3 ms·

Because other processes can periodically check whether a predictable filename is in use, and guess things you'd rather keep private?

• johnisgood 2y ago
  Why would you have processes you do not trust, or why not use firejail for those that may pose a security risk? > Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. Firejail can work in a SELinux or AppArmor environment, and it is integrated with Linux Control Groups. It supports "--private" (mounts new /root and /home/user directories in temporary filesystems), along with "--private-{bin,cache,cwd,dev,etc,home,lib,opt,srv,tmp} (plus "noexec /tmp")". It also supports "keep-config-pulse", "keep-dev-shm", and so forth, meaning you can have shared files between process if you so wish (for DBus, etc.).
• josephcsible 2y ago
  But you wouldn't need to guess names to do that, since the names of files in /tmp are publicly listable.