pam_namespace normally isolates /tmp by user or SELinux context, so your example might require a couple tweaks. I haven't tried any of these but I'm thinking an

pam_namespace normally isolates /tmp by user or SELinux context, so your example might require a couple tweaks. I haven't tried any of these but I'm thinking any of: 1) You could modify the namespace init script used by pam_namespace to also mount a shared directory under each user's /tmp, and do this only for the users who need it. 2) Rely on a different shared directory for the users who need it. 3) Configure namespace.conf to isolate by SELinux context and put each user who needs a shared /tmp into the same SELinux role.