Install packages on systems with secured /tmp and /var (noexec)

I have a group of Ubuntu servers that needs to secured to the DISA (or USGCB) baseline. Part of that process is to set the /tmp and /var mounts to noexec and nosuid.

It looks like once I do that, the apt installer is trying to run programs from /tmp and /var, and getting access denied errors.

What is the best way to configure apt to use some other directory for installing new and updated packages?

Move the apt cache

Make the new directory (and a partial directory within):

mkdir -p /my/new/cache/partial

And then add the below line referencing that directory in either:

1. a new config file in /etc/apt/apt.conf.d/ or

2. The old /etc/apt/apt.conf file (which you will most likely have to create)

   Dir::Cache::Archives "/my/new/cache";
   

Move /var/lib/dpkg

Prepare the new directory:

mkdir -p /my/new/varlibdpkg
sudo cp -r --preserve /var/lib/dpkg/* /my/new/varlibdpkg/

Set the following in /etc/dpkg/dpkg.cfg:

admindir=/my/new/varlibdpkg

Add the following line to /etc/apt/apt.conf

Dir::State::status "/my/new/varlibdpkg/status";

Note: One could technically remount /var/lib/dpkg/ instead of moving the directory.

Remount or move /tmp

Packages requiring an executable /tmp is arguably a bug that you'll have to work around. To do that, you have two options:

1. Remount /tmp (just when dpkg runs)

Add these lines to whichever apt conf file you decided to use:

DPkg::Pre-Install-Pkgs {"mount -o remount,exec /tmp";};
DPkg::Post-Invoke {"mount -o remount /tmp";};

2. Move /tmp (just for apt)

Create a new temp directory and add the following line to whichever apt conf file you decided to use:

APT::ExtractTemplates::TempDir "/my/new/tmp";

Additional notes:

Check values with apt-config:

• apt-config shell archivesDir Dir::Cache::Archives
• apt-config shell AdminDir Dir::State::status
• apt-config shell tmpdir APT::ExtractTemplates::TempDir (No result by default)