5 ms·
Is it possible to configure every user to see /tmp as $USER/.tmp via some Linux isolation method (namespaces)?
by CarpaDorada 2y ago
Is it possible to configure every user to see /tmp as $USER/.tmp via some Linux isolation method (namespaces)?
- 0xC0ncord 2y agoThis exact thing is possible with pam_namespace.so!
- CarpaDorada 2y agoVery nice, thank you. I will look into this. This may be my break into PAM that I've ignored thus far. I'm wondering if there's programs that will break with such a change. One example would be if multiple users in a group need access to the same file under /tmp.
- 0xC0ncord 2y agopam_namespace normally isolates /tmp by user or SELinux context, so your example might require a couple tweaks. I haven't tried any of these but I'm thinking any of: 1) You could modify the namespace init script used by pam_namespace to also mount a shared directory under each user's /tmp, and do this only for the users who need it. 2) Rely on a different shared directory for the users who need it. 3) Configure namespace.conf to isolate by SELinux context and put each user who needs a shared /tmp into the same SELinux role.
- CarpaDorada 2y agoWhat occurs to me now is that with a proper SELinux configuration you do not even need per-user /tmp, you can use the old /tmp for all. It is still motivating to look into PAM, but perhaps also motivating to learn more about SELinux that I've also put off.
- notamy 2y agoFor a janky way of doing it, create a new mount namespace, then bind-mount $HOME/.tmp over /tmp. In practice better ways (ex. sibling comment) exist and you should use those.