Re: proposal: per-user temporary directories on by default?

[Martin Pool <mbp@sourcefrog.net>]

On Wed, 23 Jul 2003 11:26:58 +0200, Tollef Fog Heen wrote:

> * Christoph Hellwig
> 
> | On Wed, Jul 23, 2003 at 02:09:28PM +1000, Martin Pool wrote:
> | > There is already a PAM modules, libpam-tmpdir which automatically sets
> | > this up on login by creating a per-user directory under /tmp and
> | > pointing TMPDIR at it.  Despite the scary low version number of 0.04
> | > it seems to work reliably and presumably any bugs could be fixed.
> | 
> | Nice idea, wrong implementation.  Let login fork the login shell with
> | CLONE_NEWNS and do a VFS-binding from ~/tmp to /tmp.

Presumably you'd want to add this through a PAM module rather than hacking
it right into login, otherwise gdm, ssh etc wouldn't be consistent.  

Having decided to do it through PAM, is it really necessary to change the 
VFS rather than setting $TMPDIR?  Making it impossible to get to the real
/tmp makes it a bit more intrusive and potentially confusing than really 
seems necessary.  Given that there is a TMPDIR variable which is obeyed
in most cases, using it seems to be easier than remapping /tmp.

Fixing programs which are hardcoded to /tmp to use TMPDIR is pretty
trivial.  Making sure that operations in a world-writable directory are
secure can be very hard.

A PAM module which does VFS setup would be pretty cool, but I don't think 
that's the one Debian should use by default.

> CLONE_NEWNS is 2.4.19 and higher only.  Also, ~ might be on NFS or similar
> where you don't want to put temporary files.

> (And about the version number of libpam-tmpdir: it could just as easy have
> been 0.4, in which case nobody would have thought it was «scaringly
> low».  Yes, I'm upstream for it.)

Thanks for writing it.

I couldn't find any web pages about libpam-tmpdir other than the Debian
package.  It might be nice to put up just a small one so that it's easier
for other systems to find.

> If we were to put it in as default, I'd like to clean up the code a bit..
> it should be safe, but it could use a little tidying up.

There are small issues I'll discuss offline.

I'm not sure if this is featurism, but you might add a parameter to allow
people to set the path.  /tmp/users/$uid/ is a good default but people
might possibly want it in /home or elsewhere for disk space or other
reasons.

-- 
Martin