9 ms·
The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common conven
by AgentME 7mo ago
The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away.
MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), though it's stored in memory only which is a little different from usual for /tmp/, seemingly mainly intended for small stuff like unix sockets.
- thayne 7mo ago> I wish there was a common convention for user-specific temp directories on Linux There kind of is. /run/user/$userId is part of a tmpfs and is owned by the user. But it isn't always used when it should be. Systemd also has a mechanism to create private /tmp directories for services.
- zokier 7mo agowhich of course raises the question why the fuck snap doesn't use either of these mechanisms?
- NekkoDroid 7mo ago> Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), but it's stored in memory only On a lot (at this point I assume most) of systems /tmp is also just a tmpfs, so it also is just in memory. /var/tmp usually is storage backed though.