hard to include a fix in next release of Wazuh v3.7.0. We are working in this branch wazuh-packages/fix-3.7-debs to include a fix to this issue (f5d051f) and other issues related with the .deb packages.

We will close the issue when that branch gets merged into master branch.

Thank you very much for your feedback and your patience.

Regards,
Braulio.

[BraulioV]

Hi @kravietz,

I tried to reproduce your issue but I couldn't. This is what I tried in a Debian 9 host:

1. chown -R root:root /tmp.
2. chmod -R 000 /tmp.
3. apt install wazuh-agent=3.8.1-1
4. Setup and start the agent.
5. apt-get install --reinstall wazuh-agent.

And the upgrade worked fine. Here you can see the output of this process:

root@debian9:/home/vagrant# apt install wazuh-agent=3.8.1-1 -y      
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  wazuh-agent
0 upgraded, 1 newly installed, 0 to remove and 28 not upgraded.
Need to get 9,774 kB of archives.
After this operation, 109 MB of additional disk space will be used.
Get:1 https://packages.wazuh.com/3.x/apt stable/main amd64 wazuh-agent amd64 3.8.1-1 [9,774 kB]
Fetched 9,774 kB in 0s (26.6 MB/s)
Preconfiguring packages ...
Selecting previously unselected package wazuh-agent.
(Reading database ... 31350 files and directories currently installed.)
Preparing to unpack .../wazuh-agent_3.8.1-1_amd64.deb ...
Unpacking wazuh-agent (3.8.1-1) ...
Setting up wazuh-agent (3.8.1-1) ...
Processing triggers for systemd (232-25+deb9u8) ...
root@debian9:/home/vagrant# /var/ossec/bin/agent-auth -m 172.17.0.2
2019/06/14 08:17:00 agent-auth: INFO: Started (pid: 5939).
INFO: No authentication password provided.
INFO: Connected to 172.17.0.2:1515
INFO: Using agent name as: debian9
INFO: Send request to manager. Waiting for reply.
INFO: Received response with agent key
INFO: Valid key created. Finished.
INFO: Connection closed.
root@debian9:/home/vagrant# sed -i "s:MANAGER_IP:172.17.0.2:g" /var/ossec/etc/ossec.conf 
root@debian9:/home/vagrant# systemctl start wazuh-agent                                      
root@debian9:/home/vagrant# systemctl status wazuh-agent
● wazuh-agent.service - Wazuh agent
   Loaded: loaded (/etc/systemd/system/wazuh-agent.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2019-06-14 08:17:07 GMT; 2s ago
  Process: 5946 ExecStart=/usr/bin/env ${DIRECTORY}/bin/ossec-control start (code=exited, status=0/SUCCESS)
    Tasks: 19 (limit: 4915)
   CGroup: /system.slice/wazuh-agent.service
           ├─5968 /var/ossec/bin/ossec-execd
           ├─5973 /var/ossec/bin/ossec-agentd
           ├─5980 /var/ossec/bin/ossec-syscheckd
           ├─5985 /var/ossec/bin/ossec-logcollector
           └─5995 /var/ossec/bin/wazuh-modulesd

Jun 14 08:17:05 debian9 systemd[1]: Starting Wazuh agent...
Jun 14 08:17:05 debian9 env[5946]: Starting Wazuh v3.8.1...
Jun 14 08:17:05 debian9 env[5946]: Started ossec-execd...
Jun 14 08:17:05 debian9 env[5946]: Started ossec-agentd...
Jun 14 08:17:05 debian9 env[5946]: Started ossec-syscheckd...
Jun 14 08:17:05 debian9 env[5946]: Started ossec-logcollector...
Jun 14 08:17:05 debian9 env[5946]: Started wazuh-modulesd...
Jun 14 08:17:07 debian9 env[5946]: Completed.
Jun 14 08:17:07 debian9 systemd[1]: Started Wazuh agent.
root@debian9:/home/vagrant# apt-get install --reinstall wazuh-agent
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be upgraded:
  wazuh-agent
1 upgraded, 0 newly installed, 0 to remove and 28 not upgraded.
Need to get 0 B/10.5 MB of archives.
After this operation, 3,302 kB of additional disk space will be used.
Reading changelogs... Done
Preconfiguring packages ...
(Reading database ... 31540 files and directories currently installed.)
Preparing to unpack .../wazuh-agent_3.9.2-1_amd64.deb ...
Unpacking wazuh-agent (3.9.2-1) over (3.8.1-1) ...
Setting up wazuh-agent (3.9.2-1) ...
Processing triggers for systemd (232-25+deb9u8) ...
root@debian9:/home/vagrant# 

If you can send us more information about your OS, permissions, owner and group of /tmp it would be very helpful to find the cause of the error.