←back to thread

Against /Tmp

(dotat.at)
140 points todsacerdoti | 1 comments | | HN request time: 0.001s | source
Show context
0xC0ncord ◴[] No.41913968[source]
I'm amazed that polyinstantiation of directories via pam_namespace.so[1] is so unheard of. Setting this up fixes almost all of the qualms mentioned in the article by giving each user their own mount namespace with an isolated /tmp directory (and others if configured). Still though, this wouldn't prevent poorly written applications using /tmp from clashing with others that are running under the same user.

It's relatively easy to set up[2] and provides a pretty huge defense mitigation against abusing /tmp.

[1] https://www.man7.org/linux/man-pages/man8/pam_namespace.8.ht...

[2] https://docs.redhat.com/en/documentation/red_hat_enterprise_...

replies(4): >>41914558 #>>41914916 #>>41915729 #>>41916817 #
1. yjftsjthsd-h ◴[] No.41914558[source]
There's also https://www.freedesktop.org/software/systemd/man/latest/syst... to do the same for services if you use systemd.